{"id":"https://openalex.org/W4411551017","doi":"https://doi.org/10.1109/mnet.2025.3582330","title":"Harnessing Large Language Models for Automated Intrusion Detection Rule Generation in Cyber Range","display_name":"Harnessing Large Language Models for Automated Intrusion Detection Rule Generation in Cyber Range","publication_year":2025,"publication_date":"2025-06-23","ids":{"openalex":"https://openalex.org/W4411551017","doi":"https://doi.org/10.1109/mnet.2025.3582330"},"language":"en","primary_location":{"id":"doi:10.1109/mnet.2025.3582330","is_oa":false,"landing_page_url":"https://doi.org/10.1109/mnet.2025.3582330","pdf_url":null,"source":{"id":"https://openalex.org/S186584794","display_name":"IEEE Network","issn_l":"0890-8044","issn":["0890-8044","1558-156X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Network","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5034996492","display_name":"Lei Du","orcid":"https://orcid.org/0009-0000-4175-1693"},"institutions":[{"id":"https://openalex.org/I204983213","display_name":"Harbin Institute of Technology","ror":"https://ror.org/01yqg2h08","country_code":"CN","type":"education","lineage":["https://openalex.org/I204983213"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lei Du","raw_affiliation_strings":["School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, Guangdong, China"],"raw_orcid":"https://orcid.org/0009-0000-4175-1693","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, Guangdong, China","institution_ids":["https://openalex.org/I204983213"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Jiarui Li","orcid":"https://orcid.org/0009-0004-6614-3730"},"institutions":[{"id":"https://openalex.org/I204983213","display_name":"Harbin Institute of Technology","ror":"https://ror.org/01yqg2h08","country_code":"CN","type":"education","lineage":["https://openalex.org/I204983213"]},{"id":"https://openalex.org/I4210136793","display_name":"Peng Cheng Laboratory","ror":"https://ror.org/03qdqbt06","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210136793"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiarui Li","raw_affiliation_strings":["School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, Guangdong, China","Department of New Networks, Peng Cheng Laboratory, Shenzhen, Guangdong, China"],"raw_orcid":"https://orcid.org/0009-0004-6614-3730","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, Guangdong, China","institution_ids":["https://openalex.org/I204983213"]},{"raw_affiliation_string":"Department of New Networks, Peng Cheng Laboratory, Shenzhen, Guangdong, China","institution_ids":["https://openalex.org/I4210136793"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5112444020","display_name":"Hao Yan","orcid":"https://orcid.org/0009-0002-2449-1759"},"institutions":[{"id":"https://openalex.org/I204983213","display_name":"Harbin Institute of Technology","ror":"https://ror.org/01yqg2h08","country_code":"CN","type":"education","lineage":["https://openalex.org/I204983213"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hao Yan","raw_affiliation_strings":["School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, Guangdong, China"],"raw_orcid":"https://orcid.org/0009-0002-2449-1759","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, Guangdong, China","institution_ids":["https://openalex.org/I204983213"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5006545795","display_name":"Yuhan Chai","orcid":"https://orcid.org/0000-0003-4332-0234"},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuhan Chai","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, Guangdong, China"],"raw_orcid":"https://orcid.org/0000-0003-4332-0234","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, Guangdong, China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5113587199","display_name":"Binxing Fang","orcid":null},"institutions":[{"id":"https://openalex.org/I204983213","display_name":"Harbin Institute of Technology","ror":"https://ror.org/01yqg2h08","country_code":"CN","type":"education","lineage":["https://openalex.org/I204983213"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Binxing Fang","raw_affiliation_strings":["School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, Guangdong, China"],"raw_orcid":"https://orcid.org/0000-0003-0305-2132","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, Guangdong, China","institution_ids":["https://openalex.org/I204983213"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5070856186","display_name":"Zhaoquan Gu","orcid":"https://orcid.org/0000-0001-7546-852X"},"institutions":[{"id":"https://openalex.org/I204983213","display_name":"Harbin Institute of Technology","ror":"https://ror.org/01yqg2h08","country_code":"CN","type":"education","lineage":["https://openalex.org/I204983213"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhaoquan Gu","raw_affiliation_strings":["School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, Guangdong, China"],"raw_orcid":"https://orcid.org/0000-0001-7546-852X","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, Guangdong, China","institution_ids":["https://openalex.org/I204983213"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.9389,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.76687694,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"39","issue":"5","first_page":"12","last_page":"20"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9165999889373779,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9165999889373779,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7406631708145142},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.67784583568573},{"id":"https://openalex.org/keywords/range","display_name":"Range (aeronautics)","score":0.5257312059402466},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.385286808013916},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3447118401527405},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.34052419662475586},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.09421572089195251}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7406631708145142},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.67784583568573},{"id":"https://openalex.org/C204323151","wikidata":"https://www.wikidata.org/wiki/Q905424","display_name":"Range (aeronautics)","level":2,"score":0.5257312059402466},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.385286808013916},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3447118401527405},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.34052419662475586},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.09421572089195251},{"id":"https://openalex.org/C146978453","wikidata":"https://www.wikidata.org/wiki/Q3798668","display_name":"Aerospace engineering","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/mnet.2025.3582330","is_oa":false,"landing_page_url":"https://doi.org/10.1109/mnet.2025.3582330","pdf_url":null,"source":{"id":"https://openalex.org/S186584794","display_name":"IEEE Network","issn_l":"0890-8044","issn":["0890-8044","1558-156X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Network","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2902468357","display_name":null,"funder_award_id":"62372137","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":15,"referenced_works":["https://openalex.org/W2033811087","https://openalex.org/W2518895230","https://openalex.org/W3129218590","https://openalex.org/W3136916314","https://openalex.org/W3208665740","https://openalex.org/W4205270295","https://openalex.org/W4296913776","https://openalex.org/W4322588479","https://openalex.org/W4383559238","https://openalex.org/W4385245566","https://openalex.org/W4388624483","https://openalex.org/W4391725269","https://openalex.org/W4406812118","https://openalex.org/W4408749924","https://openalex.org/W4408750152"],"related_works":["https://openalex.org/W2357468538","https://openalex.org/W1577110157","https://openalex.org/W2355007334","https://openalex.org/W2390009783","https://openalex.org/W4254602698","https://openalex.org/W2394461323","https://openalex.org/W2364419519","https://openalex.org/W2360767377","https://openalex.org/W2017948608","https://openalex.org/W2360951146"],"abstract_inverted_index":{"Rule-based":[0],"network":[1],"intrusion":[2,36],"detection":[3,20,47,60,68,76,98,111,123,151,163,183,191,221,245,264,277],"systems":[4],"hold":[5],"great":[6],"promise":[7],"in":[8,15,42,128],"cybersecurity":[9,234,293],"due":[10],"to":[11,91,118,149,203,214,233,237,255,292],"their":[12],"remarkable":[13],"performance":[14],"identifying":[16],"cyberattacks.":[17],"Unfortunately,":[18],"these":[19,70,105],"rules":[21,61,99,124,152,206,213,246,278],"are":[22,32],"manually":[23],"written":[24],"by":[25,280],"security":[26,239],"experts":[27],"for":[28,62,125],"known":[29],"attacks":[30,127],"and":[31,100,120,136,166,174,207,247,287],"ineffective":[33],"against":[34,261],"unknown":[35],"threats.":[37],"Despite":[38],"the":[39,50,67,82,85,140,182,198,209,218,224,230,243,248,257,276],"progress":[40],"made":[41],"existing":[43],"work":[44,54],"on":[45,56,81,268],"automatic":[46],"rule":[48,77,86,112,164,184,192,265],"generation,":[49,165],"majority":[51],"of":[52,69,84,96,144,159,201,211,259],"such":[53],"focuses":[55],"synthesizing":[57],"overly":[58],"specific":[59],"input":[63],"attack":[64,71,101,167,179,215,225,231,249,290],"samples,":[65],"neglecting":[66],"sample":[72,168,226],"variants.":[73],"Furthermore,":[74],"most":[75],"generation":[78,113,185,193,266],"approaches":[79,267],"rely":[80],"content":[83],"as":[87],"an":[88],"explanation,":[89],"failing":[90],"provide":[92],"a":[93,109,129,189],"high-level":[94],"understanding":[95],"both":[97],"samples.":[102,180,250],"To":[103],"tackle":[104],"challenges,":[106],"we":[107,187],"propose":[108,188],"novel":[110],"framework,":[114],"LLM4Rule,":[115],"which":[116,157],"aims":[117],"reproduce":[119],"automatically":[121],"generate":[122,150],"discovered":[126,178],"cyber":[130],"range":[131],"without":[132],"compromising":[133],"real":[134],"networks":[135],"endpoints.":[137],"LLM4Rule":[138,260,281],"leverages":[139],"knowledge":[141,235,294],"reasoning":[142],"capabilities":[143],"large":[145],"language":[146],"models":[147],"(LLMs)":[148],"through":[153],"interaction":[154],"with":[155],"LLMs,":[156],"consists":[158],"three":[160],"components:":[161],"preprocessing,":[162],"mapping.":[169],"The":[170,271],"preprocessing":[171],"component":[172,228],"extracts":[173],"converts":[175],"payloads":[176],"from":[177],"In":[181],"component,":[186],"two-stage":[190],"prompt":[194],"approach":[195],"that":[196,275],"utilizes":[197],"self-correction":[199],"ability":[200],"LLMs":[202],"filter":[204],"invalid":[205],"enhances":[208],"generalization":[210],"valid":[212],"variants":[216,286],"over":[217],"initially":[219],"generated":[220,244,279],"rules.":[222],"Finally,":[223],"mapping":[227],"maps":[229],"samples":[232,291],"bases":[236],"help":[238],"operators":[240],"better":[241],"understand":[242],"We":[251],"conduct":[252],"extensive":[253],"experiments":[254],"demonstrate":[256],"effectiveness":[258],"four":[262],"representative":[263],"two":[269],"datasets.":[270],"experimental":[272],"results":[273],"show":[274],"can":[282],"accurately":[283],"detect":[284],"cyberattack":[285],"effectively":[288],"map":[289],"bases.":[295]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-03-27T05:58:40.876381","created_date":"2025-10-10T00:00:00"}