LLMs for Intrusion Detection Systems: A Review

EROL A. G., Demirci S.

18th International Conference on Information Security and Cryptology, ISCTurkiye 2025, Ankara, Türkiye, 22 - 23 Ekim 2025, (Tam Metin Bildiri) identifier

  • Yayın Türü: Bildiri / Tam Metin Bildiri
  • Doi Numarası: 10.1109/isctrkiye68593.2025.11224813
  • Basıldığı Şehir: Ankara
  • Basıldığı Ülke: Türkiye
  • Anahtar Kelimeler: Anomaly Detection, Deep Learning (DL), Intrusion Detection Systems (IDSs), Large Language Models (LLMs), Natural Language Processing (NLP)
  • Gazi Üniversitesi Adresli: Evet

Özet

Intrusion Detection Systems (IDS) are central to identifying and mitigating cyber threats, yet traditional and even deep learning-based methods often struggle with adaptability, context awareness, and processing unstructured data sources. In contrast, recent advances in Large Language Models (LLMs) such as BERT, GPT, and LLaMA have opened new possibilities by offering superior semantic understanding and generalization. Motivated by this trajectory, this study provides one of the earliest reviews examining the integration of LLMs into IDS. Beyond synthesizing recent developments, it contributes by offering a comparative perspective with conventional approaches, highlighting respective strengths and weaknesses, while also outlining critical gaps such as focusing on unseen attack detection, SDN environments, and model explainability. In doing so, it not only evaluates how LLMs already surpass ML/DL techniques but also sets out future research directions and establishes a foundation for subsequent domain-specific investigations.