Lina Irawan
The landscape of network security underwent a fundamental shift in March 2024 when Cisco Talos introduced SnortML, a native machine learning detection engine for Snort 3. This development marked a departure from the decades-old reliance on purely signature-based Intrusion Detection Systems (IDS), which, while precise, have long struggled with the "exposure gap"—the critical window between the emergence of a novel exploit and the deployment of a specific rule. By late 2025, this evolution merged with a broader industry trend: the rise of agentic AI within Security Operations Centers (SOC). Together, these technologies are redefining how enterprises detect, investigate, and remediate threats at wire speed.
The Limitation of the Signature Model
For over twenty years, the security industry has relied on signatures to identify malicious activity. A well-crafted Snort signature is a surgical instrument, capable of identifying known Common Vulnerabilities and Exposures (CVEs) with near-zero false positives. However, the efficacy of this model is tethered to its specificity. If a researcher writes a rule for CVE-2024-12345, that rule is effective only for that specific payload. Should an attacker modify the payload to traverse the same vulnerable code path via a slightly different route, the signature often fails to fire.
The primary constraint of the traditional model is "exposure time." The process of capturing a novel exploit, reverse-engineering it, validating a new rule against a test corpus, and shipping it through update channels can take days or even weeks. In an era where zero-day vulnerabilities in common software are exploited within hours of discovery, this latency represents a structural risk to global infrastructure.
The Architecture of SnortML: Real-Time Local Inference
Cisco Talos addressed this latency directly with SnortML. Unlike previous attempts at AI integration that relied on cloud-based reputation services—which introduce significant latency—SnortML performs inference entirely on the local device. The engine is integrated directly into the Snort 3 processing pipeline, producing verdicts in under a millisecond.
The system relies on two primary components: the snort_ml_engine module, which loads pre-trained TensorFlow models into memory at startup, and the snort_ml inspector. This inspector utilizes Snort 3’s internal publish/subscribe interface to receive data from service inspectors. For instance, when an HTTP inspector finishes parsing a request, it publishes the URI query string and POST body to an internal event bus. The SnortML inspector then runs this data through a classifier to return a probability float representing the likelihood of an exploit attempt.
Technically, the model utilizes a Long Short-Term Memory (LSTM) network preceded by an embedding layer. This architecture allows the system to understand the "shape" of an attack at the byte level. By mapping raw byte values to learned vector representations, the system captures relationships between characters—such as an apostrophe (0x27) followed by the SQL "OR" command (0x4F 0x52)—that traditional frequency analysis might miss.
Chronology of Development and Expansion
The rollout of machine learning-enhanced detection has followed a structured timeline, reflecting the industry’s cautious approach to integrating probabilistic models into deterministic security environments:
- March 2024: Cisco Talos officially launches SnortML, initially targeting SQL injection (SQLi) detection within HTTP parameters.
- Late 2024: Integration with Secure Firewall 10.0.0, introducing adaptive model selection. The system begins automatically choosing between 256, 512, or 1024-byte models based on input length to optimize performance.
- April 2025: IBM launches ATOM (Autonomous Threat Operations Machine), a multi-agent framework designed to sit above SIEM analytics, signaling the start of the "Agentic SOC" era.
- August 2025: Trend Micro releases its Agentic SIEM, focusing on autonomous correlation and multi-step investigation.
- Late 2025: SnortML coverage expands beyond SQLi to include Cross-Site Scripting (XSS) and command injection attack classes.
Performance Metrics and Hardware Acceleration
A critical concern for any IDS deployment is the impact on network throughput. In tests conducted on a 4.7 GHz AMD processor, a single SnortML classification pass was clocked at approximately 350 microseconds. While this overhead is not negligible in high-speed environments, Cisco utilizes LibML and XNNPACK for hardware-accelerated matrix operations. This ensures that inference times remain predictable and bounded, even under heavy traffic loads.
