A Review of Encryption Traffic Analysis Methods Based on Large Language Models

SHEN Meng; LIU Yukai; AI Junyu; REN Chenchen; SHEN Hongye; LI Qi; XU Ke; ZHU Liehuang

doi:10.12263/DZXB.20251032

您当前的位置：

首页 >

文章列表页 >

A Review of Encryption Traffic Analysis Methods Based on Large Language Models

Cutting\-edge Technologies for Encrypted Network Security | 更新时间：2026-07-30

- A Review of Encryption Traffic Analysis Methods Based on Large Language Models
- ACTA ELECTRONICA SINICA Vol. 54, Issue 4, Pages: 1425-1445(2026)
- 作者机构：
  
  1.北京理工大学网络空间安全学院，北京100081
  2.清华大学网络科学与网络空间研究院，北京100084
  3.清华大学计算机科学与技术系，北京100084
- 作者简介：
- 基金信息：
  
  National Key Research and Development Program of China(2023YFB2703805);National Natural Science Foundation of China(U23A20304;U25A20428)
- DOI：10.12263/DZXB.20251032
  CLC： TP393.08;
- Received：17 January 2026，
  
  Accepted：24 February 2026，
  
  Online First：20 May 2026，
  
  Published：25 April 2026
- 稿件说明：
移动端阅览
沈蒙, 刘俣凯, 艾俊宇, 等. 基于大语言模型的加密流量分析方法研究综述[J]. 电子学报, 2026, 54(04): 1425-1445.

SHEN Meng, LIU Yukai, AI Junyu, et al. A Review of Encryption Traffic Analysis Methods Based on Large Language Models[J]. Acta Electronica Sinica, 2026, 54(04): 1425-1445.
沈蒙, 刘俣凯, 艾俊宇, 等. 基于大语言模型的加密流量分析方法研究综述[J]. 电子学报, 2026, 54(04): 1425-1445. DOI：10.12263/DZXB.20251032

SHEN Meng, LIU Yukai, AI Junyu, et al. A Review of Encryption Traffic Analysis Methods Based on Large Language Models[J]. Acta Electronica Sinica, 2026, 54(04): 1425-1445. DOI：10.12263/DZXB.20251032

摘要

随着网络安全技术的快速演进，主流应用、社交平台及内容服务已广泛采用加密协议来保护用户隐私。这一趋势使得加密流量逐步成为现代网络通信的主导形态，但也导致传统依赖明文载荷的深度包分析（Deep Packet Inspection，DPI）技术全面失效。在此背景下，加密流量分析作为保障网络基础设施安全、优化网络资源调度与维持服务质量的关键技术，已成为当前网络空间安全领域的研究重点。面对复杂多变的加密流量，传统机器学习方法高度依赖专家先验知识进行繁琐的手工特征设计，难以适应当前加密流量动态伪装的特点；而基于深度学习的分析方法虽在特征提取方面表现优异，但其高计算成本与大规模标注数据需求限制了在资源受限场景下的部署。近年来，大语言模型（Large Language Model，LLM）凭借其卓越的自监督预训练范式和强大的长序列上下文建模能力，为突破上述瓶颈提供了全新的技术路径。LLM将非结构化的流量字节或统计特征视为一种特殊的网络语言，实现了从专有小模型向通用基础模型底座的范式跃迁。本文聚焦流量分类、恶意流量检测、流量预测和流量生成四大核心下游任务，对基于大语言模型的加密流量分析方法进行了系统性总结和深入分析。首先，本文梳理了从流量采集、数据处理、特征提取、模型构建与微调到推理评估的通用技术流程。其次，针对四大下游任务，本文深入剖析了不同研究的技术演进脉络与架构创新：在流量分类方面，探讨了从基于BERT的判别式微调到基于生成式大模型零样本推理的演进，展现了模型在跨协议与少样本场景下的强大泛化适配能力；在恶意流量检测方面，详细论述了LLM作为特征编码器、分类器甚至可解释性决策器的多重角色，突出了其在应对多阶段隐蔽攻击与未知威胁时展现出的深层语义捕获优势；在流量预测方面，对比了传统时序模型与大模型自回归生成在捕获网络高维时空动态依赖上的差异；在流量生成方面，总结了模型如何跨越单纯的统计分布拟合，迈向受控、高保真且严格遵循协议状态机的流量生成。最后，本文总结了当前领域面临的数据分布偏移、部署资源受限等关键挑战，并从构建多模态数据生态、端云协同轻量化部署等维度展望了未来研究方向。

