mlsanityData to 14 Oct 2026

GenTI: Benchmarking LLMs for Autonomous IDPS Rule Generation for Unseen Attacks

arXiv 2606.05844 ↗First posted 4 Jun 2026cs.CR cs.AIcited by 0

Not on the map. Why?

Abstract (arXiv)

Rule-based Intrusion Detection and Prevention Systems (IDPS) offer precise attack detection as well as mitigation, however their manually crafted, signature-driven rules limit adaptability to emerging and zero-day threats. Additionally, existing public datasets (e.g., CICIDS2017, UNSW-NB15) focus on traffic classification and provide little structured information to support automatic rule synthesis or prevention logic. To address this gap, we propose Generative Thread Intelligence (GenTI) footnoteGenTI refers to the proposed framework, and GTI refers to the dataset. an LLM-driven benchmark for automatic generation of IDPS rules targeting unseen attacks. The dataset (GTI) aggregates over 150k detection and prevention rules from Snort, Suricata, Emerging Threats, as well as 50k YARA, each annotated with protocol behavior, payload signatures, contextual relationships, mappings to Cyber Threat Intelligence (CTI), along with actionable response types (alert, drop, reject). Moreover, on top of this corpus we design an LLM-based pipeline that transforms analyst prompts and representative payloads into deployable rules via structured prompt engineering, Chain-of-Thought (CoT) reasoning, as well as a Chain-of-Verification (CoVe) loop for syntactic, semantic, and security validation. The generated rules are executed in real time on (Snort/Suricata) and evaluated by syntax accuracy, semantic similarity, CTI coverage, security effectiveness as well as unseen attacks detection. Furthermore, our GenTI instantiation achieves a composite rule-quality score of 89.4%, with 94.8% CTI coverage, improving unseen attacks detection from 45% to 87.4% and reducing the false-positive rate from 8.5% to 2.3%. Overall, GenTI establishes the first large-scale benchmark that tightly couples rule-level CTI with LLM-based automation, enabling adaptive, self-evolving IDPS.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 24 of its 157 references that are in the map. First posted on arXiv 4 Jun 2026.

Builds on

24 of 157 references.

References · 24

  1. 2023Revisiting Relation Extraction in the era of Large Language Modelscited by 102
  2. 2023LogGPT: Exploring ChatGPT for Log-Based Anomaly Detectioncited by 35
  3. 2021Generating Fake Cyber Threat Intelligence Using Transformer-Based Modelscited by 29
  4. 2022Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTIcited by 27
  5. 2023HuntGPT: Integrating Machine Learning-Based Anomaly Detection and Explainable AI with Large Language Models (LLMs)cited by 25
  6. 2023FlowTransformer: A Transformer Framework for Flow-based Network Intrusion Detection Systemscited by 24
  7. 2024LOCALINTEL: Generating Organizational Threat Intelligence from Global and Local Cyber Knowledgecited by 22
  8. 2024Transformers and Large Language Models for Efficient Intrusion Detection Systems: A Comprehensive Surveycited by 21
  9. 2022CAN-BERT do it? Controller Area Network Intrusion Detection System based on BERT Language Modelcited by 17
  10. 20225G-NIDD: A Comprehensive Network Intrusion Detection Dataset Generated over 5G Wireless Networkcited by 16
  11. 2023AGIR: Automating Cyber Threat Intelligence Reporting with Natural Language Generationcited by 16
  12. 2025SVGen: Interpretable Vector Graphics Generation with Large Language Modelscited by 14
12 more
  1. 2023MITRE ATT&CK: State of the Art and Way Forwardcited by 12
  2. 2022Automatic Mapping of Unstructured Cyber Threat Intelligence: An Experimental Studycited by 11
  3. 2023A Survey on Malware Detection with Graph Representation Learningcited by 11
  4. 2023On the Uses of Large Language Models to Interpret Ambiguous Cyberattack Descriptionscited by 11
  5. 2023PMANet: Malicious URL detection via post-trained language model guided multi-level feature attention networkcited by 10
  6. 2025Large Language Models for Security Operations Centers: A Comprehensive Surveycited by 9
  7. 2023LogPr'ecis: Unleashing Language Models for Automated Malicious Log Analysiscited by 8
  8. 2022Unknown Face Presentation Attack Detection via Localised Learning of Multiple Kernelscited by 2
  9. 2025Efficient but Vulnerable: Benchmarking and Defending LLM Batch Prompting Attackcited by 2
  10. 2021GPT-2C: A GPT-2 parser for Cowrie honeypot logscited by 1
  11. 2025A Collaborative Intrusion Detection System Using Snort IDS Nodescited by 1
  12. 2025GRIDAI: Generating and Repairing Intrusion Detection Rules via Collaboration among Multiple LLM-based Agentscited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026RuleAutoPilot: Synthesizing Deployable Suricata Rules from Network Traffic ↗
  2. 2025RulePilot: An LLM-Powered Agent for Security Rule Generation
  3. 2024Generative AI in Cybersecurity: A Comprehensive Review of LLM Applications and Vulnerabilities
  4. 2026Generative AI and Federated Learning for Intrusion Detection Systems: A Survey
  5. 2026From Detection to Response: A Deep Learning and Retrieval-Augmented Generation Framework for Network Intrusion Mitigation
  6. 2025CyberRAG: An Agentic RAG cyber attack classification and reporting tool
  7. 2026Large Language Models (LLMs) and Generative AI in Cybersecurity and Privacy: A Survey of Dual-Use Risks, AI-Generated Malware, Explainability, and Defensive Strategies
  8. 2026BELLS-O: Evaluating the Operational Trade-offs of LLM Supervision Systems