Hex2Sign: Automatic IDS Signature Generation from Hexadecimal Data using LLMs

Despite the growing utilization of large language models (LLMs) in cyber defense operations, their integration within intrusion detection systems (IDS) remains substantially underexplored. This paper proposes a novel approach to generating human-readable IDS signatures by fine-tuning LLMs on hexadecimal data. In our experimental framework, we deploy honeypots to capture malicious network traffic in real-world conditions, generating packet capture (PCAP) files accompanied by text-based alerts and Suricata signatures. The collected hexadecimal data, derived from actual attack vectors, serves as the training corpus for multiple generative and classification models, which are fine-tuned for optimal performance in generating human-readable IDS alerts. According to the results, generative model GPT-3-Davinci-002 excelled across metrics with BERTscore over 96%, while RoBERTa base achieved high accuracy of 96% among classifiers. These findings enhance our understanding that foundational models can improve hexadecimal data processing for cybersecurity. Our conclusions emphasize the potential of advanced generative-AI models in automating dynamic Suricata rule generation, thus enhancing IDS efficiency and accuracy. Moreover, this paper proposes an AI-powered IDS system for securing network environments that can significantly mitigate the risks associated with diverse and widespread devices. By integrating LLMs into security frameworks, this system offers a robust defense mechanism that dynamically adapts to emerging threats, thus enhancing IDS efficiency and accuracy in handling big data challenges.