Abstract

With the rapid evolution of cybersecurity technologies

mainstream applications

social platforms

and content services have widely adopted encryption protocols to protect user privacy. This trend has made encrypted traffic the dominant form of modern network communication

but it has also rendered traditional deep packet inspection (DPI) techniques—which rely on plaintext payloads—completely ineffective. Against this backdrop

encrypted traffic analysis has emerged as a critical technology for safeguarding network infrastructure security

optimizing network resource allocation

and maintaining service quality

becoming a key research focus in the field of cyberspace security. Confronted with complex and dynamic encrypted traffic

traditional machine learning approaches heavily rely on expert-driven

cumbersome manual feature design

struggling to adapt to the dynamic obfuscation characteristics of modern encrypted traffic. While deep learning-based analysis methods excel in feature extraction

their high computational costs and requirements for large-scale labeled data limit deployment in resource-constrained scenarios. In recent years

large language models (LLMs) have emerged as a novel technical pathway to overcome these limitations

leveraging their exceptional self-supervised pre-training paradigms and robust long-sequence context modeling capabilities. LLMs treat unstructured traffic bytes or statistical features as a specialized network language

enabling a paradigm shift from specialized small models to universal foundational models. This paper systematically summarizes and deeply analyzes LLM-based cryptographic traffic analysis methods across four core downstream tasks: traffic classification

malicious traffic detection

traffic prediction

and traffic generation. First

it outlines the general technical workflow from traffic collection

data processing

feature extraction

model construction and fine-tuning

to inference evaluation. Second

for each downstream task

this paper delves into the technical evolution and architectural innovations across different studies: for traffic classification

it explores the progression from discriminative fine-tuning based on BERT to zero-shot reasoning using generative large models

demonstrating robust generalization capabilities across protocols and sparse data scenarios. For malicious traffic detection

we detail the multifaceted roles of LLMs as feature encoders

classifiers

and even explainable decision-makers

highlighting their superiority in capturing deep semantic patterns when confronting multi-stage covert attacks and unknown threats; For traffic prediction

we contrast traditional time-series models with large-model autoregressive generation in capturing high-dimensional spatiotemporal dependencies within networks. Regarding traffic generation

we summarize how models transcend mere statistical distribution fitting to achieve controlled

high-fidelity traffic generation that strictly adheres to protocol state machines. Finally

this paper summarizes key challenges facing the field

such as data distribution skew and constrained deployment resources

and outlines future research directions from dimensions including building a multimodal data ecosystem and enabling lightweight deployment through edge-cloud collaboration.

关键词

Keywords

references

中国互联网络信息中心 . 第 56 次《中国互联网络发展状况统计报告》 [R/OL ] . ( 2025-07-21 ) [ 2025-10-30 ] . https://www.cnnic.cn/n4/2025/0721/c88-11328.html https://www.cnnic.cn/n4/2025/0721/c88-11328.html .

China Internet Network Information Center . The 56th statistical report on the development of the internet in China [R/OL ] . ( 2025-07-21 ) [ 2025-10-30 ] . https://www.cnnic.cn/n4/2025/0721/c88-11328.html https://www.cnnic.cn/n4/2025/0721/c88-11328.html . (in Chinese)

Shen Meng , Zhang Jinpeng , Zhu Liehuang , et al . Accurate decentralized application identification via encrypted traffic analysis using graph neural networks [J ] . IEEE Transactions on Information Forensics and Security , 2021 , 16 : 2367 - 2380 . DOI: 10.1109/TIFS.2021.3050608 http://dx.doi.org/10.1109/TIFS.2021.3050608

Zhou Guangmeng , Guo Xiongwen , Liu Zhuotao , et al . TrafficFormer: An efficient pre-trained model for traffic data [C ] // 2025 IEEE Symposium on Security and Privacy . Piscataway : IEEE , 2025 : 1844 - 1860 . DOI: 10.1109/sp61157.2025.00102 http://dx.doi.org/10.1109/sp61157.2025.00102

Shen Meng , Wu Jinhe , Ye Ke , et al . Robust detection of malicious encrypted traffic via contrastive learning [J ] . IEEE Transactions on Information Forensics and Security , 2025 , 20 : 4228 - 4242 . DOI: 10.1109/TIFS.2025.3560560 http://dx.doi.org/10.1109/TIFS.2025.3560560

Fu Chuanpu , Li Qi , Bertino E , et al . Training with only 1.0‰ samples: Malicious traffic detection via cross-modality feature fusion [C ] // Proceedings of 2025 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2025 : 3930 - 3944 . DOI: 10.1145/3719027.3765143 http://dx.doi.org/10.1145/3719027.3765143

