Anomaly Based Intrusion Detection using Large Language Models

Published

June 15, 2024

Author(s)

Zineb Maasaoui, Abdella Battou, Mheni Merzouki, Ahmed LBATH

Abstract

In the context of modern networks where cyber-attacks are increasingly complex and frequent, traditional Intrusion Detection Systems (IDS) often struggle to manage the vast volume of data and fail to detect novel attacks. Leveraging Artificial Intelligence, specifically Natural Language Processing with transformer architectures, offers a promising solution. This study applies the Bidirectional Encoder Representations from Transformers (BERT) model, enhanced by a Byte-level Byte-pair tokenizer, to effectively identify network-based attacks within IoT systems. Experiments on three datasets—UNSW-NB15, TON-IoT, and Edge-IIoT—show that our approach substantially outperforms traditional methods in multi-class classification tasks. Notably, we achieved near-perfect classification accuracy on the Edge-IIoT dataset, with significant improvements in F1 scores and reduction in validation losses across all datasets, demonstrating the efficacy of pre-trained Large Language Models (LLMs) in network security.

Proceedings Title

The ACS/IEEE 21st International Conference on Computer Systems and Applications (AICCSA 2024)

Conference Dates

October 22-26, 2024

Conference Location

sousse, TN

Pub Type

Conferences

Keywords

Network intrusion, Network security, Natural language processing, Large Language Model, BERT, BBPE, AI, IoT

Citation

Maasaoui, Z. , Battou, A. , Merzouki, M. and Lbath, A. (2024), Anomaly Based Intrusion Detection using Large Language Models, The ACS/IEEE 21st International Conference on Computer Systems and Applications (AICCSA 2024), sousse, TN (Accessed April 24, 2026)

Additional citation formats