# PLLM-CS: Pre-trained Large Language Model (LLM) for Cyber Threat Detection in Satellite Networks

arXiv: https://arxiv.org/abs/2405.05469 · HTML: https://mlsanity.com/paper/2405.05469/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 9 May 2024.

## Built on by (most cited first, 10 of 10)

- [A Survey on Large Language Models for Communication, Network, and Service Management: Application Insights, Challenges, and Future Directions](https://mlsanity.com/paper/2412.19823/) (2024)
- [Deep Learning Advancements in Anomaly Detection: A Comprehensive Survey](https://mlsanity.com/paper/2503.13195/) (2025)
- [When IoT Meet LLMs: Applications and Challenges](https://mlsanity.com/paper/2411.17722/) (2024)
- [CVE-LLM : Ontology-Assisted Automatic Vulnerability Evaluation Using Large Language Models](https://mlsanity.com/paper/2502.15932/) (2025)
- [Clone What You Can't Steal: Black-Box LLM Replication via Logit Leakage and Distillation](https://mlsanity.com/paper/2509.00973/) (2025)
- [Seamless Detection: Unifying Salient Object Detection and Camouflaged Object Detection](https://mlsanity.com/paper/2412.16840/) (2024)
- [A Unified Framework for Context-Aware IoT Management and State-of-the-Art IoT Traffic Anomaly Detection](https://mlsanity.com/paper/2412.19830/) (2024)
- [Design and implementation of a distributed security threat detection system integrating federated learning and multimodal LLM](https://mlsanity.com/paper/2502.17763/) (2025)
- [Agentic Satellite-Augmented Low-Altitude Economy and Terrestrial Networks: A Survey on Generative Approaches](https://mlsanity.com/paper/2507.14633/) (2025)
- [CVE-LLM : Automatic vulnerability evaluation in medical device industry using large language models](https://mlsanity.com/paper/2407.14640/) (2024)

## Abstract (arXiv)

Satellite networks are vital in facilitating communication services for various critical infrastructures. These networks can seamlessly integrate with a diverse array of systems. However, some of these systems are vulnerable due to the absence of effective intrusion detection systems, which can be attributed to limited research and the high costs associated with deploying, fine-tuning, monitoring, and responding to security breaches. To address these challenges, we propose a pretrained Large Language Model for Cyber Security , for short PLLM-CS, which is a variant of pre-trained Transformers [1], which includes a specialized module for transforming network data into contextually suitable inputs. This transformation enables the proposed LLM to encode contextual information within the cyber data. To validate the efficacy of the proposed method, we conducted empirical experiments using two publicly available network datasets, UNSW_NB 15 and TON_IoT, both providing Internet of Things (IoT)-based traffic data. Our experiments demonstrate that proposed LLM method outperforms state-of-the-art techniques such as BiLSTM, GRU, and CNN. Notably, the PLLM-CS method achieves an outstanding accuracy level of 100% on the UNSW_NB 15 dataset, setting a new standard for benchmark performance in this domain.