Zhang Junbo , Zheng Yu , Qi Dekang , et al . DNN-based prediction model for spatio-temporal data [C ] // Proceedings of the 24th ACM SIGSPATIAL International Conference on Advances in Geographic Information Systems . New York : ACM , 2016 : 92 . DOI: 10.1145/2996913.2997016 http://dx.doi.org/10.1145/2996913.2997016

Li Haibin , Zhao Yi , Yao Wenbing , et al . Towards real-time ML-based DDoS detection via cost-efficient window-based feature extraction [J ] . Science China Information Sciences , 2023 , 66 ( 5 ): 152105 . DOI: 10.1007/s11432-021-3545-0 http://dx.doi.org/10.1007/s11432-021-3545-0

Fu Chuanpu , Li Qi , Xu Ke , et al . Point cloud analysis for ML-based malicious traffic detection: Reducing majorities of false positive alarms [C ] // Proceedings of 2023 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2023 : 1005 - 1019 . DOI: 10.1145/3576915.3616631 http://dx.doi.org/10.1145/3576915.3616631

Shen Meng , Ji Kexin , Gao Zhenbo , et al . Subverting website fingerprinting defenses with robust traffic representation [C ] // 32nd USENIX Security Symposium . USENIX Association , 2023 : 607 - 624 .

康海燕 , 张义钒 , 王楠敏 . 基于联邦大模型的网络攻击检测方法研究 [J ] . 电子学报 , 2025 , 53 ( 6 ): 1792 - 1804 .

Kang Haiyan , Zhang Yifan , Wang Nanmin . Research on network attack detection method based on federated large model [J ] . Acta Electronica Sinica , 2025 , 53 ( 6 ): 1792 - 1804 . (in Chinese)

Vaswani A , Shazeer N , Parmar N , et al . Attention is all you need [C ] // Proceedings of the 31st International Conference on Neural Information Processing Systems . New York : Curran Associates Inc. , 2017 : 6000 - 6010 .

Gu A , Dao T . Mamba: Linear-time sequence modeling with selective state spaces [PP/OL ] . V2.arXiv ( 2024-05-31 ) [ 2025-10-30 ] . https://arxiv.org/abs/2312.00752 https://arxiv.org/abs/2312.00752 .

Shen Meng , Ye Ke , Liu Xingtong , et al . Machine learning-powered encrypted network traffic analysis: A comprehensive survey [J ] . IEEE Communications Surveys & Tutorials , 2023 , 25 ( 1 ): 791 - 824 . DOI: 10.1109/comst.2022.3208196 http://dx.doi.org/10.1109/comst.2022.3208196

侯剑 , 鲁辉 , 刘方爱 , 等 . 加密恶意流量检测及对抗综述 [J ] . 软件学报 , 2024 , 35 ( 1 ): 333 - 355 . DOI: 10.13328/j.cnki.jos.006891 http://dx.doi.org/10.13328/j.cnki.jos.006891 .

Hou Jian , Lu Hui , Liu Fangai , et al . Detection and countermeasure of encrypted malicious traffic: A survey [J ] . Journal of Software , 2024 , 35 ( 1 ): 333 - 355 . (in Chinese)

付钰 , 刘涛涛 , 王坤 , 等 . 基于机器学习的加密流量分类研究综述 [J ] . 通信学报 , 2025 , 46 ( 1 ): 167 - 191 . DOI: 10.11959/j.issn.1000-436x.2025006 http://dx.doi.org/10.11959/j.issn.1000-436x.2025006

Fu Yu , Liu Taotao , Wang Kun , et al . Survey of research on encrypted traffic classification based on machine learning [J ] . Journal on Communications , 2025 , 46 ( 1 ): 167 - 191 . (in Chinese) . DOI: 10.11959/j.issn.1000-436x.2025006 http://dx.doi.org/10.11959/j.issn.1000-436x.2025006

王钢 , 高雲鹏 , 杨松儒 , 等 . 基于深度学习的加密恶意流量检测方法研究综述 [J ] . 信息网络安全 , 2025 , 25 ( 8 ): 1276 - 1301 .

