{"id":"https://openalex.org/W7155995157","doi":"https://doi.org/10.1145/3774904.3792458","title":"ARuleCon: Agentic Security Rule Conversion","display_name":"ARuleCon: Agentic Security Rule Conversion","publication_year":2026,"publication_date":"2026-04-12","ids":{"openalex":"https://openalex.org/W7155995157","doi":"https://doi.org/10.1145/3774904.3792458"},"language":null,"primary_location":{"id":"doi:10.1145/3774904.3792458","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3774904.3792458","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Web Conference 2026","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3774904.3792458","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100629750","display_name":"Ming Xu","orcid":"https://orcid.org/0000-0003-1061-819X"},"institutions":[{"id":"https://openalex.org/I165932596","display_name":"National University of Singapore","ror":"https://ror.org/01tgyzw49","country_code":"SG","type":"education","lineage":["https://openalex.org/I165932596"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Ming Xu","raw_affiliation_strings":["National University of Singapore, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0003-1061-819X","affiliations":[{"raw_affiliation_string":"National University of Singapore, Singapore, Singapore","institution_ids":["https://openalex.org/I165932596"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134713058","display_name":"Hongtai Wang","orcid":"https://orcid.org/0009-0003-3209-6676"},"institutions":[{"id":"https://openalex.org/I165932596","display_name":"National University of Singapore","ror":"https://ror.org/01tgyzw49","country_code":"SG","type":"education","lineage":["https://openalex.org/I165932596"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Hongtai Wang","raw_affiliation_strings":["National University of Singapore, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0009-0003-3209-6676","affiliations":[{"raw_affiliation_string":"National University of Singapore, Singapore, Singapore","institution_ids":["https://openalex.org/I165932596"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5113228229","display_name":"Yanpei Guo","orcid":null},"institutions":[{"id":"https://openalex.org/I165932596","display_name":"National University of Singapore","ror":"https://ror.org/01tgyzw49","country_code":"SG","type":"education","lineage":["https://openalex.org/I165932596"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Yanpei Guo","raw_affiliation_strings":["National University of Singapore, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0009-0006-5594-9549","affiliations":[{"raw_affiliation_string":"National University of Singapore, Singapore, Singapore","institution_ids":["https://openalex.org/I165932596"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103182703","display_name":"Zhengmin Yu","orcid":"https://orcid.org/0000-0002-0294-414X"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhengmin Yu","raw_affiliation_strings":["Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0002-0294-414X","affiliations":[{"raw_affiliation_string":"Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134726545","display_name":"Weili Han","orcid":"https://orcid.org/0000-0001-8663-436X"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Weili Han","raw_affiliation_strings":["Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0001-8663-436X","affiliations":[{"raw_affiliation_string":"Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5016340326","display_name":"Hoon Wei Lim","orcid":"https://orcid.org/0000-0002-7830-3007"},"institutions":[{"id":"https://openalex.org/I4210089308","display_name":"AMS (Singapore)","ror":"https://ror.org/008hf2578","country_code":"SG","type":"company","lineage":["https://openalex.org/I154481106","https://openalex.org/I4210089308"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Hoon Wei Lim","raw_affiliation_strings":["Cyber Special Ops-R&D, NCS Group, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0002-7830-3007","affiliations":[{"raw_affiliation_string":"Cyber Special Ops-R&D, NCS Group, Singapore, Singapore","institution_ids":["https://openalex.org/I4210089308"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5085067496","display_name":"Jin Song Dong","orcid":"https://orcid.org/0000-0002-6512-8326"},"institutions":[{"id":"https://openalex.org/I165932596","display_name":"National University of Singapore","ror":"https://ror.org/01tgyzw49","country_code":"SG","type":"education","lineage":["https://openalex.org/I165932596"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Jin