{"as_of":"2026-08-07T06:35:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:d2f7b95ef186e82504bf9a981241daa47f74af9cba1909df50b5ed979122301b","coverage":[{"denominator":66,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":66,"source":"paper_references, paper_reference_links","source_observed_at":"2026-07-08T21:01:34.899114Z","state":"measured"},{"denominator":66,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":66,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-07T06:34:17.273281+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2607.05916/citation-record","integrity":"/paper/2607.05916/integrity","json":"/paper/2607.05916/citation-record.json","paper":"/paper/2607.05916"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.825049Z","title":"Kortum Aaron Bangor and James T","venue":null,"work_id":"2c6e8652-bc0e-4685-a3d9-3f04a9aa4150","year":2008},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:67e5f5bfbaf29bda5824a17b0d5c15652cc79aa175f32df7f6c787c886f29f0f","observation_id":"f1fb7d43-a6a4-4fda-8ebb-d886a87d663b","resolution":{"observed_at":"2026-07-08T21:05:35.826404Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.813189Z","title":"Li-nids: Llm-based intelligent nids rules generation for cybersecurity applications","venue":null,"work_id":"9b1e74c5-c6e5-4b84-9ebb-4e42bcfd6453","year":2025},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:e29c6c85407a2a6a80cbdb3ca302d2f6a1d640aec9f3649cf34c139ee5b325e5","observation_id":"c7c38068-d020-4c60-b3d7-718fdc818168","resolution":{"observed_at":"2026-07-08T21:05:35.814720Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.807565Z","title":"Phi-4 technical report, 2024","venue":null,"work_id":"359f51e0-0079-424c-9083-4cbf7eab6f42","year":2024},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:65c0d410eab5f5c5b8b7aef41ab4bc3cdc899c549d7b0230478dafd05b38836a","observation_id":"12e232f9-6a27-45aa-99ba-e8d9b90b20ba","resolution":{"observed_at":"2026-07-08T21:05:35.808617Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2303.08774","last_updated":"2024-03-04T06:01:33Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-03-15T17:15:04Z","title":"GPT-4 Technical Report","version":6},"cited_work":{"arxiv_id":"2303.08774","doi":"10.1002/tea.20265","metadata_source":"pith","pith_arxiv_id":"2303.08774","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"GPT-4 Technical Report","venue":"cs.CL","work_id":"b928e041-6991-4c08-8c81-0359e4097c7b","year":2023},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"cited_paper":"/paper/2303.08774","citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:265d7a070908b35803c51c98e368e8a13e25e396c6adab51477ee91ae122b03a","observation_id":"e61993e2-389b-4332-907f-958fa878615e","resolution":{"observed_at":"2026-07-08T21:05:35.501607Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.785561Z","title":"Approximating memorization using loss surface geometry for dataset pruning and summarization","venue":null,"work_id":"7c617cbc-be58-49a4-9c31-e4b9f1ab4fec","year":2024},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:d2b056f627df76d2c65dc3d72073e19c0eb332b279dc14fe37323075f9575f73","observation_id":"e28b12ea-12ca-461d-8536-31f5e02bff46","resolution":{"observed_at":"2026-07-08T21:05:35.790969Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.779462Z","title":"99% false positives: A qualitative study of {SOC} analysts’ perspectives on security alarms","venue":null,"work_id":"7b7c40d9-fa44-4cb5-891a-cae352fc1c48","year":2022},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:75984c4d46ce1bb99a3b7a825d9705191b6888b58745a01a48de3ba0b49c3ebe","observation_id":"e1ec220f-8e93-410c-93ba-120d398a0fbf","resolution":{"observed_at":"2026-07-08T21:05:35.780815Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.781688Z","title":"Large language models hallucination: A comprehensive survey.Computer Science Review, 61:100970, 2026","venue":null,"work_id":"c98a2a0c-08fa-441e-b50f-df6a0dd189eb","year":2026},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:14917f6e4a11fa7db6e937a1c187eed655b62affea8a2dc12b9fa115bda63556","observation_id":"b73908f8-9091-4b6a-b41b-db98ad2243f5","resolution":{"observed_at":"2026-07-08T21:05:35.783109Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.768925Z","title":"Next-generation