Wang Gang , Gao Yunpeng , Yang Songru , et al . A survey on deep learning-based encrypted malicious traffic detection methods [J ] . Netinfo Security , 2025 , 25 ( 8 ): 1276 - 1301 . (in Chinese)

Bonelli N , Giordano S , Procissi G . Enabling packet fan-out in the libpcap library for parallel traffic processing [C ] // Proceedings of 2017 Network Traffic Measurement and Analysis Conference . Piscataway : IEEE , 2017 : 1 - 9 . DOI: 10.23919/tma.2017.8002904 http://dx.doi.org/10.23919/tma.2017.8002904

Chappell L . Wireshark network analysis [M ] . 2nd ed . Laura : Laura Chappell University , 2012 .

Hofstede R , Čeleda P , Trammell B , et al . Flow monitoring explained: From packet capture to data analysis with Netflow and IPFIX [J ] . IEEE Communications Surveys & Tutorials , 2014 , 16 ( 4 ): 2037 - 2064 . DOI: 10.1109/comst.2014.2321898 http://dx.doi.org/10.1109/comst.2014.2321898

Neto E C P , Dadkhah S , Ferreira R , et al . CICIoT2023: A real-time dataset and benchmark for large-scale attacks in IoT environment [J ] . Sensors , 2023 , 23 ( 13 ): 5941 . DOI: 10.3390/s23135941 http://dx.doi.org/10.3390/s23135941

Sharafaldin I , Lashkari A H , Ghorbani A A . Toward generating a new intrusion detection dataset and intrusion traffic characterization [C ] // Proceedings of the 4th International Conference on Information Systems Security and Privacy . [S.l.] : SciTePress , 2018 : 108 - 116 . DOI: 10.5220/0006639801080116 http://dx.doi.org/10.5220/0006639801080116

Mirsky Y , Doitshman T , Elovici Y , et al . Kitsune: An ensemble of autoencoders for online network intrusion detection [C ] // 25th Annual Network and Distributed System Security Symposium . [S.l.] : The Internet Society , 2018 . DOI: 10.14722/ndss.2018.23204 http://dx.doi.org/10.14722/ndss.2018.23204

Wang Wei , Zhu Ming , Zeng Xuewen , et al . Malware traffic classification using convolutional neural network for representation learning [C ] // 2017 International Conference on Information Networking . Piscataway : IEEE , 2017 : 712 - 717 . DOI: 10.1109/ICOIN.2017.7899588 http://dx.doi.org/10.1109/ICOIN.2017.7899588

Lashkari A H , Kadir A F A , Taheri L , et al . Toward developing a systematic approach to generate benchmark android malware datasets and classification [C ] // 2018 International Carnahan conference on security technology . Piscataway : IEEE , 2018 : 1 - 7 . DOI: 10.1109/ccst.2018.8585560 http://dx.doi.org/10.1109/ccst.2018.8585560

Draper-Gil G , Lashkari A H , Mamun M S I , et al . Characterization of encrypted and VPN traffic using time-related features [C ] // Proceedings of the 2nd International Conference on Information Systems Security and Privacy . SciTePress , 2016 : 407 - 414 . DOI: 10.5220/0005740704070414 http://dx.doi.org/10.5220/0005740704070414

Lin Xinjie , Xiong Gang , Gou Gaopeng , et al . ET-BERT: A contextualized datagram representation with pre-training transformers for encrypted traffic classification [C ] // Proceedings of ACM Web Conference 2022 . New York : ACM , 2022 : 633 - 642 . DOI: 10.48550/arXiv.2202.06335 http://dx.doi.org/10.48550/arXiv.2202.06335

MontazeriShatoori M , Davidson L , Kaur G , et al . Detection of doh tunnels using time-series classification of encrypted traffic [C ] // 2020 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress . Piscataway : IEEE , 2020 : 63 - 70 . DOI: 10.1109/dasc-picom-cbdcom-cyberscitech49142.2020.00026 http://dx.doi.org/10.1109/dasc-picom-cbdcom-cyberscitech49142.2020.00026

Shen Meng , Wei Mingwei , Zhu Liehuang , et al . Classification of encrypted traffic with second-order Markov chains and application attribute bigrams [J ] . IEEE Transactions on Information Forensics and Security , 2017 , 12 ( 8 ): 1830 - 1843 . DOI: 10.1109/TIFS.2017.2692682 http://dx.doi.org/10.1109/TIFS.2017.2692682

Gao Li , Fu Chuanpu , Deng Xinhao , et al . Wedjat: Detecting sophisticated evasion attacks via real-time causal analysis [C ] // Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.1 . New York : ACM , 2025 : 342 - 353 . DOI: 10.1145/3690624.3709218 http://dx.doi.org/10.1145/3690624.3709218