Song Dong","raw_affiliation_strings":["National University of Singapore, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0002-6512-8326","affiliations":[{"raw_affiliation_string":"National University of Singapore, Singapore, Singapore","institution_ids":["https://openalex.org/I165932596"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5125548356","display_name":"Jiaheng Zhang","orcid":null},"institutions":[{"id":"https://openalex.org/I165932596","display_name":"National University of Singapore","ror":"https://ror.org/01tgyzw49","country_code":"SG","type":"education","lineage":["https://openalex.org/I165932596"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Jiaheng Zhang","raw_affiliation_strings":["National University of Singapore, Singapore, CA, Singapore"],"raw_orcid":"https://orcid.org/0000-0002-7950-7845","affiliations":[{"raw_affiliation_string":"National University of Singapore, Singapore, CA, Singapore","institution_ids":["https://openalex.org/I165932596"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"3123","last_page":"3134"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.36059999465942383,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.36059999465942383,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.12300000339746475,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.09309999644756317,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/documentation","display_name":"Documentation","score":0.6291000247001648},{"id":"https://openalex.org/keywords/vendor","display_name":"Vendor","score":0.586899995803833},{"id":"https://openalex.org/keywords/consistency","display_name":"Consistency (knowledge bases)","score":0.5157999992370605},{"id":"https://openalex.org/keywords/reuse","display_name":"Reuse","score":0.4722999930381775},{"id":"https://openalex.org/keywords/ibm","display_name":"IBM","score":0.4609000086784363},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.4537999927997589},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.41929998993873596},{"id":"https://openalex.org/keywords/outsourcing","display_name":"Outsourcing","score":0.37229999899864197}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6682000160217285},{"id":"https://openalex.org/C56666940","wikidata":"https://www.wikidata.org/wiki/Q788790","display_name":"Documentation","level":2,"score":0.6291000247001648},{"id":"https://openalex.org/C2777338717","wikidata":"https://www.wikidata.org/wiki/Q1762621","display_name":"Vendor","level":2,"score":0.586899995803833},{"id":"https://openalex.org/C2776436953","wikidata":"https://www.wikidata.org/wiki/Q5163215","display_name":"Consistency (knowledge bases)","level":2,"score":0.5157999992370605},{"id":"https://openalex.org/C206588197","wikidata":"https://www.wikidata.org/wiki/Q846574","display_name":"Reuse","level":2,"score":0.4722999930381775},{"id":"https://openalex.org/C70388272","wikidata":"https://www.wikidata.org/wiki/Q5968558","display_name":"IBM","level":2,"score":0.4609000086784363},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4544000029563904},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.4537999927997589},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.41929998993873596},{"id":"https://openalex.org/C46934059","wikidata":"https://www.wikidata.org/wiki/Q61515","display_name":"Outsourcing","level":2,"score":0.37229999899864197},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.3634999990463257},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.3610000014305115},{"id":"https://openalex.org/C161301231","wikidata":"https://www.wikidata.org/wiki/Q3478658","display_name":"Knowledge representation and reasoning","level":2,"score":0.3353999853134155},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.3296000063419342},{"id":"https://openalex.org/C151319957","wikidata":"https://www.wikidata.org/wiki/Q752739","display_name":"Asynchronous communication","level":2,"score":0.3248000144958496},{"id":"https://openalex.org/C46743427","wikidata":"https://www.wikidata.org/wiki/Q1341685","display_name":"Inference engine","level":3,"score":0.3215000033378601},{"id":"https://openalex.org/C146222976","wikidata":"https://www.wikidata.org/wiki/Q1204997","display_name":"Business logic","level":2,"score":0.3188999891281128},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.28999999165534973},{"id":"https://openalex.org/C149271511","wikidata":"https://www.wikidata.org/wiki/Q1417149","display_name":"Rule-based system","level":2,"score":0.2809999883174896},{"id":"https://openalex.org/C115925183","wikidata":"https://www.wikidata.org/wiki/Q1412694","display_name":"Knowledge-based