Efficient anomaly detection in tabular cybersecurity data using large language models.

Area of Science:

• Cybersecurity
• Machine Learning
• Natural Language Processing

Background:

• Anomaly detection in tabular data is crucial for information security.
• Traditional machine learning and deep learning methods struggle with generalization in this domain.
• Existing methods face limitations in effectively identifying diverse anomalies.

Purpose of the Study:

• To introduce an innovative method for tabular data anomaly detection using large language models (LLMs).
• To address the generalization challenges faced by conventional anomaly detection techniques.
• To develop a practical and efficient solution for cybersecurity anomaly detection.

Main Methods:

• The proposed method, Tabular Anomaly Detection via Guided Prompts (TAD-GP), utilizes a 7-billion-parameter open-source LLM.
• Key strategies include data sample introduction, anomaly type recognition, chain-of-thought reasoning, multi-turn dialogue, and information reinforcement.
• The approach focuses on leveraging LLM capabilities for nuanced understanding of tabular data patterns.

Main Results:

• TAD-GP achieved significant improvements in F1 scores: 79.31% on CICIDS2017, 97.96% on KDD Cup 1999, and 59.09% on UNSW-NB15.
• The smaller-scale TAD-GP model demonstrated superior performance compared to larger models across multiple datasets.
• The method shows practical potential for environments with limited computational resources and private deployment needs.

Conclusions:

• TAD-GP offers a powerful and efficient approach to anomaly detection in tabular cybersecurity data.
• The use of small-scale, open-source LLMs presents a viable alternative to resource-intensive models.
• This research addresses a critical gap by providing an effective LLM-based solution for cybersecurity anomaly detection.