intrusion detection systems with llms: real-time anomaly detection, explainable ai, and adaptive data generation","venue":null,"work_id":"362fc48a-1e7e-4512-83af-754085a1677d","year":2024},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:ff08a21fe5adc835aa872678a5539d91390f75b34a6b2673ea9039b47eb41f27","observation_id":"5a262226-ea5b-4f4b-8685-e3c7af772120","resolution":{"observed_at":"2026-07-08T21:05:35.770253Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.766975Z","title":"The falcon series of open language models, 2023","venue":null,"work_id":"9d7e5dac-37c8-4b57-b483-d894a4fd20e4","year":2023},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:be8560fa6426c5c07dbc2dff930b84b53ee84c4fb4ec40ba415468f6addf409e","observation_id":"d7701cac-2020-4071-b40e-51b185543d8c","resolution":{"observed_at":"2026-07-08T21:05:35.768375Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.693118Z","title":"Towards transparent intrusion detection: A coherence-based framework in explainable ai integrating large language models","venue":null,"work_id":"68ceb704-9681-461b-a377-f1da20cc5164","year":2024},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:6def20cd2ad4b5f998abe975bce84711a4e84b9caaf9ae828c1d9577e63cf19c","observation_id":"6f380e24-4bcc-4414-ad2a-e0fe5d7fd326","resolution":{"observed_at":"2026-07-08T21:05:35.695179Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.696113Z","title":"The claude 3 model family: Opus, sonnet, haiku","venue":null,"work_id":"edc480ec-b40f-439e-810e-d805bf370932","year":null},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:09154950dc9805cf413b1268d7ab44d83b0b145232186762d93e982b2adb1296","observation_id":"ff1a2fbe-1958-4990-9a43-6b63492ebb57","resolution":{"observed_at":"2026-07-08T21:05:35.697607Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.704232Z","title":"Qwen technical report, 2023","venue":null,"work_id":"fcb27323-71ce-44d5-8168-cf67a43b29ff","year":2023},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:00836ce3460701aa547219917911512c0b3ae3797249f302817616b4f07ae401","observation_id":"d2af120a-7e56-414e-b9b7-46a0f3048714","resolution":{"observed_at":"2026-07-08T21:05:35.708493Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.754635Z","title":"Hex2sign: Automatic ids signature generation from hexadecimal data using llms","venue":null,"work_id":"eb28c8ce-a7b2-4c93-9268-d544207ac33a","year":2024},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:39707a1c046431621a57ec58a82787c79a45fd57e3b05d175e16aec450c5d361","observation_id":"7a1738f9-d587-4dad-9de0-e70fb2804da1","resolution":{"observed_at":"2026-07-08T21:05:35.755837Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.751627Z","title":"Determining what individual sus scores mean: Adding an adjective rating scale.Journal of usability studies, 4(3):114–123, 2009","venue":null,"work_id":"f36f4d9c-1f26-46fc-a7f4-2103a0b956db","year":2009},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:a2d7e061017b608c1511fbd7fdf454925d253d27f1ab99881a3493647292c14e","observation_id":"aca06481-596d-455e-9081-f59bd5b6e8b0","resolution":{"observed_at":"2026-07-08T21:05:35.753268Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.748437Z","title":"O’mine: A novel collaborative ddos detection mechanism for programmable data-planes","venue":null,"work_id":"25a1b8bc-0b21-4c27-86d5-507d48deb17f","year":2025},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:7968d1976cece225f380680947a4941688d88cf649f1a4c68be8e8ebd1e1cc86","observation_id":"7aaae29d-e947-45e4-86f8-c7e0cf5b48bb","resolution":{"observed_at":"2026-07-08T21:05:35.749855Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.790735Z","title":"Efficiency in the processes of intrusion detection system through usability evaluation methods.Available at SSRN 3151216, 2018","venue":null,"work_id":"8abcf887-442f-4e1b-80ac-f95f63b3430f","year":2018},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:0b4334984e6cf44372049bbe330ef654471e886be06fa7e77c28d44c13d92746","observation_id":"c453787d-9438-4001-b4a0-07bf911e010d","resolution":{"observed_at":"2026-07-08T21:05:35.792126Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.744839Z","title":"Kairos: Practical intrusion detection and investigation using