Utilizing Large Language Models for DDoS Attack Detection
Meisam Mahmoodi, Seyed Mahdi Jameii
Abstract
Large Language Models (LLMs) have shown many advantages for various tasks. These large language models, pre-trained on big textual datasets, allow us to work in different scenarios, especially for classification purposes, even with incomplete information. While LLMs’ ability is limited to text inputs, converting network packets to text form can enable LLMs to find malignant patterns, such as DDoS (Distributed Denial of Service) attacks. In this study, we use Llama 2 to detect DDoS attacks. We introduce a new method for real-time identification of DDoS attacks through network packet scanning and converting them to text data, utilizing Llama 2 LLM, and finetuned it using the CIC-IDS2017 dataset to classify network packets into malignant and benign. We compare the proposed model to previously introduced deep learning architectures, and the final results prove the effectiveness of the proposed model in DDoS attack detection. Our proposed approach utilizes QloRA from parameter-efficient finetuning and the proximal policy optimization from the TRL library, presenting promising results for detecting DDoS attacks in real-world scenarios.