GenTI Pushes Unseen Attack Detection from 45% to 87% With LLMs
GenTI uses LLMs to auto-generate Snort and Suricata rules from analyst prompts, pushing zero-day attack detection from 45% to 87.4%
- GenTI is an LLM pipeline that auto-generates deployable Snort/Suricata rules from analyst prompts and payload samples, targeting zero-day threats.
- The GTI dataset contains 150k+ annotated Snort/Suricata/Emerging Threats rules and 50k YARA rules, each mapped to CTI and MITRE ATT&CK.
- Unseen attack detection improved from 45% to 87.4%; false-positive rate dropped from 8.5% to 2.3%.
- A Chain-of-Verification (CoVe) loop runs syntactic, logical, and false-positive checks before any rule is accepted, rejecting and re-generating failures.
- The system achieves a composite rule-quality score of 89.4% and 94.8% CTI coverage on the benchmark.
- No public code or dataset release was announced; the paper is available on arXiv.
Security teams running rule-based intrusion detection systems face a stubborn paradox: the moment a novel attack appears, their defenses go blind. Writing a Snort or Suricata rule requires a human analyst to understand the attack, extract its payload signatures, map it to threat intelligence frameworks, and hand-craft syntax that can take hours or days to get right. A new paper proposes to automate that entire workflow with an LLM pipeline called GenTI (Generative Threat Intelligence).
The wall every SOC hits
Rule-based IDPS tools like Snort and Suricata are the backbone of network defense. Snort is a powerful open-source network intrusion detection and prevention system that employs a rule-based language combining anomaly, protocol, and signature inspection to identify potentially malicious behavior. The problem is the rules themselves. The fundamental challenge of zero-day defense is what some researchers call the cybersecurity catch-22: you cannot write a signature for something you do not know exists.
In 2025, Google's Threat Intelligence Group tracked 90 zero-day vulnerabilities exploited in the wild, with enterprise technologies reaching an all-time high of 48% of all targets. Edge devices, security appliances, and networking infrastructure bore the brunt of attacks that signature-based defenses simply could not see coming. And the clock is ticking: with the average time to weaponize a disclosed vulnerability collapsing to five days, while organizations still take 60 to 150 days to patch, the gap between attacker speed and defender response has never been wider.
IDPS faces significant challenges in detecting zero-day attacks, as zero-day exploits take advantage of undiscovered vulnerabilities, which prevents IDPS from having the required signatures or patches. Existing research datasets make this worse. Existing public datasets like CICIDS2017 and UNSW-NB15 focus on traffic classification and provide little structured information to support automatic rule synthesis or prevention logic.
A dataset built for rule generation, not just classification
This story is for Pro members
You've reached the end of the free preview. Upgrade to AlphaSignal Pro to read the full article - and everything else behind the paywall.
Comments
