RuleLLM: LLM-driven rule generation for anomaly network traffic identification

Abstract The ongoing evolution of network traffic attacks poses a considerable challenge for intrusion detection systems. While intelligent models can effectively identify traffic patterns, detection rules are typically easier to comprehend than these complex models. Currently, the generation of detection rules relies heavily on expert knowledge and insights from the security community alongside traditional automated generation methods. However, these generated rules often prove incomplete and inaccurate, failing to adapt to the constantly changing network environment and the rapid advancements in attack technologies. To fill this gap, this paper presents a traffic detection rule generation method called RuleLLM based on a large language model (LLM). RuleLLM establishes a framework for rule generation that utilizes this model and incorporates domain knowledge into the pretrained model using techniques such as Low-Rank Adaptation fine-tuning, few-sample fast engineering, and a feedback-driven revision mechanism. The effectiveness of the rules generated by this model has been validated through a real detection engine. Experimental results indicate that the proposed traffic rule generation method, which leverages an LLM, can analyze original traffic data comprehensively and effectively. With fine-tuning based on a small number of samples, a high detection rate of 91.8% was achieved, showcasing its ability to generate effective rules and enhance network defense capabilities.