The widespread use of encrypted traffic poses challenges for traditional anomaly detection systems that rely on payload inspection. While unsupervised learning methods offer scalable solutions by detecting statistical deviations in NetFlow-like data, they often suffer from high false positive rates due to their lack of interpretability. In this paper, we propose an LLM-assisted reinterpretation framework that augments anomaly detection outputs with natural language explanations. These explanations are designed to help human analysts, particularly junior-level security operators, to re-evaluate detection outcomes and correct misclassifications. Notably, our approach is detection-model-agnostic and can complement various anomaly detection backends. An empirical study with junior participants shows that LLM-guided interpretation reduces false positives significantly and increases confidence in the detection process. This demonstrates the potential of LLMs to serve as a cognitive aid in SOC environments where expert resources are limited.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Understanding Encrypted Network Anomalies with LLMs: A Post-Hoc Cognitive Framework

  • Seon-Woo Lee,
  • Hyeon-Woo Park,
  • Tae-Jin Lee

摘要

The widespread use of encrypted traffic poses challenges for traditional anomaly detection systems that rely on payload inspection. While unsupervised learning methods offer scalable solutions by detecting statistical deviations in NetFlow-like data, they often suffer from high false positive rates due to their lack of interpretability. In this paper, we propose an LLM-assisted reinterpretation framework that augments anomaly detection outputs with natural language explanations. These explanations are designed to help human analysts, particularly junior-level security operators, to re-evaluate detection outcomes and correct misclassifications. Notably, our approach is detection-model-agnostic and can complement various anomaly detection backends. An empirical study with junior participants shows that LLM-guided interpretation reduces false positives significantly and increases confidence in the detection process. This demonstrates the potential of LLMs to serve as a cognitive aid in SOC environments where expert resources are limited.