## 2 Related Work
### Large Language Model-Based Detection for Encrypted Malicious Traffic  
In recent years, the integration of LLMs and intrusion detection technology has injected new vitality into the field of network security, especially in scenarios such as data scarcity, complex attack patterns, and encrypted traffic [32]. Compared with traditional methods that rely on fixed features or rules, LLMs have powerful context understanding and data generation capabilities that can solve the problems of uneven data distribution or insufficient training samples in ML and deep learning training and enhance model training by synthesizing high-quality network traffic data, thereby effectively alleviating data offset and category imbalance [1]. Generative model solutions represented by PAC-GPT demonstrate the feasibility of using GPT-3 to generate network traffic data to make up for the insufficient distribution of actual datasets [15]. This method not only improves the generalization ability and accuracy of intrusion detection models but also provides a more diverse source of training data for simulating real network attack behaviors. Especially in the encrypted traffic detection scenario, due to the inability to directly obtain plaintext content, traditional detection methods face great limitations in modeling capabilities and attack identification accuracy [3]. Therefore, LLMs can be used to construct richer contextual features based on the traffic data generated by early feature research, improving the detection ability of hidden attacks in encrypted communications. In addition, the study also showed that combining neural domain features with sequence modeling technology, such as LSTM-based detection models, has better performance than traditional methods in malware detection in encrypted HTTPS traffic, especially in identifying new or variant malware [23]. With the introduction of models such as BT-TPF and Can-SecureBERT, the performance of LLMs in the encrypted communication environment of the IoT has become increasingly prominent. Some models have achieved more than 98% detection accuracy and low FPR in complex scenarios [24; 28]. Despite this, there are still certain challenges in the application of LLMs in intrusion detection systems. First, whether the generated synthetic data can truly and comprehensively reflect the complex and changeable attack patterns in the network lacks systematic verification [32]. Secondly, due to the limitations of resource utilization and actual scenario deployment, LLMs rely on a large number of training samples and historical data, making it difficult to meet the requirements of real-time detection and rapid responses [33]. In addition, while improving detection performance, LLMs also bring problems such as high computational overhead, high deployment cost, and long system response time, which limit its feasibility in resource-constrained environments or large-scale deployment scenarios [15]. At present, research is still mainly focused on the modeling and identification of known threat patterns. In the face of unknown or fuzzy attack traffic, the generalization ability of the model still has room for improvement [28]. Therefore, future research can focus on multi-source heterogeneous data fusion and statistical-semantic feature collaborative modeling, combined with a lightweight generation framework, to improve the system's ability to adapt to complex threat behaviors in encrypted traffic, reduce the dependence on manual intervention, and thus achieve an efficient and scalable intelligent intrusion detection system [3].