Verification-Guided Specification Synthesis with Large Language Models for Intrusion Detection Rules
2026-08-24 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors address the challenge of creating rules to detect attacks on IoT devices from network traffic. They use a large language model (LLM) to first identify risky parts in HTTP requests and write detection rules in a step-by-step way. These rules are then tested and improved using real examples of normal traffic to avoid false alarms. Their method successfully detects many attacks without flagging harmless activity. Testing shows their approach is both accurate and reliable.
Internet of Things (IoT)Intrusion Detection System (IDS)SuricataLarge Language Models (LLM)HTTP request tracesCounterexample-guided Inductive Synthesis (CEGIS)Common Vulnerabilities and Exposures (CVE)False positive rateDetection rateRule synthesis
Authors
Kohei Yamamoto, Marie Katsurai
Abstract
Attacks against Internet-connected IoT devices continue to increase; however, transforming observed attack traffic into deployable intrusion detection system (IDS) rules remains largely a manual process. Recent studies have explored using large language models (LLMs) to generate IDS rules; nonetheless, existing approaches often require auxiliary information beyond observed traffic or generate rules without validating their detection logic against benign traffic. This study presents a verification-guided specification synthesis framework for generating Suricata rules directly from HTTP request traces. Instead of having an LLM generate IDS rules in a single step, an LLM first identifies a vulnerable parameter and synthesizes a semantic detection specification. These specifications are iteratively refined through counterexample-guided inductive synthesis (CEGIS), in which benign traffic samples serve as counterexamples during synthesis and verification. Verified specifications are then deterministically compiled into Suricata rules. Experiments on 281 real-world CVEs and benign traffic collected from real IoT devices show that the proposed method achieves a detection rate of 81.5% while maintaining a false positive rate of 0.0%. An ablation study also demonstrates that CEGIS-based verification improves detection performance while maintaining a low false positive rate.