{"id":"https://openalex.org/W4416874155","doi":"https://doi.org/10.1109/dsc65356.2025.11260863","title":"LLM-Based Multi-Label Mapping of Snort Rules to ATT&CK","display_name":"LLM-Based Multi-Label Mapping of Snort Rules to ATT&CK","publication_year":2025,"publication_date":"2025-10-18","ids":{"openalex":"https://openalex.org/W4416874155","doi":"https://doi.org/10.1109/dsc65356.2025.11260863"},"language":"en","primary_location":{"id":"doi:10.1109/dsc65356.2025.11260863","doi":"https://doi.org/10.1109/dsc65356.2025.11260863","is_oa":false,"landing_page_url":"https://doi.org/10.1109/dsc65356.2025.11260863","pdf_url":null,"source":{"id":"https://openalex.org/S7407088050","display_name":"IEEE Conference on Dependable and Secure Computing (DSC)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Conference on Dependable and Secure Computing (DSC)","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5017018302","display_name":"Yu-Hsun Lee","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yu-Hsun Lee","raw_affiliation_strings":["National Institute of Cyber Security,Tainan,Taiwan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Institute of Cyber Security,Tainan,Taiwan","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068829903","display_name":"Chansu Han","orcid":"https://orcid.org/0000-0002-1728-5300","observed_orcids":["https://orcid.org/0000-0002-1728-5300","https://orcid.org/0000-0001-9568-8458"]},"institutions":[{"id":"https://openalex.org/I90023481","display_name":"National Institute of Information and Communications Technology","ror":"https://ror.org/016bgq349","country_code":"JP","type":"facility","lineage":["https://openalex.org/I90023481"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Chansu Han","raw_affiliation_strings":["National Institute of Information and Communications Technology,Tokyo,Japan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Institute of Information and Communications Technology,Tokyo,Japan","institution_ids":["https://openalex.org/I90023481"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5116296358","display_name":"Min-Chun Peng","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Min-Chun Peng","raw_affiliation_strings":["National Institute of Cyber Security,Tainan,Taiwan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Institute of Cyber Security,Tainan,Taiwan","institution_ids":[]}]},{"author_position":"last","author":{"id":null,"display_name":"Takeshi Takahashi","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I90023481","display_name":"National Institute of Information and Communications Technology","ror":"https://ror.org/016bgq349","country_code":"JP","type":"facility","lineage":["https://openalex.org/I90023481"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Takeshi Takahashi","raw_affiliation_strings":["National Institute of Information and Communications Technology,Tokyo,Japan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Institute of Information and Communications Technology,Tokyo,Japan","institution_ids":["https://openalex.org/I90023481"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.2391,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.80667932,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":93,"max":96},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9883000254631042,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9883000254631042,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.003000000026077032,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.002099999925121665,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/snort-rules","display_name":"Snort rules","score":0.9869999885559082},{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.9210000038146973},{"id":"https://openalex.org/keywords/intrusion-detection-and-prevention","display_name":"intrusion detection and prevention","score":0.7360000014305115},{"id":"https://openalex.org/keywords/threat-intelligence","display_name":"threat intelligence","score":0.5960000157356262},{"id":"https://openalex.org/keywords/retrieval-augmented-generation","display_name":"retrieval-augmented