NIDS-GPT: A New GPT-Based Model for Anomaly Data Package Detection

Network data packet anomaly detection faces numerous challenges, including incomplete supervision signals, extremely imbalanced data, weak adaptability in across- scenario. This paper proposes a GPT-based causal language model for network intrusion detection, which called NIDS-GPT. Unlike previous work, NIDS-GPT innovatively treats each number in the packet as an independent “word” rather than packet fields, enabling a more fine-grained data representation. In this model, we design special tokenizers and embedding layers to capture the structure and semantics of network data capture the structure and semantics of network data better. NIDS-GPT has good scalability and supports unsupervised pre-training. Experiments on the CICIDS2017 and car-hacking datasets show that NIDS-GPT achieves high accuracy under extreme imbalance conditions, far surpassing traditional methods; it also achieves over 90% accuracy in one shot learning. These results demonstrate NIDS-GPT’s excellent performance and potential in handling complex network anomaly detection tasks, especially in data-imbalanced and resource-constrained scenarios.