From Threat Intelligence to Firewall Rules: Semantic Relations in Hybrid AI Agent and Expert System Architectures

Researchers propose a hybrid AI agent and expert system architecture that uses semantic relations to automatically convert cyber threat intelligence reports into firewall rules. The system leverages hypernym-hyponym textual relations and generates CLIPS code for expert systems to create security controls that block malicious network traffic.

• →A neuro-symbolic approach combining AI agents with expert systems shows superior performance in threat mitigation compared to baseline methods.
• →Hypernym-hyponym semantic relations prove effective for extracting actionable information from cyber threat intelligence reports.
• →The system automatically generates CLIPS code for expert systems to create firewall rules from threat intelligence.
• →Multi-agent systems can bridge the gap between AI automation and trustworthy security responses in cybersecurity operations.
• →The research demonstrates practical applications of semantic AI in operational security control configuration.