{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,17]],"date-time":"2026-08-17T19:35:49Z","timestamp":1786995349011,"version":"build-2736575974"},"reference-count":161,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Netw. Sci. Eng."],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/tnse.2026.3716998","type":"journal-article","created":{"date-parts":[[2026,7,27]],"date-time":"2026-07-27T19:14:31Z","timestamp":1785179671000},"page":"10692-10714","source":"Crossref","is-referenced-by-count":0,"title":["GenTI: Benchmarking LLMs for Autonomous IDPS Rule Generation for Unseen Attacks"],"prefix":"10.1109","volume":"13","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7746-344X","authenticated-orcid":false,"given":"Hassan Jalil","family":"Hadi","sequence":"first","affiliation":[{"name":"King Abdullah University of Science and Technology","place":["Thuwal, Saudi Arabia"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6636-0533","authenticated-orcid":false,"given":"Muhammad Khurram","family":"Khan","sequence":"additional","affiliation":[{"name":"King Saud University","place":["Riyadh, Saudi Arabia"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2941-9780","authenticated-orcid":false,"given":"Naveed","family":"Ahmad","sequence":"additional","affiliation":[{"name":"Prince Sultan University","place":["Riyadh, Saudi Arabia"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-9039-0648","authenticated-orcid":false,"given":"Rehana","family":"Yasmin","sequence":"additional","affiliation":[{"name":"King Abdullah University of Science and Technology","place":["Thuwal, Saudi Arabia"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ali","family":"Shoker","sequence":"additional","affiliation":[{"name":"King Abdullah University of Science and Technology","place":["Thuwal, Saudi Arabia"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","first-page":"4337","article-title":"$\\lbrace$xNIDS$\\rbrace$: Explaining deep learning-based network intrusion detection systems for active intrusion responses","volume-title":"Proc. 32nd USENIX Secur. Symp.","author":"Wei","year":"2023"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.103069"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2025.104702"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2022.3233793"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2024.124317"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2019.105124"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3725216"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.5220\/0006639801080116"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1007\/s42979-023-01926-7"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-47549-8_13"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3472753"},{"issue":"3","key":"ref12","first-page":"35","article-title":"Signature based intrusion detection system using snort","volume":"1","author":"Kumar","year":"2012","journal-title":"Int. J. Comput. Appl. Inf. Technol."},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2014.04.012"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.3390\/app12020852"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-19-1844-5_24"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1007\/s10207-023-00794-9"},{"key":"ref17","article-title":"A collaborative intrusion detection system using snort IDS nodes","author":"Davies","year":"2025"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom50675.2020.00101"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2021.3061297"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102177"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2023.3332284"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/TNSE.2022.3206353"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/TNSE.2019.2936466"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3616581"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/TSMCC.2010.2048428"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.25"},{"key":"ref27","article-title":"GRIDAI: Generating and repairing intrusion detection rules via collaboration among multiple LLM-based agents","author":"Li","year":"2025"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3474085.3475538"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1007\/s10115-025-02556-6"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/ICCTA60978.2023.10969349"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3240841"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102861"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/access.2017.2762418"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2895334"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2024.125860"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2022.118745"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2014.11.009"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-70139-4_87"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102537"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2022.07.027"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3664649"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2023.3239522"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.103928"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.3390\/s21041113"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2022.118476"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-95161-0_5"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2023.122198"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1016\/j.inffus.2022.09.026"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/IOTM.003.2200001"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/TICPS.2024.3406505"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2022.3203427"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2025.3563680"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2024.124215"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103483"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2023.3334028"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3206425"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2023.122564"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.7717\/peerj-cs.900"},{"key":"ref59","article-title":"Time for action: Automated analysis of cyber threat intelligence in the wild","author":"Siracusano","year":"2023"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE55969.2022.00027"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.3390\/data8010018"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1155\/jece\/3383674"},{"key":"ref63","article-title":"IDS-agent: An LLM agent for explainable intrusion detection in IoT networks","author":"Li","year":"2025"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1145\/3459637.3481896"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2024.103736"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/BigData62323.2024.10825710"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom63139.2024.00259"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.2025.3582330"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2025.108086"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1016\/j.inffus.2025.103347"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/ICMCIS52405.2021.9486307"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3141161"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.3390\/electronics11233955"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1111\/exsy.13518"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1088\/1742-6596\/2670\/1\/012025"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/GLOBECOM48099.2022.10000985"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/TNSE.2025.3629983"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-93420-0_22"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.3390\/telecom7030073"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1109\/AICCSA56895.2022.10017800"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-34433-6_10"},{"key":"ref82","article-title":"CVE-driven