将数据包视为语言：使用 Transformer 进行异常检测
Take Package as Language: Anomaly Detection Using Transformer
AI总结：
提出 NIDS-GPT，将数据包数字按语言 token 建模，用改进 GPT-2、特殊 tokenizer 与注意力可视化实现高精度、可解释的弱监督网络异常检测。
摘要：
网络数据包异常检测面临诸多挑战，包括探索新的异常监督信号、研究弱监督异常检测以及提升模型可解释性。本文提出 NIDS-GPT，这是一种用于网络入侵检测、基于 GPT 的因果语言模型。与以往工作不同，NIDS-GPT 创新性地将数据包中的每个数字视为独立的“词”，而非数据包字段，从而实现更细粒度的数据表示。我们采用改进的 GPT-2 模型，并设计特殊的 tokenizer 和嵌入层，以更好地捕捉网络数据的结构与语义。NIDS-GPT 具有良好的可扩展性，支持无监督预训练，并通过注意力权重可视化增强模型可解释性。在 CICIDS2017 和 car-hacking 数据集上的实验表明，NIDS-GPT 在极端不平衡条件下达到 100% 准确率，远超传统方法；它在 one-shot 学习中也取得超过 90% 的准确率。这些结果证明了 NIDS-GPT 在处理复杂网络异常检测任务，尤其是在数据不平衡和资源受限场景中的优异性能与潜力。代码可在 https://github.com/woshixiaobai2019/nids-gpt.gi 获取。
英文摘要：
Network data packet anomaly detection faces numerous challenges, including exploring new anomaly supervision signals, researching weakly supervised anomaly detection, and improving model interpretability. This paper proposes NIDS-GPT, a GPT-based causal language model for network intrusion detection. Unlike previous work, NIDS-GPT innovatively treats each number in the packet as an independent "word" rather than packet fields, enabling a more fine-grained data representation. We adopt an improved GPT-2 model and design special tokenizers and embedding layers to better capture the structure and semantics of network data. NIDS-GPT has good scalability, supports unsupervised pre-training, and enhances model interpretability through attention weight visualization. Experiments on the CICIDS2017 and car-hacking datasets show that NIDS-GPT achieves 100\% accuracy under extreme imbalance conditions, far surpassing traditional methods; it also achieves over 90\% accuracy in one-shot learning. These results demonstrate NIDS-GPT's excellent performance and potential in handling complex network anomaly detection tasks, especially in data-imbalanced and resource-constrained scenarios. The code is available at \url{https://github.com/woshixiaobai2019/nids-gpt.gi
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
