A Framework for Intelligent Generation of Intrusion Detection Rules Based on Grad-CAM

Intrusion detection systems (IDS) play a critical role in protecting networks from cyber threats. Currently, intrusion detection methods based on artificial intelligen (AI) stand as the mainstream, yet they grapple with the challenges of interpretability and high computational costs. Conversely, rule-based approaches offer ease of comprehension and lower computational overhead, but their development demands extensive expertise. This paper proposes an intelligent framework for generating intrusion detection rules, which integrates the strong representational capabilities of AI detectors while retaining the advantages of rule-based detection. Initially, the framework involves training a TextCNN model for traffic payload classification. The parameters of this model, along with the Gradient-weighted Class Activation Mapping (Grad-CAM) algorithm, are employed to analyze critical fields in captured traffic payloads. Subsequently, a comprehensive list of keywords is obtained through a sensitive words aggregation algorithm, and regular expressions are generated to describe the detection content. These regular expressions undergo fine-tuning to reduce their false positive rate. Furthermore, adhering to the syntax of Suricata rules, they are formulated into intrusion detection rules. The proposed method is evaluated on two publicly available datasets, with experimental results demonstrating commendable detection efficacy for the generated intrusion detection rules.