RT journal article
T1 LLM-Based Cyberattack Detection Using Network Flow Statistics
A1 Gutiérrez Galeano, Leopoldo Jesús
A1 Domínguez Jiménez, Juan José
A1 Schäfer, Jörg
A1 Medina Bulo, María Inmaculada
A2 Ingeniería Informática
K1 large language model
K1 machine learning
K1 fine-tuning
K1 deep learning
K1 cybersecurity
K1 network security
K1 cyberthreat
K1 attack detection
K1 multiclass classification
K1 attack classification
AB Cybersecurity is a growing area of research due to the constantly emerging newtypes of cyberthreats. Tools and techniques exist to keep systems secure against certainknown types of cyberattacks, but are insufficient for others that have recently appeared.Therefore, research is needed to design new strategies to deal with new types of cyberattacks as they arise. Existing tools that harness artificial intelligence techniques mainlyuse artificial neural networks designed from scratch. In this paper, we present a novelapproach for cyberattack detection using an encoder–decoder pre-trained Large LanguageModel (T5), fine-tuned to adapt its classification scheme for the detection of cyberattacks.Our system is anomaly-based and takes statistics of already finished network flows asinput. This work makes significant contributions by introducing a novel methodology foradapting its original task from natural language processing to cybersecurity, achieved bytransforming numerical network flow features into a unique abstract artificial languagefor the model input. We validated the robustness of our detection system across threedatasets using undersampling. Our model achieved consistently high performance acrossall evaluated datasets. Specifically, for the CIC-IDS-2017 dataset, we obtained an accuracy, precision, recall, and F-score of more than 99.94%. For CSE-CIC-IDS-2018, thesemetrics exceeded 99.84%, and for BCCC-CIC-IDS-2017, they were all above 99.90%. Theseresults collectively demonstrate superior performance for cyberattack detection, whilemaintaining highly competitive false-positive rates and false-negative rates. This efficacy isachieved by relying exclusively on real-world network flow statistics, without the need forsynthetic data generation.
PB MDPI
SN 2076-3417
YR 2025
FD 2025-06-10
LK http://hdl.handle.net/10498/38738
UL http://hdl.handle.net/10498/38738
LA eng
DS Repositorio Institucional de la Universidad de Cádiz
RD 10-nov-2026