Fine-Tuning Large Language Models for Network Traffic Analysis in Cyber Security

Language modelling has demonstrated the exceptional interpretation and analysis capabilities of Large Language Models (LLMs) in addressing a wide range of Natural Language Processings (NLPs) tasks. However, LLMs still face challenges in technical network text analysis due to its special terminology, syntax, and protocols which are not consistent with conventional human language. In this paper, we introduce a method for fine-tuning NLP-based LLMs on technical network text intended for machine comprehension. We apply our method to detect and classify different types of attacks in network traffic flows. To validate our method, we used the Kitsune Network Attack Dataset and our results show that our method is able to correctly classify the network attacks, even in adverse conditions, when the model receives irrelevant context for classification. This study highlights how the capabilities of LLMs can be extended across different unknown domains, specifically cyber security, thereby enhancing their ability to detect anomalies, classify them, and distinguish between various types of attacks. Our experiments show that fine-tuned models significantly outperform non-fine-tuned models, underlining the effectiveness of fine-tuning LLMs for cyber security applications involving the analysis of technical text data.