systems","level":2,"score":0.2667999863624573},{"id":"https://openalex.org/C2129575","wikidata":"https://www.wikidata.org/wiki/Q54837","display_name":"Semantic Web","level":2,"score":0.26420000195503235},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.2529999911785126},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.25290000438690186}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3774904.3792458","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3774904.3792458","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Web Conference 2026","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3774904.3792458","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3774904.3792458","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Web Conference 2026","raw_type":"proceedings-article"},"sustainable_development_goals":[{"display_name":"Responsible consumption and production","id":"https://metadata.un.org/sdg/12","score":0.43795570731163025}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":10,"referenced_works":["https://openalex.org/W2077121139","https://openalex.org/W3015650867","https://openalex.org/W3098605233","https://openalex.org/W3209153114","https://openalex.org/W4385944529","https://openalex.org/W4388843191","https://openalex.org/W4396988324","https://openalex.org/W4402265033","https://openalex.org/W4404652862","https://openalex.org/W4416457564"],"related_works":[],"abstract_inverted_index":{"The":[0],"real-time":[1],"demand":[2],"for":[3,55],"web":[4],"security":[5,17,94],"makes":[6,45],"Security":[7],"Information":[8],"and":[9,14,42,63,105,123,167,175,201,204,233,255],"Event":[10],"Management":[11],"(SIEM)":[12],"platforms":[13],"their":[15],"applied":[16],"rule":[18,47,65],"an":[19,61,86],"integral":[20],"part":[21],"of":[22,30,77,119,192,208],"the":[23,28,75,93,101,114,117,120,129,164,199,205,220,247,252,257],"intrusion":[24],"detection":[25,148],"life-cycle.":[26],"However,":[27],"heterogeneity":[29],"vendor-specific":[31],"rules":[32,122,177,215],"(e.g.,":[33],"Splunk":[34],"SPL,":[35],"Microsoft":[36],"KQL,":[37],"IBM":[38],"AQL,":[39],"Google":[40],"YARA-L,":[41],"RSA":[43],"ESA)":[44],"cross-platform":[46],"reuse":[48],"extremely":[49],"difficult,":[50],"requiring":[51],"deep":[52],"domain":[53],"knowledge":[54],"reliable":[56],"conversion.":[57],"As":[58],"a":[59,189,230],"result,":[60],"autonomous":[62],"accurate":[64],"conversion":[66,89],"framework":[67],"can":[68,125,213,244],"significantly":[69,245],"lead":[70],"to":[71,99,108,128,162,182],"effort":[72],"savings,":[73],"preserving":[74],"value":[76],"existing":[78],"rules.":[79],"In":[80],"this":[81],"paper,":[82],"we":[83,228],"propose":[84],"ARuleCon,":[85,92],"agentic":[87,153],"SIEM-rule":[88],"approach.":[90],"Using":[91],"professionals":[95],"do":[96],"not":[97],"need":[98],"distill":[100],"source":[102,115,174,200],"rules'":[103],"logic":[104,149],"re-map":[106],"it":[107],"target":[109,121,130,176,202,209],"vendors,":[110],"instead,":[111],"they":[112],"provide":[113],"rules,":[116,203,210],"documentation":[118,161,254],"ARuleCon":[124,138,193,212,243],"purposely":[126],"convert":[127,214],"vendors":[131],"without":[132],"more":[133],"intervention.":[134],"To":[135],"achieve":[136],"this,":[137],"is":[139],"equipped":[140],"with":[141,216,235],"intermediate":[142],"representation":[143],"(IR)":[144],"that":[145,156,171,242],"aligns":[146],"core":[147],"into":[150],"vendor-neutral":[151],"layer,":[152],"RAG":[154],"pipeline":[155],"retrieves":[157],"authoritative":[158],"official":[159],"vendor":[160],"address":[163],"convension/schema":[165],"mismatches,":[166],"Python-based":[168],"consistency":[169],"check":[170],"running":[172],"both":[173],"in":[178],"controlled":[179],"test":[180],"environments":[181],"mitigate":[183],"subtle":[184],"semantic":[185],"drifts.":[186],"We":[187],"present":[188],"comprehensive":[190],"evaluation":[191],"ranging":[194],"from":[195],"textual":[196],"alignment":[197],"between":[198],"execution":[206],"success":[207],"showcasing":[211],"higher":[217],"fidelity,":[218],"outperforming":[219],"baseline":[221],"LLM":[222],"models":[223],"by":[224],"15%":[225],"averagely.":[226],"Finally,":[227],"perform":[229],"case":[231],"study":[232],"interview":[234],"our":[236],"industry":[237],"collaborators":[238],"1,":[239],"which":[240],"showcases":[241],"save":[246],"expert's":[248],"time":[249],"on":[250],"understanding":[251],"cross-SIEM's":[253],"remapping":[256],"logic.":[258]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-04-28T00:00:00"}