{"id":"https://openalex.org/W7152447797","doi":"https://doi.org/10.48550/arxiv.2604.06762","title":"ARuleCon: Agentic Security Rule Conversion","display_name":"ARuleCon: Agentic Security Rule Conversion","publication_year":2026,"publication_date":"2026-04-08","ids":{"openalex":"https://openalex.org/W7152447797","doi":"https://doi.org/10.48550/arxiv.2604.06762"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.06762","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.06762","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.06762","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5133247200","display_name":"Ming Xu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xu, Ming","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Wang, Hongtai","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Hongtai","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5113228229","display_name":"Yanpei Guo","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Guo, Yanpei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133282911","display_name":"Zhengmin Yu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yu, Zhengmin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133252496","display_name":"Weili Han","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Han, Weili","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5016340326","display_name":"Hoon Wei Lim","orcid":"https://orcid.org/0000-0002-7830-3007"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lim, Hoon Wei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133288868","display_name":"Jin Song Dong","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Dong, Jin Song","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5125548356","display_name":"Jiaheng Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Jiaheng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.27810001373291016,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.27810001373291016,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.17960000038146973,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.1298999935388565,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/documentation","display_name":"Documentation","score":0.67330002784729},{"id":"https://openalex.org/keywords/reuse","display_name":"Reuse","score":0.6238999962806702},{"id":"https://openalex.org/keywords/ibm","display_name":"IBM","score":0.6223999857902527},{"id":"https://openalex.org/keywords/consistency","display_name":"Consistency (knowledge bases)","score":0.6179999709129333},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.5329999923706055},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5169000029563904},{"id":"https://openalex.org/keywords/baseline","display_name":"Baseline (sea)","score":0.46129998564720154},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.34779998660087585}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6899999976158142},{"id":"https://openalex.org/C56666940","wikidata":"https://www.wikidata.org/wiki/Q788790","display_name":"Documentation","level":2,"score":0.67330002784729},{"id":"https://openalex.org/C206588197","wikidata":"https://www.wikidata.org/wiki/Q846574","display_name":"Reuse","level":2,"score":0.6238999962806702},{"id":"https://openalex.org/C70388272","wikidata":"https://www.wikidata.org/wiki/Q5968558","display_name":"IBM","level":2,"score":0.6223999857902527},{"id":"https://openalex.org/C2776436953","wikidata":"https://www.wikidata.org/wiki/Q5163215","display_name":"Consistency (knowledge bases)","level":2,"score":0.6179999709129333},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.5329999923706055},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5169000029563904},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.46129998564720154},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.41339999437332153},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.34779998660087585},{"id":"https://openalex.org/C2779955035","wikidata":"https://www.wikidata.org/wiki/Q4686785","display_name":"Advice (programming)","level":2,"score":0.3303999900817871},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.30979999899864197},{"id":"https://openalex.org/C149271511","wikidata":"https://www.wikidata.org/wiki/Q1417149","display_name":"Rule-based system","level":2,"score":0.30550000071525574},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.2987000048160553},{"id":"https://openalex.org/C115925183","wikidata":"https://www.wikidata.org/wiki/Q1412694","display_name":"Knowledge-based systems","level":2,"score":0.28940001130104065},{"id":"https://openalex.org/C3019659195","wikidata":"https://www.wikidata.org/wiki/Q5690566","display_name":"Meaningful use","level":3,"score":0.2750000059604645},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.2727000117301941},{"id":"https://openalex.org/C6881194","wikidata":"https://www.wikidata.org/wiki/Q7449091","display_name":"Semantic technology","level":4,"score":0.26829999685287476},{"id":"https://openalex.org/C58328972","wikidata":"https://www.wikidata.org/wiki/Q184609","display_name":"Expert system","level":2,"score":0.26489999890327454},{"id":"https://openalex.org/C33762810","wikidata":"https://www.wikidata.org/wiki/Q461671","display_name":"Data integrity","level":2,"score":0.2599000036716461},{"id":"https://openalex.org/C115051666","wikidata":"https://www.wikidata.org/wiki/Q6522493","display_name":"Ranging","level":2,"score":0.2515000104904175},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.25029999017715454}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.06762","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.06762","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.06762","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.06762","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Security":[0],"Information":[1],"and":[2,37,58,106,127,135,158,183,205],"Event":[3],"Management":[4],"(SIEM)":[5],"systems":[6],"make":[7],"it":[8],"possible":[9],"for":[10,50],"detecting":[11],"intrusion":[12],"anomalies":[13],"in":[14,138,189],"real-time":[15],"manner":[16],"by":[17,175],"their":[18],"applied":[19],"security":[20,89],"rules.":[21,74],"However,":[22],"the":[23,70,88,96,100,103,112,159,171],"heterogeneity":[24],"of":[25,72,102,152],"vendor-specific":[26],"rules":[27,105,137,166],"(e.g.,":[28],"Splunk":[29],"SPL,":[30],"Microsoft":[31],"KQL,":[32],"IBM":[33],"AQL,":[34],"Google":[35],"YARA-L,":[36],"RSA":[38],"ESA)":[39],"makes":[40],"cross-platform":[41],"rule":[42,60],"reuse":[43],"extremely":[44],"difficult,":[45],"requiring":[46],"deep":[47],"domain":[48],"knowledge":[49],"reliable":[51],"conversion.":[52],"As":[53],"a":[54,149],"result,":[55],"an":[56,81],"autonomous":[57],"accurate":[59],"conversion":[61,84],"framework":[62],"can":[63,108,164,196],"significantly":[64,197],"lead":[65],"to":[66,94,111,142],"effort":[67],"savings,":[68],"preserving":[69],"value":[71],"existing":[73],"In":[75],"this":[76],"paper,":[77],"we":[78,179],"propose":[79],"ARuleCon,":[80,87],"agentic":[82],"SIEM-rule":[83],"approach.":[85],"Using":[86],"professionals":[90],"do":[91],"not":[92],"need":[93],"distill":[95],"source":[97,134],"rules'":[98],"logic,":[99],"documentation":[101,204],"target":[104,113,136],"ARuleCon":[107,121,153,163,195],"purposely":[109],"convert":[110,165],"vendors":[114],"without":[115],"more":[116],"intervention.":[117],"To":[118],"achieve":[119],"this,":[120],"is":[122],"equipped":[123],"with":[124,167,185],"conversion/schema":[125],"mismatches,":[126],"Python-based":[128],"consistency":[129],"check":[130],"that":[131,194],"running":[132],"both":[133],"controlled":[139],"test":[140],"environments":[141],"mitigate":[143],"subtle":[144],"semantic":[145],"drifts.":[146],"We":[147],"present":[148],"comprehensive":[150],"evaluation":[151],"ranging":[154],"from":[155],"textual":[156],"alignment":[157],"execution":[160],"success,":[161],"showcasing":[162],"high":[168],"fidelity,":[169],"outperforming":[170],"baseline":[172],"LLM":[173],"model":[174],"15%":[176],"averagely.":[177],"Finally,":[178],"perform":[180],"case":[181],"studies":[182],"interview":[184],"our":[186],"industry":[187],"collaborators":[188],"Singtel":[190],"Singapore,":[191],"which":[192],"showcases":[193],"save":[198],"expert's":[199],"time":[200],"on":[201],"understanding":[202],"cross-SIEM's":[203],"remapping":[206],"logic.":[207]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-04-10T00:00:00"}