To further mitigate latency, SnortML employs "Adaptive Model Selection." Smaller queries are routed to a 256-byte model, while only complex requests undergo full 1024-byte inference. This tiered approach ensures that the processing budget—which typically ranges from low hundreds of microseconds to a few milliseconds per packet—is managed efficiently.
The Rise of the Agentic SOC
While SnortML operates at the "wire level" (Layer 7 parameters), the security industry is moving toward a higher layer of abstraction known as Agentic AI. This shift is driven by a staggering labor shortage; a 2025 industry survey indicated a global cybersecurity workforce gap of four million unfilled positions. Furthermore, 82% of SOC analysts reported that the sheer volume of alerts caused them to miss real threats.
Unlike conventional ML models that score a single input, or SOAR (Security Orchestration, Automation, and Response) playbooks that follow rigid scripts, an AI agent maintains state across multi-step investigations. An agentic framework can:
- Query a SIEM for related historical events.
- Cross-reference file hashes with threat intelligence platforms.
- Analyze identity provider logs for suspicious user behavior.
- Decide on a course of action based on assembled context.
In this modern architecture, Snort 3 acts as the primary sensor. Its output—rich with ML probability scores—feeds directly into the agentic reasoning chain. A SnortML alert with a 0.97 probability score, combined with a signature match, triggers an immediate high-priority investigation, whereas a 0.61 score might be routed for lower-priority enrichment.
Industry Reactions and Strategic Analysis
Security analysts have largely welcomed the move toward hybrid detection. "The combination of deterministic signatures and probabilistic ML creates a ‘defense-in-depth’ strategy at the packet level," noted one senior network architect during the 2025 Security Operations Summit. "Signatures provide the low-noise floor we need for known threats, while ML catches the syntactic variations that previously slipped through."
However, the transition is not without its critics. Concerns remain regarding the "black box" nature of neural networks. When SnortML flags a payload, it traditionally provides a probability score but does not specify which part of the payload—the specific bytes or characters—triggered the alert. This lack of "feature attribution" can make it difficult for human analysts to validate findings quickly.
Furthermore, the risk of adversarial ML is a growing area of research. Attackers may attempt to "probe" the boundaries of SnortML by using obfuscation techniques, such as whitespace manipulation or non-standard character encoding, to find the threshold where an exploit remains functional but the ML score stays below the alert trigger.
Implications for Future Network Defense
The integration of SnortML and agentic AI points toward a future where security systems are self-healing and self-improving. The most significant untapped potential lies in the "feedback loop." Currently, when an agent confirms a true positive, that data is rarely fed back into the ML training pipeline automatically.
By capturing confirmed incident data, extracting the malicious parameters, and using them to retrain models, organizations could theoretically create a detection system that evolves alongside its specific threat landscape. Research into "Zero-Trust Agentic Federated Learning" suggests that this loop could even be distributed across multiple organizations, allowing the entire community to benefit from the discovery of a novel exploit in a single network.
Operational Recommendations for Deployment
For organizations deploying Snort 3 with SnortML, experts recommend a phased operational posture:
- Passive Evaluation: Run SnortML in "alert-only" mode for at least two weeks to establish a baseline. This allows administrators to identify legitimate applications—such as those using unusual REST API encodings—that might trigger false positives.
- Composite Scoring: Do not use ML scores as a standalone trigger for automated blocking. Instead, incorporate the score into a composite confidence calculation within the agentic layer.
- Conservative Response: While investigation should be heavily automated, final containment actions (such as blocking a critical infrastructure IP) should remain subject to human-in-the-loop validation to prevent attackers from weaponizing the automated response system for Denial-of-Service attacks.
As the industry moves toward 2026, the success of network defense will depend less on the volume of alerts generated and more on the quality of the reasoning applied to them. The marriage of packet-level machine learning and agentic orchestration represents the most viable path forward in closing the gap between the attacker’s choice and the defender’s response.
