# TrafficLLM: Enhancing Large Language Models for Network Traffic Analysis with Generic Traffic Representation

arXiv: https://arxiv.org/abs/2504.04222 · HTML: https://mlsanity.com/paper/2504.04222/

## Key facts

- Cited by 15 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 5 Apr 2025.

## Built on by (most cited first, 15 of 15)

- [Large Language Models and Their Applications in Roadway Safety and Mobility Enhancement: A Comprehensive Review](https://mlsanity.com/paper/2506.06301/) (2025)
- [TeleMath: A Benchmark for Large Language Models in Telecom Mathematical Problem Solving](https://mlsanity.com/paper/2506.10674/) (2025)
- [Respond to Change with Constancy: Instruction-tuning with LLM for Non-I.I.D. Network Traffic Classification](https://mlsanity.com/paper/2505.20866/) (2025)
- [Quantifying the Privacy Implications of High-Fidelity Synthetic Network Traffic](https://mlsanity.com/paper/2511.20497/) (2025)
- [PLUME: Building a Network-Native Foundation Model for Wireless Traces via Protocol-Aware Tokenization](https://mlsanity.com/paper/2603.13647/) (2026)
- [SAFT: Structure-Aware Fine-Tuning of LLMs for AMR-to-Text Generation](https://mlsanity.com/paper/2507.13381/) (2025)
- [An LLM-Powered AI Agent Framework for Holistic IoT Traffic Interpretation](https://mlsanity.com/paper/2510.13925/) (2025)
- [MalRAG: A Retrieval-Augmented LLM Framework for Open-set Malicious Traffic Identification](https://mlsanity.com/paper/2511.14129/) (2025)
- [ReGAIN: Retrieval-Grounded AI Framework for Network Traffic Analysis](https://mlsanity.com/paper/2512.22223/) (2025)
- [Lightweight GenAI for Network Traffic Generation: Fidelity, Augmentation, and Classification](https://mlsanity.com/paper/2603.25507/) (2026)
- [Multimodal Reasoning with LLM for Encrypted Traffic Interpretation: A Benchmark](https://mlsanity.com/paper/2604.08140/) (2026)
- [ReasonLight: A Multimodal Foundation Model-Enhanced Reinforcement Learning Framework for Zero-Shot Traffic Signal Control](https://mlsanity.com/paper/2605.29425/) (2026)
- [TraceCodec: A Compiler-Backed Neural Codec for Network Traffic Traces](https://mlsanity.com/paper/2605.29941/) (2026)
- [PCAP-LM: An LLM-Native Text Representation for TLS Bulk Traffic Analysis](https://mlsanity.com/paper/2607.28100/) (2026)
- [BlueSTAR: Tiered Agentic Architecture for Autonomous Cyber Defense](https://mlsanity.com/paper/2609.11852/) (2026)

## Abstract (arXiv)

Machine learning (ML) powered network traffic analysis has been widely used for the purpose of threat detection. Unfortunately, their generalization across different tasks and unseen data is very limited. Large language models (LLMs), known for their strong generalization capabilities, have shown promising performance in various domains. However, their application to the traffic analysis domain is limited due to significantly different characteristics of network traffic. To address the issue, in this paper, we propose TrafficLLM, which introduces a dual-stage fine-tuning framework to learn generic traffic representation from heterogeneous raw traffic data. The framework uses traffic-domain tokenization, dual-stage tuning pipeline, and extensible adaptation to help LLM release generalization ability on dynamic traffic analysis tasks, such that it enables traffic detection and traffic generation across a wide range of downstream tasks. We evaluate TrafficLLM across 10 distinct scenarios and 229 types of traffic. TrafficLLM achieves F1-scores of 0.9875 and 0.9483, with up to 80.12% and 33.92% better performance than existing detection and generation methods. It also shows strong generalization on unseen traffic with an 18.6% performance improvement. We further evaluate TrafficLLM in real-world scenarios. The results confirm that TrafficLLM is easy to scale and achieves accurate detection performance on enterprise traffic.