Xu Songsong , Fu Chuanpu , Li Qi , et al . “One Model Fits All Nodes”: Neuron activation pattern analysis-based attack traffic detection framework for P2P networks [J ] . IEEE Transactions on Networking , 2025 , 33 ( 4 ): 1630 - 1645 . DOI: 10.1109/ton.2025.3546735 http://dx.doi.org/10.1109/ton.2025.3546735

Shen Meng , Liu Yiting , Zhu Liehuang , et al . Fine-grained webpage fingerprinting using only packet length information of encrypted traffic [J ] . IEEE Transactions on Information Forensics and Security , 2021 , 16 : 2046 - 2059 . DOI: 10.1109/tifs.2020.3046876 http://dx.doi.org/10.1109/tifs.2020.3046876

Fu Chuanpu , Li Qi , Shen Meng , et al . Detecting tunneled flooding traffic via deep semantic analysis of packet length patterns [C ] // Proceedings of 2024 on ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2024 : 3659 - 3673 . DOI: 10.1145/3658644.3670353 http://dx.doi.org/10.1145/3658644.3670353

Cui Tianyu , Lin Xinjie , Li Sijia , et al . TrafficLLM: Enhancing large language models for network traffic analysis with generic traffic representation [PP/OL ] . V2. arXiv ( 2025-04-15 ) [ 2025-10-30 ] . https://arxiv.org/abs/2504.04222 https://arxiv.org/abs/2504.04222 .

Shen Meng , Zhang Jinpeng , Zhu Liehuang , et al . Encrypted traffic classification of decentralized applications on ethereum using feature fusion [C ] // Proceedings of International Symposium on Quality of Service . New York : ACM , 2019 : 18 . DOI: 10.1145/3326285.3329053 http://dx.doi.org/10.1145/3326285.3329053

Wu Songyun , Dong Enhuan , He Hong , et al . ALM: A two-stage traffic anomaly detection and analysis system via the large language model [C ] // 2025 IEEE Network Operations and Management Symposium . Piscataway : IEEE , 2025 : 1 - 7 . DOI: 10.1109/noms57970.2025.11073622 http://dx.doi.org/10.1109/noms57970.2025.11073622

Wickramasinghe N , Shaghaghi A , Tsudik G , et al . SoK: Decoding the enigma of encrypted network traffic classifiers [C ] // 2025 IEEE Symposium on Security and Privacy . Piscataway : IEEE , 2025 : 1825 - 1843 . DOI: 10.1109/SP61157.2025.00165 http://dx.doi.org/10.1109/SP61157.2025.00165

Shen Meng , Zhang Jinpeng , Xu Ke , et al . DeepQoE: Real-time measurement of video QoE from encrypted traffic with deep learning [C ] // 2020 IEEE/ACM 28th International Symposium on Quality of Service . Piscataway : IEEE , 2020 : 1 - 10 . DOI: 10.1109/IWQoS49365.2020.9212897 http://dx.doi.org/10.1109/IWQoS49365.2020.9212897

Liu Ziao , Xie Yuanyuan , Luo Yanyan , et al . TransECA-Net: A transformer-based model for encrypted traffic classification [J ] . Applied Sciences , 2025 , 15 ( 6 ): 2977 . DOI: 10.3390/app15062977 http://dx.doi.org/10.3390/app15062977

Zhou Qiang , Wang Liangmin , Zhu Huijuan , et al . WF-transformer: Learning temporal features for accurate anonymous traffic identification by using transformer networks [J ] . IEEE Transactions on Information Forensics and Security , 2024 , 19 : 30 - 43 . DOI: 10.1109/tifs.2023.3318966 http://dx.doi.org/10.1109/tifs.2023.3318966

Meng Zhiyan , Liu Dan , Meng Jintao . LETFORMER: Lightweight transformer pre-training with sharpness-aware optimization for efficient encrypted traffic analysis [J ] . International Journal of Innovative Computing, Information and Control , 2025 , 21 ( 2 ): 359 - 371 . DOI: 10.24507/ijicic.21.02.359 http://dx.doi.org/10.24507/ijicic.21.02.359

Pan Quanbo , Yu Yang , Yan Hanbing , et al . FlowBERT: An encrypted traffic classification model based on transformers using flow sequence [C ] // 2023 IEEE 22nd International Conference on Trust, Security and Privacy in Computing and Communications . Piscataway : IEEE , 2023 : 133 - 140 . DOI: 10.1109/trustcom60117.2023.00039 http://dx.doi.org/10.1109/trustcom60117.2023.00039

