{"id":"https://openalex.org/W7010981060","doi":null,"title":"Leveraging Large Language Models for Network Traffic Analysis : Design, Implementation, and Evaluation of an LLM-Powered System for Cyber Incident Reconstruction","display_name":"Leveraging Large Language Models for Network Traffic Analysis : Design, Implementation, and Evaluation of an LLM-Powered System for Cyber Incident Reconstruction","publication_year":2024,"publication_date":"2024-11-28","ids":{"openalex":"https://openalex.org/W7010981060"},"language":"en","primary_location":{"id":"pmh:oai:utupub.fi:11111/19630","doi":null,"is_oa":true,"landing_page_url":"https://www.utupub.fi/handle/11111/19630","pdf_url":"https://www.utupub.fi/bitstreams/1f46743f-5315-41c2-a407-df281007c04a/download","source":{"id":"https://openalex.org/S4306402470","display_name":"UTUPub (University of Turku)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I155660961","host_organization_name":"University of Turku","host_organization_lineage":["https://openalex.org/I155660961"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"https://www.utupub.fi/handle/10024/179397","raw_type":"fi=Diplomity\u00f6|en=Master's thesis|"},"volume":null,"type":"dissertation","is_traditional":true,"indexed_in":[],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://www.utupub.fi/bitstreams/1f46743f-5315-41c2-a407-df281007c04a/download","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Rahman, Naeemur","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Rahman, Naeemur","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":true,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.5619999766349792,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.5619999766349792,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.4171999990940094,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.00419999985024333,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.9330000281333923},{"id":"https://openalex.org/keywords/network-traffic-analysis","display_name":"network traffic analysis","score":0.9909999966621399},{"id":"https://openalex.org/keywords/open-source-llms","display_name":"open-source LLMs","score":0.875},{"id":"https://openalex.org/keywords/vector-databases","display_name":"vector databases","score":0.8299999833106995},{"id":"https://openalex.org/keywords/pcap-files","display_name":"PCAP files","score":0.5580000281333923},{"id":"https://openalex.org/keywords/threat-intelligence","display_name":"threat intelligence","score":0.6549999713897705},{"id":"https://openalex.org/keywords/attacker-identification","display_name":"attacker identification","score":0.621999979019165},{"id":"https://openalex.org/keywords/digital-forensics","display_name":"digital forensics","score":0.7850000262260437},{"id":"https://openalex.org/keywords/incident-response","display_name":"incident response","score":0.8410000205039978},{"id":"https://openalex.org/keywords/prompt-engineering","display_name":"prompt engineering","score":0.5879999995231628},{"id":"https://openalex.org/keywords/data-privacy","display_name":"data privacy","score":0.5619999766349792}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7224000096321106},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.5629000067710876},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5317999720573425},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.4578999876976013},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.44589999318122864},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.40939998626708984},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.392300009727478},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3833000063896179},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3734999895095825},{"id":"https://openalex.org/C113843644","wikidata":"https://www.wikidata.org/wiki/Q901882","display_name":"Interface (matter)","level":4,"score":0.35179999470710754},{"id":"https://openalex.org/C38369872","wikidata":"https://www.wikidata.org/wiki/Q7445009","display_name":"Security analysis","level":2,"score":0.33550000190734863},{"id":"https://openalex.org/C79158427","wikidata":"https://www.wikidata.org/wiki/Q485396","display_name":"Analytics","level":2,"score":0.3305000066757202},{"id":"https://openalex.org/C145804949","wikidata":"https://www.wikidata.org/wiki/Q478123","display_name":"Situation