With significant advancements in Transformers LLMs, NLP has extended its reach into many research fields due to its enhanced capabilities in text generation and user interaction. One field benefiting greatly from these advancements is cybersecurity. In cybersecurity, many parameters that need to be protected and exchanged between senders and receivers are in the form of text and tabular data, making NLP a valuable tool in enhancing the security measures of communication protocols. This survey paper provides a comprehensive analysis of the utilization of Transformers and LLMs in cyber-threat detection systems. The methodology of paper selection and bibliometric analysis is outlined to establish a rigorous framework for evaluating existing research. The fundamentals of Transformers are discussed, including background information on various cyber-attacks and datasets commonly used in this field. The survey explores the application of Transformers in IDSs, focusing on different architectures such as Attention-based models, LLMs like BERT and GPT, CNN/LSTM-Transformer hybrids, emerging approaches like ViTs, among others. Furthermore, it explores the diverse environments and applications where Transformers and LLMs-based IDS have been implemented, including computer networks, IoT devices, critical infrastructure protection, cloud computing, SDN, as well as in autonomous vehicles. The paper also addresses research challenges and future directions in this area, identifying key issues such as interpretability, scalability, and adaptability to evolving threats, and more. Finally, the conclusion summarizes the findings and highlights the significance of Transformers and LLMs in enhancing cyber-threat detection capabilities, while also outlining potential avenues for further research and development.
FedSecureFormer: A Fast, Federated and Secure Transformer Framework for Lightweight Intrusion Detection in Connected and Autonomous Vehicles
Department of Computer Science and Information Systems, BITS Pilani, Pilani Campus（计算机科学与信息系统系，比斯汉学院）；Department of Systems and Computer Engineering, Carleton University（系统与计算机工程系，卡尔顿大学）
Large Language Models for Network Intrusion Detection Systems: Foundations, Implementations, and Future Directions
Department of Electrical and Electronic Engineering, The University of Hong Kong（香港大学电子与电气工程系）；Department of Electronic Engineering, Tsinghua University（清华大学电子工程系）；National Institute of Health Data Science, Peking University（北京大学健康数据科学国家研究院）；Data Science and Analytics Thrust, Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州）数据科学与分析方向）
From Network Intrusion Detection to Blockchain-Backed Endpoint Detection and Response: Mapping the Landscape of Decentralized Detection-and-Response Architectures
École de technologie supérieure (ÉTS)（高等技术学院（ÉTS））；University of Calgary（卡尔加里大学）
BARTPredict: Empowering IoT Security with LLM-Driven Cyber Threat Prediction
Badji Mokhtar-Annaba University（巴吉·穆克塔尔-安纳巴大学）；University of La Rochelle（拉罗谢尔大学）；National Higher School of Technology and Engineering -Annaba（安纳巴国家技术与工程高等学校）
Advancing Transformer Architecture in Long-Context Large Language Models: A Comprehensive Survey
State Key Lab of Novel Software Technology, Nanjing University（南京大学计算机软件新技术国家重点实验室）；School of Computing and Mathematical Sciences, Birkbeck, University of London（伦敦大学伯克贝克学院计算与数学科学学院）
A Novel Unified Lightweight Temporal-Spatial Transformer Approach for Intrusion Detection in Drone Networks
