{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T08:18:18Z","timestamp":1783153098291,"version":"3.54.6"},"publisher-location":"New York, NY, USA","reference-count":42,"publisher":"ACM","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2026,4,13]]},"DOI":"10.1145\/3774904.3792458","type":"proceedings-article","created":{"date-parts":[[2026,4,27]],"date-time":"2026-04-27T12:38:33Z","timestamp":1777293513000},"page":"3123-3134","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["ARuleCon: Agentic Security Rule Conversion"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-1061-819X","authenticated-orcid":false,"given":"Ming","family":"Xu","sequence":"first","affiliation":[{"name":"National University of Singapore, Singapore, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-3209-6676","authenticated-orcid":false,"given":"Hongtai","family":"Wang","sequence":"additional","affiliation":[{"name":"National University of Singapore, Singapore, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-5594-9549","authenticated-orcid":false,"given":"Yanpei","family":"Guo","sequence":"additional","affiliation":[{"name":"National University of Singapore, Singapore, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0294-414X","authenticated-orcid":false,"given":"Zhengmin","family":"Yu","sequence":"additional","affiliation":[{"name":"Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8663-436X","authenticated-orcid":false,"given":"Weili","family":"Han","sequence":"additional","affiliation":[{"name":"Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7830-3007","authenticated-orcid":false,"given":"Hoon Wei","family":"Lim","sequence":"additional","affiliation":[{"name":"Cyber Special Ops-R&D, NCS Group, Singapore, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6512-8326","authenticated-orcid":false,"given":"Jin Song","family":"Dong","sequence":"additional","affiliation":[{"name":"National University of Singapore, Singapore, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7950-7845","authenticated-orcid":false,"given":"Jiaheng","family":"Zhang","sequence":"additional","affiliation":[{"name":"National University of Singapore, Singapore, CA, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,4,12]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"2022. meta-llama\/Llama-3.1--405B \u00b7 Hugging Face \u2014 huggingface.co. https:\/\/huggingface.co\/meta-llama\/Llama-3.1--405B."},{"key":"e_1_3_2_1_2_1","unstructured":"2022. text-embedding-ada-002. https:\/\/platform.openai.com\/docs\/guides\/embeddings\/what-are-embeddings."},{"key":"e_1_3_2_1_3_1","unstructured":"2024. deepseek-ai\/DeepSeek-V3 \u00b7 Hugging Face \u2014 huggingface.co. https:\/\/huggingface.co\/deepseek-ai\/DeepSeek-V3."},{"key":"e_1_3_2_1_4_1","unstructured":"Andi Albrecht and contributors. [n.d.]. sqlparse: non-validating SQL parser for Python. https:\/\/pypi.org\/project\/sqlparse\/."},{"key":"e_1_3_2_1_5_1","unstructured":"Ariel Query Language Guide [n.d.]. https:\/\/www.ibm.com\/docs\/en\/SS42VS_7.4\/pdf\/b_qradar_aql.pdf. Ariel Query Language Guide."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2014.103"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.2308.05034"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.18653\/V1\/2020.FINDINGS-EMNLP.139"},{"key":"e_1_3_2_1_9_1","unstructured":"Google Cloud [n.d.]. https:\/\/cloud.google.com\/chronicle\/docs\/detection\/yara-l-2-0-syntax. YARA-L 2.0 language syntax."},{"key":"e_1_3_2_1_10_1","unstructured":"Google Security Operations (SecOps) [n.d.]. https:\/\/cloud.google.com\/security\/products\/security-operations?hl=en. Google SecOps' cloud-native security operations platform empowers security teams to better detect investigate and respond to cybersecurity threats.."