LLM-based Continuous Intrusion Detection Framework for Next-Gen Networks
Frédéric Adjewa, Moez Esseghir, Leïla Merghem‐Boulahia, Cheikh Kacfah
Abstract
The study presents a dynamic framework for detecting, recognizing, and categorizing cyber threats in network traffic. It uses a transformer-based encoder to identify malicious behavior and detects attacks with a 100% recall rate. The system then uses a Gaussian Mixture Model to identify unseen attack types. This allows the framework to refine its recognition abilities over time, sustaining strong detection performance. Despite the inclusion of unknown attack types, the system maintains robustness, achieving 95.6% in classification accuracy and recall metrics. The findings validate the framework’s ability to adapt to the evolving threat environment and deliver reliable detection and threat characterization results. The goal is to create a scalable, real-time intrusion detection system that can continuously adapt to network security threats.