whole-system provenance","venue":null,"work_id":"51a9007e-8b54-4d1f-b51a-16156a0ffbf6","year":2024},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:90c566e7e4710433cb334dfdde310f0bc3ce8f801532cabc8fb93635deca4725","observation_id":"7ae173b0-137d-4618-b9a9-27d6c1b7707d","resolution":{"observed_at":"2026-07-08T21:05:35.746400Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.691933Z","title":"Deepseek llm: Scaling open-source language models with longtermism, 2024","venue":null,"work_id":"1ba53f3c-3857-4411-a7ab-d0aa38f6e2d5","year":2024},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:5d8bdadb83db0ecd4a0a7b204c37f2c93f0b17a5776a858cd608aaac61af3418","observation_id":"96b1f131-2828-43c8-8d34-5b093e23d54d","resolution":{"observed_at":"2026-07-08T21:05:35.693293Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.714588Z","title":"Deepseek-v3 technical report, 2025","venue":null,"work_id":"ef9b43cb-2682-44bb-b588-dee4abdc1dcb","year":2025},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:2205df2f96274e9e4b18580f68e241a08b6ce3b6fe0296b54c13716624a67b41","observation_id":"48a454c6-4429-4846-923e-a4552ca0406c","resolution":{"observed_at":"2026-07-08T21:05:35.716677Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.803832Z","title":"Harnessing large language models for automated intrusion detection rule generation in cyber range.IEEE Network, 2025","venue":null,"work_id":"aea168f8-0876-4ba5-8162-8dedd4db3dd1","year":2025},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:3c9a6bb5eab496ddb5368d9d6ff56041b9967f5b56432e0a735e72498b9df669","observation_id":"8db360ae-3c38-4f0d-bc0d-f4b3d141a829","resolution":{"observed_at":"2026-07-08T21:05:35.805103Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.704685Z","title":"Ollama: Get up and running with large language models, 2023","venue":null,"work_id":"77a7ea9a-0a37-47a3-bd5d-a50bfd8c251e","year":2023},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:55a77214a6afe0b7543ea80a417f33e26c377098cadf19dbe64eba2b7be9b703","observation_id":"a718e92b-7c6b-4522-8528-9d7b1851bd69","resolution":{"observed_at":"2026-07-08T21:05:35.706181Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.709380Z","title":"Point cloud analysis for ml-based malicious traffic detection: Reducing majorities of false positive alarms","venue":null,"work_id":"f4ef86e9-d4ed-4298-b2b0-2d460c5e0ab2","year":2023},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:0a7d62fca41a9d4c3c367bafed376ecf285115588fdb6375f4efa856fab8849f","observation_id":"b5c9e6c4-114f-4921-add4-840b62352564","resolution":{"observed_at":"2026-07-08T21:05:35.712930Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.786791Z","title":"Sometimes, you aren’t what you do: Mimicry attacks against provenance graph host intrusion detection systems","venue":null,"work_id":"740fdd5c-54b7-45c3-940b-7b10df0ec98b","year":2023},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:01e4c13c749014a0c6ea69970af877d9bef547543026b9344eb668fc927f8eab","observation_id":"159cb6ca-4ecb-4f88-b75b-588e4cfbbb80","resolution":{"observed_at":"2026-07-08T21:05:35.788072Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.801564Z","title":"R-caid: Embedding root cause analysis within provenance-based intrusion detection","venue":null,"work_id":"50738342-d278-4a9b-a5d5-e6f3d7d9f58a","year":2024},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:e79fc165659985b81eace48b551308aa8826a23c4685ab6491abd0fc42293e37","observation_id":"e14d4dac-593a-4f5d-974f-b3d27023da72","resolution":{"observed_at":"2026-07-08T21:05:35.802946Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.21783","last_updated":"2024-11-23T23:27:33Z","snapshot_observed_at":"2026-07-06T18:55:11.576666Z","submitted_at":"2024-07-31T17:54:27Z","title":"The Llama 3 Herd of Models","version":3},"cited_work":{"arxiv_id":"2407.21783","doi":"10.1016/s0749-0720(15","metadata_source":"pith","pith_arxiv_id":"2407.21783","snapshot_observed_at":"2026-07-11T11:50:26.030339Z","title":"The Llama 3 Herd of Models","venue":"cs.AI","work_id":"1549a635-88af-4ac1-acfe-51ae7bb53345","year":2024},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"cited_paper":"/paper/2407.21783","citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:3b313a64410b7d1d8c3cb0175e56912c87e2547a72bfdb4e41efda9eec44bf0b","observation_id":"5428c8ec-010e-4eb4-beb9-193c2e508d01","resolution":{"observed_at":"2026-07-08T21:05:35.518423Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.809252Z","title":"A