From IOCs to Regex: Automating CTI Operationalization for SOC with LLMs

2026-04-13

AI Summary

This work addresses the inefficiency and error-proneness of manually converting Indicators of Compromise (IOCs) from cyber threat intelligence (CTI) into regular expressions, a process ill-suited for large-scale data. To overcome this limitation, the authors propose an automated approach leveraging large language models, enhanced with a group-aware mechanism to distinguish capturing from non-capturing groups. The method integrates iterative reasoning and a multi-stage validation pipeline to ensure both syntactic correctness and semantic precision of the generated regular expressions. Evaluated on over 3,000 real-world CTI reports and 2,400 MITRE ATT&CK assessment entries, the approach achieves a 99.1% hit rate with only a 0.8% false positive rate, demonstrating its effectiveness in accelerating the operationalization of threat intelligence for log analysis and SIEM rule generation.

Technology Category

• Knowledge Representation and Reasoning: Automated Reasoning and Theorem Proving
• Natural Language Processing: Code Generation / Program Synthesis from Natural Language
• Machine Learning: Feature Construction/Reformulation

Application Category

• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics

Abstract

Cyber Threat Intelligence (CTI) reports contain Indicators of Compromise (IOCs) that are critical for security operations. To operationalize these IOCs across heterogeneous logs, analysts often convert them into regular expressions (regexes) for tasks such as digital forensics, log parsing, and SIEM rule creation. However, regex construction is still largely manual, requiring analysts to extract IOCs from CTI reports and transform them into syntactically valid and semantically precise patterns. This process is slow, error-prone, and increasingly impractical as CTI volumes grow. Although recent studies have applied Large Language Models (LLMs) to IOC extraction, they typically output plain strings rather than regexes, limiting practical deployment. Plain IOCs cannot effectively capture variations in system context, log format, or attacker behavior. To address this gap, we propose IOCRegex-gen, a fully automated LLM-based regex generation system that converts IOCs into regexes. The system introduces two key innovations: (i) a group-aware mechanism that identifies which IOC segments should be represented as capture or non-capture groups, and (ii) an iterative reasoning and multi-stage validation pipeline to ensure syntactic validity and semantic correctness. Experiments on over 3,000 real CTI reports and 2,400 ground-truth strings from the MITRE ATT&CK Evaluation framework show that IOCRegex-gen achieves an average hit rate of 99.1% and a false-positive rate of only 0.8%, demonstrating its effectiveness for large-scale CTI processing and automated regex generation.

Problem

• Cyber Threat Intelligence
• Indicators of Compromise
• regular expressions
• security operations
• log parsing

Innovation

• LLM-based regex generation
• group-aware mechanism
• iterative reasoning
• multi-stage validation
• CTI operationalization