{"id":"https://openalex.org/W4415934269","doi":"https://doi.org/10.1109/nof66640.2025.11223303","title":"LI-NIDS: LLM-based Intelligent NIDS Rules Generation for Cybersecurity Applications","display_name":"LI-NIDS: LLM-based Intelligent NIDS Rules Generation for Cybersecurity Applications","publication_year":2025,"publication_date":"2025-09-30","ids":{"openalex":"https://openalex.org/W4415934269","doi":"https://doi.org/10.1109/nof66640.2025.11223303"},"language":null,"primary_location":{"id":"doi:10.1109/nof66640.2025.11223303","is_oa":false,"landing_page_url":"https://doi.org/10.1109/nof66640.2025.11223303","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 16th International Conference on Network of the Future (NoF)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5078840150","display_name":"Anes Abdennebi","orcid":"https://orcid.org/0000-0002-3301-0155"},"institutions":[{"id":"https://openalex.org/I9736820","display_name":"\u00c9cole de Technologie Sup\u00e9rieure","ror":"https://ror.org/0020snb74","country_code":"CA","type":"education","lineage":["https://openalex.org/I49663120","https://openalex.org/I9736820"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Anes Abdennebi","raw_affiliation_strings":["École de Technologie Supérieure,Dept. of Software Engineering and IT,Montreal,Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"École de Technologie Supérieure,Dept. of Software Engineering and IT,Montreal,Canada","institution_ids":["https://openalex.org/I9736820"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5063425543","display_name":"Nadjia Kara","orcid":null},"institutions":[{"id":"https://openalex.org/I9736820","display_name":"\u00c9cole de Technologie Sup\u00e9rieure","ror":"https://ror.org/0020snb74","country_code":"CA","type":"education","lineage":["https://openalex.org/I49663120","https://openalex.org/I9736820"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Kara Nadjia","raw_affiliation_strings":["École de Technologie Supérieure,Dept. of Software Engineering and IT,Montreal,Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"École de Technologie Supérieure,Dept. of Software Engineering and IT,Montreal,Canada","institution_ids":["https://openalex.org/I9736820"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5016021331","display_name":"Laaziz Lahlou","orcid":"https://orcid.org/0000-0002-8503-6779"},"institutions":[{"id":"https://openalex.org/I9736820","display_name":"\u00c9cole de Technologie Sup\u00e9rieure","ror":"https://ror.org/0020snb74","country_code":"CA","type":"education","lineage":["https://openalex.org/I49663120","https://openalex.org/I9736820"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Laaziz Lahlou","raw_affiliation_strings":["École de Technologie Supérieure,Dept. of Software Engineering and IT,Montreal,Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"École de Technologie Supérieure,Dept. of Software Engineering and IT,Montreal,Canada","institution_ids":["https://openalex.org/I9736820"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5045523857","display_name":"Hakima Ould\u2010Slimane","orcid":"https://orcid.org/0000-0002-2694-6959"},"institutions":[{"id":"https://openalex.org/I63341726","display_name":"Universit\u00e9 du Qu\u00e9bec \u00e0 Trois-Rivi\u00e8res","ror":"https://ror.org/02xrw9r68","country_code":"CA","type":"education","lineage":["https://openalex.org/I49663120","https://openalex.org/I63341726"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Hakima Ould-Slimane","raw_affiliation_strings":["UQTR,Dept. of Mathematics and Computer Science,Montreal,Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"UQTR,Dept. of Mathematics and Computer Science,Montreal,Canada","institution_ids":["https://openalex.org/I63341726"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"55","last_page":"63"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8309999704360962,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8309999704360962,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.02070000022649765,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.019700000062584877,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.73089998960495},{"id":"https://openalex.org/keywords/hacker","display_name":"Hacker","score":0.6445000171661377},{"id":"https://openalex.org/keywords/field","display_name":"Field (mathematics)","score":0.621999979019165},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.5900999903678894},{"id":"https://openalex.org/keywords/matching","display_name":"Matching (statistics)","score":0.5730000138282776},{"id":"https://openalex.org/keywords/measure","display_name":"Measure (data warehouse)","score":0.4948999881744385},{"id":"https://openalex.org/keywords/work","display_name":"Work (physics)","score":0.36169999837875366},{"id":"https://openalex.org/keywords/pattern-matching","display_name":"Pattern matching","score":0.35269999504089355}],"concepts":[{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.73089998960495},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6730999946594238},{"id":"https://openalex.org/C86844869","wikidata":"https://www.wikidata.org/wiki/Q2798820","display_name":"Hacker","level":2,"score":0.6445000171661377},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.621999979019165},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5900999903678894},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.5730000138282776},{"id":"https://openalex.org/C2780009758","wikidata":"https://www.wikidata.org/wiki/Q6804172","display_name":"Measure (data warehouse)","level":2,"score":0.4948999881744385},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.44600000977516174},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4154999852180481},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4097999930381775},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.36169999837875366},{"id":"https://openalex.org/C68859911","wikidata":"https://www.wikidata.org/wiki/Q1503724","display_name":"Pattern matching","level":2,"score":0.35269999504089355},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.3379000127315521},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3246000111103058},{"id":"https://openalex.org/C58328972","wikidata":"https://www.wikidata.org/wiki/Q184609","display_name":"Expert system","level":2,"score":0.3190999925136566},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2809999883174896},{"id":"https://openalex.org/C39890363","wikidata":"https://www.wikidata.org/wiki/Q36108","display_name":"Generative grammar","level":2,"score":0.2777999937534332},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.2718000113964081},{"id":"https://openalex.org/C27061796","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion prevention system","level":3,"score":0.2648000121116638},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.2639000117778778},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.26179999113082886},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.2529999911785126}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/nof66640.2025.11223303","is_oa":false,"landing_page_url":"https://doi.org/10.1109/nof66640.2025.11223303","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 16th International Conference on Network of the Future (NoF)","raw_type":"proceedings-article"},{"id":"pmh:oai:espace2.etsmtl.ca:33169","is_oa":false,"landing_page_url":"https://espace2.etsmtl.ca/id/eprint/33169/","pdf_url":null,"source":{"id":"https://openalex.org/S4306402392","display_name":"Espace \u00c9TS (ETS)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1341030882","host_organization_name":"Educational Testing Service","host_organization_lineage":["https://openalex.org/I1341030882"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Compte rendu de conf\u00e9rence"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":19,"referenced_works":["https://openalex.org/W2529525882","https://openalex.org/W2807786182","https://openalex.org/W2980576170","https://openalex.org/W3093410479","https://openalex.org/W3174223893","https://openalex.org/W3192676711","https://openalex.org/W4285227013","https://openalex.org/W4320058141","https://openalex.org/W4385532455","https://openalex.org/W4387662349","https://openalex.org/W4393406122","https://openalex.org/W4400006996","https://openalex.org/W4400976574","https://openalex.org/W4403212129","https://openalex.org/W4404628699","https://openalex.org/W4408324654","https://openalex.org/W4410255674","https://openalex.org/W4411948870","https://openalex.org/W4414594130"],"related_works":[],"abstract_inverted_index":{"The":[0,39],"current":[1,42],"cybersecurity":[2],"landscape":[3],"for":[4,70,133],"many":[5],"companies,":[6],"Small":[7],"and":[8,14,29,73,87,140,161,183],"Midsize":[9],"Enterprises":[10],"(SMEs),":[11],"public":[12],"services,":[13],"organizations":[15],"is":[16,59],"experiencing":[17],"cyberattacks":[18],"daily":[19],"due":[20],"to":[21,46,49,104,129,147],"two":[22],"main":[23],"factors:":[24],"1)":[25],"the":[26,57,93,134,142,149,181],"powerful":[27],"hacking":[28],"system-infiltrating":[30],"tools":[31],"generally":[32],"supported":[33],"by":[34,115],"advanced":[35],"AI":[36],"techniques.":[37],"2)":[38],"incapability":[40],"of":[41,96,137,151,177],"intrusion":[43],"detection":[44,72,81,118],"systems":[45],"react":[47],"dynamically":[48],"new":[50,62,126,138],"cyber":[51],"threats":[52],"once":[53],"they":[54,76],"occur.":[55],"As":[56],"literature":[58],"rich":[60],"with":[61],"papers":[63],"proposing":[64],"Large":[65],"Language":[66],"Model-based":[67],"(LLM)":[68],"solutions":[69],"anomaly":[71],"threat":[74],"hunting,":[75],"are":[77],"being":[78],"used":[79],"as":[80],"models":[82,164],"mimicking":[83],"traditional":[84],"machine":[85],"learning":[86,89],"deep":[88],"techniques":[90],"without":[91],"leveraging":[92],"full":[94],"potential":[95],"LLMs.":[97],"This":[98],"work":[99],"proposes":[100],"a":[101,125,174,188],"substantial":[102],"addition":[103],"existing":[105],"Generative":[106],"Artificial":[107],"Intelligence-based":[108],"(GAI)":[109],"Network":[110],"Intrusion":[111],"Detection":[112],"Systems":[113],"(NIDSs)":[114],"reinforcing":[116],"their":[117,169],"engine\u2019s":[119],"rules":[120,139,167],"generation":[121,136],"process.":[122],"We":[123,156],"develop":[124],"training":[127],"method":[128],"train":[130],"an":[131],"LLM":[132],"automated":[135],"propose":[141],"Rule":[143],"Matching":[144],"Score":[145],"RuMS":[146],"measure":[148],"performance":[150],"our":[152,159],"LLM-based":[153],"rule":[154],"generator.":[155],"demonstrated":[157],"that":[158],"Llama":[160],"Falcon-based":[162],"fine-tuned":[163],"generate":[165],"NIDS":[166],"respecting":[168],"standard":[170],"field":[171],"while":[172,186],"achieving":[173],"$98.9":[175],"\\%$":[176],"matching":[178],"scores":[179],"between":[180],"actual":[182],"generated":[184],"rules,":[185],"maintaining":[187],"minimal":[189],"memory":[190],"footprint.":[191]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-11-05T00:00:00"}