Metraipolis › archive › dc_071c58df2fb2

How It's Made: Uncovering Detection Engineering Processes for Network Intrusion Detection Rules — arXiv:2609.25901

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.25901
License (as archived): CC0-1.0
Archived: 2026-10-08T14:42:02.485Z
SHA-256 of the archived text: 02f5b196aed494eb336682838f37e5c7ab83b1989bcb6caebbde3e566259988e
Stable URL of this page: https://metraipolis.com/documento/dc_071c58df2fb2

How to cite

How It's Made: Uncovering Detection Engineering Processes for Network Intrusion Detection Rules — arXiv:2609.25901 — arXiv (en), https://arxiv.org/abs/2609.25901 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_071c58df2fb2 (Metraipolis archive dc_071c58df2fb2, sha256 02f5b196aed494eb336682838f37e5c7ab83b1989bcb6caebbde3e566259988e)

BibTeX

@misc{dc071c58df2fb2,
  title = {How It's Made: Uncovering Detection Engineering Processes for Network Intrusion Detection Rules — arXiv:2609.25901},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.25901},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_071c58df2fb2; sha256 02f5b196aed494eb336682838f37e5c7ab83b1989bcb6caebbde3e566259988e},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.25901. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Many Security Operations Centers rely on signature-based Network Intrusion Detection Systems like Suricata, yet detection rule engineering remains understudied. We investigate this process by introducing SuriCap, a platform for rule engineering exercises, and hosting CTF-style workshops where 60 participants, trained MSc students, and experienced SOC professionals, created rules for four scenarios. Participants produced 3146 valid rules, enabling analysis of their methods, performance, and iteration patterns. Surprisingly, prior experience had limited impact on rule quality, suggesting that less experienced engineers can produce rules comparable to experts. We also observed challenges in generalizing rules beyond available tests, underscoring the need for sufficient labeled data. From our study, we identify three phases and a common pattern in rule engineering, offering SOC managers insights to improve their processes and expectations of engineer expertise.

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-09-23 in cs.CR).
Categorie arXiv: Cryptography and Security (cs.CR) ; Human-Computer Interaction (cs.HC).
Pagina del lavoro: https://arxiv.org/abs/2609.25901 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-08T13:55:11.736Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-09-23?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).