},{"key":"e_1_3_2_1_11_1","unstructured":"Google YARA-L Rules [n.d.]. https:\/\/github.com\/chronicle\/detection-rules\/tree\/main\/rules\/community. Google YARA-L Rule Dataset."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00096"},{"key":"e_1_3_2_1_13_1","unstructured":"IBM. 2024. SPL To KQL Application."},{"key":"e_1_3_2_1_14_1","unstructured":"IBM AQL Rules [n.d.]. https:\/\/github.com\/Xboarder56\/QRCE-Rules. IBM QRadar AQL Rule Dataset."},{"key":"e_1_3_2_1_15_1","unstructured":"Cohen's Kappa. [n.d.]. A measure of agreement between two dependent categorical samples. https:\/\/datatab.net\/tutorial\/cohens-kappa."},{"key":"e_1_3_2_1_16_1","unstructured":"Haitao Li Qian Dong Junjie Chen Huixue Su Yujia Zhou Qingyao Ai Ziyi Ye and Yiqun Liu. 2024. LLMs-as-Judges: A Comprehensive Survey on LLM-based Evaluation Methods. arXiv:2412.05579 [cs.CL] https:\/\/arxiv.org\/abs\/2412.05579"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.241407"},{"key":"e_1_3_2_1_18_1","unstructured":"Jiawei Liu Nirav Diwan Zhe Wang Haoyu Zhai Xiaona Zhou Kiet A. Nguyen Tianjiao Yu Muntasir Wahed Yinlin Deng Hadjer Benkraouda Yuxiang Wei Lingming Zhang Ismini Lourentzou and Gang Wang. 2025. PurpCode: Reasoning for Safer Code Generation. arXiv:2507.19060 [cs.CR] https:\/\/arxiv.org\/abs\/2507.19060"},{"key":"e_1_3_2_1_19_1","volume-title":"Agentic Concolic Execution. In 2026 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 1--19","author":"Luo Zhengxiong","year":"2026","unstructured":"Zhengxiong Luo, Huan Zhao, Dylan Wolff, Cristian Cadar, and Abhik Roychoudhury. 2026. Agentic Concolic Execution. In 2026 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 1--19."},{"key":"e_1_3_2_1_20_1","unstructured":"Microsoft. 2025. Microsoft Sentinel - Cloud-native SIEM Solution | Microsoft Azure \u2014 azure.microsoft.com. https:\/\/azure.microsoft.com\/en-us\/products\/microsoft-sentinel."},{"key":"e_1_3_2_1_21_1","unstructured":"Microsoft Ignite [n.d.]. https:\/\/learn.microsoft.com\/en-us\/kusto\/query\/?view=microsoft-fabric. Kusto Query Language overview."},{"key":"e_1_3_2_1_22_1","unstructured":"Microsoft KQL Rules [n.d.]. https:\/\/github.com\/Azure\/Azure-Sentinel\/tree\/master\/Detections. Microsoft Sentinel KQL Rule Dataset."},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/3663742.3663973"},{"key":"e_1_3_2_1_24_1","volume-title":"Intention-driven generation of project-specific test cases. arXiv preprint arXiv:2507.20619","author":"Qi Binhang","year":"2025","unstructured":"Binhang Qi, Yun Lin, Xinyi Weng, Yuhuan Huang, Chenyan Liu, Hailong Sun, Zhi Jin, and Jin Song Dong. 2025. Intention-driven generation of project-specific test cases. arXiv preprint arXiv:2507.20619 (2025)."},{"key":"e_1_3_2_1_25_1","volume-title":"CodeBLEU: a Method for Automatic Evaluation of Code Synthesis. CoRR abs\/2009.10297","author":"Ren Shuo","year":"2020","unstructured":"Shuo Ren, Daya Guo, Shuai Lu, Long Zhou, Shujie Liu, Duyu Tang, Neel Sundaresan, Ming Zhou, Ambrosio Blanco, and Shuai Ma. 2020. CodeBLEU: a Method for Automatic Evaluation of Code Synthesis. CoRR abs\/2009.10297 (2020). arXiv:2009.10297 https:\/\/arxiv.org\/abs\/2009.10297"},{"key":"e_1_3_2_1_26_1","unstructured":"RSA ESA Rules [n.d.]. https:\/\/github.com\/netwitness\/nw-esa. RSA NetWitness ESA Rule Dataset."},{"key":"e_1_3_2_1_27_1","unstructured":"Rule SyntaxRule Syntax [n.d.]. https:\/\/community.netwitness.com\/s\/article\/RuleSyntax. NetWitness Community."},{"key":"e_1_3_2_1_28_1","unstructured":"Stuart J Russell and Peter Norvig. 2016. Artificial intelligence: a modern approach. Pearson."