Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? | Paper Citation Record

Observation f1fb7d43-a6a4-4fda-8ebb-d886a87d663b · outbound

This paper cites Kortum Aaron Bangor and James T.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Kortum Aaron Bangor and James T

Reference 1

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.826404Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation c7c38068-d020-4c60-b3d7-718fdc818168 · outbound

This paper cites Li-nids: Llm-based intelligent nids rules generation for cybersecurity applications.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Li-nids: Llm-based intelligent nids rules generation for cybersecurity applications

Reference 2

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.814720Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 12e232f9-6a27-45aa-99ba-e8d9b90b20ba · outbound

This paper cites Phi-4 technical report, 2024.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Phi-4 technical report, 2024

Reference 3

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.808617Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation e61993e2-389b-4332-907f-958fa878615e · outbound

This paper cites GPT-4 Technical Report.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? GPT-4 Technical Report

Reference 4

Resolution: verified exact; local_arxiv, observed 2026-07-08T21:05:35.501607Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation e28b12ea-12ca-461d-8536-31f5e02bff46 · outbound

This paper cites Approximating memorization using loss surface geometry for dataset pruning and summarization.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Approximating memorization using loss surface geometry for dataset pruning and summarization

Reference 5

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.790969Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation e1ec220f-8e93-410c-93ba-120d398a0fbf · outbound

This paper cites 99% false positives: A qualitative study of {SOC} analysts’ perspectives on security alarms.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? 99% false positives: A qualitative study of {SOC} analysts’ perspectives on security alarms

Reference 6

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.780815Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation b73908f8-9091-4b6a-b41b-db98ad2243f5 · outbound

This paper cites Large language models hallucination: A comprehensive survey.Computer Science Review, 61:100970, 2026.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Large language models hallucination: A comprehensive survey.Computer Science Review, 61:100970, 2026

Reference 7

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.783109Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 5a262226-ea5b-4f4b-8685-e3c7af772120 · outbound

This paper cites Next-generation intrusion detection systems with llms: real-time anomaly detection, explainable ai, and adaptive data generation.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Next-generation intrusion detection systems with llms: real-time anomaly detection, explainable ai, and adaptive data generation

Reference 8

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.770253Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation d7701cac-2020-4071-b40e-51b185543d8c · outbound

This paper cites The falcon series of open language models, 2023.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? The falcon series of open language models, 2023

Reference 9

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.768375Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 6f380e24-4bcc-4414-ad2a-e0fe5d7fd326 · outbound

This paper cites Towards transparent intrusion detection: A coherence-based framework in explainable ai integrating large language models.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Towards transparent intrusion detection: A coherence-based framework in explainable ai integrating large language models

Reference 10

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.695179Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation ff1a2fbe-1958-4990-9a43-6b63492ebb57 · outbound

This paper cites The claude 3 model family: Opus, sonnet, haiku.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? The claude 3 model family: Opus, sonnet, haiku

Reference 11

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.697607Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation d2af120a-7e56-414e-b9b7-46a0f3048714 · outbound

This paper cites Qwen technical report, 2023.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Qwen technical report, 2023

Reference 12

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.708493Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 7a1738f9-d587-4dad-9de0-e70fb2804da1 · outbound

This paper cites Hex2sign: Automatic ids signature generation from hexadecimal data using llms.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Hex2sign: Automatic ids signature generation from hexadecimal data using llms

Reference 13

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.755837Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation aca06481-596d-455e-9081-f59bd5b6e8b0 · outbound

This paper cites Determining what individual sus scores mean: Adding an adjective rating scale.Journal of usability studies, 4(3):114–123, 2009.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Determining what individual sus scores mean: Adding an adjective rating scale.Journal of usability studies, 4(3):114–123, 2009

Reference 14

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.753268Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 7aaae29d-e947-45e4-86f8-c7e0cf5b48bb · outbound

