# LLM-Based Cyberattack Detection Using Network Flow Statistics
## 5 Conclusions and Future Work  
The dynamic and increasing range of cyberattacks presents a significant challenge to current security systems, necessitating the development of new strategies for robust threat detection. The current study presented a novel approach for cyberattack detection using an encoder-decoder pre-trained LLM, fine-tuned to adapt its classification scheme for the detection of cyberattacks. Given statistics of already finished network flows, we built an anomaly-based system for the detection of cyberattacks. We presented a novel methodology based on the adaptation of the original tasks of an LLM from NLP to detect cyberattacks. Our first contribution is to convert the numerical network flow statistics into a consistent abstract artificial language input string to be interpreted by the LLM. We validate the robustness of our detection system across three diverse and widely recognized datasets, CSE-CIC-IDS2018, CIC-IDS-2017, and BCCC-CIC-IDS-2017. By using undersampling and a Stratified Fivefold Cross-Validation approach, our model achieved consistently high performance across all evaluated datasets. Specifically, for the CIC-IDS-2017 dataset, we obtained accuracy, precision, recall, and F-score of more than 99.94%. For CSE-CIC-IDS-2018, these metrics exceeded 99.84%, and for BCCC-CIC-IDS-2017, they were all above 99.90%. These results collectively demonstrate superior performance for cyberattack detection, while maintaining highly competitive FPR and FNR, ensuring both minimal false alarms and robust threat identification. Crucially, the consistent convergence of training and validation loss, alongside stable high validation accuracy across all datasets, provides strong empirical evidence that our model generalizes effectively to unseen data and does not suffer from overfitting. This efficacy is achieved by relying exclusively on real-world network flow statistics, without the need for synthetic data generation, differentiating our approach from those that may use synthetic data for training. Future work will focus on several key directions aimed at refining current capabilities and addressing identified limitations. A primary focus will be the mitigation of the effectiveness limitations observed for attack types that are poorly represented in the dataset, which currently leads to a higher FNR (as detailed in our granular analysis of the confusion matrix in Section 3 with SQL Injection, Brute Force-Web and Brute Force-XSS). To address this issue, we plan to conduct a comprehensive study on the application of advanced data augmentation and oversampling techniques specifically tailored for highly imbalanced cybersecurity datasets. This will involve exploring methods such as Synthetic Minority Oversampling Technique (SMOTE) and Adaptive Synthetic Sampling (ADASYN). The objective is to enrich the dataset for these under-represented attack categories, providing the LLM with a more robust and diverse set of training examples. While our current system effectively uses the T5 encoder-decoder architecture, future work will involve exploring and comparing various LLM architectures and model sizes. This includes investigating the performance trade-offs of smaller, more efficient T5 variants for potential edge deployments, as well as evaluating other encoder-decoder models or even novel hybrid architectures. The aim is to optimize the balance between detection performance and computational efficiency for diverse operational environments, particularly for low-resource settings. We selected fine-tuning to perform our experiments. Our strategy achieved better results than other approaches mentioned in Section 4. However, it would be interesting to study the differences between the application of fine-tuning or Transfer Learning. Therefore, we propose to apply the latter approach in order to determine which is better in our case.