把网络包字节当单词，用Transformer做异常检测，效果惊艳。
Take Package as Language: Anomaly Detection Using Transformer
- 将每个字节视为独立词汇，构建细粒度的网络数据语言模型。
- 在极端不平衡数据下准确率达100%，单样本学习也超90%。
- 适合安全研究者和工业界部署，尤其适用于数据稀缺场景。
网络数据包异常检测面临诸多挑战，包括探索新型异常监督信号、研究弱监督异常检测以及提升模型可解释性。本文提出NIDS-GPT，一种基于GPT的因果语言模型，用于网络入侵检测。与以往工作不同，NIDS-GPT创新性地将每个数据包中的数值视为独立的“词”，而非传统字段，从而实现更细粒度的数据表示。采用改进的GPT-2模型，并设计专用分词器与嵌入层，以更好地捕捉网络数据的结构与语义。NIDS-GPT具备良好可扩展性，支持无监督预训练，并通过注意力权重可视化增强模型可解释性。在CICIDS2017和car-hacking数据集上的实验表明，该模型在极端不平衡条件下达到100%准确率，远超传统方法；同时在单样本学习场景中也实现超过90%的准确率。结果表明，NIDS-GPT在复杂网络异常检测任务中表现优异，尤其适用于数据不平衡和资源受限的场景。代码已开源。
原文摘要 · Abstract (English)
Network data packet anomaly detection faces numerous challenges, including exploring new anomaly supervision signals, researching weakly supervised anomaly detection, and improving model interpretability. This paper proposes NIDS-GPT, a GPT-based causal language model for network intrusion detection. Unlike previous work, NIDS-GPT innovatively treats each number in the packet as an independent "word" rather than packet fields, enabling a more fine-grained data representation. We adopt an improved GPT-2 model and design special tokenizers and embedding layers to better capture the structure and semantics of network data. NIDS-GPT has good scalability, supports unsupervised pre-training, and enhances model interpretability through attention weight visualization. Experiments on the CICIDS2017 and car-hacking datasets show that NIDS-GPT achieves 100\% accuracy under extreme imbalance conditions, far surpassing traditional methods; it also achieves over 90\% accuracy in one-shot learning. These results demonstrate NIDS-GPT's excellent performance and potential in handling complex network anomaly detection tasks, especially in data-imbalanced and resource-constrained scenarios. The code is available at \url{https://github.com/woshixiaobai2019/nids-gpt.gi
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。