Toward Agentic Intrusion Detection in the Internet of Things: Rule Generation and Live Validation for XRCE-DDS Attacks - Ciocca, Matheus M.; Ferreira, Emanuel C.; Barcelos, Tuigg R.; Quincozes, Silvio E.; Kreutz, Diego; Souza, Paulo Silas Severo de (Anais Estendidos do Simpósio Brasileiro de Cibersegurança (SBSeg); 2026: Anais Estendidos do XXVI Simpósio Brasileiro de Cibersegurança, 2026)
Signature-based IDSs rely on rules that must accurately capture attack behavior, yet public repositories provide limited coverage for emerging IoT and cyber-physical protocols such as XRCE-DDS. We present Rules Farmer, an open-source agentic tool that generates, deploys, and adversarially validates Snort 3 rules. A Defense Agent synthesizes signatures from natural-language intent, while an Attack Agent executes Docker-based attacks and evasive variants. Across four XRCE-DDS scenarios, 167 executions and 142 variants, 3 of 4 initial rules failed against the canonical attacks and required 15–23 revisions per scenario to converge. All campaigns converged within 50 executions, showing that live adversarial validation can expose semantic weaknesses that static validation misses.