Anomalous Network Access Detection with Large Language Model

Accurately detecting and handling abnormal access behaviors is crucial for the stable operation of network systems, while traditional anomaly detection methods are usually difficult to deeply understand and identify existing complex network security scenarios and potential threats, which limits their application in power network systems. To solve this problem, this paper proposes a network anomaly detection method based on a large language model (LLM). This method constructs a high-quality network security dataset by aligning multimodal network system data with natural language methods, and uses continuous pre-training and supervised fine-tuning methods to train a vertical domain large language model (NS-LLM) for network system anomaly detection, thereby helping the vertical domain model to effectively understand complex network access behavior patterns. In addition, this method also uses the model's network security knowledge and cross-domain reasoning capabilities to construct a mechanism for identifying and handling abnormal patterns, further enhancing the system's ability to detect and respond to complex or potentially abnormal access behaviors. Experimental results show that the method designed in this paper is significantly superior to traditional methods in terms of accuracy and robustness.