一句话：提出 LLM 智能体 RulePilot，借助中间表示从自然语言标注自动生成安全检测规则。
基于规则的入侵检测要求专家按预定义语法手工编写检测规则，门槛高、耗时长，是安全工程师的沉重负担。本文提出 RulePilot：用基于 LLM 的智能体模拟人类专家经验，处理规则创建、规则转换等任务。用户无需按语法书写规则，只需提供自然语言描述等标注，RulePilot 即可在无需额外干预的情况下自动生成检测规则。其核心设计是引入中间表示（IR），把配置规则的复杂性抽象为结构化、标准化的格式，使 LLM 能在更可控、更一致的表示上生成规则。评估从文本相似度与执行成功率两方面展开：生成规则对真值的文本相似度相对基线最高提升 107.4%，在真实执行测试中取得更高的检测准确率；与新加坡产业合作者的案例研究也表明该工具能显著帮助初级分析员和普通用户完成规则创建。
The real-time demand for system security leads to the detection rules becoming an integral part of the intrusion detection life-cycle. Rule-based detection often identifies malicious logs based on the predefined grammar logic, requiring experts with deep domain knowledge for rule generation. Therefore, automation of rule generation can result in significant time savings and ease the burden of rule-related tasks on security engineers. In this paper, we propose RulePilot, which mimics human expertise via LLM-based agent for addressing rule-related challenges like rule creation or conversion. Using RulePilot, the security analysts do not need to write down the rules following the grammar, instead, they can just provide the annotations such as the natural-language-based descriptions of a rule, our RulePilot can automatically generate the detection rules without more intervention. RulePilot is equipped with the intermediate representation (IR), which abstracts the complexity of config rules into structured, standardized formats, allowing LLMs to focus on generation rules in a more manageable and consistent way. We present a comprehensive evaluation of RulePilot in terms of textual similarity and execution success abilities, showcasing RulePilot can generate high-fidelity rules, outperforming the baseline models by up to 107.4% in textual similarity to ground truths and achieving better detection accuracy in real-world execution tests. We perform a case study from our industry collaborators in Singapore, showcasing that RulePilot significantly help junior analysts/general users in the rule creation process.
@inproceedings{abs-2511-12224,
title = {RulePilot: An LLM-Powered Agent for Security Rule Generation},
author = {Hongtai Wang and Ming Xu and Yanpei Guo and Weili Han and Hoon Wei Lim and Jin Song Dong},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3773249}
}