survey on llm-as-a-judge","venue":null,"work_id":"7d4a0d70-bb32-4984-8f3b-baa0c5197601","year":2025},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:ca1526a02c6ede19e59c67af565a4c60f6694887ed0d7369bf9d315a91696362","observation_id":"023e3dd2-1e2c-4af9-9c52-9a3bd755c83b","resolution":{"observed_at":"2026-07-08T21:05:35.810395Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.777492Z","title":"Flowsentry: Accelerat- ing netflow-based ddos detection","venue":null,"work_id":"2b1cb235-6065-4a8e-ab61-b6d3dda8ec47","year":2025},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:45cd8d21e164af78a6991ded1ca532f8d969a54d991c4d90189cd038b4017050","observation_id":"1e2d68e0-04ad-47ad-9558-08787126b11f","resolution":{"observed_at":"2026-07-08T21:05:35.778849Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.726988Z","title":"A llm-based agent for the automatic generation and generalization of ids rules","venue":null,"work_id":"67884e2e-075d-47a7-ada8-a5255aecef83","year":2024},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:cfd0622beb3cea728fe672de8fb20fbe1f01bd7933c0ad1cf0a8a3ebed296a5b","observation_id":"c6eb4cdf-9e8a-4cb6-9639-f1082a39ddf5","resolution":{"observed_at":"2026-07-08T21:05:35.728728Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.807908Z","title":"A comparative analysis of difficulty between log and graph-based detection rule creation","venue":null,"work_id":"8f3d50c6-68dc-4a08-9787-04f9dc5bcf03","year":2024},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:b68a004f90fcf058223117dd57bd82baed0ea85f631f583649cf0ada067c49b6","observation_id":"ae53712d-2e10-4dcc-8e08-b7e19f8ccfce","resolution":{"observed_at":"2026-07-08T21:05:35.809431Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.835155Z","title":"Jiang, Alexandre Sablayrolles, Arthur Mensch, et al","venue":null,"work_id":"edcd1850-8300-4f61-a29c-e7580c47d170","year":2023},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:bba327462a4d53fd72cc439b9a8607fcca369448cbe130b392e81e05413b5f82","observation_id":"bda97fc6-5cb9-4887-b29e-729bf04eb83b","resolution":{"observed_at":"2026-07-08T21:05:35.836497Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.833255Z","title":"Survey of intrusion detection systems: techniques, datasets and challenges.Cybersecurity, 2(1):20, 2019","venue":null,"work_id":"a05f1b63-e638-4cda-bb98-baeca9b4e5bd","year":2019},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:843e16dcbf58ccd7ae50da7eb09f049799aa9d79cc77ba5022fff7b681282fe1","observation_id":"d21aa75e-497d-4d4c-a622-d2b78b57c8d3","resolution":{"observed_at":"2026-07-08T21:05:35.834584Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.826954Z","title":"Learning, forgetting, remembering: Insights from tracking llm memorization during training","venue":null,"work_id":"fc87a339-e29b-451d-ba8d-bdbef278ec0d","year":2024},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:dcf0db602ee9c39f4d98a9108cae7b0ae95e509224871fb13da77b4ad62d609b","observation_id":"ce6b8b57-87d5-49d9-bb50-d17e71abe375","resolution":{"observed_at":"2026-07-08T21:05:35.828204Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.822986Z","title":"From generation to judgment: Opportunities and challenges of llm-as-a-judge","venue":null,"work_id":"12bc2819-af2a-493d-a061-587e9d5dd254","year":2025},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:e55aefb5a10ce04d5a0b089bb13a1131b5b615446546bf06ad8a980aa5f431a9","observation_id":"d2d97efe-a2b2-417f-a9cf-5d9d2d8c1f36","resolution":{"observed_at":"2026-07-08T21:05:35.824464Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2510.13257","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.512398Z","title":"Gridai: Generating and repairing intrusion detection rules via collaboration among multiple llm-based agents.arXiv preprint arXiv:2510.13257, 2025","venue":null,"work_id":"3ef54edc-6a17-4782-b2e2-d45690a65efb","year":2025},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:46d8430e3e6d45acfa4ed3946697a62a2bcf7a628829430b34d4d4497c2a87e8","observation_id":"22eca70a-adf8-4ac1-9800-ffd92960bdb7","resolution":{"observed_at":"2026-07-08T21:05:35.514022Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.819129Z","title":"Rulemaster+: