AVDA: An Intelligent Generation Framework for Cybersecurity Detection Rules Based on MCP

AVDA (Autonomous Vibe Detection Authoring) is an intelligent generation framework for cybersecurity detection rules based on the MCP protocol. Its core innovation lies in integrating organizational context to enable automatic generation of detection rules. The agent workflow improves similarity scores by 19% compared to the baseline, and the generated rules achieve a 99.4% TTP matching rate, providing a quantitative trade-off framework for AI-assisted security detection engineering.

Current cybersecurity detection engineering faces multiple dilemmas: Detection rule writing relies on manual work, plagued by code fragmentation, repeated development, and limited organizational visibility; Engineers need to master professional skills such as attack techniques (TTPs), log formats, and coding standards, leading to long talent training cycles and difficult knowledge inheritance, which restricts the expansion of detection coverage and response capabilities.

AVDA integrates organizational context (existing rules, telemetry patterns, style guides) via the Model Context Protocol (MCP) to generate customized rules. Three strategies are compared: Baseline (one-time generation), Sequential (multi-step execution), and Agent (multi-agent collaboration). The agent method improves similarity by 19%, while the sequential method achieves 87% of the agent's quality with only 2.5% of the token cost, providing a trade-off reference for deployment.

The agent workflow adopts a multi-agent architecture: The requirement analysis agent extracts attack features, the code generation agent generates rules, the verification agent checks syntax and logic, and the optimization agent tunes performance. Agents communicate via shared memory and support iterative reasoning (quality improvement slows after 3-5 iterations), with feedback loops continuously improving output quality.

Experiments are evaluated based on production rule corpora and LLMs, with metrics including similarity, TTP matching rate, and syntax validity. Results: TTP matching rate of 99.4%, syntax validity of 95.9%, but exclusion rule accuracy of only 8.9% (main limitation). Expert validation shows a Spearman correlation coefficient of 0.64 (p<0.002) between automated metrics and human judgment. The quality-cost trade-offs of the three strategies provide data support for organizations.

AVDA accesses organizational context via MCP: Existing detection libraries (to avoid repetition and learn coding patterns), telemetry data patterns (mapping attack descriptions to log fields), and style guides (to ensure consistent coding standards). It supports integration with mainstream IDEs like VS Code and IntelliJ, allowing developers to generate rules in real time using natural language, lowering the barrier to use.

Current limitations: Low exclusion rule accuracy (8.9%) because distinguishing between malicious and legitimate behaviors requires in-depth business context; Limited ability to model complex attack chains; Lack of real-time adaptation to emerging threats. Improvement directions: Integrate business context, introduce historical baselines, and implement human-machine collaborative review of exclusion rules; Expand attack chain modeling; Research online learning and incremental update mechanisms.

Application value of AVDA: Improve detection engineering efficiency (AI-generated rules as a starting point, reducing writing from scratch); Promote standardized knowledge inheritance (new engineers quickly learn organizational standards); Empower SOC (analysts quickly convert threat intelligence into detection rules, accelerating response). It provides a practical path and quantitative framework for AI-assisted detection engineering.