Chen Xuyang , Han Lu , Zhan Dechuan , et al . MIETT: Multi-instance encrypted traffic transformer for encrypted traffic classification [J ] . Proceedings of the AAAI Conference on Artificial Intelligence , 2025 , 39 ( 15 ): 15922 - 15929 . DOI: 10.1609/aaai.v39i15.33748 http://dx.doi.org/10.1609/aaai.v39i15.33748

Shi Zhaolei , Luktarhan N , Song Yangyang , et al . BFCN: A novel classification method of encrypted traffic based on BERT and CNN [J ] . Electronics , 2023 , 12 ( 3 ): 516 . DOI: 10.3390/electronics12030516 http://dx.doi.org/10.3390/electronics12030516

Farrukh Y A , Wali S , Khan I , et al . XG-NID: Dual-modality network intrusion detection using a heterogeneous graph neural network and large language model [J ] . Expert Systems with Applications , 2025 , 287 : 128089 . DOI: 10.1016/j.eswa.2025.128089 http://dx.doi.org/10.1016/j.eswa.2025.128089

Luo Jian , Chen Zechao , Chen Wenxiong , et al . A study on the application of the T5 large language model in encrypted traffic classification [J ] . Peer-to-Peer Networking and Applications , 2025 , 18 ( 1 ): 15 . DOI: 10.1007/s12083-024-01817-5 http://dx.doi.org/10.1007/s12083-024-01817-5

Antari A , Abo-Aisheh Y , Shamasneh J , et al . Network traffic classification using machine learning, transformer, and large language models [C ] // 2025 IEEE 4th International Conference on Computing and Machine Intelligence (ICMI) . Piscataway : IEEE , 2025 : 1 - 5 . DOI: 10.1109/icmi65310.2025.11141207 http://dx.doi.org/10.1109/icmi65310.2025.11141207

Fu Chuanpu , Li Qi , Xu Ke . Flow interaction graph analysis: Unknown encrypted malicious traffic detection [J ] . IEEE/ACM Transactions on Networking , 2024 , 32 ( 4 ): 2972 - 2987 . DOI: 10.1109/TNET.2024.3370851 http://dx.doi.org/10.1109/TNET.2024.3370851

Fu Chuanpu , Li Qi , Shen Meng , et al . Realtime robust malicious traffic detection via frequency domain analysis [C ] // Proceedings of 2021 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2021 : 3431 - 3446 . DOI: 10.1145/3460120.3484585 http://dx.doi.org/10.1145/3460120.3484585

Liang Yu , Li Pengchao , Lai Qiunan , et al . EM-BERT: A language model based method to detect encrypted malicious network traffic [M ] // Proceedings of International Conference on Image, Vision and Intelligent Systems 2023 (ICIVIS 2023) . Singapore : Springer , 2024 : 580 - 589 . DOI: 10.1007/978-981-97-0855-0_56 http://dx.doi.org/10.1007/978-981-97-0855-0_56

Stein K , Mahyari A A , Francia G , et al . Towards novel malicious packet recognition: A few-shot learning approach [C ] // 2024 IEEE Military Communications Conference . Piscataway : IEEE , 2024 : 847 - 852 . DOI: 10.1109/milcom61039.2024.10774059 http://dx.doi.org/10.1109/milcom61039.2024.10774059

Naseer M , Ullah F , Ijaz S , et al . Obfuscated malware detection and classification in network traffic leveraging hybrid large language models and synthetic data [J ] . Sensors , 2025 , 25 ( 1 ): 202 . DOI: 10.3390/s25010202 http://dx.doi.org/10.3390/s25010202

Chaves-Tibaduiza J F , Becerra-Muñoz A I , Robledo-Giron A , et al . On the feasibility of using an encoder-only model for anomaly detection: The BERTAD approach [C ] // 2024 IEEE Colombian Conference on Communications and Computing . Piscataway : IEEE , 2024 : 1 - 6 . DOI: 10.1109/colcom62950.2024.10720312 http://dx.doi.org/10.1109/colcom62950.2024.10720312

Yang Z , Jin Y , Liu J , et al . Research on cloud platform network traffic monitoring and anomaly detection system based on large language models [C ] // 2025 IEEE 7th International Conference on Communications, Information System and Computer Engineering (CISCE) . Piscataway : IEEE , 2025 : 1029 - 1032 . DOI: 10.1109/CISCE65916.2025.11065413 http://dx.doi.org/10.1109/CISCE65916.2025.11065413

Zhao Jianming , Jin Ziwen , Zeng Peng , et al . An anomaly detection method for oilfield industrial control systems fine-tuned using the llama3 model [J ] . Applied Sciences , 2024 , 14 ( 20 ): 9169 . DOI: 10.3390/app14209169 http://dx.doi.org/10.3390/app14209169

