City Research Online

Abstract

This paper investigates the zero-shot capabilities of LLMs to reconstruct the origin network’s underlying structure from the produced NetFlow data. We conduct a comprehensive empirical analysis of thirteen open-weight models and a closed-weight, large-scale model, evaluating their ability to reconstruct topological and application-level features from limited NetFlow samples. We demonstrate that off-the-shelf LLMs can infer certain topological features from NetFlow metadata. However, we identify a clear boundary to these capabilities: while structural inference is strong, models struggle to generate plausible values for dynamic, unbounded numerical features. This study provides a critical baseline for LLM-based traffic analysis, highlighting the fragility of metadata anonymisation and the security implications of deploying LLMs in network-aware applications.

Publication Type:	Conference or Workshop Item (Paper)
Additional Information:	Copyright © 2026 by The Institute of Electrical and Electronics Engineers, Inc. All rights reserved. This accepted manuscript is made available under the terms of the Creative Commons Attribution License (CC-BY), which permits unrestricted use, distribution and reproduction in any medium, provided the original work is properly cited.
Publisher Keywords:	Modeling, Training, Codes, Printing, Large language models, Ports (computers), Context, IP networks, Recording, Tuning
Subjects:	Q Science > QA Mathematics > QA75 Electronic computers. Computer science
Departments:	School of Science & Technology School of Science & Technology > Department of Computer Science
SWORD Depositor:	Symplectic Administrator

Export

Downloads