Llm-based automated rule generation framework for intrusion detection systems.Chinese Journal of Electronics, 34(5):1402–1415, 2025","venue":null,"work_id":"a3d35e25-40e2-43a0-8a13-5318e01ac6ad","year":2025},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:355161bbcf935b5db84f112b7c02c9cf862b336e9d8d29325d9e88dd06f39f59","observation_id":"04ecb25b-6af9-452e-895b-89db2e1b7992","resolution":{"observed_at":"2026-07-08T21:05:35.820538Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.815399Z","title":"Rulellm: Llm-driven rule generation for anomaly network traffic identification","venue":null,"work_id":"9923d8e7-f5fe-491d-a0b1-0d202503718e","year":2026},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:fc9aabc766d0adfc7520d3b42bd579598ed4343ccd8321a519a6bc1670985684","observation_id":"19a3ee3c-21c4-450a-ae8b-59c5d5b2d77a","resolution":{"observed_at":"2026-07-08T21:05:35.816813Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.810997Z","title":"Granite code models: A family of open foundation models for code intelligence, 2024","venue":null,"work_id":"4112fdbd-9caf-4d4f-ac9d-2d54f9a30bf8","year":2024},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:eec8dc6c8ef2c4c0f05405e13f14055339e1536820b9936b681d571717223199","observation_id":"0d43d318-ae80-4c78-9b19-e667ec2b76e1","resolution":{"observed_at":"2026-07-08T21:05:35.812504Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.18684","last_updated":"2026-06-23T04:40:30Z","snapshot_observed_at":"2026-08-05T16:24:25.529504Z","submitted_at":"2025-08-26T05:08:53Z","title":"FALCON: Transforming Cyber Threat Intelligence into Deployable IDS Rules with Self-Reflection","version":2},"cited_work":{"arxiv_id":"2508.18684","doi":null,"metadata_source":"pith","pith_arxiv_id":"2508.18684","snapshot_observed_at":"2026-07-08T21:05:35.513972Z","title":"arXiv preprint arXiv:2508.18684 (2025)","venue":"cs.CR","work_id":"17bac0a2-27e3-4cac-a9f6-e238b6ae5b6b","year":2025},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"cited_paper":"/paper/2508.18684","citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:55961edb539f2e23f609e65452663dda48619784d243a4bd92251783e13a43c1","observation_id":"3b5baad9-f734-47e6-88f6-cc4ffc461300","resolution":{"observed_at":"2026-07-08T21:05:35.515686Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.803566Z","title":"Leveraging llms for automated ids rule generation: A novel methodology for securing industrial environments","venue":null,"work_id":"8dc1363d-8f2c-4fa3-b85e-b4bf3d29a37a","year":2025},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:ff113254128bce3d44dea7440fcfd4e02136df369bab36fcb90f3fc2eaa0b3e3","observation_id":"c3e1eeec-f032-496d-b70f-588ae6cf2b1e","resolution":{"observed_at":"2026-07-08T21:05:35.804865Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.798558Z","title":"Behind the scenes of attack graphs: Vulnerable network generator for in-depth experimental evaluation of attack graph scalability.Computers & Security, 157:104576, October 2025","venue":null,"work_id":"c6549498-172b-43b9-8484-e698beb0bb1b","year":2025},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:7d01b328ba92419cbe0ec3aafaf075f33f74da20e58617766943cd897803b37c","observation_id":"393c93e9-dcd4-4b57-8524-5aa01d81078d","resolution":{"observed_at":"2026-07-08T21:05:35.800283Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.791880Z","title":"Rulexploit: A framework for generating suricata rules from exploits using generative ai","venue":null,"work_id":"82630072-94b0-4691-a90f-4239ca687a9f","year":2025},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:0ec0c1c536fcd88d0937dab5e44df2ebf38fdb862b3f66b824b555eca41d7848","observation_id":"a9426a25-c53b-4b65-ba0d-2aab90cfd84f","resolution":{"observed_at":"2026-07-08T21:05:35.797828Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.731404Z","title":"Toward generating a new intrusion detection dataset and intrusion traffic characterization.ICISSp, 1(2018):108–116, 