Network Intrusion Detection: Evolution from Conventional Approaches to LLM Collaboration and Emerging Risks

TL;DR

The paper surveys the evolution of network intrusion detection systems from traditional signature-based methods to neural network approaches and now to LLM-assisted frameworks. It analyzes the strengths and limitations of each paradigm, highlighting signature-based systems for accuracy on known threats but poor zero-day detection, NN-based models for learning capability yet suffering from data, robustness, and interpretability challenges, and LLMs for continuous adaptation and deep behavioral insight alongside significant costs and security concerns. It discusses domain-adaptive strategies (CPT/SFT), prompt engineering, and hybrid architectures as practical paths to deploy LLMs in NIDS, while detailing offensive uses and defense implications. The practical impact is a nuanced, multi-layered defense strategy that leverages fast, rule-based detectors with semantically aware LLM components, augmented by RAG, PEFT, and input hardening to address real-world threat landscapes and policy constraints. The paper also emphasizes ethical, privacy, and legal considerations, underscoring the need for robust evaluation, adversarial testing, and continual maintenance to ensure reliable, trustworthy intrusion detection in complex networks.

Abstract

This survey systematizes the evolution of network intrusion detection systems (NIDS), from conventional methods such as signature-based and neural network (NN)-based approaches to recent integrations with large language models (LLMs). It clearly and concisely summarizes the current status, strengths, and limitations of conventional techniques, and explores the practical benefits of integrating LLMs into NIDS. Recent research on the application of LLMs to NIDS in diverse environments is reviewed, including conventional network infrastructures, autonomous vehicle environments and IoT environments. From this survey, readers will learn that: 1) the earliest methods, signature-based IDSs, continue to make significant contributions to modern systems, despite their well-known weaknesses; 2) NN-based detection, although considered promising and under development for more than two decades, and despite numerous related approaches, still faces significant challenges in practical deployment; 3) LLMs are useful for NIDS in many cases, and a number of related approaches have been proposed; however, they still face significant challenges in practical applications. Moreover, they can even be exploited as offensive tools, such as for generating malware, crafting phishing messages, or launching cyberattacks. Recently, several studies have been proposed to address these challenges, which are also reviewed in this survey; and 4) strategies for constructing domain-specific LLMs have been proposed and are outlined in this survey, as it is nearly impossible to train a NIDS-specific LLM from scratch.

Figures (1)

• Figure 1: Organization of this survey paper.