Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper investigates the interpretability of encoder-based LLMs for Software-Defined Networking (SDN) intrusion detection using flow-level traffic features. Attribution analysis is applied to demonstrate that model decisions are driven by meaningful traffic behavior patterns that align with established intrusion detection principles. The results show that LLMs can effectively learn attack behavior from traffic dynamics, enhancing trust and transparency in transformer-based SDN intrusion detection.
LLMs aren't black boxes when it comes to intrusion detection: attribution analysis reveals they're learning attack patterns from network traffic dynamics just like traditional methods.
Software-Defined Networking (SDN) improves network flexibility but also increases the need for reliable and interpretable intrusion detection. Large Language Models (LLMs) have recently been explored for cybersecurity tasks due to their strong representation learning capabilities; however, their lack of transparency limits their practical adoption in security-critical environments. Understanding how LLMs make decisions is therefore essential. This paper presents an attribution-driven analysis of encoder-based LLMs for network intrusion detection using flow-level traffic features. Attribution analysis demonstrates that model decisions are driven by meaningful traffic behavior patterns, improving transparency and trust in transformer-based SDN intrusion detection. These patterns align with established intrusion detection principles, indicating that LLMs learn attack behavior from traffic dynamics. This work demonstrates the value of attribution methods for validating and trusting LLM-based security analysis.