A Protocol-Language Model for Network Intrusion (Without Deep Packet Inspection)

• URL: http://arxiv.org/abs/2606.00155v1
• Date: Fri, 29 May 2026 07:03:11 GMT
• Title: A Protocol-Language Model for Network Intrusion (Without Deep Packet Inspection)
• Abstract summary: We present PLM-NIDS, which proves three claims in sequence.<n>Because it reads only IP/ TCP/UDP headers, it is inherently encryption-agnostic.
• Score: 0.0
• License: http://creativecommons.org/licenses/by-sa/4.0/
• Abstract: Modern network intrusion detection systems (NIDS) are caught in a structural contradiction: the protocols carrying the highest threat intelligence are precisely those encrypted under TLS 1.3 and QUIC, where payload inspection yields nothing. We ask a simpler question -- what if the attack signature is not in the bytes, but in the rhythm? -- and answer it by treating network flows as a language whose grammar is written entirely in L3/L4 packet metadata: length, inter-arrival time, TTL, TCP flags, and hashed port numbers. We present PLM-NIDS, which proves three claims in sequence. (1) The grammar exists and is learnable: a RWKV-4 state-space model trained on 344,232 unlabelled Monday flows achieves a causal LM validation loss of 0.204, demonstrating that benign traffic has predictable, statistically consistent structure. (2) Attacks violate this grammar: the per-flow perplexity score cleanly separates benign from attack flows with PR-AUC = 0.93 using zero attack labels at training time. (3) This separation is architecturally nontrivial: an LSTM trained on identical token sequences degenerates to a majority-class predictor (ROC-AUC approximately 0.50, F1 = 0.91 by always predicting "attack"), proving that RWKV's causal pre-training provides an inductive bias unavailable to direct classifiers. Supervised fine-tuning further raises PR-AUC to 0.94 and ROC-AUC to 0.75, with a precision of 97.7% at the calibrated operating threshold. The RWKV backbone's O(T) recurrent inference enables per-packet streaming without flow buffering, making PLM-NIDS operationally viable at line rate. Because it reads only IP/TCP/UDP headers, it is inherently encryption-agnostic: TLS 1.3, QUIC, and future encrypted protocols are handled transparently.