This paper cites O’mine: A novel collaborative ddos detection mechanism for programmable data-planes.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? O’mine: A novel collaborative ddos detection mechanism for programmable data-planes

Reference 15

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.749855Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation c453787d-9438-4001-b4a0-07bf911e010d · outbound

This paper cites Efficiency in the processes of intrusion detection system through usability evaluation methods.Available at SSRN 3151216, 2018.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Efficiency in the processes of intrusion detection system through usability evaluation methods.Available at SSRN 3151216, 2018

Reference 16

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.792126Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 7ae173b0-137d-4618-b9a9-27d6c1b7707d · outbound

This paper cites Kairos: Practical intrusion detection and investigation using whole-system provenance.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Kairos: Practical intrusion detection and investigation using whole-system provenance

Reference 17

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.746400Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 96b1f131-2828-43c8-8d34-5b093e23d54d · outbound

This paper cites Deepseek llm: Scaling open-source language models with longtermism, 2024.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Deepseek llm: Scaling open-source language models with longtermism, 2024

Reference 18

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.693293Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 48a454c6-4429-4846-923e-a4552ca0406c · outbound

This paper cites Deepseek-v3 technical report, 2025.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Deepseek-v3 technical report, 2025

Reference 19

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.716677Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 8db360ae-3c38-4f0d-bc0d-f4b3d141a829 · outbound

This paper cites Harnessing large language models for automated intrusion detection rule generation in cyber range.IEEE Network, 2025.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Harnessing large language models for automated intrusion detection rule generation in cyber range.IEEE Network, 2025

Reference 20

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.805103Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation a718e92b-7c6b-4522-8528-9d7b1851bd69 · outbound

This paper cites Ollama: Get up and running with large language models, 2023.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Ollama: Get up and running with large language models, 2023

Reference 21

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.706181Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation b5c9e6c4-114f-4921-add4-840b62352564 · outbound

This paper cites Point cloud analysis for ml-based malicious traffic detection: Reducing majorities of false positive alarms.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Point cloud analysis for ml-based malicious traffic detection: Reducing majorities of false positive alarms

Reference 22

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.712930Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 159cb6ca-4ecb-4f88-b75b-588e4cfbbb80 · outbound

This paper cites Sometimes, you aren’t what you do: Mimicry attacks against provenance graph host intrusion detection systems.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Sometimes, you aren’t what you do: Mimicry attacks against provenance graph host intrusion detection systems

Reference 23

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.788072Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation e14d4dac-593a-4f5d-974f-b3d27023da72 · outbound

This paper cites R-caid: Embedding root cause analysis within provenance-based intrusion detection.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? R-caid: Embedding root cause analysis within provenance-based intrusion detection

Reference 24

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.802946Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 5428c8ec-010e-4eb4-beb9-193c2e508d01 · outbound

This paper cites The Llama 3 Herd of Models.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? The Llama 3 Herd of Models

Reference 25

Resolution: verified exact; local_arxiv, observed 2026-07-08T21:05:35.518423Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 023e3dd2-1e2c-4af9-9c52-9a3bd755c83b · outbound

This paper cites A survey on llm-as-a-judge.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? A survey on llm-as-a-judge

Reference 26

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.810395Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 1e2d68e0-04ad-47ad-9558-08787126b11f · outbound

This paper cites Flowsentry: Accelerat- ing netflow-based ddos detection.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Flowsentry: Accelerat- ing netflow-based ddos detection

Reference 27

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.778849Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation c6eb4cdf-9e8a-4cb6-9639-f1082a39ddf5 · outbound

This paper cites A llm-based agent for the automatic generation and generalization of ids rules.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? A llm-based agent for the automatic generation and generalization of ids rules

Reference 28

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.728728Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation ae53712d-2e10-4dcc-8e08-b7e19f8ccfce · outbound

This paper cites A comparative analysis of difficulty between log and graph-based detection rule creation.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? A comparative analysis of difficulty between log and graph-based detection rule creation