2018","venue":null,"work_id":"270385a6-8909-4924-ae44-398761b500e7","year":2018},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:8d2ed0156d26dc49b60eddacf853c3befd927bf5ef16e88c39817b78ede0a10e","observation_id":"c240a672-4143-4a11-8601-35e7f387c77a","resolution":{"observed_at":"2026-07-08T21:05:35.733051Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2508.18947","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.503079Z","title":"LLMs in the SOC: An Empirical Study of Human-AI Collaboration in Security Operations Centres, September 2025","venue":null,"work_id":"c8cb019b-5325-4023-aa4c-69d89265e5a8","year":2025},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:192c76525988c4c4e6ee7d6d08ca24b6402ff0fdd674fd25284bd1738ad45f37","observation_id":"5851faf8-21ef-412e-86a4-4211d7831572","resolution":{"observed_at":"2026-07-08T21:05:35.504897Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.781457Z","title":"Gemini: A family of highly capable multimodal models","venue":null,"work_id":"a42ec617-708d-428a-b1fd-35375f955763","year":2025},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:4ddbf84f8728a48b7081091dd283f627863288bd5be221accfdd45b62880efe9","observation_id":"8855838a-0fb1-4802-a81b-a22a3240b85f","resolution":{"observed_at":"2026-07-08T21:05:35.782752Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.757596Z","title":"Ruling the unruly: Designing effective, low-noise network intrusion detection rules for security operations centers","venue":null,"work_id":"6b03577f-14cc-4af2-a42d-124c470fefe5","year":2025},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:53e26ccbafa31632c449b98f8ca679670e1b3f1047d493b377717909739c02bb","observation_id":"d8bd42be-15f7-419d-bae9-1689e666fdc6","resolution":{"observed_at":"2026-07-08T21:05:35.758811Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.772648Z","title":"Memorization without overfitting: Analyzing the training dynamics of large language models.Advances in Neural Information Processing Systems, 35:38274–38290","venue":null,"work_id":"3ab06ed2-039d-45c8-845a-b89f57b01ef3","year":2022},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:ce628e78c01e6a287be07e49759d6199ffcc801cded21d7c6d3004954abc717d","observation_id":"2061674d-f850-43bd-b034-45d52fd35212","resolution":{"observed_at":"2026-07-08T21:05:35.774702Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.09288","last_updated":"2023-07-19T17:08:59Z","snapshot_observed_at":"2026-08-02T11:57:18.735747Z","submitted_at":"2023-07-18T14:31:57Z","title":"Llama 2: Open Foundation and Fine-Tuned Chat Models","version":2},"cited_work":{"arxiv_id":"2307.09288","doi":"10.24963/ijcai.2025/706","metadata_source":"pith","pith_arxiv_id":"2307.09288","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Llama 2: Open Foundation and Fine-Tuned Chat Models","venue":"cs.CL","work_id":"68a5177f-d644-44c1-bd4f-4e5278c22f5d","year":2023},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"cited_paper":"/paper/2307.09288","citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:4e771e206a183463892d413455bbfced5f18e59bad91f7d87da0cf8d2828bdaf","observation_id":"f020e44b-9d25-4de7-a415-05cdf5b06609","resolution":{"observed_at":"2026-07-08T21:05:35.516647Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.770851Z","title":"Flash: A comprehensive approach to intrusion detection via provenance graph representation learning","venue":null,"work_id":"138d906e-f97c-41f2-a612-16ae6a37fe35","year":2024},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:f4aa8d992a3990bfb432c7c9941f411021c41ea58f58e7bd4b4f483c790f75a5","observation_id":"94acd9a3-3184-4483-a903-a7765322f981","resolution":{"observed_at":"2026-07-08T21:05:35.772099Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.805525Z","title":"Alert alchemy: Soc workflows and decisions in the management of nids rules","venue":null,"work_id":"b73b2fcf-51fd-498d-b9db-0c9cae985261","year":2023},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:cb517d026732ea6e4743eddd51db00d600975597f8106d7b8de50e31aa83ce3b","observation_id":"5d2c9f60-3413-4519-a93f-f68b4eee4345","resolution":{"observed_at":"2026-07-08T21:05:35.806934Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.783332Z","title":"Ruling the rules: Quantifying the evolution of rulesets, alerts and incidents in network intrusion