Attribution-Driven Explainable Intrusion Detection with Encoder-Based Large Language Models

Researchers propose an attribution-driven approach to make encoder-based Large Language Models more transparent and trustworthy for network intrusion detection in Software-Defined Networks. By analyzing which traffic features drive model decisions, the study demonstrates that LLMs learn legitimate attack behavior patterns, addressing a critical barrier to deploying AI security tools in sensitive environments.