Verification-Guided Specification Synthesis with Large Language Models for Intrusion Detection Rules

2026-08-24

AI Summary

本文提出了一种基于验证引导的规范合成框架，利用大型语言模型从HTTP请求轨迹生成Suricata入侵检测规则，通过CEGIS方法迭代优化，提高了检测率并保持了低误报率。

Abstract

Attacks against Internet-connected IoT devices continue to increase; however, transforming observed attack traffic into deployable intrusion detection system (IDS) rules remains largely a manual process. Recent studies have explored using large language models (LLMs) to generate IDS rules; nonetheless, existing approaches often require auxiliary information beyond observed traffic or generate rules without validating their detection logic against benign traffic. This study presents a verification-guided specification synthesis framework for generating Suricata rules directly from HTTP request traces. Instead of having an LLM generate IDS rules in a single step, an LLM first identifies a vulnerable parameter and synthesizes a semantic detection specification. These specifications are iteratively refined through counterexample-guided inductive synthesis (CEGIS), in which benign traffic samples serve as counterexamples during synthesis and verification. Verified specifications are then deterministically compiled into Suricata rules. Experiments on 281 real-world CVEs and benign traffic collected from real IoT devices show that the proposed method achieves a detection rate of 81.5% while maintaining a false positive rate of 0.0%. An ablation study also demonstrates that CEGIS-based verification improves detection performance while maintaining a low false positive rate.

Problem

• Intrusion Detection Systems
• Large Language Models
• Verification
• Semantic Specification Synthesis
• Counterexample-Guided Inductive Synthesis

Innovation

• Verification-Guided Specification Synthesis
• Counterexample-Guided Inductive Synthesis (CEGIS)
• Large Language Models (LLMs)