Reference 29

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.809431Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation bda97fc6-5cb9-4887-b29e-729bf04eb83b · outbound

This paper cites Jiang, Alexandre Sablayrolles, Arthur Mensch, et al.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Jiang, Alexandre Sablayrolles, Arthur Mensch, et al

Reference 30

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.836497Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation d21aa75e-497d-4d4c-a622-d2b78b57c8d3 · outbound

This paper cites Survey of intrusion detection systems: techniques, datasets and challenges.Cybersecurity, 2(1):20, 2019.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Survey of intrusion detection systems: techniques, datasets and challenges.Cybersecurity, 2(1):20, 2019

Reference 31

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.834584Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation ce6b8b57-87d5-49d9-bb50-d17e71abe375 · outbound

This paper cites Learning, forgetting, remembering: Insights from tracking llm memorization during training.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Learning, forgetting, remembering: Insights from tracking llm memorization during training

Reference 32

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.828204Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation d2d97efe-a2b2-417f-a9cf-5d9d2d8c1f36 · outbound

This paper cites From generation to judgment: Opportunities and challenges of llm-as-a-judge.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? From generation to judgment: Opportunities and challenges of llm-as-a-judge

Reference 33

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.824464Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 22eca70a-adf8-4ac1-9800-ffd92960bdb7 · outbound

This paper cites Gridai: Generating and repairing intrusion detection rules via collaboration among multiple llm-based agents.arXiv preprint arXiv:2510.13257, 2025.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Gridai: Generating and repairing intrusion detection rules via collaboration among multiple llm-based agents.arXiv preprint arXiv:2510.13257, 2025

Reference 34

Resolution: verified exact; arxiv_id, observed 2026-07-08T21:05:35.514022Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 04ecb25b-6af9-452e-895b-89db2e1b7992 · outbound

This paper cites Rulemaster+: Llm-based automated rule generation framework for intrusion detection systems.Chinese Journal of Electronics, 34(5):1402–1415, 2025.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Rulemaster+: Llm-based automated rule generation framework for intrusion detection systems.Chinese Journal of Electronics, 34(5):1402–1415, 2025

Reference 35

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.820538Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 19a3ee3c-21c4-450a-ae8b-59c5d5b2d77a · outbound

This paper cites Rulellm: Llm-driven rule generation for anomaly network traffic identification.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Rulellm: Llm-driven rule generation for anomaly network traffic identification

Reference 36

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.816813Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 0d43d318-ae80-4c78-9b19-e667ec2b76e1 · outbound

This paper cites Granite code models: A family of open foundation models for code intelligence, 2024.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Granite code models: A family of open foundation models for code intelligence, 2024

Reference 37

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.812504Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 3b5baad9-f734-47e6-88f6-cc4ffc461300 · outbound

This paper cites FALCON: Transforming Cyber Threat Intelligence into Deployable IDS Rules with Self-Reflection.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? FALCON: Transforming Cyber Threat Intelligence into Deployable IDS Rules with Self-Reflection

Reference 38

Resolution: verified exact; local_arxiv, observed 2026-07-08T21:05:35.515686Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation c3e1eeec-f032-496d-b70f-588ae6cf2b1e · outbound

This paper cites Leveraging llms for automated ids rule generation: A novel methodology for securing industrial environments.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Leveraging llms for automated ids rule generation: A novel methodology for securing industrial environments

Reference 39

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.804865Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 393c93e9-dcd4-4b57-8524-5aa01d81078d · outbound

This paper cites Behind the scenes of attack graphs: Vulnerable network generator for in-depth experimental evaluation of attack graph scalability.Computers & Security, 157:104576, October 2025.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Behind the scenes of attack graphs: Vulnerable network generator for in-depth experimental evaluation of attack graph scalability.Computers & Security, 157:104576, October 2025

