BTGPT: Generative Pretrained Transformer for Benign Network Traffic

The rapid proliferation of encrypted communication and polymorphic attack vectors has rendered traditional signature-based or heuristic-based traffic analysis increasingly fragile. We introduce BTGPT (Benign-Traffic Generative Pre-trained Transformer)-a domain-specialised large language model that learns normative traffic patterns end-to-end and flags semantic deviations indicative of compromise. BTGPT is built through four tightly coupled stages: (i) language-agnostic generative pre-training on network traffic pcap corpora, (ii) cross-lingual code-centric pre-training on 32 programming languages, (iii) enterprise-specific fine-tuning on labelled benign and malicious flows, and (iv) continuous incremental re-training fed by live telemetry. Evaluated on three public benchmarks and an internal utility-grid dataset containing $\mathbf{0. 6 8 M}$ packets, BTGPT achieves 87.53% benign-flow recognition F1 while maintaining < 10% false-negative rate on novel attack samples. Moreover, ablation shows a 46% reduction in detection latency compared with purely discriminative baselines. These findings suggest that generative modelling of “white traffic” can serve as a robust, self-evolving defensive sentinel for critical infrastructure networks.