---
title: "GenTI Pushes Unseen Attack Detection from 45% to 87% With LLMs"
subtitle: "GenTI uses LLMs to auto-generate Snort and Suricata rules from analyst prompts, pushing zero-day attack detection from 45% to 87.4%"
url: "https://alphasignal.ai/news/genti-pushes-unseen-attack-detection-from-45-to-87-with-llms"
author: "AlphaSignal Newsroom"
author_url: "https://alphasignal.ai/editorial-team"
company: "AlphaSignal"
company_url: "https://alphasignal.ai/company/alphasignal"
published: "2026-06-04T00:00:00.000Z"
updated: "2026-06-12T01:23:42.473Z"
type: "Paper"
topics:
  - "Security"
  - "Benchmarks"
subtopics:
  - "Red Teaming"
upvotes: 2522
source_url: "https://arxiv.org/abs/2606.05844"
comments: 0
truncated: true
---

# GenTI Pushes Unseen Attack Detection from 45% to 87% With LLMs

> GenTI uses LLMs to auto-generate Snort and Suricata rules from analyst prompts, pushing zero-day attack detection from 45% to 87.4%

Security teams running rule-based intrusion detection systems face a stubborn paradox: the moment a novel attack appears, their defenses go blind. Writing a Snort or Suricata rule requires a human analyst to understand the attack, extract its payload signatures, map it to threat intelligence frameworks, and hand-craft syntax that can take hours or days to get right. A new paper proposes to automate that entire workflow with an LLM pipeline called [GenTI (Generative Threat Intelligence)](https://arxiv.org/abs/2606.05844).

## The wall every SOC hits

Rule-based IDPS tools like Snort and Suricata are the backbone of network defense. Snort is a powerful open-source network intrusion detection and prevention system that employs a rule-based language combining anomaly, protocol, and signature inspection to identify potentially malicious behavior. The problem is the rules themselves. The fundamental challenge of zero-day defense is what some researchers call the cybersecurity catch-22: you cannot write a signature for something you do not know exists.

In 2025, Google's Threat Intelligence Group tracked 90 zero-day vulnerabilities exploited in the wild, with enterprise technologies reaching an all-time high of 48% of all targets. Edge devices, security appliances, and networking infrastructure bore the brunt of attacks that signature-based defenses simply could not see coming. And the clock is ticking: with the average time to weaponize a disclosed vulnerability collapsing to five days, while organizations still take 60 to 150 days to patch, the gap between attacker speed and defender response has never been wider.

IDPS faces significant challenges in detecting zero-day attacks, as zero-day exploits take advantage of undiscovered vulnerabilities, which prevents IDPS from having the required signatures or patches. Existing research datasets make this worse. Existing public datasets like CICIDS2017 and UNSW-NB15 focus on traffic classification and provide little structured information to support automatic rule synthesis or prevention logic.

![Architecture diagram of NIDPS showing data flow between detection, correlation, and prevention modules](https://arxiv.org/html/2606.05844v1/IDPSS.drawio.png) 

## A dataset built for rule generation, not just classification

_Preview only. Full text requires an AlphaSignal Pro account._

## Sources

- [GenTI: Benchmarking LLMs for Autonomous IDPS Rule Generation for Unseen Attacks](https://arxiv.org/abs/2606.05844)
- [GenTI ResearchGate Full Text](https://www.researchgate.net/publication/406039739_GenTI_Benchmarking_LLMs_for_Autonomous_IDPS_Rule_Generation_for_Unseen_Attacks)
- [Zero-day vulnerabilities: how they work and how to stop them - Vectra AI](https://www.vectra.ai/topics/zero-day)
- [Leveraging LLMs for Automated IDS Rule Generation](https://iturbe.info/assets/pdf/moreno2025leveraging.pdf)
- [Chain-of-Verification (CoVe) - Emergent Mind](https://www.emergentmind.com/topics/chain-of-verification-cove-2e45b96a-a8a3-4bbf-981f-0f00450d29f5)