Generating Suricata Rules Straight From Malware PCAPs, No Threat Intel Required

arXiv 2609.16231·low signalXBlueskyLinkedInCopy link

RuleAutoPilot (arXiv 2609.16231, submitted 14 Sep 2026) is an agentic framework that synthesizes deployable Suricata IDS rules directly from malware network traffic, sidestepping the chicken-and-egg problem that curated threat intelligence only exists after the traffic artifacts do. A Benign Traffic Fingerprinting stage strips known background flows before LLM processing to control noise and cost, and rules that fail syntax checks, do not trigger on the source traffic, or false-positive on a benign corpus are automatically repaired using structured feedback. Across 1,296 malware PCAPs, execution-grounded verification raised rule F1 from 0.443 to 0.539.