Large Language Models (LLMs) have revolutionised natural language processing tasks, particularly as chat agents. However, their applicability to threat detection problems remains unclear. This paper examines the feasibility of employing LLMs as a Network Intrusion Detection System (NIDS), despite their high computational requirements, primarily for the sake of explainability. Furthermore, considerable resources have been invested in developing LLMs, and they may offer utility for NIDS. Current state-of-the-art NIDS rely on artificial benchmarking datasets, resulting in skewed performance when applied to real-world networking environments. Therefore, we compare the GPT-4 and LLama3 models against traditional architectures and transformer-based models to assess their ability to detect malicious NetFlows without depending on artificially skewed datasets, but solely on their vast pre-trained acquired knowledge. Our results reveal that, although LLMs struggle with precise attack detection, they hold significant potential for a path towards explainable NIDS. Our preliminary exploration shows that LLMs are unfit for the detection of Malicious NetFlows. Most promisingly, however, these exhibit significant potential as complementary agents in NIDS, particularly in providing explanations and aiding in threat response when integrated with Retrieval Augmented Generation (RAG) and function calling capabilities.
Large Language Models for Network Intrusion Detection Systems: Foundations, Implementations, and Future Directions
Department of Electrical and Electronic Engineering, The University of Hong Kong（香港大学电子与电气工程系）；Department of Electronic Engineering, Tsinghua University（清华大学电子工程系）；National Institute of Health Data Science, Peking University（北京大学健康数据科学国家研究院）；Data Science and Analytics Thrust, Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州）数据科学与分析方向）
A Hybrid Approach for an Interpretable and Explainable Intrusion Detection System
Research Group on Intelligent Engineering and Computing for Advanced Innovation and Development (GECAD), Porto School of Engineering (ISEP)（波尔图工程学院（ISEP）智能工程与先进创新开发计算研究组（GECAD））
ExAI5G: A Logic-Based Explainable AI Framework for Intrusion Detection in 5G Networks
organization= Faculty of Information Technology；Electrical Engineering, University of Oulu , addressline= , city= Oulu , postcode= 90570 , state= , country= Finland
Explainable AI for Comparative Analysis of Intrusion Detection Models
Embry-Riddle Aeronautical University（安柏瑞德航空大学）；University of Tennessee at Martin（田纳西大学马丁分校）；Bowling Green State University（鲍灵格林州立大学）；University of Maryland, Baltimore County（马里兰大学巴尔的摩郡分校）
Explainable AI-based Intrusion Detection System for Industry 5.0: An Overview of the Literature, associated Challenges, the existing Solutions, and Potential Research Directions
Hamad bin Khalifa University（哈马德·本·哈利法大学）；Qatar Computing Research Institute（卡塔尔计算研究所）；Munster Technological University（芒斯特理工大学）；Toronto Metropolitan University（多伦多都会大学）
XAI-SOH-FL: Enhancing SOH-FL with Adaptive Aggregation and Explainable AI for Intrusion Detection in Heterogeneous IoT
School of Electrical Engineering and Computer Science (SEECS), National University of Sciences and Technology (NUST)（电气工程与计算机科学学院（SEECS），国家 sciences and Technology（NUST））
Automated and Explainable Denial of Service Analysis for AI-Driven Intrusion Detection Systems
Computer and Information Science Department, Fordham University（福特汉姆大学计算机与信息科学系）；RENCI, University of North Carolina at Chapel Hill（北卡罗来纳大学教堂山分校RENCI）；Department of Mathematics and Computer Science, Royal Military College of Canada（加拿大皇家军事学院数学与计算机科学系）；Data Science Department, University of North Texas（德克萨斯大学纳夫卡特数据科学系）
LENS-XAI: Redefining Lightweight and Explainable Network Security through Knowledge Distillation and Variational Autoencoders for Scalable Intrusion Detection in Cybersecurity
Kırıkkale University（克尔克卡拉大学）；University College Dublin（都柏林大学学院）；CeADAR；School of Computer Science（计算机科学学院）
Explainable AI-Driven Cyber Risk Analytics and Model Reliability Assessment for Intelligent Governance of U.S. Critical Infrastructure: An XGBoost and SHAP-Based Intrusion Detection Framework
Department of Business Information Systems, Central Michigan University（中央密歇根大学商业信息系统系）；Department of Information Studies, Trine University（特林大学信息学系）；Department of Computer Science, Maharishi International University（Maharishi国际大学计算机科学系）
Application Layer Intrusion Detection with Combination of Explicit-Rule- Based and Machine Learning Algorithms and Deployment in Cyber- Defence Program
FedSecureFormer: A Fast, Federated and Secure Transformer Framework for Lightweight Intrusion Detection in Connected and Autonomous Vehicles
Department of Computer Science and Information Systems, BITS Pilani, Pilani Campus（计算机科学与信息系统系，比斯汉学院）；Department of Systems and Computer Engineering, Carleton University（系统与计算机工程系，卡尔顿大学）
A Survey for Deep Reinforcement Learning Based Network Intrusion Detection
Department of Computer Sciences, University of Liverpool（计算机科学系，利物浦大学）；Centre for Doctoral Training (CDT) in Distributed Algorithm, University of Liverpool（分布式算法博士培训中心，利物浦大学）；Department of Electrical Engineering and Electronics, University of Liverpool（电子工程与电子系，利物浦大学）；Shenzhen Institute of Advanced Technology, Chinese Academy of Sciences（深圳先进技术研究所，中国科学院）
