These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
Malicious traffic detection is a pivotal technology for network security to
identify abnormal network traffic and detect network attacks. Large Language
Models (LLMs) are trained on a vast corpus of text, have amassed remarkable
capabilities of context-understanding and commonsense knowledge. This has
opened up a new door for network attacks detection. Researchers have already
initiated discussions regarding the application of LLMs on specific
cyber-security tasks. Unfortunately, there remains a lack of comprehensive
analysis on harnessing LLMs for traffic detection, as well as the opportunities
and challenges. In this paper, we focus on unleashing the full potential of
Large Language Models (LLMs) in malicious traffic detection. We present a
holistic view of the architecture of LLM-powered malicious traffic detection,
including the procedures of Pre-training, Fine-tuning, and Detection.
Especially, by exploring the knowledge and capabilities of LLM, we identify
three distinct roles LLM can act in traffic classification: Classifier,
Encoder, and Predictor. For each of them, the modeling paradigm, opportunities
and challenges are elaborated. Finally, we present our design on LLM-powered
DDoS detection as a case study. The proposed framework attains accurate
detection on carpet bombing DDoS by exploiting LLMs' capabilities in contextual
mining. The evaluation shows its efficacy, exhibiting a nearly 35% improvement
compared to existing systems.