{"id":"https://openalex.org/W4406875947","doi":"https://doi.org/10.3390/bdcc9020023","title":"Labeling Network Intrusion Detection System (NIDS) Rules with MITRE ATT&CK Techniques: Machine Learning vs. Large Language Models","display_name":"Labeling Network Intrusion Detection System (NIDS) Rules with MITRE ATT&CK Techniques: Machine Learning vs. Large Language Models","publication_year":2025,"publication_date":"2025-01-26","ids":{"openalex":"https://openalex.org/W4406875947","doi":"https://doi.org/10.3390/bdcc9020023"},"language":"en","primary_location":{"id":"doi:10.3390/bdcc9020023","is_oa":true,"landing_page_url":"https://doi.org/10.3390/bdcc9020023","pdf_url":null,"source":{"id":"https://openalex.org/S4210238752","display_name":"Big Data and Cognitive Computing","issn_l":"2504-2289","issn":["2504-2289"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Big Data and Cognitive Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.3390/bdcc9020023","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5026549568","display_name":"Nir Daniel","orcid":"https://orcid.org/0000-0001-5310-2324"},"institutions":[{"id":"https://openalex.org/I124227911","display_name":"Ben-Gurion University of the Negev","ror":"https://ror.org/05tkyf982","country_code":"IL","type":"education","lineage":["https://openalex.org/I124227911"]}],"countries":["IL"],"is_corresponding":true,"raw_author_name":"Nir Daniel","raw_affiliation_strings":["Cyber@BGU, Cyber Labs at Ben-Gurion University, Beer Sheva 8410501, Israel","Department of Software and Information Systems Engineering, Ben-Gurion University, Beer Sheva 8410501, Israel"],"raw_orcid":"https://orcid.org/0000-0001-5310-2324","affiliations":[{"raw_affiliation_string":"Cyber@BGU, Cyber Labs at Ben-Gurion University, Beer Sheva 8410501, Israel","institution_ids":["https://openalex.org/I124227911"]},{"raw_affiliation_string":"Department of Software and Information Systems Engineering, Ben-Gurion University, Beer Sheva 8410501, Israel","institution_ids":["https://openalex.org/I124227911"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101905440","display_name":"Florian Klaus Kaiser","orcid":"https://orcid.org/0000-0002-0043-4306"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Florian Klaus Kaiser","raw_affiliation_strings":["Agnostic Intelligence AG, 6300 Zug, Switzerland"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Agnostic Intelligence AG, 6300 Zug, Switzerland","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5115505376","display_name":"Shay Giladi","orcid":null},"institutions":[{"id":"https://openalex.org/I124227911","display_name":"Ben-Gurion University of the Negev","ror":"https://ror.org/05tkyf982","country_code":"IL","type":"education","lineage":["https://openalex.org/I124227911"]}],"countries":["IL"],"is_corresponding":false,"raw_author_name":"Shay Giladi","raw_affiliation_strings":["Department of Software and Information Systems Engineering, Ben-Gurion University, Beer Sheva 8410501, Israel"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Software and Information Systems Engineering, Ben-Gurion University, Beer Sheva 8410501, Israel","institution_ids":["https://openalex.org/I124227911"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5115505377","display_name":"Sapir Sharabi","orcid":null},"institutions":[{"id":"https://openalex.org/I124227911","display_name":"Ben-Gurion University of the Negev","ror":"https://ror.org/05tkyf982","country_code":"IL","type":"education","lineage":["https://openalex.org/I124227911"]}],"countries":["IL"],"is_corresponding":false,"raw_author_name":"Sapir Sharabi","raw_affiliation_strings":["Department of Software and Information Systems Engineering, Ben-Gurion University, Beer Sheva 8410501, Israel"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Software and Information Systems Engineering, Ben-Gurion University, Beer Sheva 8410501, Israel","institution_ids":["https://openalex.org/I124227911"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5115505378","display_name":"Raz Moyal","orcid":null},"institutions":[{"id":"https://openalex.org/I124227911","display_name":"Ben-Gurion University of the Negev","ror":"https://ror.org/05tkyf982","country_code":"IL","type":"education","lineage":["https://openalex.org/I124227911"]}],"countries":["IL"],"is_corresponding":false,"raw_author_name":"Raz Moyal","raw_affiliation_strings":["Department of Software and Information Systems Engineering, Ben-Gurion University, Beer Sheva 8410501, Israel"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Software and Information Systems Engineering, Ben-Gurion University, Beer Sheva 8410501, Israel","institution_ids":["https://openalex.org/I124227911"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5115505379","display_name":"Shalev Shpolyansky","orcid":null},"institutions":[{"id":"https://openalex.org/I124227911","display_name":"Ben-Gurion University of the Negev","ror":"https://ror.org/05tkyf982","country_code":"IL","type":"education","lineage":["https://openalex.org/I124227911"]}],"countries":["IL"],"is_corresponding":false,"raw_author_name":"Shalev