Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?

Technical Summary: Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?

Problem Statement
As network threats evolve with increasing speed and complexity (e.g., polymorphic malware, zero-day exploits), manual Network Intrusion Detection System (NIDS) rule engineering has become a critical operational bottleneck. While open-source solutions like Snort and Suricata rely on signature-based detection, the efficacy of these systems is contingent upon the quality and timeliness of their rule sets. The manual creation and maintenance of these rulesets are labor-intensive, unscalable, and prone to "SOC fatigue" due to high false positive rates and the syntactic complexity of rule languages. Although Large Language Models (LLMs) have shown promise in automating rule generation, their practical utility remains unvalidated. Specifically, there is a lack of empirical evidence regarding whether security experts trust LLM-generated rules, how they interact with such outputs, and whether syntactically correct rules are semantically deployable in real-world scenarios.

Methodology
The authors employ a four-phase, human-centered methodology to investigate the viability of LLM-based NIDS rule engineering:

1. System Formalization: The authors conducted a literature review of 11 primary works and a pre-study with three domain experts to formalize a grounded generation framework. The resulting system (Figure 1) consists of a "Rule Engineering Agent" and a "Human Loop."

   • Inputs: The agent ingests network inventory data, vulnerability inventories (CVEs, CPEs), and Proof-of-Concept (PoC) exploits.
   • Processing: It utilizes an LLM engine (hosted locally via Ollama to ensure privacy and reproducibility) with role-based and few-shot prompting.
   • Validation: A multi-stage pipeline includes a syntax checker (native compiler validation) and an automated syntax corrector that uses adaptive prompting to fix errors.
   • Human-in-the-Loop: Experts can interact with the LLM via adaptive prompting to refine rules iteratively.

2. User Study Design: The study involved 137 recruited participants, with a final analysis subset of 10 highly experienced security experts (SOC analysts, researchers, and engineers). The study was structured into three phases: ethics/demographics, rule evaluation (assessing quality and cognitive load), and interactive system evaluation.

   • Scenarios: Participants evaluated rules generated across six network scenarios (two synthetic, four based on the CIC-IDS 2017 dataset) with varying topological complexity and vulnerability densities.
   • Tasks: Experts performed blind evaluations of rule correctness, assessed the utility of LLM-generated explanations, and interacted with the system to modify rules.

3. Statistical Analysis: The authors generated rules using 27 different LLM engines across the scenarios. They analyzed syntax validity, the necessity of correction loops, and the semantic content of the rules (field distribution, specificity).

4. Human-Centered Evaluation: The top-performing engine (DeepSeek-R1 70B) was selected for the user study. Experts rated rule deployability, confidence levels, and system usability using the System Usability Scale (SUS) and custom questionnaires.

Key Contributions

• Formalization of a Grounded Framework: The paper formalizes a state-of-the-art LLM-based rule engineering system that integrates vulnerability data, PoCs, and a human-in-the-loop verification mechanism, addressing gaps in existing literature where human feedback is often absent.
• Empirical Characterization of Expert Trust: It provides the first empirical data on security professionals' trust in LLM-generated NIDS rules, revealing a critical disconnect between syntactic validity and semantic deployability.
• Insights into Interaction Patterns: The study identifies specific interaction patterns, cognitive load factors, and usability barriers when experts utilize LLM assistance for rule engineering.

Results
The evaluation reveals a "syntax-semantics paradox":

• Syntax vs. Semantics: While large-scale models (≥70B parameters) demonstrate high syntactic proficiency (up to 87-90% valid rules), small models (≤4B) are largely ineffective. However, even the best models require syntax-checking and correction modules; only ~21% of rules from the best model were valid on the first attempt.
• Semantic Deployability: Despite high syntactic success, experts deemed only 37.5% of the generated rules semantically correct and deployable. The primary reasons for rejection were low specificity (over-reliance on generic variables like ANY), heavy dependence on pure content matching (lack of fields like OFFSET, DEPTH, or protocol-specific fields), and logic hallucinations (e.g., incorrect port/protocol associations).
• Model Performance: DeepSeek-R1 70B and Llama-3.1/3.3 70B emerged as the superior engines. The inclusion of PoC data improved syntactic accuracy but only for models capable of handling large context windows.
• Expert Trust and Usability:
  • The system received a favorable SUS score of 67, indicating it is perceived as usable and learnable.
  • However, experts remain skeptical of autonomous capabilities. They view LLMs as support tools for drafting, syntax checking, and explanation, rather than independent generators.
  • Adoption: Over 70% of experts refused to deploy the rules "as is," citing the need for substantial human refinement (average effort rating: 4.25/5).
  • Cognitive Load: While experts could easily identify flaws in simple scenarios, their confidence and ability to validate rules decreased as network complexity increased, though highly experienced experts (3+ years) maintained higher accuracy in identifying issues even in complex contexts.

Significance and Claims
The paper claims to provide a foundational assessment of LLMs in the rule engineering domain. Its primary significance lies in delineating the limitations of current LLMs: while they can produce syntactically correct code, they currently lack the deep reasoning capabilities required for the semantic precision and context-awareness necessary for production-ready NIDS rules.

The authors conclude that the path forward is not fully autonomous generation but rather human-in-the-loop architectures. These systems should prioritize the analyst's agency, using LLMs to assist with drafting, verification, and explanation, while relying on human experts for final validation and decision-making to mitigate risks of false positives and hallucinations. The work serves as a roadmap for developing more robust, reliable, and human-aligned rule engineering workflows.