Saved in:
| Main Authors: | , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2026
|
| Subjects: | |
| Online Access: | https://arxiv.org/abs/2604.11078 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866911587888005120 |
|---|---|
| author | Meng, Cheng Le, Wenxin Li, Xinyi Wang, Qiuyun Ren, Fangli Jiang, Zhengwei Liu, Baoxu |
| author_facet | Meng, Cheng Le, Wenxin Li, Xinyi Wang, Qiuyun Ren, Fangli Jiang, Zhengwei Liu, Baoxu |
| contents | Existing methods for detection rule generation are tightly coupled to specific input-output combinations, requiring dedicated pipelines for each. We formalize this problem as a unified mapping f:C*L->R and characterize optimal rules through semantic distance. We propose UniRule, an agentic RAG framework built on dual semantic projection spaces: detection intent and detection logic. This design enables retrieval and generation across arbitrary contexts and target languages within a single system. Experiments across 12 scenarios (3 languages, 4 context types, 12,000 pairwise comparisons) show that UniRule significantly outperforms pure LLM generation with a Bradley-Terry coefficient of 0.52, validating semantic projection as an effective abstraction for unified rule generation. Together, the formalization, method, and evaluation provide an initial framework for studying detection rule generation as a unified task. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2604_11078 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | From Context to Rules: Toward Unified Detection Rule Generation Meng, Cheng Le, Wenxin Li, Xinyi Wang, Qiuyun Ren, Fangli Jiang, Zhengwei Liu, Baoxu Cryptography and Security Existing methods for detection rule generation are tightly coupled to specific input-output combinations, requiring dedicated pipelines for each. We formalize this problem as a unified mapping f:C*L->R and characterize optimal rules through semantic distance. We propose UniRule, an agentic RAG framework built on dual semantic projection spaces: detection intent and detection logic. This design enables retrieval and generation across arbitrary contexts and target languages within a single system. Experiments across 12 scenarios (3 languages, 4 context types, 12,000 pairwise comparisons) show that UniRule significantly outperforms pure LLM generation with a Bradley-Terry coefficient of 0.52, validating semantic projection as an effective abstraction for unified rule generation. Together, the formalization, method, and evaluation provide an initial framework for studying detection rule generation as a unified task. |
| title | From Context to Rules: Toward Unified Detection Rule Generation |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2604.11078 |