The growth of data volume and access users in the 5G Internet of Things (IoT) has made network traffic increasingly complicated and diversified. Conventional attack traffic detection has been unable to meet the needs of security assurance. Large Language Model (LLM) technology has demonstrated outstanding efficiency in numerous domains. It’s a novel direction to using its potent performance for attack detection. This paper proposes an attack detection method called ADL, which uses the LLM performance to detect DDoS attacks through the cloud edge collaboration in the 5G IoT. For optimal LLM performance and first-time traffic detection, the Multi-Layer Perceptron (MLP) is placed at the edge of the Internet of Things and the LLM is deployed in the cloud center. A personalized model parameter method is proposed, so that the detection results of LLM can be fed back to the edge to provide training basis for MLP. In addition, a traffic processing method is proposed to make the traffic sequential for LLM to understand and process it. The experimental results demonstrate a significant improvement in accuracy, recall rate, and F1 value over the conventional neural network detection scheme in the proposed attack detection method’s detection performance for five distinct DDoS attacks.