# LLM-Based Cyberattack Detection Using Network Flow Statistics
## 1 Introduction  
Cybersecurity has become an essential field due to the continuous emergence of new risks. Given the wide range of threats that can affect a computer system, it is crucial to implement techniques and tools to minimize the impact of persistent attacks on computer networks. However, such measures are still insufficient, as cybercriminals are always ahead of the curve, constantly developing new types of cyberthreats [1]. It is thus necessary to protect information since it is the most important asset of an organization. To this end, we have a wide range of tools at our disposal that can be used to reduce the risks faced by these systems. In terms of protecting organization networks, we have so-called Security Information and Event Management (SIEM) systems [2], Intrusion Prevention Systems (IPSs) [3], and Intrusion Detection Systems (IDSs) [4]. An IDS can be classified into host-based and network-based. The first monitors a computer, and the second, known as the Network Intrusion Detection System (NIDS), monitors a network. Finally, a NIDS could be classified as (a) signature-based, focused on signatures of attacks or specific patterns; or (b) anomaly-based, which is focused on abnormalities and malicious activity, identifying departures from the normal behavior of computer networks [5]. It is worth noting that our approach is aligned with anomaly-based NIDS. The main purpose of the aforementioned tools is the detection of cyberattacks. However, the continuous appearance of new types of attacks makes it necessary to have cyberattack detection systems that can use Artificial Intelligence (AI) techniques to infer new attacks. To develop such systems, Deep Learning (DL) [6] algorithms can be used and, more specifically, a model based on Artificial Neural Networks (ANNs) [7]. This task can be solved by defining and training a model from scratch, or by selecting an existing pre-trained one, to apply fine-tuning or transfer learning, which, despite being similar techniques, have certain differences. The use of pre-trained models is growing, particularly for building new ones, typically aimed at solving specific tasks related to the original one. This approach is widely used in supervised learning for models based on different tasks, such as face recognition, object recognition, and Natural Language Processing (NLP) [8]. Transfer learning [9] is a well-established technique focused on modifying part of the architecture of an existing ANN that has already been trained, replacing the last layers with new ones that are relevant to the new task, and then retraining only the altered layers to adapt a model to a new domain. In contrast, fine-tuning [10] is an approach used to modify weights of an existing ANN, without altering its architecture, to solve a specific task, different from that for which it was initially trained. The starting point is a pre-trained model, which will be transformed into a new one after applying a training step using new data. Fine-tuning techniques are typically used to solve a more specific issue, within the purpose for which a model was initially trained. However, in our case, we radically changed the purpose for which the model was initially trained. Although applying this technique means that all layers of a model require some learning, this is faster than training a model from scratch [9]. Section 4 contains a bibliographic study with several publications on the detection of attacks using AI techniques, most of which are based on DL, such as [11; 12; 13; 14; 15; 16; 17; 18; 19; 20; 21; 22; 23; 24]. As a subset of DL, Large Language Models (LLMs) have evolved from their roots in NLP to encompass a wider range of applications, including cybersecurity. Following the classification proposed in [PERSON] et al. [25], LLMs can be classified into three types based on their transformer architecture: decoder-only, encoder-only, and encoder-decoder models.