Hex2Sign: Automatic IDS Signature Generation from Hexadecimal Data using LLMs
Prasasthy Balasubramanian, Tarek Ali, Mohammad Salmani, Danial KhoshKholgh, Panos Kostakos · 2024
Despite the growing utilization of large language models (LLMs) in cyber defense operations, their integration within intrusion detection systems (IDS) remains substantially underexplored. This paper proposes a novel approach to generating human-readable IDS signatures by fine-tuning LLMs on hexadecimal data. In our experimental framework, we deploy honeypots to capture malicious network traffic in real-world conditions, generating packet capture (PCAP) files accompanied by text-based alerts and Suricata signatures. The collected hexadecimal data, derived from actual attack vectors, serves as the training corpus for multiple generative and classification models, which are fine-tuned for optimal performance in generating human-readable IDS alerts. According to the results, generative model GPT-3-Davinci-002 excelled across metrics with BERTscore over 96%, while RoBERTa base achieved high accuracy of 96% among classifiers. These findings enhance our understanding that foundational models can improve hexadecimal data processing for cybersecurity. Our conclusions emphasize the potential of advanced generative-AI models in automating dynamic Suricata rule generation, thus enhancing IDS efficiency and accuracy. Moreover, this paper proposes an AI-powered IDS system for securing network environments that can significantly mitigate the risks associated with diverse and widespread devices. By integrating LLMs into security frameworks, this system offers a robust defense mechanism that dynamically adapts to emerging threats, thus enhancing IDS efficiency and accuracy in handling big data challenges.