AI system links intrusion alerts to compliance and defense actions
ACE: An AI-Orchestrated Intrusion Detection and Compliance Mapping Engine
Cryptography and Security
Summary
Companies face a big challenge in turning security alerts into the right protective actions while also meeting regulatory rules. This paper presents ACE, an AI-powered system that helps automate this process by detecting intrusions, matching them to relevant security controls, and generating defense rules. The authors tested ACE in a small controlled environment and found it can accurately detect attacks, avoid false alarms, and produce deployable rules while linking alerts to compliance standards. Their work shows how AI can reduce the manual work for security teams in responding to threats and meeting regulations.
What this means in practice
- •For security operations teams: Automatically translate intrusion alerts into compliance-linked defensive rules to reduce analyst workload during threat response.
- •For cybersecurity product developers: Integrate AI-driven compliance mapping and rule deployment into intrusion detection products to improve automated response capabilities.$Commercial implications: This enables selling enhanced IDS solutions with built-in AI orchestration for compliance and countermeasure automation.
Tested on simulated data.
Authors
Abdoulie Ceesay, Rishikesh Sahay, Md Rasel Al Mamun, Bell Raj Eapen
Abstract
This study proposes the Automated Compliance Engine (ACE), an AI-orchestrated framework that links intrusion detection, regulatory control mapping, and automated countermeasure deployment for security operations environments. ACE integrates Suricata IDS, a LangGraph five-stage workflow, retrieval-augmented generation, NIST SP 800-53 Rev. 5 control retrieval, large language model-based control ranking, and SSH-based Suricata rule deployment. The framework was evaluated in a two-virtual-machine laboratory using eight simulated attack scenarios and three legitimate traffic tests. ACE processed all eight attack alerts, achieved 100% alert detection, 0% false positives across legitimate traffic tests, generated deployable AUTO rules for 37.5% of alerts, verified 100% deployment of generated rules, and achieved an average NIST control-mapping confidence score of 0.87. The DeepEval assessment produced 1.0 scores for answer relevancy and faithfulness, while the hallucination score reflected known LLM-as-judge calibration limitations. The evaluation was conducted in a controlled environment with a limited attack set. Further validation is required using enterprise-scale telemetry, multiple IDS sensors, and an analyst-in-the-loop review. The results demonstrate how AI-assisted security automation can reduce analyst effort in translating IDS alerts into compliance-relevant evidence and defensive actions. ACE contributes an integrated detection-to-compliance-to-response workflow combining IDS telemetry, RAG-based control mapping, and automated rule deployment.