# LLM-Based Cyberattack Detection Using Network Flow Statistics
## 4 Related Work
### Comparative Analysis
#### 4.3.2 Using the CIC-IDS-2017 Dataset  
Section 4.2 contains details on the publications included in this comparative analysis. Table 11 displays the results reported in these papers and ours, after applying our approach to the CIC-IDS-2017 dataset. This table is divided into two parts by dark horizontal lines. The first part, with only one row, contains the results of our approach. Our T5-based approach demonstrates exceptional performance on CIC-IDS-2017, achieving 99.94% across all core metrics. Crucially, it records an extremely low FPR of 0.01%, signifying an almost negligible rate of false alarms, which is a highly desirable characteristic for operational security. Concurrently, its FNR of 0.05% underscores its robust ability to identify actual threats, minimizing the risk of undetected attacks. The second part shows several references for IDS-related models that used ML techniques, since we found no studies on LLM, using CIC-IDS-2017. Our results are again better. Considering we selected the smallest available size of the T5 model, we can state that our results for all metrics are better than almost all the papers found. Only one approach, that of [PERSON] et al. [18], obtained slightly better recall. When examining the error rates of other methods that report FPR, our model generally maintains a competitive or superior balance. For instance, while some traditional ML models from [PERSON] et al. [19] achieve very low FPRs, not better than ours, their corresponding recall values are significantly lower than those of our model, implying a higher risk of missed attacks, which suggests higher FNR, although this was not reported by the authors. Figure 6 extends this comparative analysis to the CIC-IDS-2017 dataset, using the same perspective as Figure 5. Consistent with our findings on CSE-CIC-IDS2018, our approach continues to demonstrate its strength across accuracy, precision, recall, and F-score. The consistently minimal (or zero) differences from the best-observed values reaffirm  
Figure 5: Metrics comparison for CSE-CIC-IDS2018. References [11; 12; 13; 14; 15; 16; 17; 18; 19; 20; 21; 27; 28]. the robustness and superior performance of our model for cyberattack detection across different benchmark datasets. Our model's capacity to achieve near-perfect core metrics alongside such a low FPR and FNR highlights its comprehensive and balanced detection capability. Therefore, our approach performs best among the ML-based techniques. \begin{table}
\begin{tabular}{l l c c c c c c} \hline \hline
**Reference** & **Technique** & **Accuracy** & **Precision** & **Recall** & **F-Score** & **FPR** & **FNR** \\ \hline Our approach & T5 & **99.94\%** & **99.94\%** & **99.94\%** & **99.94\%** & **0.01\%** & **0.05\%** \\ \hline \multirow{4}{*}{[PERSON] et al. [11]} & IADCL & **99.70\%** & 99.72\% & 99.70\% & 99.71\% & – & – \\  & Immune Net & 99.63\% & 99.64\% & 99.63\% & 99.63\% & – & – \\  & XGBoost & 99.09\% & 99.03\% & 99.07\% & 99.07\% & – & – \\  & RF & 98.81\% & 98.82\% & 98.81\% & 98.81\% & – & – \\  & DT & 98.54\% & 93.41\% & 96.76\% & 95.06\% & – & – \\  & LR & 92.96\% & 90.80\% & 90.96\% & 90.87\% & – & – \\ \hline [PERSON] et al. [12] & SS-Deep-ID & 99.69\% & 92.31\% & 96.29\% & 94.18\% & – & – \\ \hline [PERSON] et al. [17] & Hybrid DL Model & 95.68\% & 96.50\% & 95.68\% & 96.10\% & – & – \\ \hline [PERSON] et al. [18] & HDEFE & – & **99.73\%** & **99.96\%** & **99.84\%** & – & – \\ \hline \multirow{4}{*}{[PERSON] et al. [19]} & RF & – & 93.00\% & 71.00\% & 74.00\% & 0.14\% & – \\  & CatBoost & – & 89.00\% & 83.00\% & 83.00\% & **0.02\%** & – \\  & LightGBM & – & 87.00\% & 84.00\% & 85.00\% & **0.01\%** & – \\  & XGBoost & – & 89.00\% & 85.00\% & 86.00\% & **0.02\%** & – \\ \hline [PERSON] et al. [22] & GA-BPNN & 98.00\% & 98.50\% & 95.00\% & 96.50\% & – & – \\ \hline [PERSON] et al. [23] & TRBMA (BS-OSS) & **99.88\%** & **99.86\%** & **99.88\%** & **99.89\%** & – & – \\ \hline [PERSON] et al. [24] & Hybrid DL Model & 99.00\% & 97.00\% & 96.00\% & 97.00\% & – & – \\ \hline \hline \end{tabular}
\end{table}