一句话：提出 AVDA 框架，利用 MCP 与 LLM 自动编写网络安全检测规则，并量化不同智能体工作流的质量与成本权衡。
网络安全检测编写长期依赖人工，检测逻辑分散在多个仓库中，存在重复且组织可见性有限，制约了覆盖范围与编写速度。本文提出 AVDA，利用 Model Context Protocol（MCP）将组织上下文——已有检测、遥测 schema 与风格指南——集成到 AI 辅助代码生成中，从而自动化检测编写。作者在真实生产检测语料和多种先进 LLM 上比较了 Baseline、Sequential 与 Agentic 三种编写策略。结果显示，Agentic 工作流在整体相似度上比 Baseline 提升 19%，而 Sequential 以低 40 倍的 token 成本达到 Agentic 87% 的质量。生成检测在 TTP 匹配（99.4%）和语法有效性（95.9%）上表现优异，但排除一致性（exclusion parity）仅 8.9%。在 22 条检测子集上的专家验证表明，自动指标与从业者判断具有较强 Spearman 相关性（ρ = 0.64，p < 0.002）。AVDA 可无缝集成至标准开发环境，为 AI 辅助检测工程提供了量化质量、成本与延迟权衡的实用路径。
With the rapid advancement of AI in code generation, cybersecurity detection engineering faces new opportunities to automate traditionally manual processes. Detection authoring—the practice of creating executable logic that identifies malicious activities from security telemetry—is hindered by fragmented code across repositories, duplication, and limited organizational visibility. Current workflows remain heavily manual, constraining both coverage and velocity. In this paper, we introduce AVDA, a framework that leverages the Model Context Protocol (MCP) to automate detection authoring by integrating organizational context—existing detections, telemetry schemas, and style guides—into AI-assisted code generation. We evaluate three authoring strategies—Baseline, Sequential, and Agentic—across a diverse corpus of production detections and state-of-the-art LLMs. Our results show that Agentic workflows achieve a 19% improvement in overall similarity score over Baseline approaches, while Sequential workflows attain 87% of Agentic quality at 40× lower token cost. Generated detections excel at TTP matching (99.4%) and syntax validity (95.9%) but struggle with exclusion parity (8.9%). Expert validation on a 22-detection subset confirms strong Spearman correlation between automated metrics and practitioner judgment (ρ = 0.64, p < 0.002). By integrating seamlessly into standard developer environments, AVDA provides a practical path toward AI-assisted detection engineering with quantified trade-offs between quality, cost, and latency.