awareness","level":2,"score":0.3276999890804291},{"id":"https://openalex.org/C2781317605","wikidata":"https://www.wikidata.org/wiki/Q7832483","display_name":"Traffic analysis","level":2,"score":0.32269999384880066},{"id":"https://openalex.org/C188067584","wikidata":"https://www.wikidata.org/wiki/Q219363","display_name":"NetFlow","level":2,"score":0.31679999828338623},{"id":"https://openalex.org/C34736171","wikidata":"https://www.wikidata.org/wiki/Q918333","display_name":"Preprocessor","level":2,"score":0.31630000472068787},{"id":"https://openalex.org/C193415008","wikidata":"https://www.wikidata.org/wiki/Q639681","display_name":"Network architecture","level":2,"score":0.31450000405311584},{"id":"https://openalex.org/C10551718","wikidata":"https://www.wikidata.org/wiki/Q5227332","display_name":"Data pre-processing","level":2,"score":0.30640000104904175},{"id":"https://openalex.org/C10511746","wikidata":"https://www.wikidata.org/wiki/Q899388","display_name":"Data security","level":3,"score":0.3010999858379364},{"id":"https://openalex.org/C175801342","wikidata":"https://www.wikidata.org/wiki/Q1988917","display_name":"Data analysis","level":2,"score":0.2919999957084656},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.28049999475479126},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.265500009059906},{"id":"https://openalex.org/C32946077","wikidata":"https://www.wikidata.org/wiki/Q618079","display_name":"Network analysis","level":2,"score":0.26409998536109924},{"id":"https://openalex.org/C100463513","wikidata":"https://www.wikidata.org/wiki/Q5227322","display_name":"Data model (GIS)","level":2,"score":0.26190000772476196},{"id":"https://openalex.org/C114713312","wikidata":"https://www.wikidata.org/wiki/Q7551269","display_name":"Social network analysis","level":3,"score":0.26109999418258667},{"id":"https://openalex.org/C104122410","wikidata":"https://www.wikidata.org/wiki/Q1416406","display_name":"Network model","level":2,"score":0.2522999942302704}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:utupub.fi:11111/19630","doi":null,"is_oa":true,"landing_page_url":"https://www.utupub.fi/handle/11111/19630","pdf_url":"https://www.utupub.fi/bitstreams/1f46743f-5315-41c2-a407-df281007c04a/download","source":{"id":"https://openalex.org/S4306402470","display_name":"UTUPub (University of Turku)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I155660961","host_organization_name":"University of Turku","host_organization_lineage":["https://openalex.org/I155660961"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"https://www.utupub.fi/handle/10024/179397","raw_type":"fi=Diplomity\u00f6|en=Master's thesis|"},{"id":"pmh:oai:www.utupub.fi:10024/179397","doi":null,"is_oa":false,"landing_page_url":"https://www.utupub.fi/handle/10024/179397","pdf_url":null,"source":{"id":"https://openalex.org/S4306402470","display_name":"UTUPub (University of Turku)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I155660961","host_organization_name":"University of Turku","host_organization_lineage":["https://openalex.org/I155660961"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"fi=Diplomity\u00f6|en=Master's thesis|"}],"best_oa_location":{"id":"pmh:oai:utupub.fi:11111/19630","doi":null,"is_oa":true,"landing_page_url":"https://www.utupub.fi/handle/11111/19630","pdf_url":"https://www.utupub.fi/bitstreams/1f46743f-5315-41c2-a407-df281007c04a/download","source":{"id":"https://openalex.org/S4306402470","display_name":"UTUPub (University of Turku)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I155660961","host_organization_name":"University of Turku","host_organization_lineage":["https://openalex.org/I155660961"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"https://www.utupub.fi/handle/10024/179397","raw_type":"fi=Diplomity\u00f6|en=Master's