用流量内容检测网络攻击，准确率超99.9%，误报极低。
Payload-Aware Intrusion Detection with CMAE and Large Language Models
- 基于数据包内容设计检测框架，识别细微攻击特征。
- 新模型达99.971%准确率，误报率仅0.018%。
- 融合大模型分词器，兼顾实时性与检测能力。
入侵检测系统（IDS）对识别恶意流量至关重要，但传统基于签名的方法难以应对零日攻击且误报率高。现有基于人工智能的包捕获分析方法多依赖流或统计特征，难捕捉精细攻击模式。本文提出Xavier-CMAE，一种增强型卷积多头注意力集成模型，通过将Word2Vec嵌入替换为Hex2Int分词器和Xavier初始化，无需预训练即可加速训练，实现99.971%准确率与0.018%误报率，优于原有方法。此外，引入LLM-CMAE，结合预训练大语言模型分词器提升特征提取能力，虽计算开销较大，但仍达成99.969%准确率与0.019%误报率，在效率与性能间取得平衡。本研究推动了基于AI的入侵检测发展，构建了以数据包载荷为核心的检测框架，提升了模型效率，并实现了大模型分词器在实时检测中的应用。
原文摘要 · Abstract (English)
Intrusion Detection Systems (IDS) are crucial for identifying malicious traffic, yet traditional signature-based methods struggle with zero-day attacks and high false positive rates. AI-driven packet-capture analysis offers a promising alternative. However, existing approaches rely heavily on flow-based or statistical features, limiting their ability to detect fine-grained attack patterns. This study proposes Xavier-CMAE, an enhanced Convolutional Multi-Head Attention Ensemble (CMAE) model that improves detection accuracy while reducing computational overhead. By replacing Word2Vec embeddings with a Hex2Int tokenizer and Xavier initialization, Xavier-CMAE eliminates pre-training, accelerates training, and achieves 99.971% accuracy with a 0.018% false positive rate, outperforming Word2Vec-based methods. Additionally, we introduce LLM-CMAE, which integrates pre-trained Large Language Model (LLM) tokenizers into CMAE. While LLMs enhance feature extraction, their computational cost hinders real-time detection. LLM-CMAE balances efficiency and performance, reaching 99.969% accuracy with a 0.019% false positive rate. This work advances AI-powered IDS by (1) introducing a payload-based detection framework, (2) enhancing efficiency with Xavier-CMAE, and (3) integrating LLM tokenizers for improved real-time detection.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。