Shpolyansky","raw_affiliation_strings":["Department of Software and Information Systems Engineering, Ben-Gurion University, Beer Sheva 8410501, Israel"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Software and Information Systems Engineering, Ben-Gurion University, Beer Sheva 8410501, Israel","institution_ids":["https://openalex.org/I124227911"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5108326511","display_name":"Andres Murillo","orcid":null},"institutions":[{"id":"https://openalex.org/I2252096349","display_name":"Fujitsu (Japan)","ror":"https://ror.org/038e2g226","country_code":"JP","type":"company","lineage":["https://openalex.org/I2252096349"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Andres Murillo","raw_affiliation_strings":["Fujitsu Ltd., Kawasaki 212-0014, Japan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Fujitsu Ltd., Kawasaki 212-0014, Japan","institution_ids":["https://openalex.org/I2252096349"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075299708","display_name":"Aviad Elyashar","orcid":"https://orcid.org/0000-0002-0918-0146"},"institutions":[{"id":"https://openalex.org/I124227911","display_name":"Ben-Gurion University of the Negev","ror":"https://ror.org/05tkyf982","country_code":"IL","type":"education","lineage":["https://openalex.org/I124227911"]},{"id":"https://openalex.org/I3129975082","display_name":"Sami Shamoon College of Engineering","ror":"https://ror.org/011aa4g29","country_code":"IL","type":"education","lineage":["https://openalex.org/I3129975082"]}],"countries":["IL"],"is_corresponding":false,"raw_author_name":"Aviad Elyashar","raw_affiliation_strings":["Cyber@BGU, Cyber Labs at Ben-Gurion University, Beer Sheva 8410501, Israel","Department of Computer Science, Shamoon College of Engineering, Ashdod 77245, Israel"],"raw_orcid":"https://orcid.org/0000-0002-0918-0146","affiliations":[{"raw_affiliation_string":"Cyber@BGU, Cyber Labs at Ben-Gurion University, Beer Sheva 8410501, Israel","institution_ids":["https://openalex.org/I124227911"]},{"raw_affiliation_string":"Department of Computer Science, Shamoon College of Engineering, Ashdod 77245, Israel","institution_ids":["https://openalex.org/I3129975082"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5059447087","display_name":"Rami Puzis","orcid":"https://orcid.org/0000-0002-7229-3899"},"institutions":[{"id":"https://openalex.org/I124227911","display_name":"Ben-Gurion University of the Negev","ror":"https://ror.org/05tkyf982","country_code":"IL","type":"education","lineage":["https://openalex.org/I124227911"]}],"countries":["IL"],"is_corresponding":false,"raw_author_name":"Rami Puzis","raw_affiliation_strings":["Cyber@BGU, Cyber Labs at Ben-Gurion University, Beer Sheva 8410501, Israel","Department of Software and Information Systems Engineering, Ben-Gurion University, Beer Sheva 8410501, Israel"],"raw_orcid":"https://orcid.org/0000-0002-7229-3899","affiliations":[{"raw_affiliation_string":"Cyber@BGU, Cyber Labs at Ben-Gurion University, Beer Sheva 8410501, Israel","institution_ids":["https://openalex.org/I124227911"]},{"raw_affiliation_string":"Department of Software and Information Systems Engineering, Ben-Gurion University, Beer Sheva 8410501, Israel","institution_ids":["https://openalex.org/I124227911"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5026549568"],"corresponding_institution_ids":["https://openalex.org/I124227911"],"apc_list":{"value":1400,"currency":"CHF","value_usd":1515},"apc_paid":{"value":1400,"currency":"CHF","value_usd":1515},"fwci":13.3115,"has_fulltext":false,"cited_by_count":19,"citation_normalized_percentile":{"value":0.98852139,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":99,"max":100},"biblio":{"volume":"9","issue":"2","first_page":"23","last_page":"23"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9355999827384949,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9355999827384949,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6063937544822693},{"id":"https://openalex.org/keywords/intrusion","display_name":"Intrusion","score":0.553842306137085},{"id":"https://openalex.org/keywords/natural-language-processing","display_name":"Natural language processing","score":0.42468389868736267},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.42128652334213257},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.41350629925727844}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6063937544822693},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.553842306137085},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.42468389868736267},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.42128652334213257},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.41350629925727844},{"id":"https://openalex.org/C17409809","wikidata":"https://www.wikidata.org/wiki/Q161764","display_name":"Geochemistry","level":1,"score":0.0},{"id":"https://openalex.org/C127313418","wikidata":"https://www.wikidata.org/wiki/Q1069","display_name":"Geology","level":0,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.3390/bdcc9020023","is_oa":true,"landing_page_url":"https://doi.org/10.3390/bdcc9020023","pdf_url":null,"source":{"id":"https://openalex.org/S4210238752","display_name":"Big