Rezaei H , Taheri R , Shojafar M . FedLLMGuard: A federated large language model for anomaly detection in 5G networks [J ] . Computer Networks , 2025 , 269 : 111473 . DOI: 10.1016/j.comnet.2025.111473 http://dx.doi.org/10.1016/j.comnet.2025.111473

Li Qingyang , Zhang Yihang , Jia Zhidong , et al . DoLLM: How large language models understanding network flow data to detect carpet bombing DDoS [PP/OL ] . V1. arXiv ( 2024-05-13 ) [ 2025-10-30 ] . https://arxiv.org/abs/2405.07638 https://arxiv.org/abs/2405.07638 .

Lin Xinjie , Xiong Gang , Gou Gaopeng , et al . Respond to change with constancy: Instruction-tuning with LLM for Non-I.I.D. network traffic classification [J ] . IEEE Transactions on Information Forensics and Security , 2025 , 20 : 5758 - 5773 . DOI: 10.1109/TIFS.2025.3574971 http://dx.doi.org/10.1109/TIFS.2025.3574971

Wu Dongming , Peng Zhiyuan , Chen Mingzhe , et al . Transforming network intrusion detection using large language models [C ] // 2025 IEEE 22nd Consumer Communications & Networking Conference . Piscataway : IEEE , 2025 : 1 - 9 . DOI: 10.1109/ccnc54725.2025.10976105 http://dx.doi.org/10.1109/ccnc54725.2025.10976105

Xu Hongbo , Si Chengxiang , Zhouzhou , et al . APTSniffer: Detecting APT attack traffic using retrieval-augmented large language models [C ] // 2025 IEEE International Conference on Acoustics, Speech and Signal Processing . Piscataway : IEEE , 2025 : 1 - 5 . DOI: 10.1109/icassp49660.2025.10888022 http://dx.doi.org/10.1109/icassp49660.2025.10888022

Shen Meng , Ji Kexin , Wu Jinhe , et al . Real-time website fingerprinting defense via traffic cluster anonymization [C ] // 2024 IEEE Symposium on Security and Privacy . Piscataway : IEEE , 2024 : 3238 - 3256 . DOI: 10.1109/sp54263.2024.00247 http://dx.doi.org/10.1109/sp54263.2024.00247

Liu Zixuan , Zhao Yi , Liu Zhuotao , et al . A hard-label black-box evasion attack against ML-based malicious traffic detection systems [PP/OL ] . V1. arXiv ( 2025-10-16 ) [ 2025-10-30 ] . https://arxiv.org/abs/2510.14906 https://arxiv.org/abs/2510.14906 . DOI: 10.14722/ndss.2026.230916 http://dx.doi.org/10.14722/ndss.2026.230916

Kong Qian , Zhang Xu , Zhang Chongfu , et al . Network traffic prediction: Apply the transformer to time series forecasting [J ] . Mathematical Problems in Engineering , 2022 , 2022 : 8424398 . DOI: 10.1155/2022/8424398 http://dx.doi.org/10.1155/2022/8424398

Xu Luyang , Liu Haoyu , Song Junping , et al . TransMUSE: Transferable traffic prediction in multi-service edge networks [J ] . Computer Networks , 2023 , 221 : 109518 . DOI: 10.1016/j.comnet.2022.109518 http://dx.doi.org/10.1016/j.comnet.2022.109518

Van Langendonck L , Castell-Uroz I , Barlet-Ros P . Towards a graph-based foundation model for network traffic analysis [C ] // Proceedings of the 3rd GNNet Workshop on Graph Neural Networking Workshop . New York : ACM , 2024 : 41 - 45 . DOI: 10.1145/3694811.3697817 http://dx.doi.org/10.1145/3694811.3697817

Diaf A , Korba A A , Karabadji N E , et al . BARTPredict: Empowering IoT security with LLM-driven cyber threat prediction [C ] // 2024 IEEE Global Communications Conference . Piscataway : IEEE , 2024 : 1239 - 1244 . DOI: 10.1109/globecom52923.2024.10901770 http://dx.doi.org/10.1109/globecom52923.2024.10901770

Diaf A , Korba A A , Karabadji N E , et al . Beyond detection: Leveraging large language models for cyber attack prediction in IoT networks [C ] // 2024 20th International Conference on Distributed Computing in Smart Systems and the Internet of Things . Piscataway : IEEE , 2024 : 117 - 123 . DOI: 10.1109/dcoss-iot61029.2024.00026 http://dx.doi.org/10.1109/dcoss-iot61029.2024.00026

