Cisco Talos shipped SnortML in March 2024, embedding a machine learning detection engine directly inside Snort 3. The system classifies HTTP parameters for exploit attempts in roughly 350 microseconds per request, running entirely on the local firewall without phoning home to cloud services. By late 2025, coverage had expanded from SQL injection to cross-site scripting and command injection attack classes, with models delivered through Snort's existing Lightweight Security Package update channel.
How SnortML Detects What Signatures Miss
Traditional Snort rules encode specific, verifiable knowledge about known attacks. A well-crafted signature catches a specific CVE with minimal false positives. The problem is exposure time. Between a novel exploit surfacing and a researcher writing, testing, and shipping a rule, days or weeks pass. For actively exploited vulnerabilities, that window is not theoretical.
SnortML takes a different approach. Instead of matching known patterns, it learns the shape of entire attack classes. An LSTM neural network preceded by an embedding layer processes raw byte sequences from HTTP parameters. The embedding layer converts raw bytes into learned vectors, capturing relationships that simple frequency counting cannot detect. The byte 0x27 appearing beside 0x4F 0x52 carries learned context about SQL injection patterns. The LSTM processes these sequences to capture temporal structure, and a final dense layer outputs a probability score.
LibML, the inference library shipped with SnortML, relies on XNNPACK for hardware-accelerated matrix math. On current AMD hardware running at 4.7 GHz, one classification pass finishes in roughly 350 microseconds. The system automatically selects between models sized for 256, 512, or 1024 byte inputs based on query length, keeping overhead predictable. For queries exceeding 1024 bytes, the input gets truncated before classification.
Running Parallel to Traditional Detection
SnortML is not designed to displace signature-based detection. The two detection paths operate simultaneously and meet at the verdict stage. Each path can raise an alert on its own, and when both paths identify the same payload, the combined signal carries stronger confidence than ML alone.
This design is deliberate. Neural networks trained on vulnerability classes occasionally misfire on legitimate traffic that resembles attack syntax. URL-encoded special characters in a valid database query are a common trigger. Classical signatures provide a low-noise floor for known patterns while ML catches novel variants that signatures miss.
The float-based scoring helps systems further down the pipeline. Because the classifier returns a probability rather than a binary match, automated triage systems can weight alerts differently. A detection combining a signature match with a 0.97 SnortML score gets routed very differently from one where only the ML fired at 0.61.
The Agentic AI Layer Above the Sensor
SnortML operates at the wire level, scoring individual HTTP parameters. What it cannot see is temporal context: the three-request sequence where a probe maps input validation, an enumeration identifies injectable parameters, and a tailored exploit follows. Each request viewed alone might score below threshold. The third is dangerous precisely because of the first two.
This is where agentic AI enters the picture. The worldwide shortage of cybersecurity professionals stands at roughly four million open roles. In a 2025 survey, 82% of SOC analysts expressed concern about overlooking genuine threats due to sheer alert volume. Adding detection capabilities without changing triage workflows generates more alerts, not better outcomes.
Under an agentic model, Snort's event stream flows straight into automated reasoning chains. Dedicated agents manage deduplication, enrich alerts with threat intelligence, correlate across data sources, and map historical context. False positives do more than waste analyst time. They waste agent compute cycles and may set off automated containment actions in poorly configured setups. The accuracy requirements for the sensor layer go up when machines, not humans, are consuming the output.
The Feedback Loop That Matters Most
When SnortML flags a confirmed exploit, the triggering payload holds syntactic patterns that could inform new signatures. A large language model with access to that payload and knowledge of Snort rule syntax could draft candidate signatures, hardening classical coverage for future instances.
This produces a valuable cycle: ML covers novel cases that signatures miss, and confirmed detections feed a pipeline that strengthens classical coverage. The research question is concrete and measurable. How do LLM-generated Snort rules compare to manually authored ones in false positive rate, generalization across variants, and processing overhead?
Adversarial robustness is another open question. An adversary aware of SnortML could systematically probe where the model draws its boundaries, testing obfuscated variants and encoding tricks to find inputs that preserve exploit functionality while scoring below threshold. Public evaluations of where that boundary lies and how it holds up under deliberate probing have not yet been released. The operational security community deserves published adversarial robustness evaluations for a system running in production Cisco Secure Firewall deployments today.
Looking Ahead
SnortML marks a mature first step: production machine learning that tackles a specific, well-defined problem without touching the reliability properties Snort deployments depend on. The agentic layer above it is less mature, though the operational pressure pushing adoption will not ease. Most organizations currently sit at the intersection of packet-level ML detection and agentic investigation, aware that both layers exist and still working out how to connect them reliably.
The next milestone to watch is whether Cisco Talos publishes adversarial robustness evaluations for SnortML's models, and whether the attribution tooling needed to explain why a specific byte sequence triggered the classifier makes it into production releases.