thesis|"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7010981060.pdf","grobid_xml":"https://content.openalex.org/works/W7010981060.grobid-xml"},"referenced_works_count":13,"referenced_works":["https://openalex.org/W2787887017","https://openalex.org/W2896457183","https://openalex.org/W3030163527","https://openalex.org/W4224051134","https://openalex.org/W4380353722","https://openalex.org/W4385774833","https://openalex.org/W4393027333","https://openalex.org/W4399694926","https://openalex.org/W4407070057","https://openalex.org/W4407163436","https://openalex.org/W4412130408","https://openalex.org/W4413993509","https://openalex.org/W4414594130"],"related_works":["https://openalex.org/W7163067225","https://openalex.org/W4396788086","https://openalex.org/W7167468948","https://openalex.org/W4412446464","https://openalex.org/W4404366308","https://openalex.org/W7134917331","https://openalex.org/W7168464343","https://openalex.org/W7170405503","https://openalex.org/W7221649226","https://openalex.org/W4408566127"],"abstract_inverted_index":{"Cyberthreats":[0],"are":[1],"evolving,":[2],"and":[3,24,32,61,88,108,121,148,182,191,198,206,233,250,260,272,291,331,341],"becoming":[4],"more":[5],"sophisticated.":[6],"Hence,":[7],"there":[8],"is":[9,333],"a":[10,89,97,118,136,165,169,208,235,325],"growing":[11],"need":[12],"for":[13,20,56,178,238,270,275],"advanced":[14,240],"security":[15,204,213,244,295],"analysis":[16,245],"tools.":[17],"Traditional":[18],"approaches":[19],"analyzing":[21],"network":[22,37,113,143,230,243],"traffic":[23,114,231],"reconstructing":[25],"cyber":[26,119],"incidents":[27],"struggle":[28],"to":[29,80,111,116,163,202,215,220,288,294,335],"efficiently":[30],"process":[31],"analyse":[33],"large":[34,48],"amounts":[35],"of":[36,44,91,100,127,255,339],"data":[38,85,137,158,177,197,232,248],"in":[39,71,242,311],"real-time.":[40],"The":[41,125,223,253,278,297],"rapid":[42],"advancement":[43],"Generative":[45],"AI,":[46],"particularly":[47],"language":[49],"models":[50,274,302],"(LLMs),":[51],"opens":[52],"up":[53],"new":[54,98],"possibilities":[55],"extending":[57],"current":[58],"digital":[59],"forensics":[60],"incident":[62,120],"response":[63],"capabilities.":[64],"LLMs":[65,107,188,256,284,340],"can":[66],"play":[67],"an":[68],"important":[69,334],"role":[70],"cybersecurity,":[72],"but":[73],"their":[74],"adoption":[75],"has":[76],"been":[77],"limited":[78],"due":[79],"reliance":[81],"on":[82],"commercial":[83],"models,":[84],"privacy":[86,249],"concerns,":[87],"lack":[90],"domain-specific":[92],"fine-tuning.":[93],"This":[94],"thesis":[95],"proposes":[96],"type":[99],"framework":[101,237],"that":[102,140,173,211,281,300],"uses":[103],"locally":[104],"run":[105,186],"open-source":[106,187,283],"vector":[109,170],"databases":[110],"perform":[112,306],"analytics":[115],"reconstruct":[117],"identify":[122],"the":[123,128,142,175,195,203,218,317,337],"attacker.":[124],"architecture":[126],"proposed":[129,224],"system":[130,225,251],"includes":[131],"five":[132],"major":[133],"components:":[134],"(1)":[135],"preprocessing":[138],"pipeline":[139],"ingests":[141],"packet":[144],"capture":[145],"(PCAP)":[146],"files":[147],"extracts":[149],"relevant":[150,343],"features":[151],"while":[152,246],"also":[153],"using":[154,228,239],"external":[155],"threat":[156],"intelligence":[157],"source,":[159],"such":[160],"as":[161,316],"\"VirusTotal\",":[162],"provide":[164,289],"context-aware":[166],"response;":[167],"(2)":[168],"database":[171],"(ChromaDB)":[172],"stores":[174],"preprocessed":[176],"fast":[179],"similarity":[180],"search":[181],"retrieval;":[183],"(3)":[184],"Locally":[185],"(LLAMA,":[189],"Falcon,":[190,259],"Mistral)":[192],"which":[193],"analyze":[194],"retrieved":[196],"generate":[199],"human-like":[200],"responses":[201,293],"queries;":[205],"(4)":[207],"user":[209],"interface":[210],"allows":[212],"analysts":[214],"interact":[216],"with":[217,262,328],"system,":[219],"gather":[221],"insights.":[222,344],"was":[226],"tested":[227],"real-world":[229,276],"offers":[234],"practical":[236],"LLM":[241],"ensuring":[247],"efficiency.":[252],"comparison":[254],"like":[257],"LLAMA,":[258],"Mistral":[261],"different":[263],"parameter":[264],"sizes":[265],"(7B,13B)":[266],"provides":[267],"useful":[268],"insights":[269],"selecting":[271],"optimizing":[273],"use.":[277],"results":[279,298],"indicate":[280,299],"these":[282],"have":[285],"great":[286],"potential":[287],"accurate":[290],"smart":[292],"queries.":[296],"larger":[301],"(large":[303],"parameters)":[304],"generally":[305],"better":[307],"than":[308],"smaller":[309],"ones":[310],"accuracy.":[312],"Llama7-13b":[313],"stood":[314],"out":[315],"top":[318],"performer":[319],"across":[320],"all":[321],"metrics.":[322],"Furthermore,":[323],"designing":[324],"detailed":[326],"form":[327],"sufficient":[329],"information":[330],"context":[332],"guide":[336],"output":[338],"obtain":[342]},"counts_by_year":[],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2025-10-10T00:00:00"}