# LLM-Based Cyberattack Detection Using Network Flow Statistics
## 3 Experimental Results
Its FNR is particularly low, indicating robust detection of true positives. The BCCC-CIC-IDS-2017 also maintained a highly respectable FPR of 0.11% and an FNR of 0.04%. Figure 4 displays the progression of the training loss, validation loss, and validation accuracy over ten epochs for our models trained on the CSE-CIC-IDS2018, CIC-IDS-2017, and BCCC-CIC-IDS-2017 datasets. A clear decrease in both loss values is observed within the first two epochs, indicating that the model rapidly learns the fundamental patterns from the data. Following this initial phase, both the training loss and validation loss curves converge and stabilize at very low values. Notably, the validation loss remains consistently low and does not exhibit an upward trend as training progresses, which would be a clear indicator of overfitting. This behavior provides strong evidence that the three models generalize effectively to unseen data and do not present overfitting. Simultaneously, the validation accuracy curve shows a rapid initial increase, stabilizing at very high values, which complements the information provided by the loss curves. This consistent behavior across all three datasets provides strong evidence that our models not only learn effectively from the training data but also generalize robustly to unseen data and do not suffer from overfitting. Concerning detection latency, our system consistently demonstrated efficient processing times across all datasets. The CIC-IDS-2017 showed an average latency of 0.035 s, compared to 0.032 s for CSE-CIC-IDS2018, and 0.037 s for BCCC-CIC-IDS-2017. These low \begin{table}
\begin{tabular}{l c c c c c c c} \hline \hline
**Dataset** & **Accuracy** & **Precision** & **Recall** & **F-score** & **FPR** & **FNR** & **Detection Latency** \\ \hline CIC-IDS-2017 & 99.94\% & 99.94\% & 99.94\% & 99.94\% & 0.01\% & 0.05\% & 0.035 s \\ CSE-CIC-IDS2018 & 99.84\% & 99.84\% & 99.84\% & 99.84\% & 0.27\% & 0.02\% & 0.032 s \\ BCCC-CIC-IDS-2017 & 99.90\% & 99.90\% & 99.90\% & 99.90\% & 0.11\% & 0.04\% & 0.037 s \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Results of our approach for different datasets. latency values highlight the potential for integrating our LLM-based solution into systems requiring timely threat analysis. Overall, despite minor variations, the results across all datasets are remarkably consistent and demonstrate highly promising values for all selected metrics, underscoring the robustness and reliability of our proposed LLM-based cyberattack detection approach. At this stage, we can thus compare our results with the aforementioned research papers. This comparison focuses on widely accepted performance metrics, including accuracy, precision, recall, F1-score, FPR, and FNR. It is important to note that direct comparisons of detection latency were not feasible due to variations in the hardware environments used for model training and inference reported in the respective literature, which could significantly skew such comparisons. Therefore, our focus remains on the efficacy of detection. We already demonstrated the validity of our methodology across different datasets. Section 4 compares our approach with different strategies published in other research papers.