Rule engineering for network intrusion detection works regardless of experience
How It's Made: Uncovering Detection Engineering Processes for Network Intrusion Detection Rules
Cryptography and SecurityHuman-Computer Interaction
Summary
Detecting harmful activity on networks often uses rules in tools like Suricata, but how these rules are created isn’t well understood. The authors built a platform called SuriCap and ran workshops where experts and students wrote detection rules for different scenarios. They found that experience made little difference in rule quality, meaning even newcomers can write effective rules. They also saw that rules don’t always work well outside their test data, highlighting a need for more examples to train from. The study outlines common steps in making these rules to help security teams improve their process.
What this means in practice
- •For security operations teams: Improve how teams develop and evaluate detection rules by following observed engineering phases to reduce errors and inefficiencies.
- •For cybersecurity training providers: Design training programs that empower less experienced staff to write effective network intrusion detection rules.
Authors
Koen T. W. Teuwen, Emmanuele Zambon, Luca Allodi
Abstract
Many Security Operations Centers rely on signature-based Network Intrusion Detection Systems like Suricata, yet detection rule engineering remains understudied. We investigate this process by introducing SuriCap, a platform for rule engineering exercises, and hosting CTF-style workshops where 60 participants, trained MSc students, and experienced SOC professionals, created rules for four scenarios. Participants produced 3146 valid rules, enabling analysis of their methods, performance, and iteration patterns. Surprisingly, prior experience had limited impact on rule quality, suggesting that less experienced engineers can produce rules comparable to experts. We also observed challenges in generalizing rules beyond available tests, underscoring the need for sufficient labeled data. From our study, we identify three phases and a common pattern in rule engineering, offering SOC managers insights to improve their processes and expectations of engineer expertise.