detection","venue":null,"work_id":"0dd21c64-b284-4d0e-9862-af665f74078a","year":2022},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:e3cec04c120d19d7b2322b97b0698759ca7e9a4081dcfbcb5b7fa6acc0670356","observation_id":"539183b7-cfba-4346-968b-892074b43bb3","resolution":{"observed_at":"2026-07-08T21:05:35.784925Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2511.12224","doi":"10.48550/arxiv.2511.12224","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Rulepilot: An llm-powered agent for security rule generation.arXiv preprint arXiv:2511.12224, 2025","venue":"ArXiv.org","work_id":"19504846-aefc-480f-b4c9-8c5327da22d7","year":2025},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:5b94aa1be2c68fb487ca500d6d7af8bc83aafaa7f621de04313dd6d997600b53","observation_id":"603bd6b7-d973-400a-9ce5-69ec86e7fa6d","resolution":{"observed_at":"2026-07-08T21:05:35.521724Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.764901Z","title":"Incorporating gradients to rules: Towards lightweight, adaptive provenance-based intrusion detection","venue":null,"work_id":"a2e42483-794c-429c-8e9e-3d699d990a32","year":2024},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:f84c20eb9448b8eb1a20977924b263c0c4b0b0451746c13c0960a02146543527","observation_id":"4a250cde-18ae-4be0-a2f1-07a8fb843a7a","resolution":{"observed_at":"2026-07-08T21:05:35.766429Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T11:37:03.941805Z","title":"Chain-of-thought prompting elicits reasoning in large language models.Advances in neural information processing systems, 35:24824–24837","venue":null,"work_id":"3256b5a6-76d9-460c-ad77-5d232058ad6d","year":2022},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:3ca1cbb7827cb14f36b36fd7ce09ce741cda85b99691bebce5a42646a8bfba18","observation_id":"1e3775eb-4ebd-4aca-a95c-66fd0f3bfb69","resolution":{"observed_at":"2026-07-08T21:05:35.764063Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2309.06794","last_updated":"2023-09-13T08:33:09Z","snapshot_observed_at":"2026-07-06T16:17:50.837748Z","submitted_at":"2023-09-13T08:33:09Z","title":"Cognitive Mirage: A Review of Hallucinations in Large Language Models","version":1},"cited_work":{"arxiv_id":"2309.06794","doi":null,"metadata_source":"pith","pith_arxiv_id":"2309.06794","snapshot_observed_at":"2026-07-08T21:05:35.523194Z","title":"Cognitive mirage: A review of hallucinations in large language models","venue":"cs.CL","work_id":"09c56b2e-6529-4a42-a882-e8eada97292f","year":2023},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"cited_paper":"/paper/2309.06794","citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:7134b97d51629fd154fa1edcb13a03a57fcbe518e393bf453e079d27504343e1","observation_id":"dec81438-8340-4d2e-8d3e-3a522ff206f3","resolution":{"observed_at":"2026-07-08T21:05:35.524817Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.721253Z","title":"C y b e r s e c u r i t y","venue":null,"work_id":"58b349cb-b5b9-4a6e-b2dd-00ba97b8e68c","year":2024},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:cfac885d05a9a7d450dd8e33769ed7a5e279f84cd1396d620200cf19d83b476b","observation_id":"17d38faa-0ee7-41b7-939d-5aa33b7d5aa9","resolution":{"observed_at":"2026-07-08T21:05:35.724208Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.717993Z","title":"report, malicious payload, ET rules GLM4 Custom Custom × ×","venue":null,"work_id":"556cf0c3-6c31-4698-a1cb-f59a1209934f","year":null},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:7faab755c02021c59220891e56546c6b5960f04b4a478352d99affafc93b915b","observation_id":"d2d7d3b3-43ec-42e1-9d62-559ae3c963b4","resolution":{"observed_at":"2026-07-08T21:05:35.719646Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.758457Z","title":null,"venue":null,"work_id":"29ee19dc-d20b-4743-aace-ff1cddea6f16","year":null},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:212f3e8a715b3b52b2cb4fe95fafe51c2948c30cb048a19db671947b8907465b","observation_id":"c2c76808-4481-4f58-9ef4-12ff5bcf968a","resolution":{"observed_at":"2026-07-08T21:05:35.759493Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.756774Z","title":null,"venue":null,"work_id":"84b798d3-0e60-4dd9-8338-d60e0474c882","year":null},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:b4b821b587df096b9175d09ece5fa171c85ff4c338edabf0b39d2382eae255c6","observation_id":"8eaf8d01-dcb8-4dbc-82fd-02490e35c55e","resolution":{"observed_at":"