TrafficLLM: Enhancing Large Language Models for Network Traffic Analysis with Generic Traffic Representation
This addresses the problem of improving threat detection and traffic generation for network security practitioners, representing a novel method for a known bottleneck.
The paper tackles the limited generalization of machine learning in network traffic analysis by proposing TrafficLLM, a dual-stage fine-tuning framework for large language models, which achieves F1-scores up to 0.9875 and 0.9483 with performance improvements of up to 80.12% and 33.92% over existing methods across diverse scenarios.
Machine learning (ML) powered network traffic analysis has been widely used for the purpose of threat detection. Unfortunately, their generalization across different tasks and unseen data is very limited. Large language models (LLMs), known for their strong generalization capabilities, have shown promising performance in various domains. However, their application to the traffic analysis domain is limited due to significantly different characteristics of network traffic. To address the issue, in this paper, we propose TrafficLLM, which introduces a dual-stage fine-tuning framework to learn generic traffic representation from heterogeneous raw traffic data. The framework uses traffic-domain tokenization, dual-stage tuning pipeline, and extensible adaptation to help LLM release generalization ability on dynamic traffic analysis tasks, such that it enables traffic detection and traffic generation across a wide range of downstream tasks. We evaluate TrafficLLM across 10 distinct scenarios and 229 types of traffic. TrafficLLM achieves F1-scores of 0.9875 and 0.9483, with up to 80.12% and 33.92% better performance than existing detection and generation methods. It also shows strong generalization on unseen traffic with an 18.6% performance improvement. We further evaluate TrafficLLM in real-world scenarios. The results confirm that TrafficLLM is easy to scale and achieves accurate detection performance on enterprise traffic.