WAFGen: LLM Agents for IDS and Multi-Cloud WAF Rules Generation
This paper introduces WAFGen, a multi-LLM fine-tuning pipeline that automatically generates syntactically valid and cost-efficient IDS and WAF rules for major cloud providers, achieving high accuracy and significant reductions in AWS Web ACL capacity costs compared to manual baselines.
Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
The digital world has expanded far beyond the walls of a single office building. Today, critical services live in the cloud, scattered across vast networks managed by different companies. To keep these systems safe, security teams rely on digital guards known as firewalls and intrusion detection systems. These tools act like bouncers at a club, checking every piece of data that tries to enter. If a visitor looks suspicious, the guard stops them. But to do this, the guard needs a list of what to look for. Security engineers must write these lists, known as rules, by hand. They translate descriptions of new threats into complex, technical instructions that the software can understand. As the internet grows and threats change faster, writing these rules by hand has become a slow, expensive, and error-prone task. The sheer volume of different cloud platforms means engineers often have to rewrite the same rule in three or four different languages just to protect a single application.
A team of researchers at École de Technologie Supérieure and Université du Québec à Trois-Rivières has developed a new way to automate this process. They created a system called WAFGen, which uses advanced artificial intelligence to write these security rules automatically. Instead of asking a human to translate a threat description into code, the system takes a plain English description of a danger and instantly produces the correct technical rule for the specific cloud provider being used. The researchers tested this system against three major cloud platforms: Amazon Web Services, Microsoft Azure, and Cloudflare, as well as two traditional network security frameworks. Their goal was to see if an artificial intelligence could learn the distinct "grammar" of each platform well enough to write valid, working rules without human help.
The researchers built a massive training library containing thousands of examples of security rules from all five target systems. They taught four different AI models to recognize the patterns of these rules. To ensure the AI did not just memorize the examples but truly learned the logic, they tested two different training strategies. In one approach, they trained separate AI models for each specific platform, hoping that specialization would lead to better results. In the other approach, they trained a single AI model on all five platforms at once, forcing it to learn the differences between them simultaneously. They then put these models to the test by asking them to generate rules for new, unseen threats and checking if the real cloud providers would accept them.
The results showed that the AI models were remarkably successful at writing rules that the cloud providers would accept. When the models generated rules for the three major cloud platforms, more than 90 percent of them were syntactically correct and ready for deployment. The best-performing model, a 7-billion-parameter system, achieved a success rate of nearly 96 percent on Amazon's platform and over 90 percent on Microsoft's. Perhaps most surprisingly, the researchers found that the single model trained on all platforms at once performed just as well as, and often better than, the specialized models trained on only one platform. This suggests that teaching the AI to understand the differences between the various cloud languages actually helped it avoid mistakes, rather than confusing it. The system also learned to keep the rules simple and efficient. In the Amazon environment, where complex rules cost more money to run, the AI-generated rules used a tiny fraction of the available budget, costing only about 10 to 25 units per rule compared to hundreds for standard managed rule sets.
The study also addressed a common fear about artificial intelligence: that it might invent fake or dangerous instructions. The researchers found that the system rarely made up invalid commands. When it did make a mistake, it was usually a minor formatting error that could be caught by a simple check before the rule was ever used. The system was able to handle a wide variety of threats, from common web attacks like SQL injection to more complex bot-driven threats. By integrating a cost-checking step directly into the generation process, the system allows security teams to know exactly how much a new rule will cost before they even deploy it. This capability turns rule creation from a guessing game into a precise, budget-conscious operation.
While the system is highly effective, the researchers noted that it works best with larger AI models. Smaller, more compact models struggled when asked to learn all the different cloud languages at once, often failing to produce valid rules for certain platforms. However, for organizations that need to protect their systems across multiple clouds, the multi-platform approach proved to be the most reliable. The work demonstrates that artificial intelligence can now handle the complex, tedious task of translating human security needs into the specific technical languages required by modern cloud infrastructure. This does not replace the security engineer but rather frees them from the drudgery of manual coding, allowing them to focus on strategy and analysis while the machine handles the heavy lifting of rule generation. The code and data behind this system are now available for others to use and improve, marking a significant step toward more agile and cost-effective cloud security.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.