DR MOHAMMAD HAFIZ MOHD YUSOF Universiti Teknologi MARA
The rapid expansion of digital networks has sig- nificantly increased cyber threats, exposing the limitations of traditional Intrusion Detection Systems (IDS). Conventional signature-based and machine learning-based IDS often struggle to detect novel attacks, generate high false positive rates, and lack explainability. This paper proposes a real-time, anomaly- based Network Intrusion Detection System (NIDS) utilizing the LLaMA Large Language Model (LLM) for intelligent threat detection. By transforming structured network traffic features into descriptive textual prompts, the system leverages LLaMA’s contextual learning to identify anomalous patterns. Using the CIRA-CIC-DoHBrw-2020 dataset, which includes essential Layer 3 information, the model was fine-tuned using Quantized Low- Rank Adaptation (QLoRA). Experimental results demonstrate that the LLaMA-based NIDS achieves 99.74% accuracy and a 0.30% false alarm rate, outperforming SVM and CNN models while providing rule-based explanations for detections through a context-aware Explainable AI module.