Large language model based intelligent malicious packet detection
A method and system for detecting malicious network packets via an intelligent large language model are described. In addition, a method for fine-tuning a pretrained large language model to detect malicious network packets is described. The training process generates a plurality of embeddings from input network packet data, generates clusters for those embeddings, performs an entropy analysis, and calculates a loss value. Contrastive learning is used to further fine-tune the large language model based embedder.
1 . A method of training a large language model based packet detection software tool, the method comprising:
processing a training data set of network packets with a large language model (LLM) based embedder to generate a plurality of embeddings;
generating a plurality of clusters from the plurality of embeddings;
performing an entropy analysis of the generated plurality of clusters from the plurality of embeddings;
computing a loss value from a result of the performed entropy analysis; and
updating the LLM based embedder based on the computed loss value, wherein when a malicious packet is detected, an attack detector begins to take actions to mitigate the attack, to launch a counter attack, to publish the identity of the originator of the malicious packet, or to take no action.
2 . The method of claim 1 , wherein the LLM utilizes a Generative Pre-trained Transformer (GPT) neural network.
3 . The method of claim 1 , wherein each of the generated plurality of embeddings is a numerical array.
4 . The method of claim 3 , further comprising reducing at least some of the generated plurality of embeddings to two-dimensional coordinates.
5 . The method of claim 4 , further comprising generating a two-dimensional graphical representation of the at least some of the generated plurality of embeddings.
6 . The method of claim 1 , wherein the performing the entropy analysis further comprises determining an anchor point embedding, a first candidate point embedding, and a second candidate point embedding.
7 . The method of claim 6 , further comprising: using a contrastive learning process to label each of the first candidate point embedding and the second candidate point embedding with one of a positive label and a negative label.
8 . The method of claim 1 , wherein the training data set of network packets comprises at least one of the following parameters for each network packet: destination address, source address, destination port, source port, TCP sequence number, TCP ACK number, packet length, and frame length.
9 . The method of claim 1 , wherein the training data set of network packets comprises historical data from past malicious network packets.
10 . A method of malicious packet detection via an intelligent large language model, the method comprising:
processing network packets at a trained large language model (LLM) based embedder to generate a plurality of embeddings;
generating a plurality of clusters from the plurality of embeddings; and
generating a Berkeley Packet Filter (BPF) from the plurality of clusters.
11 . The method of claim 10 , wherein the trained LLM based embedder utilizes a Generative Pre-trained Transformer (GPT) neural network.
12 . The method of claim 10 , wherein the trained LLM based embedder is trained with a contrastive learning process.
13 . The method of claim 10 , wherein the processing the network packets comprises processing at least one of the following parameters for each network packet: destination address, source address, destination port, source port, TCP sequence number, TCP ACK number, packet length, and frame length.
14 . The method of claim 10 , wherein the trained LLM based embedder is trained with historical data from past malicious network packets.
15 . A system for malicious packet detection via a large language model, the system comprising:
at least one processor configured to:
process network packets at a trained large language model (LLM) based embedder to generate a plurality of embeddings;
generate a plurality of clusters from the plurality of embeddings; and
generate a Berkeley Packet Filter (BPF) from the plurality of clusters.
16 . The system of claim 15 , wherein the trained LLM based embedder utilizes a Generative Pre-trained Transformer (GPT) neural network.
17 . The system of claim 15 , wherein the trained LLM based embedder is trained with a contrastive learning process.
18 . The system of claim 15 , wherein the wherein the processing the network packets comprises processing at least one of the following parameters for each network packet: destination address, source address, destination port, source port, TCP sequence number, TCP ACK number, packet length, and frame length.
19 . The system of claim 15 , wherein the trained LLM based embedder is trained with historical data from past malicious network packets.