Language Model Embedding and Boosting Ensemble Learning for Malicious Intrusion Detection

This paper proposes an intrusion detection method that integrates language models with textualized network flow features. The core idea is to transform the original numerical and categorical attributes of network traffic into textual sequences and utilize the semantic modeling capability of language models to map these features into a readable vector space. This approach enables the model to effectively capture contextual relationships among features, thereby maintaining strong generalization performance even when faced with previously unseen attacks. In the classification stage, we combine language embeddings with boosting-based ensemble learning, employing a progressive weighting strategy to emphasize hard-to-classify samples and reduce the risk of overfitting in individual models. Experiments conducted in the CSE-CIC-IDS2018 dataset demonstrate outstanding performance in multiple evaluation metrics, achieving an overall accuracy of 99.66%. The results confirm that the integration of textualized features with language embeddings can clearly enhance the effectiveness and generalization capability of malicious traffic detection and provide a robust and realistic approach for modern-day intrusion detection systems.