Automated network attack detection rules created directly from traffic
RuleAutoPilot: Synthesizing Deployable Suricata Rules from Network Traffic
Cryptography and Security
Summary
Creating rules that detect network attacks usually needs expert knowledge and can lag behind new threats. The authors developed RuleAutoPilot, a system that makes these detection rules automatically from recorded network traffic of malware, without needing prior information about threats. It filters out normal background traffic to focus on suspicious activity and fixes bad rules by checking how well they work. Tested on many malware samples, RuleAutoPilot generated useful detection rules that are almost as good as top-tier methods but cost much less to run.
What this means in practice
- •For network security teams: Generate effective Suricata intrusion detection rules automatically from malware network captures without manual threat intelligence.
- •For cyber threat analysts: Reduce time and cost to produce intrusion detection rules by automating rule creation and repair from real network traffic.
Authors
Mughees Ur Rehman, Aritran Piplai, Murat Kantarcioglu
Abstract
Rule-based Intrusion Detection Systems (IDS) such as Suricata are central to network security, yet crafting effective detection rules demands deep expert knowledge and cannot keep pace with emerging threats. Existing LLM-based approaches can reduce analyst effort, but they either rely on curated threat intelligence that is produced only after the underlying traffic artifacts already exist, or they require costly LLM use without sufficient quality control. We present RuleAutoPilot, an end-to-end agentic framework that generates deployable Suricata rules directly from malware network traffic, with no prior threat intelligence required. A key challenge is noise: network traffic captures often contain a small amount of security-relevant traffic mixed with large volumes of background traffic, which reduces LLM reasoning quality and increases cost. RuleAutoPilot addresses this challenge with a Benign Traffic Fingerprinting stage that removes known benign background flows before LLM processing. Rules that fail syntax checks, do not trigger on the source traffic, or generate false positives on a benign corpus are automatically repaired using structured feedback. Across 1,296 malware PCAPs, execution-grounded verification raises rule quality (F1) from 0.443 to 0.539. On a stratified 200-PCAP subset, RuleAutoPilot on the open-weight gpt-oss-120b reaches near-frontier quality, 0.524 F1 against Claude Opus 5 under Claude Code's 0.623, at 52x lower billed-token cost. Swapping only the backbone to Claude Opus 5, RuleAutoPilot surpasses Claude Code outright, 0.656 F1 against 0.623, at 40x fewer tokens. A stronger backbone raises RuleAutoPilot's own ceiling, but at the same backbone, our scaffold still outperforms Claude Code's, showing the scaffold contributes independently of the backbone.