Parameter-Efficient Fine-Tuning of LLMs for Intrusion Detection and Firewall Rule Generation: A Comparative Study
摘要
Large Language Models (LLMs) offer promising capabilities for enhancing cybersecurity, particularly in generating rules for firewalls and intrusion detection systems (IDS). This study investigates the effectiveness of fine-tuning several LLMs, namely Mistral-7B, LLaMA2-7B, and Qwen2-7B, in generating correct rules for nftables firewall and Snort IDS. Initial experiments assessed multiple Parameter-Efficient Fine-Tuning (PEFT) techniques, including prefix tuning and prompt tuning, on a single model. Based on these results, Low-Rank Adaptation (LoRA) was selected as the most effective approach and subsequently applied to all models for comprehensive evaluation. The performance of these models was compared to assess their rule generation capabilities. Comparative analysis revealed that Qwen2-7B outperforms the other models, achieving a success rate of 85% for Snort and over 95% for nftables rule generation. Notably, Qwen2-7B also surpassed the larger Qwen3-14B model, suggesting that optimal performance may depend more on task-specific suitability than on model size. These findings highlight the importance of selecting appropriately sized models aligned with the task requirements rather than relying solely on scale.