Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?

As network threats evolve, manual NIDS rule engineering has become a critical operational bottleneck. While Large Language Models LLMs show promise for automating this process, their ability to produce production-ready rules remains unvalidated. This paper presents a human-centered investigation...

GRIDAI: Generating and Repairing Intrusion Detection Rules Via Collaboration among Multiple LLM-Based Agents

Rule-based network intrusion detection systems play a crucial role in the real-time detection of Web attacks. However, most existing works primarily focus on automatically generating detection rules for new attacks, often overlooking the relationships between new attacks and existing rules, which...

Cisco FireSIGHT Management Center SSL HTTP Attack Detection Vulnerability

A vulnerability in HTTP attack detection within decrypted SSL traffic of Cisco FireSIGHT Management Center could allow an unauthenticated, remote attacker to bypass HTTP attack detection. The traffic is SSL and the application is configured to decrypt the SSL connection and detect HTTP-based...