},{"key":"e_1_3_2_1_29_1","unstructured":"SIEM Migration [n.d.]. https:\/\/cardinalops.com\/blog\/siem-migration-challenges-strategies\/. SIEM Migration: Challenges and Strategies.."},{"key":"e_1_3_2_1_30_1","unstructured":"Kirill Simonov and contributors. [n.d.]. PyYAML: YAML parser and emitter for Python. https:\/\/pypi.org\/project\/PyYAML\/."},{"key":"e_1_3_2_1_31_1","unstructured":"Splunk [n.d.]. https:\/\/help.splunk.com\/en\/splunk-enterprise\/search\/spl-search-reference\/9.4\/introduction\/welcome-to-the-search-reference. Splunk Enterprise."},{"key":"e_1_3_2_1_32_1","unstructured":"Splunk cisco company [n.d.]. https:\/\/shorturl.at\/dgTsP. State of Security 2024: The Race to Harness AI."},{"key":"e_1_3_2_1_33_1","unstructured":"Splunk SPL Rules [n.d.]. https:\/\/github.com\/splunk\/security_content\/tree\/develop\/detections. Splunk SPL Rule Dataset."},{"key":"e_1_3_2_1_34_1","volume-title":"https:\/\/www.cloudwards.net\/cyber-security-statistics\/?utm_source=chatgpt.com. 67 Cyber Security Statistics, Facts and Trends: Data on Attacks, Breaches and Threats for","author":"Threat Report","year":"2025","unstructured":"Threat Report [n.d.]. https:\/\/www.cloudwards.net\/cyber-security-statistics\/?utm_source=chatgpt.com. 67 Cyber Security Statistics, Facts and Trends: Data on Attacks, Breaches and Threats for 2025."},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.2311.10197"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00139"},{"key":"e_1_3_2_1_37_1","unstructured":"VirusTotal. [n.d.]. yara-python: The Python interface for YARA. https:\/\/pypi.org\/project\/yara-python\/."},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.2511.12224"},{"key":"e_1_3_2_1_39_1","volume-title":"Wang","author":"Wei Yuxiang","year":"2025","unstructured":"Yuxiang Wei, Olivier Duchenne, Jade Copet, Quentin Carbonneaux, Lingming Zhang, Daniel Fried, Gabriel Synnaeve, Rishabh Singh, and Sida I. Wang. 2025. SWE-RL: Advancing LLM Reasoning via Reinforcement Learning on Open Software Evolution. arXiv:2502.18449 [cs.SE] https:\/\/arxiv.org\/abs\/2502.18449"},{"key":"e_1_3_2_1_40_1","unstructured":"Why SIEM Migration [n.d.]. DemystifyingSIEMmigration: Pitfallstoavoidandtipsforensuringsuccess. Demystifying SIEM migration: Pitfalls to avoid and tips for ensuring success.."},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2021.3123511"},{"key":"e_1_3_2_1_42_1","volume-title":"PARROT: A Benchmark for Evaluating LLMs in Cross-System SQL Translation. arXiv:2509.23338 [cs.DB] https:\/\/arxiv.org\/abs\/2509.23338","author":"Zhou Wei","year":"2025","unstructured":"Wei Zhou, Guoliang Li, Haoyu Wang, Yuxing Han, Xufei Wu, Fan Wu, and Xuanhe Zhou. 2025. PARROT: A Benchmark for Evaluating LLMs in Cross-System SQL Translation. arXiv:2509.23338 [cs.DB] https:\/\/arxiv.org\/abs\/2509.23338"}],"event":{"name":"WWW '26: The ACM Web Conference 2026","location":"Dubai United Arab Emirates","sponsor":["SIGWEB ACM Special Interest Group on Hypertext, Hypermedia, and Web"]},"container-title":["Proceedings of the ACM Web Conference 2026"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3774904.3792458","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T07:47:01Z","timestamp":1783151221000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3774904.3792458"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4,12]]},"references-count":42,"alternative-id":["10.1145\/3774904.3792458","10.1145\/3774904"],"URL":"https:\/\/doi.org\/10.1145\/3774904.3792458","relation":{},"subject":[],"published":{"date-parts":[[2026,4,12]]},"assertion":[{"value":"2026-04-12","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}