Search papers, labs, and topics across Lattice.
This study introduces a verification-guided specification synthesis framework that leverages large language models (LLMs) to generate deployable intrusion detection system (IDS) rules from HTTP request traces. By first identifying vulnerable parameters and synthesizing semantic detection specifications, the framework iteratively refines these specifications using counterexample-guided inductive synthesis (CEGIS) to ensure their effectiveness against benign traffic. The approach achieves an impressive detection rate of 81.5% with a 0.0% false positive rate, significantly enhancing the automation of IDS rule generation while ensuring accuracy.
Achieving an 81.5% detection rate with zero false positives, this framework revolutionizes how IDS rules are generated from IoT traffic.
Attacks against Internet-connected IoT devices continue to increase; however, transforming observed attack traffic into deployable intrusion detection system (IDS) rules remains largely a manual process. Recent studies have explored using large language models (LLMs) to generate IDS rules; nonetheless, existing approaches often require auxiliary information beyond observed traffic or generate rules without validating their detection logic against benign traffic. This study presents a verification-guided specification synthesis framework for generating Suricata rules directly from HTTP request traces. Instead of having an LLM generate IDS rules in a single step, an LLM first identifies a vulnerable parameter and synthesizes a semantic detection specification. These specifications are iteratively refined through counterexample-guided inductive synthesis (CEGIS), in which benign traffic samples serve as counterexamples during synthesis and verification. Verified specifications are then deterministically compiled into Suricata rules. Experiments on 281 real-world CVEs and benign traffic collected from real IoT devices show that the proposed method achieves a detection rate of 81.5% while maintaining a false positive rate of 0.0%. An ablation study also demonstrates that CEGIS-based verification improves detection performance while maintaining a low false positive rate.
