When the sensor starts thinking: SnortML, agentic AI, and the evolving architecture of intrusion detection
In March 2024 Cisco Talos released SnortML, embedding TensorFlow‑trained LSTM classifiers directly inside Snort 3’s packet‑processing chain. The engine loads pre‑compiled models at startup, subscribes to the HTTP inspector’s event bus, and evaluates each request’s URI and body against a byte‑level embedding followed by an LSTM, outputting a probability score in roughly 350 µs on a 4.7 GHz AMD CPU. Three model variants—256, 512 and 1024‑byte inputs—are auto‑selected based on query length, preserving accuracy for short traffic and scaling to longer payloads without excessive latency. Model updates travel through Snort’s Lightweight Security Package system, syncing with the existing rule‑update pipeline.
The SnortML rollout arrives as the security industry experiments with “agentic AI” that can act autonomously on network data. By keeping inference on‑device, Cisco sidesteps the privacy and bandwidth concerns of cloud‑based reputation services, while still offering a dynamic detection layer that complements static signatures. Competing IDS vendors have begun experimenting with similar hybrid approaches, but Cisco’s tight integration with the mature Snort rule engine and its use of XNNPACK for hardware‑accelerated inference give it a performance edge that could set a new baseline for real‑time ML in IDS products.
Running ML alongside signatures introduces a new risk surface: false positives from the neural net can surface on legitimate traffic that mimics attack syntax, especially with URL‑encoded characters. Administrators must tune probability thresholds per model size and monitor alerts where both the ML and signature paths fire, as those dual hits provide higher confidence. Future watch points include the expansion of SnortML beyond HTTP (e.g., DNS or binary protocols) and how agentic AI orchestration platforms will consume SnortML’s confidence scores to automate block or quarantine actions without human oversight.
Key Takeaways
SnortML adds sub‑millisecond, on‑device ML classification to Snort 3, preserving the low‑latency profile of traditional IDS deployments.
Cisco’s three‑tier model sizing ensures that short queries are evaluated with a model trained on similar traffic, reducing unnecessary false alarms.
The parallel execution of signatures and ML creates a layered detection posture where coincident alerts signal higher certainty.
Administrators must actively manage ML thresholds and monitor dual‑trigger alerts to prevent automated responses from amplifying false positives.
About the Source
This analysis is based on reporting by Stack Overflow Blog. Here is a short excerpt for context:
Signature-based detection has always known what it was looking for. Machine learning and autonomous agents are changing the question entirely, shifting from "does this match a known pattern?" to "does this actually make sense in context?"Read the original at Stack Overflow Blog
