用大模型让网络入侵检测结果可解释，准确率提升20%以上。
eX-NIDS: A Framework for Explainable Network Intrusion Detection Leveraging Large Language Models
- 通过上下文增强提示，让大模型理解恶意流量的背景。
- 相比基础提示，解释准确性和一致性提升超20%。
- 适合安全研究人员和需透明决策的防御系统使用。
本文提出eX-NIDS框架，利用大语言模型（LLM）提升基于流量的网络入侵检测系统（NIDS）的可解释性。针对被NIDS标记为恶意的流量，框架首先通过提示增强模块提取上下文信息与网络威胁情报（CTI）知识，将这些信息融入LLM输入提示中，从而生成对恶意判定的详细解释。我们对比了采用上下文增强提示的LLM与不包含上下文信息的基础提示解释器（Basic-Prompt Explainer）。使用Llama 3和GPT-4模型进行定量评估，采用专为自然语言解释设计的新评价方法，聚焦解释的正确性与一致性。结果表明，增强提示的LLM能生成更准确、一致的解释，性能优于基础提示解释器超过20%。该框架可作为NIDS的有力补充，提升恶意流量判别的透明度。
原文摘要 · Abstract (English)
This paper introduces eX-NIDS, a framework designed to enhance interpretability in flow-based Network Intrusion Detection Systems (NIDS) by leveraging Large Language Models (LLMs). In our proposed framework, flows labelled as malicious by NIDS are initially processed through a module called the Prompt Augmenter. This module extracts contextual information and Cyber Threat Intelligence (CTI)-related knowledge from these flows. This enriched, context-specific data is then integrated with an input prompt for an LLM, enabling it to generate detailed explanations and interpretations of why the flow was identified as malicious by NIDS. We compare the generated interpretations against a Basic-Prompt Explainer baseline, which does not incorporate any contextual information into the LLM's input prompt. Our framework is quantitatively evaluated using the Llama 3 and GPT-4 models, employing a novel evaluation method tailored for natural language explanations, focusing on their correctness and consistency. The results demonstrate that augmented LLMs can produce accurate and consistent explanations, serving as valuable complementary tools in NIDS to explain the classification of malicious flows. The use of augmented prompts enhances performance by over 20% compared to the Basic-Prompt Explainer.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。