Explainable Anomaly Detection in Network Traffic Using LLM
The result's identifiers
Result code in IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F68407700%3A21240%2F25%3A00384334" target="_blank" >RIV/68407700:21240/25:00384334 - isvavai.cz</a>
Result on the web
<a href="https://doi.org/10.1109/NOMS57970.2025.11073574" target="_blank" >https://doi.org/10.1109/NOMS57970.2025.11073574</a>
DOI - Digital Object Identifier
<a href="http://dx.doi.org/10.1109/NOMS57970.2025.11073574" target="_blank" >10.1109/NOMS57970.2025.11073574</a>
Alternative languages
Result language
angličtina
Original language name
Explainable Anomaly Detection in Network Traffic Using LLM
Original language description
Network anomaly detection is essential for modern cybersecurity, yet existing systems often generate numerous alerts without clear explanations, leading to inefficiencies and high false-positive rates. This paper proposes a novel approach that integrates Large Language Models (LLMs) with an anomaly detection framework to enhance explainability in network traffic analysis. Instead of directly detecting anomalies, the LLM only interprets already flagged anomaly events, providing insights into their potential root causes. Our method reduces LLM over-usage while improving decision-making for security analysts. We evaluated our approach using real-world network traffic data, demonstrating its ability to enhance situational awareness, reduce false positives, and support more effective cybersecurity practices.
Czech name
—
Czech description
—
Classification
Type
D - Article in proceedings
CEP classification
—
OECD FORD branch
10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)
Result continuities
Project
<a href="/en/project/VJ02010024" target="_blank" >VJ02010024: Flow-based Encrypted Traffic Analysis</a><br>
Continuities
P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)
Others
Publication year
2025
Confidentiality
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů
Data specific for result type
Article name in the collection
NOMS 2025-2025 IEEE Network Operations and Management Symposium
ISBN
979-8-3315-3163-8
ISSN
2374-9709
e-ISSN
—
Number of pages
6
Pages from-to
—
Publisher name
IEEE
Place of publication
New York
Event location
Honolulu
Event date
May 12, 2025
Type of event by nationality
WRD - Celosvětová akce
UT code for WoS article
001556086900003