Large Language Models (LLMs) offer promising capabilities for enhancing cybersecurity, particularly in generating rules for firewalls and intrusion detection systems (IDS). This study investigates the effectiveness of fine-tuning several LLMs, namely Mistral-7B, LLaMA2-7B, and Qwen2-7B, in generating correct rules for nftables firewall and Snort IDS. Initial experiments assessed multiple Parameter-Efficient Fine-Tuning (PEFT) techniques, including prefix tuning and prompt tuning, on a single model. Based on these results, Low-Rank Adaptation (LoRA) was selected as the most effective approach and subsequently applied to all models for comprehensive evaluation. The performance of these models was compared to assess their rule generation capabilities. Comparative analysis revealed that Qwen2-7B outperforms the other models, achieving a success rate of 85% for Snort and over 95% for nftables rule generation. Notably, Qwen2-7B also surpassed the larger Qwen3-14B model, suggesting that optimal performance may depend more on task-specific suitability than on model size. These findings highlight the importance of selecting appropriately sized models aligned with the task requirements rather than relying solely on scale.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Parameter-Efficient Fine-Tuning of LLMs for Intrusion Detection and Firewall Rule Generation: A Comparative Study

  • Chi Zhang,
  • Muhammad Shadi Hajar,
  • Harsha Kalutarage,
  • Lankeshwara Munasinghe

摘要

Large Language Models (LLMs) offer promising capabilities for enhancing cybersecurity, particularly in generating rules for firewalls and intrusion detection systems (IDS). This study investigates the effectiveness of fine-tuning several LLMs, namely Mistral-7B, LLaMA2-7B, and Qwen2-7B, in generating correct rules for nftables firewall and Snort IDS. Initial experiments assessed multiple Parameter-Efficient Fine-Tuning (PEFT) techniques, including prefix tuning and prompt tuning, on a single model. Based on these results, Low-Rank Adaptation (LoRA) was selected as the most effective approach and subsequently applied to all models for comprehensive evaluation. The performance of these models was compared to assess their rule generation capabilities. Comparative analysis revealed that Qwen2-7B outperforms the other models, achieving a success rate of 85% for Snort and over 95% for nftables rule generation. Notably, Qwen2-7B also surpassed the larger Qwen3-14B model, suggesting that optimal performance may depend more on task-specific suitability than on model size. These findings highlight the importance of selecting appropriately sized models aligned with the task requirements rather than relying solely on scale.