# GRIDAI: Generating and Repairing Intrusion Detection Rules via Collaboration among Multiple LLM-based Agents

**Authors:** Jiarui Li, Yuhan Chai, Lei Du, Chenyun Duan, Hao Yan, Zhaoquan Gu  
**arXiv:** [2510.13257](https://arxiv.org/abs/2510.13257)  
**Date:** 2025-10-15  
**Summary page:** https://www.summarizepaper.com/en/paper/2510.13257v1/

## Key points

- Rule-based network intrusion detection systems are crucial for real-time identification of web attacks.
- Existing systems often suffer from bloated and redundant rulesets due to a lack of consideration for connections between new attack patterns and pre-existing rules.
- GRIDAI is an innovative solution that automates the generation and repair of intrusion detection rules by fostering collaboration among multiple LLM-based agents.
- GRIDAI analyzes incoming attack samples to create new rules for novel attack types and enhance existing rules for attack variants, improving generalization capability while reducing redundancy.
- The framework addresses syntactic and semantic errors in rules caused by LLM hallucinations, ensuring automated rule generation and repair processes with real-time validation tools.

## Summary

, , , , 

In the realm of network security, rule-based network intrusion detection systems are essential for real-time identification of web attacks. However, a common issue with existing systems is the lack of consideration for connections between new attack patterns and pre-existing rules, resulting in a bloated and redundant ruleset. To tackle this challenge, a groundbreaking solution called GRIDAI has been introduced. This innovative end-to-end framework focuses on automated generation and repair of intrusion detection rules by fostering collaboration among multiple LLM-based agents. Unlike conventional approaches, GRIDAI begins by analyzing incoming attack samples to determine their nature. If a sample represents a novel type of attack, it is utilized to create a new rule. On the other hand, if the sample corresponds to a variant of an attack already covered by an existing rule, it is leveraged to enhance that rule by updating its signature. This process significantly boosts the generalization capability of the ruleset while minimizing redundancy. Moreover, GRIDAI incorporates mechanisms to address syntactic and semantic errors in rules caused by LLM hallucinations. By integrating real-time validation tools and maintaining representative attack samples for each rule, GRIDAI ensures fully automated rule generation and repair processes. Extensive experiments were conducted using both public and private datasets containing various types of attacks. The results unequivocally demonstrate that GRIDAI excels at identifying relationships between new attack samples and existing rules, efficiently generating and repairing rules to adapt to emerging threats and their variants, as well as effectively mitigating the adverse effects of LLM hallucinations. Authored by Jiarui Li, Yuhan Chai, Lei Du, Chenyun Duan, Hao Yan, and Zhaoquan Gu; this cutting-edge research titled "GRIDAI: Generating and Repairing Intrusion Detection Rules via Collaboration among Multiple LLM-based Agents" marks a significant advancement in enhancing network security through intelligent automation and collaborative learning mechanisms.