Reference 40

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.800283Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation a9426a25-c53b-4b65-ba0d-2aab90cfd84f · outbound

This paper cites Rulexploit: A framework for generating suricata rules from exploits using generative ai.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Rulexploit: A framework for generating suricata rules from exploits using generative ai

Reference 41

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.797828Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation c240a672-4143-4a11-8601-35e7f387c77a · outbound

This paper cites Toward generating a new intrusion detection dataset and intrusion traffic characterization.ICISSp, 1(2018):108–116, 2018.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Toward generating a new intrusion detection dataset and intrusion traffic characterization.ICISSp, 1(2018):108–116, 2018

Reference 42

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.733051Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 5851faf8-21ef-412e-86a4-4211d7831572 · outbound

This paper cites LLMs in the SOC: An Empirical Study of Human-AI Collaboration in Security Operations Centres, September 2025.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? LLMs in the SOC: An Empirical Study of Human-AI Collaboration in Security Operations Centres, September 2025

Reference 43

Resolution: verified exact; arxiv_id, observed 2026-07-08T21:05:35.504897Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 8855838a-0fb1-4802-a81b-a22a3240b85f · outbound

This paper cites Gemini: A family of highly capable multimodal models.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Gemini: A family of highly capable multimodal models

Reference 44

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.782752Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation d8bd42be-15f7-419d-bae9-1689e666fdc6 · outbound

This paper cites Ruling the unruly: Designing effective, low-noise network intrusion detection rules for security operations centers.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Ruling the unruly: Designing effective, low-noise network intrusion detection rules for security operations centers

Reference 45

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.758811Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 2061674d-f850-43bd-b034-45d52fd35212 · outbound

This paper cites Memorization without overfitting: Analyzing the training dynamics of large language models.Advances in Neural Information Processing Systems, 35:38274–38290.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Memorization without overfitting: Analyzing the training dynamics of large language models.Advances in Neural Information Processing Systems, 35:38274–38290

Reference 46

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.774702Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation f020e44b-9d25-4de7-a415-05cdf5b06609 · outbound

This paper cites Llama 2: Open Foundation and Fine-Tuned Chat Models.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Llama 2: Open Foundation and Fine-Tuned Chat Models

Reference 47

Resolution: verified exact; local_arxiv, observed 2026-07-08T21:05:35.516647Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 94acd9a3-3184-4483-a903-a7765322f981 · outbound

This paper cites Flash: A comprehensive approach to intrusion detection via provenance graph representation learning.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Flash: A comprehensive approach to intrusion detection via provenance graph representation learning

Reference 48

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.772099Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 5d2c9f60-3413-4519-a93f-f68b4eee4345 · outbound

This paper cites Alert alchemy: Soc workflows and decisions in the management of nids rules.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Alert alchemy: Soc workflows and decisions in the management of nids rules

Reference 49

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.806934Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 539183b7-cfba-4346-968b-892074b43bb3 · outbound

This paper cites Ruling the rules: Quantifying the evolution of rulesets, alerts and incidents in network intrusion detection.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Ruling the rules: Quantifying the evolution of rulesets, alerts and incidents in network intrusion detection

Reference 50

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.784925Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 603bd6b7-d973-400a-9ce5-69ec86e7fa6d · outbound

This paper cites Rulepilot: An llm-powered agent for security rule generation.arXiv preprint arXiv:2511.12224, 2025.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Rulepilot: An llm-powered agent for security rule generation.arXiv preprint arXiv:2511.12224, 2025

Reference 51

Resolution: verified exact; arxiv_id, observed 2026-07-08T21:05:35.521724Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 4a250cde-18ae-4be0-a2f1-07a8fb843a7a · outbound

This paper cites Incorporating gradients to rules: Towards lightweight, adaptive provenance-based intrusion detection.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Incorporating gradients to rules: Towards lightweight, adaptive provenance-based intrusion detection

Reference 52

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.766429Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 1e3775eb-4ebd-4aca-a95c-66fd0f3bfb69 · outbound

