A Protocol-Language Model for Network Intrusion (Without Deep Packet Inspection)
Researchers present PLM-NIDS, a machine learning system that detects network intrusions by analyzing packet metadata patterns rather than encrypted payload content, achieving 97.7% precision without requiring access to encrypted traffic. The approach uses a RWKV state-space model to learn the 'grammar' of benign network behavior, identifying attacks as statistical deviations from normal flow patterns.