Sommers J , Kim H , Barford P . Harpoon: A flow-level traffic generator for router and network tests [J ] . ACM SIGMETRICS Performance Evaluation Review , 2004 , 32 ( 1 ): 392 . DOI: 10.1145/1012888.1005733 http://dx.doi.org/10.1145/1012888.1005733

Meng Xuying , Lin Chungang , Wang Yequan , et al . NetGPT: Generative pretrained transformer for network traffic [PP/OL ] . V3. arXiv ( 2025-08-28 ) [ 2025-10-30 ] . https://arxiv.org/abs/2304.09513 https://arxiv.org/abs/2304.09513 . DOI: 10.1109/isaeece66033.2025.11159936 http://dx.doi.org/10.1109/isaeece66033.2025.11159936

Qu J , Ma X , Li J . TrafficGPT: Breaking the token barrier for efficient long traffic analysis and generation [PP/OL ] . V2. arXiv ( 2024-03-18 ) [ 2025-10-30 ] . https://arxiv.org/abs/2403.05822 https://arxiv.org/abs/2403.05822 .

Zhao Di , Jiang Bo , Liu Song , et al . Language of network: A generative pre-trained model for encrypted traffic comprehension [PP/OL ] . V1. arXiv ( 2025-05-26 ) [ 2026-05-07 ] . https://arxiv.org/abs/2505.19482 https://arxiv.org/abs/2505.19482 .

Zhou Jiawei , Kim W , Xu Zhiying , et al . Netflowgen: Leveraging generative pre-training for network traffic dynamics [PP/OL ] . V1. arXiv ( 2024-12-30 ) [ 2025-10-30 ] . https://arxiv.org/abs/2412.20635 https://arxiv.org/abs/2412.20635 .

Chu A , Jiang X , Liu S , et al . Netssm: Multi-flow and state-aware network trace generation using state-space models [J ] . Proceedings of the ACM on Networking , 2026 , 4 (CoNEXT 1 ): 1 - 24 . DOI: 10.1145/3786289 http://dx.doi.org/10.1145/3786289

Sun Peishuai , Yun Xiaochun , Li Shuhao , et al . AdvTG: An Adversarial traffic generation framework to deceive dl-based malicious traffic detection models [C ] // Proceedings of the ACM on Web Conference 2025 . New York : ACM , 2025 : 3147 - 3159 . DOI: 10.1145/3696410.3714876 http://dx.doi.org/10.1145/3696410.3714876

Kholgh D K , Kostakos P . PAC-GPT: A novel approach to generating synthetic network traffic with GPT-3 [J ] . IEEE Access , 2023 , 11 : 114936 - 114951 . DOI: 10.1109/access.2023.3325727 http://dx.doi.org/10.1109/access.2023.3325727

Delgado-Soto J A , López de Vergara J E , González I , et al . GPT on the wire: Towards realistic network traffic conversations generated with large language models [J ] . Computer Networks , 2025 , 265 : 111308 . DOI: 10.1016/j.comnet.2025.111308 http://dx.doi.org/10.1016/j.comnet.2025.111308

Jiang Xi , Liu Shinan , Gember-Jacobson A , et al . NetDiffusion: Network data augmentation through protocol-constrained traffic generation [J ] . Proceedings of the ACM on Measurement and Analysis of Computing Systems , 2024 , 8 ( 1 ): 11 . DOI: 10.1145/3639037 http://dx.doi.org/10.1145/3639037

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Unknown Encrypted Malicious Traffic Detection via Burst Feature Token Self-Learning

A Survey on the Applications of Large Language Models in Electronic Design Automation

Multi-Stage Trajectory and Resource Joint Optimization for UAV-Enabled ISAC in Complex Environments

Convolutional Blind Source Separation Method Based on Impulse Response Compression

Analysis and Design of Wideband High-Efficiency Transparent Vehicular Glass Antenna with Surface Wave Self-Cancelling

Related Author

SHEN Meng

JIA Ji-zhe

ZHAO Bu-fan

CHANG Li-yuan

YANG Ming

REN Chen-chen

SONG Yue

ZHU Lie-huang

Related Institution

National Supercomputing Center in Jinan

School of Cyberspace Science and Technology, Beiijing Institute of Technology

Department of Basic Ability, China Telecom Cybersecurity Technology Co., Ltd.

School of Cyber Science and Engineering, Sichuan University

School of Computing and Data Science, The University of Hong Kong

⁰