Department of Computer Science and Engineering, Jahangirnagar University（贾杭吉纳大学计算机科学与工程系）；Department of Computer Science and Engineering, Bangladesh Army University of Science & Technology（孟加拉国陆军科学技术大学计算机科学与工程系）；State University of Bangladesh, Department of Computer Science and Engineering（孟加拉国国立大学计算机科学与工程系）；Skill Morph Research Lab., Skill Morph（Skill Morph研究实验室）
Self-Supervised Transformer-based Contrastive Learning for Intrusion Detection Systems
Dept. of Electrical and Computer Engineering, University of Thessaly（电气与计算机工程系，希腊塞萨洛尼基大学）；Centre for Research and Technology Hellas, CERTH（希腊研究中心与技术中心，CERTH）
AI-driven Intrusion Detection for UAV in Smart Urban Ecosystems: A Comprehensive Survey
College of Computer Science and Information Systems, Najran University（纳季兰大学计算机科学与信息系统学院）；Saudi Technology and Security Comprehensive Control Company (Tahakom)（沙特技术与安全综合控制公司（塔哈科姆））；National School of Artificial Intelligence (ENSIA)（国立人工智能学院）；Computer, Electrical, and Mathematical Sciences and Engineering (CEMSE) Division, King Abdullah University of Science and Technology (KAUST)（阿卜杜拉国王科技大学计算机、电气和数学科学与工程部）
SE-Enhanced ViT and BiLSTM-Based Intrusion Detection for Secure IIoT and IoMT Environments
LSEA Lab., Faculty of Technology University of MEDEA Medea 26000, Algeria；LSEA Lab, Faculty of Science University of MEDEA Medea 26000, Algeria；Department of Computer Engineering Gazi University Ankara, Turkey；Department of Management Information Systems Gazi University Ankara, Turkey
Deep Adversarial Learning in Intrusion Detection: A Data Augmentation Enhanced Framework
University of Exeter（埃克塞特大学）；China University of Petroleum (East China)（中国石油大学（华东））
入侵检测系统（IDS）在识别网络系统中的恶意攻击和威胁方面发挥着重要作用。作为入侵检测系统的基本工具，基于学习的分类方法得到了广泛的应用。当涉及到检测小样本大小的网络入侵时（例如，新兴的入侵），训练样本的数量有限和比例不平衡通常会给监督和半监督分类器的训练带来重大挑战。在本文中，我们提出了一个通用的网络入侵检测框架，以解决\emph{data scarcity}和\emph{data imbalance}的挑战。所提出的框架的新颖之处在于将深度对抗学习与统计学习相结合，并利用基于学习的数据增强。针对少量网络入侵样本，首先推导出Poisson-Gamma联合概率生成模型，利用蒙特卡罗方法生成综合入侵数据。然后，这些合成数据通过对抗性学习由深度生成神经网络增强。最后，采用扩充后的入侵数据训练监督模型，用于检测网络入侵。在KDD Cup 99数据集上的实验结果表明，该框架在准确率、查准率、查全率和F1得分等方面均优于现有的基于学习的入侵检测系统。
A Survey for Deep Reinforcement Learning Based Network Intrusion Detection
Department of Computer Sciences, University of Liverpool（计算机科学系，利物浦大学）；Centre for Doctoral Training (CDT) in Distributed Algorithm, University of Liverpool（分布式算法博士培训中心，利物浦大学）；Department of Electrical Engineering and Electronics, University of Liverpool（电子工程与电子系，利物浦大学）；Shenzhen Institute of Advanced Technology, Chinese Academy of Sciences（深圳先进技术研究所，中国科学院）
Open Set Dandelion Network for IoT Intrusion Detection
Shenzhen Institute of Advanced Technology, Chinese Academy of Sciences（中国科学院深圳先进技术研究院）；University of Chinese Academy of Sciences（中国科学院大学）；University of New Brunswick（新不伦瑞克大学）；University of Macau（澳门大学）
Heterogeneous Domain Adaptation for IoT Intrusion Detection: A Geometric Graph Alignment Approach
Shenzhen Institute of Advanced Technology, Chinese Academy of Sciences（中国科学院深圳先进技术研究院）；University of Chinese Academy of Sciences（中国科学院大学）；University of Macau（澳门大学）
Intrusion Detection in IoT Networks Using Hyperdimensional Computing: A Case Study on the NSL-KDD Dataset
Computer Science and Engineering, Wright State University, Ohio, USA（计算机科学与工程系，怀特州立大学，俄亥俄州，美国）；Computer Science and Engineering, Azad University, Ahvaz, Iran（计算机科学与工程系，阿扎德大学，阿瓦兹，伊朗）
ExAI5G: A Logic-Based Explainable AI Framework for Intrusion Detection in 5G Networks
organization= Faculty of Information Technology；Electrical Engineering, University of Oulu , addressline= , city= Oulu , postcode= 90570 , state= , country= Finland