2026-07-08T21:05:35.757875Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.725099Z","title":null,"venue":null,"work_id":"d170abea-6af7-478d-b789-49aa43ac7ba3","year":null},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:f22df4aa0fed7b93595625061911be7d9352d15a29274c71c340d2b4fe8500e7","observation_id":"b21f9e02-f3ad-4cd5-8f32-22115ee05c67","resolution":{"observed_at":"2026-07-08T21:05:35.726530Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.750498Z","title":null,"venue":null,"work_id":"e2eb109e-0032-4665-bef1-7ea08471e4f1","year":null},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:cb4d4122bdb2968f7ff0346c01dfd27f09e3ad09cd04dbe4cf536d6cc241b9e2","observation_id":"1c63517d-f821-463a-a5cf-12183ce99374","resolution":{"observed_at":"2026-07-08T21:05:35.752110Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.828777Z","title":null,"venue":null,"work_id":"dd045765-3cda-433a-abd9-dd1b8e9ac198","year":null},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:dc7d2c055586fdba34f0cb076c86a94e1c4af1c35614b50b4231a801f46613e3","observation_id":"40fc4cb1-5487-49d8-8bbb-25401419c07a","resolution":{"observed_at":"2026-07-08T21:05:35.830605Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.821097Z","title":null,"venue":null,"work_id":"3bf4f71c-d422-449d-a7dc-0e5303f6c790","year":null},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:227d608ea9a1d830bcd024ee0af3ab9aa403e9a155e711fe7b543a55e041bd47","observation_id":"8400c76b-4097-4a73-bebc-0a99810bca5e","resolution":{"observed_at":"2026-07-08T21:05:35.822365Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.746999Z","title":null,"venue":null,"work_id":"bbae69ea-c0a2-439c-a55b-154dd7d8964a","year":null},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:236425687a66e12b0f3e24c61931c05fd97ff648551135b497a95ed1d82616b4","observation_id":"964dd938-bbff-431b-a144-023fd1434c7a","resolution":{"observed_at":"2026-07-08T21:05:35.748606Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.817367Z","title":null,"venue":null,"work_id":"feafdfc2-c5fd-47a5-af5f-7f3c0ae2ca11","year":null},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:af5a3f500e14c28e1c4b8816b5d710bacbe9d8e720cd94ccebecea74005d8da9","observation_id":"b2928f22-2fd5-4f6a-a875-0accfcab9153","resolution":{"observed_at":"2026-07-08T21:05:35.818480Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.831356Z","title":null,"venue":null,"work_id":"0ad81bde-4782-44e8-b9bc-f8fb4ab5f3c1","year":null},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:8a2adbe53f7427d876ebf0bb7058a5d37e29e5499362664ca2eb8d5e1e9bba76","observation_id":"ccc7795e-444f-4c11-9be1-ed9074a38edb","resolution":{"observed_at":"2026-07-08T21:05:35.832503Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-08T21:05:35.775453Z","title":"suggest-and-deploy","venue":null,"work_id":"a763508b-6ae5-4d9a-be85-f7c44002fe5b","year":null},"citing_paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?","version":1},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-07-08T21:01:34.899114Z"},"links":{"citing_paper":"/paper/2607.05916"},"observation_digest":"sha256:634e23fcc1034791985dd3a20be4d7e66c41a0c8b5d6830ab1d10a24de402ad1","observation_id":"7dfc05cd-1a25-4bb0-a641-3c7fe4a92884","resolution":{"observed_at":"2026-07-08T21:05:35.776816Z","resolver_source":"raw_fallback","status":"malformed_identifier"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-07T06:34:17.273281+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2607.05916","last_updated":"2026-07-07T07:09:56Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-07-10T23:17:30.710127Z","submitted_at":"2026-07-07T07:09:56Z","title":"Beyond the Syntax: Do Security Experts Trust LLMs for NIDS Rule Engineering?"},"reference_resolution":{"displayed":66,"state_counts":{"malformed_identifier":1,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":9,"verified_exact":8,"verified_fuzzy":48},"total_outbound_references":66},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-07T06:34:17.273281+00:00","source":"crossref"},{"observed_at":"2026-08-07T06:34:11.927384+00:00","source":"retraction_watch"}],"thesis":"As of 7 August 2026, this Paper Citation Record lists 66 of 66 outbound references and 0 inbound Pith citation observations for arXiv:2607.05916."}