attack technique prediction with semantic information extraction and a domain-specific language model","author":"Aghaei","year":"2023"},{"key":"ref83","article-title":"On the uses of large language models to interpret ambiguous cyberattack descriptions","author":"Fayyazi","year":"2023"},{"key":"ref84","article-title":"Can LLM-generated misinformation be detected?","author":"Chen","year":"2023"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1016\/j.inffus.2024.102638"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.24556"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.104016"},{"key":"ref88","article-title":"GPT-2C: A GPT-2 parser for cowrie honeypot logs","author":"Domalis","year":"2021"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3325727"},{"key":"ref90","article-title":"PentestGPT: An LLM-empowered automatic penetration testing tool","author":"Deng","year":"2023"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1371\/journal.pcsy.0000085"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-10684-2_7"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1145\/3607199.3607208"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-99-7969-1_18"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.103805"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1109\/HPCC-DSS-SmartCity-DependSys60770.2023.00045"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1145\/3485447.3512217"},{"key":"ref98","article-title":"NetGPT: Generative pretrained transformer for network traffic","author":"Meng","year":"2023"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2023.122045"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2025.3596915"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1145\/3746027.3755011"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.52202\/079017-0288"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.findings-acl.245"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.52202\/085713-1183"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.emnlp-industry.114"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102258"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2025.107877"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978315"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE51399.2021.00024"},{"issue":"2012","key":"ref110","first-page":"1","article-title":"Standardizing cyber threat intelligence information with the structured threat information expression (STIX)","volume":"11","author":"Barnum","year":"2012","journal-title":"Mitre Corporation"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1145\/3134600.3134646"},{"key":"ref112","first-page":"1149","article-title":"Helping hands: Measuring the impact of a large threat intelligence sharing community","volume-title":"Proc. 31st USENIX Secur. Symp.","author":"Bouwman","year":"2022"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-65745-1_1"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN52387.2021.9534192"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3151148"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1145\/3587255"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1109\/ICAIC53980.2022.9896966"},{"issue":"8","key":"ref118","first-page":"1","article-title":"Applications of cyber threat intelligence (CTI) in financial institutions and challenges in its adoption","volume":"6","author":"Kayode-Ajala","year":"2023","journal-title":"Appl. Res. Artif. Intell. Cloud Comput."},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.1145\/3687300"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1109\/SITA67914.2025.11273397"},{"key":"ref121","article-title":"Methods to employ Zeek in detecting MITRE ATT&CK techniques","author":"McPhee","year":"2020"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1109\/PerComWorkshops53856.2022.9767375"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.3390\/bdcc9020023"},{"key":"ref124","article-title":"Generating labelled network datasets of APT with the MITRE CALDERA framework","author":"Gjerstad","year":"2022"},{"key":"ref125","article-title":"Radar: Effective network-based malware detection based on the MITRE ATT&CK framework","author":"Sharma","year":"2022"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1155\/2021\/3187205"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102763"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2022.3175719"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1155\/2022\/9875199"},{"key":"ref130","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-long.868"},{"key":"ref131","article-title":"CRUSH: Cybersecurity research using universal LLMs and semantic hypernetworks","volume-title":"Proc. EKG-LLM Workshop ACM Int. Conf. Inf. Knowl. Manage.","author":"Sewak","year":"2023"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-acl.229"},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.1109\/BigData59044.2023.10386116"},{"key":"ref134","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-87496-3_5"},{"key":"ref135","article-title":"KDD Cup 1999 Data","year":"1999"},{"key":"ref136","article-title":"NSL-KDD  datasets  research  Canadian Institute for Cybersecurity  UNB","year":"2008"},{"key":"ref137","article-title":"DEF CON hacking conference - Capture the flag archive","author":"Tangent","year":"1996"},{"key":"ref138","article-title":"G-NIDD: A comprehensive network intrusion detection dataset generated over 5G wireless network","author":"Samarakoon","year":"2022"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-47358-7_52"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3094024"},{"key":"ref141","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-64758-2_6"},{"key":"ref142","doi-asserted-by":"publisher","DOI":"10.1109\/TNSE.2025.3553442"},{"key":"ref143","doi-asserted-by":"publisher","DOI":"10.1109\/DISCEX.2000.821506"},{"key":"ref144","article-title":"The CAIDA DDOS Attack 2007 dataset","year":"2020"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"ref146","doi-asserted-by":"publisher","DOI":"10.1145\/972374.972384"},{"key":"ref147","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2016.2609907"},{"key":"ref148","doi-asserted-by":"publisher","DOI":"10.1109\/IIH-MSP.2015.10"},{"key":"ref149","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2005.15"},{"key":"ref150","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2006.18"},{"key":"ref151","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-89363-6_8"},{"key":"ref152","article-title":"Autograph: Toward automated, distributed worm signature detection","volume-title":"Proc. USENIX Secur. Symp.","volume":"286","author":"Kim","year":"2004"},{"key":"ref153","doi-asserted-by":"publisher","DOI":"10.1109\/IranianCEE.2016.7585840"},{"key":"ref154","doi-asserted-by":"publisher","DOI":"10.1109\/CICYBS.2011.5949394"},{"key":"ref155","doi-asserted-by":"publisher","DOI":"10.7717\/peerj-cs.900"},{"key":"ref156","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-11197-1_47"},{"key":"ref157","doi-asserted-by":"publisher","DOI":"10.1016\/j.engappai.2023.106344"},{"key":"ref158","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2025.3542142"},{"key":"ref159","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-89363-6_9"},{"key":"ref160","doi-asserted-by":"publisher","DOI":"10.1145\/3488932.3517412"},{"key":"ref161","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2012.6163595"}],"container-title":["IEEE Transactions on Network Science and Engineering"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/6488902\/11264281\/11623726.pdf?arnumber=11623726","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,8,17]],"date-time":"2026-08-17T19:05:23Z","timestamp":1786993523000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11623726\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":161,"URL":"https:\/\/doi.org\/10.1109\/tnse.2026.3716998","relation":{},"ISSN":["2327-4697","2334-329X"],"issn-type":[{"value":"2327-4697","type":"electronic"},{"value":"2334-329X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}