Self-refining structures in large-language generative AI models for the generation of cybersecurity detection capabilities using machine-based and natural languages

Abstract

The cybersecurity threat landscape evolves rapidly placing increasing pressure on detectionapproaches that rely on static rules, manually curated signatures, or models trained on fixeddatasets. While modern security environments collect large volumes of telemetry data, theprocesses used to generate and maintain detection knowledge remain heavily dependent onongoing human effort. These approaches struggle to adapt as attack behaviours change. Thisthesis investigates whether autonomous generative systems can be used to generate andimprove cybersecurity detection knowledge without continuous human intervention. Ratherthan treating detection logic as a static artefact, the research examines how generative systemscan refine their behaviour over time through feedback-driven mechanisms. An artefact-drivenmethodology is adopted to design, implement, and evaluate two distinct but related generativesystems.The first system is a grammar-grounded generator that produces structured, machine-readableSQL detection queries directly from formal grammars. Generation is performed withoutexternal input, and syntactic correctness is guaranteed through grammar-constrained traversal.This system is extended by exposing internal decision points and introducing heuristic andweighted mechanisms that influence traversal behaviour based on prior outcomes. The secondsystem is a large language model–based pipeline designed to generate natural-languagecybersecurity reasoning and synthetic datasets. In this pipeline, generated outputs areautomatically evaluated using task-specific criteria, and feedback is used to guide regenerationuntil defined quality thresholds are met.The weighted generator was further evaluated in a controlled cybersecurity detectionexperiment using CIC-IDS2017-derived network-flow records. The selected SQL ruleachieved an F1 score of 0.7361 and balanced accuracy of 0.7389 on a held-out test set,compared with an F1 score of 0.6667 and balanced accuracy of 0.5000 for an always-maliciousbaseline. The LLM Judge was separately validated against blinded human ratings across 30generated responses. The results showed partial agreement, indicating that the Judge cansupport automated screening and refinement but should not be treated as a substitute for humanexpertise.By analysing these systems together, the thesis demonstrates that self-refinement can be treatedas a shared design principle across both structured and probabilistic generative architectures.Although the mechanisms differ, weighted traversal versus automated evaluation, both systemsexhibit outcome-driven adaptation that improves output quality over time. The findings showthat autonomous self-refinement can reduce reliance on static rules, fixed datasets, and manualcuration, providing a practical foundation for adaptive cybersecurity detection knowledgegeneration.