Existing methods for detection rule generation are tightly coupled to specific input-output combinations, requiring dedicated pipelines for each. We formalize this problem as a unified mapping f:C*L->R and characterize optimal rules through semantic distance. We propose UniRule, an agentic RAG framework built on dual semantic projection spaces: detection intent and detection logic. This design enables retrieval and generation across arbitrary contexts and target languages within a single system. Experiments across 12 scenarios (3 languages, 4 context types, 12,000 pairwise comparisons) show that UniRule significantly outperforms pure LLM generation with a Bradley-Terry coefficient of 0.52, validating semantic projection as an effective abstraction for unified rule generation. Together, the formalization, method, and evaluation provide an initial framework for studying detection rule generation as a unified task.

翻译：现有的检测规则生成方法与特定的输入-输出组合紧密耦合，需要为每种组合设计专用流水线。我们将该问题形式化为统一映射 f:C×L→R，并通过语义距离刻画最优规则。本文提出 UniRule——一种基于双重语义投影空间（检测意图与检测逻辑）的智能检索增强生成框架。该设计使得在同一系统中能够跨任意上下文和目标语言进行检索与生成。在12个实验场景（3种语言、4种上下文类型、12,000组配对比较）中，UniRule 以0.52的Bradley-Terry系数显著优于纯大语言模型生成，验证了语义投影作为统一规则生成的有效抽象。形式化方法、框架与评估共同为将检测规则生成作为统一任务研究提供了初步框架。