From IOCs to Regex: Automating CTI Operationalization for SOC with LLMs
Pei-Yu Tseng (1), Lan Zhang (2), ZihDwo Yeh (1), Xiaoyan Sun (3), Xushu Dai (1), Peng Liu (1) ((1) The Pennsylvania State University, USA, (2) Northern Arizona University, USA, (3) Worcester Polytechnic Institute, USA)

TL;DR
This paper introduces IOCRegex-gen, an automated system using LLMs to convert CTI IOCs into accurate regexes, significantly improving efficiency and correctness in security operations.
Contribution
It presents a novel LLM-based approach with group-aware mechanisms and validation pipelines for automatic, precise regex generation from IOCs.
Findings
Achieved 99.1% hit rate in regex accuracy.
Reduced false-positive rate to 0.8%.
Validated on over 3,000 CTI reports and 2,400 strings.
Abstract
Cyber Threat Intelligence (CTI) reports contain Indicators of Compromise (IOCs) that are critical for security operations. To operationalize these IOCs across heterogeneous logs, analysts often convert them into regular expressions (regexes) for tasks such as digital forensics, log parsing, and SIEM rule creation. However, regex construction is still largely manual, requiring analysts to extract IOCs from CTI reports and transform them into syntactically valid and semantically precise patterns. This process is slow, error-prone, and increasingly impractical as CTI volumes grow. Although recent studies have applied Large Language Models (LLMs) to IOC extraction, they typically output plain strings rather than regexes, limiting practical deployment. Plain IOCs cannot effectively capture variations in system context, log format, or attacker behavior. To address this gap, we propose…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
