Towards an Intelligent Hybrid Intrusion Detection System Using Machine Learning and Large Language Models (LLM)

Abstract

Intrusion Detection Systems (IDSs) play a critical role in modern cybersecurity by continuously monitoring and protecting computer networks against increasingly sophisticated and evolving cyber threats. Despite significant advances in intrusion detection, conventional IDS approaches, including signature-based and machine learning (ML)-based methods, often struggle to balance detection accuracy, adaptability, and real-time performance in dynamic network environments. This paper proposes an intelligent hybrid IDS framework that integrates a lightweight machine learning detector with Large Language Model (LLM)-based contextual reasoning. The proposed framework adopts a two-stage detection strategy. In the first stage, a computationally efficient ML model rapidly classifies network traffic, allowing high-confidence flows to be processed immediately while forwarding suspicious or low-confidence flows to the second stage for further analysis. In the second stage, the LLM incorporates and analyzes contextual information to validate and refine the initial ML predictions. Finally, a confidence-guided decision mechanism combines the outputs of both stages to produce the final intrusion detection decision.A preliminary evaluation demonstrates that the proposed framework improves recall by reducing false negatives while maintaining high overall detection accuracy and computational efficiency.