This paper cites Chain-of-thought prompting elicits reasoning in large language models.Advances in neural information processing systems, 35:24824–24837.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Chain-of-thought prompting elicits reasoning in large language models.Advances in neural information processing systems, 35:24824–24837

Reference 53

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.764063Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation dec81438-8340-4d2e-8d3e-3a522ff206f3 · outbound

This paper cites Cognitive Mirage: A Review of Hallucinations in Large Language Models.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Cognitive Mirage: A Review of Hallucinations in Large Language Models

Reference 54

Resolution: verified exact; local_arxiv, observed 2026-07-08T21:05:35.524817Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 17d38faa-0ee7-41b7-939d-5aa33b7d5aa9 · outbound

This paper cites C y b e r s e c u r i t y.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? C y b e r s e c u r i t y

Reference 55

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.724208Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation d2d7d3b3-43ec-42e1-9d62-559ae3c963b4 · outbound

This paper cites report, malicious payload, ET rules GLM4 Custom Custom × ×.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? report, malicious payload, ET rules GLM4 Custom Custom × ×

Reference 56

Resolution: verified fuzzy; raw_fallback, observed 2026-07-08T21:05:35.719646Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation c2c76808-4481-4f58-9ef4-12ff5bcf968a · outbound

This paper cites an unresolved cited work.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Unresolved cited work

Reference 57

Resolution: unresolved; raw_fallback, observed 2026-07-08T21:05:35.759493Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 8eaf8d01-dcb8-4dbc-82fd-02490e35c55e · outbound

This paper cites an unresolved cited work.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Unresolved cited work

Reference 58

Resolution: unresolved; raw_fallback, observed 2026-07-08T21:05:35.757875Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation b21f9e02-f3ad-4cd5-8f32-22115ee05c67 · outbound

This paper cites an unresolved cited work.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Unresolved cited work

Reference 59

Resolution: unresolved; raw_fallback, observed 2026-07-08T21:05:35.726530Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 1c63517d-f821-463a-a5cf-12183ce99374 · outbound

This paper cites an unresolved cited work.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Unresolved cited work

Reference 60

Resolution: unresolved; raw_fallback, observed 2026-07-08T21:05:35.752110Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 40fc4cb1-5487-49d8-8bbb-25401419c07a · outbound

This paper cites an unresolved cited work.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Unresolved cited work

Reference 61

Resolution: unresolved; raw_fallback, observed 2026-07-08T21:05:35.830605Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 8400c76b-4097-4a73-bebc-0a99810bca5e · outbound

This paper cites an unresolved cited work.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Unresolved cited work

Reference 62

Resolution: unresolved; raw_fallback, observed 2026-07-08T21:05:35.822365Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 964dd938-bbff-431b-a144-023fd1434c7a · outbound

This paper cites an unresolved cited work.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Unresolved cited work

Reference 63

Resolution: unresolved; raw_fallback, observed 2026-07-08T21:05:35.748606Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation b2928f22-2fd5-4f6a-a875-0accfcab9153 · outbound

This paper cites an unresolved cited work.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Unresolved cited work

Reference 64

Resolution: unresolved; raw_fallback, observed 2026-07-08T21:05:35.818480Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation ccc7795e-444f-4c11-9be1-ed9074a38edb · outbound

This paper cites an unresolved cited work.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? Unresolved cited work

Reference 65

Resolution: unresolved; raw_fallback, observed 2026-07-08T21:05:35.832503Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Observation 7dfc05cd-1a25-4bb0-a641-3c7fe4a92884 · outbound

This paper cites suggest-and-deploy.

Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering? suggest-and-deploy

Reference 66

Resolution: malformed identifier; raw_fallback, observed 2026-07-08T21:05:35.776816Z

Source-reported events for the cited work

No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.

Coverage vector

Reference resolution

Outbound references

Pith citing papers