Related papers

• Trustworthy RAG: An Evaluation Agent for Detecting Misinformation and Knowledge Poisoning in Generative AI Systems [1.7327102304628392]
  Retrieval-Augmented Generation (RAG) grounds Large Language Model (LLM) outputs in external knowledge.<n>We propose an Evaluation Agent that combines Natural Language Inference (NLI) factual verification, a five-signal poison detector with relevance-weighted aggregation, and a Trust Index T = 0.4 F + 0.35 C + 0.25 (1 - P )<n>On TruthfulQA with Llama 3.3 70B, the agent reaches 91% accuracy and 100% precision, with 100% recall on instruction injection.
  arXiv  Detail & Related papers  (2026-08-21T13:42:41Z)
• Architecture-Dependent Causal Transfer of Activation States Across Large Language Models [51.56484100374058]
  Internal language activation states can be transferred causally between different large language models.<n>Injecting projected activations into a target model during generation produces a statistically significant, preregistered causal effect.<n>We conclude that end-to-end activation-state transfer between LLMs, as currently implemented, is architecture-dependent rather than universal.
  arXiv  Detail & Related papers  (2026-08-17T09:53:27Z)
• Categorical Robustness Assessment for Machine Learning based Network Intrusion Detection Systems [6.42094170804706]
  adversarial attacks add carefully crafted perturbations to network traffic data that leads to misclassifications.<n>This paper asks what type of architectures actually hold up when attackers try to manipulate the systems.<n>For practitioners deploying intrusion detection in adversarial environments, we recommend CNN-based architectures.
  arXiv  Detail & Related papers  (2026-06-10T13:41:44Z)
• MIRAGE: A Polarity-Flipping Encoding Subspace in LLM Agents [2.896184275229374]
  LLM agents are coerced into covertly encoding sensitive data.<n>The resulting outputs evade output-side detection but the underlying computation does not.<n>We build MIRAGE, a two-channel real-time monitor exploiting both signals.
  arXiv  Detail & Related papers  (2026-06-09T01:45:19Z)
• Hiding in Plain Floats: Steganographic Carriers for Indirect Prompt and Content Injection [0.0]
  Text-centered prompt-injection defenses assume that the malicious signal is visible in one of the inspected text views.<n>We study a reproducible LLM01-style indirect prompt/content-injection failure mode where that assumption breaks.<n>A payload caught in plain English slips past the same detector when it is transported as structured float parameters and reconstructed only as fragmented telemetry.
  arXiv  Detail & Related papers  (2026-06-07T01:41:01Z)
• Amplifying, Not Learning: Fine-Tuned AI Text Detectors Amplify a Pretrained Direction [51.56484100374058]
  Text detectors amplify a pretrained typicality axis; they do not construct an AI-vs-human boundary.<n>On raw encoders before any task supervision, projecting onto centroid(AI)-centroid(HC3) achieves NYT-vs-HC3 AUROC 0.806/0.944/0.834 across three architectures.<n>On RoBERTa-base, raw projection exceeds fine-tuning; on RoBERTa-base, full fine-tuning reduces discrimination below raw on both fluent-formal populations tested.
  arXiv  Detail & Related papers  (2026-05-20T19:08:38Z)
• How Code Representation Shapes False-Positive Dynamics in Cross-Language LLM Vulnerability Detection [8.360057179027322]
  How code representation format shapes false positive behaviour in cross-language vulnerability detection remains poorly understood.<n>We systematically vary training intensity and code representation format, comparing raw source text with pruned Abstract Syntax Trees at both training time and inference time.<n>Cross-language FPR reflects the joint effect of training-time and inference-time representation, not either alone.
  arXiv  Detail & Related papers  (2026-04-30T11:01:03Z)
• COBALT-TLA: A Neuro-Symbolic Verification Loop for Cross-Chain Bridge Vulnerability Discovery [0.0]
  COBALT-TLA is a neuro-symbolic verification loop that pairs an LLM with TLC, the TLA+ model checker.<n>We evaluate the system against three cross-chain bridge targets, including a faithful model of the Nomad $190M exploit.
  arXiv  Detail & Related papers  (2026-04-14T00:56:58Z)
• StealthRL: Reinforcement Learning Paraphrase Attacks for Multi-Detector Evasion of AI-Text Detectors [0.0]
  StealthRL is a reinforcement learning framework for AI-text detectors.<n>We train a paraphrase policy against a multi-detector ensemble under realistic adversarial conditions.<n>StealthRL achieves near-zero detection, reduces mean AUROC from 0.74 to 0.27, and attains a 99.9% attack success rate.
  arXiv  Detail & Related papers  (2026-02-09T17:33:46Z)
• Residual Context Diffusion Language Models [90.07635240595926]
  Residual Context Diffusion (RCD) is a module that converts discarded token representations into contextual residuals and injects them back for the next denoising step.<n>RCD consistently improves frontier dLLMs by 5-10 points in accuracy with minimal extra computation overhead.
  arXiv  Detail & Related papers  (2026-01-30T13:16:32Z)
• LLM-Based Emulation of the Radio Resource Control Layer: Towards AI-Native RAN Protocols [28.04609776570199]
  Large AI Models (LAMs) are key enablers of the AI-Native Air Interface (AI-AI)<n>This paper presents the first standards-compliant emulation of the Radio Resource Control layer using a decoder-only LAM.<n>Results demonstrate that LAMs, when augmented with protocol-aware reasoning, can directly orchestrate control-plane procedures.
  arXiv  Detail & Related papers  (2025-05-22T15:55:56Z)
• Towards Effective and Efficient Non-autoregressive Decoding Using Block-based Attention Mask [74.64216073678617]
  AMD performs parallel NAR inference within contiguous blocks of output labels concealed using attention masks. A beam search algorithm is designed to leverage a dynamic fusion of CTC, AR Decoder, and AMD probabilities. Experiments on the LibriSpeech-100hr corpus suggest the tripartite Decoder incorporating the AMD module produces a maximum decoding speed-up ratio of 1.73x.
  arXiv  Detail & Related papers  (2024-06-14T13:42:38Z)
• CTC-based Non-autoregressive Speech Translation [51.37920141751813]
  We investigate the potential of connectionist temporal classification for non-autoregressive speech translation. We develop a model consisting of two encoders that are guided by CTC to predict the source and target texts. Experiments on the MuST-C benchmarks show that our NAST model achieves an average BLEU score of 29.5 with a speed-up of 5.67$times$.
  arXiv  Detail & Related papers  (2023-05-27T03:54:09Z)
• Improved techniques for deterministic l2 robustness [63.34032156196848]
  Training convolutional neural networks (CNNs) with a strict 1-Lipschitz constraint under the $l_2$ norm is useful for adversarial robustness, interpretable gradients and stable training. We introduce a procedure to certify robustness of 1-Lipschitz CNNs by replacing the last linear layer with a 1-hidden layer. We significantly advance the state-of-the-art for standard and provable robust accuracies on CIFAR-10 and CIFAR-100.
  arXiv  Detail & Related papers  (2022-11-15T19:10:12Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.