Data and Cognitive Computing","issn_l":"2504-2289","issn":["2504-2289"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Big Data and Cognitive Computing","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:2ac66f2ea0de42bb81930ff321f5bab5","is_oa":true,"landing_page_url":"https://doaj.org/article/2ac66f2ea0de42bb81930ff321f5bab5","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Big Data and Cognitive Computing, Vol 9, Iss 2, p 23 (2025)","raw_type":"article"},{"id":"pmh:oai:mdpi.com:/2504-2289/9/2/23/","is_oa":true,"landing_page_url":"https://dx.doi.org/10.3390/bdcc9020023","pdf_url":null,"source":{"id":"https://openalex.org/S4306400947","display_name":"MDPI (MDPI AG)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4210097602","host_organization_name":"Multidisciplinary Digital Publishing Institute (Switzerland)","host_organization_lineage":["https://openalex.org/I4210097602"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Pages: 23","raw_type":"Text"}],"best_oa_location":{"id":"doi:10.3390/bdcc9020023","is_oa":true,"landing_page_url":"https://doi.org/10.3390/bdcc9020023","pdf_url":null,"source":{"id":"https://openalex.org/S4210238752","display_name":"Big Data and Cognitive Computing","issn_l":"2504-2289","issn":["2504-2289"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Big Data and Cognitive Computing","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":30,"referenced_works":["https://openalex.org/W1986152343","https://openalex.org/W2008060027","https://openalex.org/W2014821958","https://openalex.org/W2538865281","https://openalex.org/W2771963642","https://openalex.org/W3033945962","https://openalex.org/W3107390109","https://openalex.org/W3122241445","https://openalex.org/W3153939733","https://openalex.org/W3206325220","https://openalex.org/W3211888892","https://openalex.org/W3214329506","https://openalex.org/W4210404000","https://openalex.org/W4220736833","https://openalex.org/W4229028905","https://openalex.org/W4285112571","https://openalex.org/W4293234321","https://openalex.org/W4313591697","https://openalex.org/W4315699905","https://openalex.org/W4319079731","https://openalex.org/W4324031781","https://openalex.org/W4378976945","https://openalex.org/W4379231174","https://openalex.org/W4381279495","https://openalex.org/W4391769842","https://openalex.org/W4392639626","https://openalex.org/W4398239377","https://openalex.org/W6765180486","https://openalex.org/W6851275496","https://openalex.org/W7028841820"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W4391913857","https://openalex.org/W2358668433","https://openalex.org/W4396701345","https://openalex.org/W2376932109","https://openalex.org/W2133389611","https://openalex.org/W3204019825"],"abstract_inverted_index":{"Analysts":[0],"in":[1,124],"Security":[2],"Operations":[3],"Centers":[4],"(SOCs)":[5],"are":[6],"often":[7],"occupied":[8],"with":[9,28,59,85,99],"time-consuming":[10],"investigations":[11],"of":[12,38,69,163],"alerts":[13],"from":[14],"Network":[15],"Intrusion":[16],"Detection":[17],"Systems":[18],"(NIDSs).":[19],"Many":[20],"NIDS":[21,80],"rules":[22,58,81],"lack":[23],"clear":[24],"explanations":[25],"and":[26,35,75,89,95,112,130,145,166],"associations":[27],"attack":[29,39,60],"techniques,":[30],"complicating":[31],"the":[32,36,52,67,135,148,155,160],"alert":[33,53],"triage":[34],"generation":[37],"hypotheses.":[40],"Large":[41],"Language":[42],"Models":[43],"(LLMs)":[44],"may":[45],"be":[46],"a":[47],"promising":[48],"technology":[49],"to":[50,77,141],"reduce":[51],"explainability":[54],"gap":[55],"by":[56],"associating":[57],"techniques.":[61,90],"In":[62],"this":[63],"paper,":[64],"we":[65],"investigate":[66],"ability":[68],"three":[70],"prominent":[71],"LLMs":[72,108],"(ChatGPT,":[73],"Claude,":[74],"Gemini)":[76],"reason":[78],"about":[79],"while":[82,107],"labeling":[83],"them":[84,123],"MITRE":[86],"ATT&CK":[87],"tactics":[88],"We":[91],"discuss":[92],"prompt":[93],"design":[94],"present":[96],"experiments":[97],"performed":[98],"973":[100],"Snort":[101],"rules.":[102],"Our":[103],"results":[104,133],"indicate":[105],"that":[106],"provide":[109],"explainable,":[110],"scalable,":[111],"efficient":[113],"initial":[114],"mappings,":[115],"traditional":[116],"machine":[117],"learning":[118],"(ML)":[119],"models":[120],"consistently":[121],"outperform":[122],"accuracy,":[125],"achieving":[126],"higher":[127],"precision,":[128],"recall,":[129],"F1-scores.":[131],"These":[132],"highlight":[134],"potential":[136],"for":[137,169],"hybrid":[138],"LLM-ML":[139],"approaches":[140],"enhance":[142,159],"SOC":[143,164],"operations":[144],"better":[146],"address":[147],"evolving":[149],"threat":[150],"landscape.":[151],"By":[152],"utilizing":[153],"automation,":[154],"presented":[156],"methods":[157],"will":[158],"analysis":[161],"efficiency":[162],"alerts,":[165],"decrease":[167],"workloads":[168],"analysts.":[170]},"counts_by_year":[{"year":2026,"cited_by_count":8},{"year":2025,"cited_by_count":11}],"updated_date":"2026-07-15T18:14:33.161393","created_date":"2025-01-28T00:00:00"}