跳转至

文章背景与核心概要

高级持续性威胁（APT）的快速演变使得手动编写威胁检测规则（特别是 Sigma 规则）变得缓慢、易出错且难以扩展。虽然现有的规则代码库提供了一定帮助，但它们往往难以跟上新型攻击向量的步伐。为了弥合非结构化网络威胁情报（CTI）与可落地检测工程之间的鸿沟，本文作者推出了 AUTOSIGMA 框架。

与传统的纯大语言模型（LLM）方法不同，AUTOSIGMA 创新性地结合了三种核心机制：1）知识驱动增强（Knowledge-Driven Enrichment），利用结构化知识库补全不完整的输入；2）模板化规则落地（Template-Based Rule Grounding），将增强后的内容映射到已有的 Sigma 规则库中；3）迭代验证（Iterative Validation），采用“大模型作为裁判（LLM-as-a-Judge）”的多阶段框架，确保规则的上下文感知能力、相关性与有效性。

对真实世界 APT 报告和安全博客的评估表明，AUTOSIGMA 在规则有效性、相关性、MITRE ATT&CK 技术覆盖率以及对输入质量的鲁棒性方面，均显著优于现有解决方案和基准 LLM 模型。这为自动化安全运维（SecOps）提供了一条极具前景的技术路径。

从威胁情报到检测：基于知识驱动增强与模板化规则落地的自动化 Sigma 规则生成 (From Threat Intelligence to Detection: Knowledge-driven Enrichment and Template-based Rule Grounding for Automated Sigma Rule Generation)

arXiv ID: arXiv:2608.19011 [cs.CR]
Submitted On: August 19, 2026
Authors: Sepehr Ghaffarzadegan, Boubakr Nour, Makan Pourzandi, Mourad Debbabi, Chadi Assi
Primary Subject: Cryptography and Security (cs.CR)
Secondary Subject: Artificial Intelligence (cs.AI)

执行摘要 (Executive Summary)

The rapid evolution of Advanced Persistent Threats (APTs) makes the manual creation of threat detection rules—specifically Sigma rules—slow, error-prone, and difficult to scale. While repositories of existing rules help, they struggle to keep pace with novel attack vectors.

To bridge the gap between unstructured Cyber Threat Intelligence (CTI) and actionable detection engineering, the authors introduce AUTOSIGMA. Unlike traditional LLM-only approaches, AUTOSIGMA combines: 1. Knowledge-Driven Enrichment: Enhancing partial inputs using a structured knowledge base. 2. Template-Based Rule Grounding: Mapping enriched content to established Sigma rule repositories. 3. Iterative Validation: Employing an LLM-as-a-Judge multi-stage framework to ensure context-awareness, relevance, and validity.

Evaluations against real-world APT reports and security blogs demonstrate that AUTOSIGMA outperforms existing solutions and baseline LLMs in rule validity, relevance, MITRE ATT&CK technique coverage, and input-quality robustness.

高级持续性威胁（APT）的飞速演变使得手动创建威胁检测规则（尤其是 Sigma 规则）变得缓慢、易出错且难以扩展。尽管现有的规则库有所帮助，但它们在跟上新颖攻击向量方面仍然力不从心。

为了弥合非结构化网络威胁情报（CTI）与可执行检测工程之间的鸿沟，作者推出了 AUTOSIGMA。与传统仅依赖大模型的方法不同，AUTOSIGMA 结合了以下三个核心部分： 1. 知识驱动增强： 使用结构化知识库增强部分输入。 2. 模板化规则落地： 将增强后的内容映射到成熟的 Sigma 规则库中。 3. 迭代验证： 采用 LLM-as-a-Judge（大模型作为裁判）的多阶段框架，以确保上下文感知能力、相关性和有效性。

针对真实世界 APT 报告和安全博客的评估表明，AUTOSIGMA 在规则有效性、相关性、MITRE ATT&CK 技术覆盖率以及对输入质量的鲁棒性方面，均优于现有解决方案和基准 LLM。

摘要 (Abstract)

Mechanisms for dynamically converting cyber threat intelligence (CTI) into actionable detection capabilities are necessary due to the rapid evolution of Advanced Persistent Threats (APTs). Sigma rules are an essential part of contemporary threat detection workflows because they offer a platform-independent framework for expressing detection logic that can be converted into particular queries across SIEM systems. Conventional techniques for manually crafting Sigma rules are prone to mistakes, and necessitate extensive knowledge, which restricts their scalability.

Although there are open-source and industry-maintained Sigma rule repositories, they often fail to keep pace with emerging threats and require frequent customization to fit diverse operational environments. This emphasizes the necessity of dynamic rule generation that is adapted to evolving attack techniques as well as particular use cases.

In this work, we design AUTOSIGMA, an automated solution for transforming unstructured CTI reports into relevant Sigma rules. Rather than relying solely on language models, AUTOSIGMA leverages a structured knowledge base to enrich partial inputs, matches the enriched content against a repository of existing Sigma rules, and then employs an LLM-as-a-Judge mechanism to iteratively validate the rules. By combining knowledge-driven enrichment, template-based rule grounding, and a multi-stage solution, AUTOSIGMA enables accurate, context-aware, and relevant rule generation.

Evaluations across multiple real-world APT reports and multiple security blogs demonstrate that AUTOSIGMA outperforms alternative solutions and LLM models in rule validity, rule relevancy, MITRE ATT&CK technique coverage, and robustness to input quality.

鉴于高级持续性威胁（APT）的快速演变，亟需建立能够将网络威胁情报（CTI）动态转换为可执行检测能力的机制。Sigma 规则是现代威胁检测工作流中不可或缺的一部分，因为它们提供了一个平台无关的框架来表达检测逻辑，该逻辑可以转换为各个 SIEM 系统中的特定查询。传统的手工编写 Sigma 规则的技术容易出错，且需要大量的专业知识，从而限制了其可扩展性。

尽管存在开源和行业维护的 Sigma 规则库，但它们往往无法跟上新兴威胁的步伐，并且需要进行频繁的定制以适应多样化的操作环境。这凸显了适应不断演变的攻击技术和特定用例的动态规则生成的必要性。

在这项工作中，我们设计了 AUTOSIGMA，这是一种将非结构化 CTI 报告转换为相关 Sigma 规则的自动化解决方案。AUTOSIGMA 没有完全依赖语言模型，而是利用结构化知识库来增强部分输入，将增强后的内容与现有 Sigma 规则库进行匹配，然后采用 LLM-as-a-Judge 机制对规则进行迭代验证。通过结合知识驱动增强、模板化规则落地和多阶段解决方案，AUTOSIGMA 能够生成准确、具备上下文感知且高度相关的规则。

对多个真实世界 APT 报告和多个安全博客的评估表明，AUTOSIGMA 在规则有效性、规则相关性、MITRE ATT&CK 技术覆盖率以及对输入质量的鲁棒性方面，均优于替代解决方案和 LLM 模型。

外部参考与工具 (External References & Tools)