generation","score":0.9549999833106995}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7833999991416931},{"id":"https://openalex.org/C2781067378","wikidata":"https://www.wikidata.org/wiki/Q17027399","display_name":"Interpretability","level":2,"score":0.7515000104904175},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.6090999841690063},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.5802000164985657},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.573199987411499},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5103999972343445},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3337000012397766},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.29100000858306885},{"id":"https://openalex.org/C170130773","wikidata":"https://www.wikidata.org/wiki/Q216378","display_name":"Usability","level":2,"score":0.28439998626708984},{"id":"https://openalex.org/C169900460","wikidata":"https://www.wikidata.org/wiki/Q2200417","display_name":"Cognition","level":2,"score":0.27619999647140503},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2655999958515167},{"id":"https://openalex.org/C517642484","wikidata":"https://www.wikidata.org/wiki/Q2388514","display_name":"Intelligence analysis","level":2,"score":0.26179999113082886},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.26010000705718994}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/dsc65356.2025.11260863","doi":"https://doi.org/10.1109/dsc65356.2025.11260863","is_oa":false,"landing_page_url":"https://doi.org/10.1109/dsc65356.2025.11260863","pdf_url":null,"source":{"id":"https://openalex.org/S7407088050","display_name":"IEEE Conference on Dependable and Secure Computing (DSC)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Conference on Dependable and Secure Computing (DSC)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":6,"referenced_works":["https://openalex.org/W2771963642","https://openalex.org/W2964522977","https://openalex.org/W4294343684","https://openalex.org/W4324031781","https://openalex.org/W4392639626","https://openalex.org/W4400586487"],"related_works":["https://openalex.org/W4406875947","https://openalex.org/W7092287068","https://openalex.org/W4405468965","https://openalex.org/W4391769842","https://openalex.org/W4407186287","https://openalex.org/W4416333539","https://openalex.org/W6893087533","https://openalex.org/W4415709603","https://openalex.org/W4413250014","https://openalex.org/W7214206108"],"abstract_inverted_index":{"Intrusion":[0],"detection":[1],"and":[2,37,82,98,118,132,139,189,197],"prevention":[3],"systems":[4],"(IDS/IPS)":[5],"are":[6],"essential":[7],"for":[8,30],"network":[9],"defense,":[10],"with":[11,64,122],"Snort":[12,58,187],"being":[13],"a":[14,27,47,195],"popular":[15],"open-source":[16],"solution.":[17],"However,":[18],"the":[19,75,89,100,103,170,184],"technical":[20],"complexity":[21],"of":[22,173,186],"Snort's":[23],"rule-based":[24],"alerts":[25,188],"poses":[26],"significant":[28],"challenge":[29],"first-line":[31],"operators,":[32,79],"who":[33],"must":[34],"quickly":[35],"understand":[36],"respond":[38],"to":[39,56,73,102,168,193],"potential":[40],"threats.":[41,124],"To":[42],"address":[43],"this,":[44],"we":[45,87],"propose":[46],"novel":[48],"framework":[49,106],"that":[50],"integrates":[51],"Large":[52],"Language":[53],"Models":[54],"(LLMs)":[55],"translate":[57],"rules":[59],"into":[60,92,114],"human-readable":[61],"summaries,":[62],"enhanced":[63],"contextual":[65],"Cyber":[66],"Threat":[67],"Intelligence":[68],"(CTI).":[69],"The":[70,176],"goal":[71],"is":[72,127,165],"ease":[74],"cognitive":[76],"burden":[77],"on":[78],"enabling":[80],"faster":[81],"more":[83],"informed":[84,198],"decision-making.":[85],"Furthermore,":[86],"expand":[88],"generated":[90],"summary":[91],"several":[93],"attack":[94],"descriptions":[95,101],"using":[96,107,147],"LLM":[97],"map":[99],"MITRE":[104],"ATT&CK":[105],"Retrieval-augmented":[108],"generation":[109],"(RAG),":[110],"providing":[111,190],"deeper":[112],"insights":[113],"adversarial":[115],"tactics,":[116],"techniques,":[117],"procedures":[119],"(TTPs)":[120],"associated":[121],"detected":[123],"Our":[125],"method":[126],"evaluated":[128],"by":[129,182],"cybersecurity":[130],"professionals":[131],"achieves":[133],"high":[134],"scores":[135],"in":[136,159],"accuracy,":[137],"clarity,":[138],"coherence.":[140],"We":[141],"further":[142],"assess":[143],"our":[144,174],"description-to-technique":[145],"mapping":[146],"CISA":[148],"Cybersecurity":[149],"Advisory":[150],"reports":[151],"as":[152],"ground":[153],"truth,":[154],"achieving":[155],"80":[156],"%":[157],"accuracy":[158],"single-label":[160],"classification.":[161],"A":[162],"case":[163],"study":[164],"also":[166],"presented":[167],"demonstrate":[169],"practical":[171],"applicability":[172],"approach.":[175],"proposed":[177],"approach":[178],"empowers":[179],"security":[180],"teams":[181],"improving":[183],"interpretability":[185],"actionable":[191],"context":[192],"support":[194],"rapid":[196],"threat":[199],"response.":[200]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-10-28T10:33:24.094632","created_date":"2025-12-01T00:00:00"}