用大模型零样本识别异常流量，抗分布式拒绝服务攻击
DrLLM: Prompt-Enhanced Distributed Denial-of-Service Resistance Method with Large Language Models
- 用大模型提取流量全局与局部特征，构建推理框架
- 零样本下准确率超传统方法，验证LLM在网络安全潜力
- 适合安全研究者、网络防护开发者快速部署应用
分布式拒绝服务（DDoS）攻击日益增多，对互联网构成重大威胁，亟需有效的缓解措施。现有方法多依赖复杂训练以学习数据特征，增加了应用复杂性和泛化难度。本文提出DrLLM，通过大语言模型（LLMs）在零样本场景下挖掘异常流量信息。为弥合与现有方法的差距，我们把流量数据的全局与局部信息嵌入推理范式，设计了知识嵌入、令牌嵌入和渐进角色推理三个模块，实现数据表征与推理。此外，探索提示工程在网络安全领域的泛化能力，提升DrLLM分类性能。消融实验表明，DrLLM在零样本场景下具有适用性，进一步验证了大模型在网络领域中的潜力。DrLLM代码已开源：https://github.com/liuup/DrLLM。
原文摘要 · Abstract (English)
The increasing number of Distributed Denial of Service (DDoS) attacks poses a major threat to the Internet, highlighting the importance of DDoS mitigation. Most existing approaches require complex training methods to learn data features, which increases the complexity and generality of the application. In this paper, we propose DrLLM, which aims to mine anomalous traffic information in zero-shot scenarios through Large Language Models (LLMs). To bridge the gap between DrLLM and existing approaches, we embed the global and local information of the traffic data into the reasoning paradigm and design three modules, namely Knowledge Embedding, Token Embedding, and Progressive Role Reasoning, for data representation and reasoning. In addition we explore the generalization of prompt engineering in the cybersecurity domain to improve the classification capability of DrLLM. Our ablation experiments demonstrate the applicability of DrLLM in zero-shot scenarios and further demonstrate the potential of LLMs in the network domains. DrLLM implementation code has been open-sourced at https://github.com/liuup/DrLLM.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。