Using Large Language Models to Detect Network Attacks Across Multiple Traffic Flows

What is it about?

Most network attack detection methods analyze each traffic flow separately. However, complex attacks often involve multiple related flows, and important signs of malicious behavior may only become clear when these flows are considered together. In this work, we develop a large language model-based approach that analyzes both individual traffic characteristics and relationships across multiple flows. The method organizes traffic into meaningful contexts and uses information such as communication endpoints, ports, protocols, and traffic patterns to help the model identify related behaviors. We evaluate the approach on DDoS attacks and malicious encrypted traffic, including previously unseen attacks and cross-dataset scenarios.

Featured Image

Photo by Aerps.com on Unsplash

Photo by Aerps.com on Unsplash

Why is it important?

Modern cyberattacks are increasingly coordinated and complex, so analyzing traffic flows independently can miss important relationships between malicious activities. Our results show that modeling interactions across multiple flows can improve the detection of complex and previously unseen attacks and provide more stable performance across different network environments. The study also shows that large language models can be adapted beyond text processing to structured cybersecurity data when network-specific relationships are properly incorporated. This provides a promising direction for developing more accurate and generalizable network attack detection systems.

Perspectives