PLLM-CS: Pre-trained Large Language Model (LLM) for Cyber Threat Detection in Satellite Networks

TL;DR

This paper introduces PLLM-CS, a pretrained large language model tailored for cyber threat detection in satellite networks, demonstrating superior accuracy over existing methods on IoT traffic datasets.

Contribution

The paper presents a novel LLM architecture with a specialized module for transforming network data, achieving state-of-the-art performance in satellite network cyber threat detection.

Findings

Achieves 100% accuracy on UNSW_NB 15 dataset.

Outperforms BiLSTM, GRU, and CNN in experiments.

Validates effectiveness on IoT network traffic data.

Abstract

Satellite networks are vital in facilitating communication services for various critical infrastructures. These networks can seamlessly integrate with a diverse array of systems. However, some of these systems are vulnerable due to the absence of effective intrusion detection systems, which can be attributed to limited research and the high costs associated with deploying, fine-tuning, monitoring, and responding to security breaches. To address these challenges, we propose a pretrained Large Language Model for Cyber Security , for short PLLM-CS, which is a variant of pre-trained Transformers [1], which includes a specialized module for transforming network data into contextually suitable inputs. This transformation enables the proposed LLM to encode contextual information within the cyber data. To validate the efficacy of the proposed method, we conducted empirical experiments using two publicly available network datasets, UNSW_NB 15 and TON_IoT, both providing Internet of Things (IoT)-based traffic data. Our experiments demonstrate that proposed LLM method outperforms state-of-the-art techniques such as BiLSTM, GRU, and CNN. Notably, the PLLM-CS method achieves an outstanding accuracy level of 100% on the UNSW_NB 15 dataset, setting a new standard for benchmark performance in this domain.