A Traffic Attack Detection Method Based on Reverse-Weighted Fine-Tuning of Large Language Models
Traditional network traffic attack detection relies on manual feature engineering and struggles to effectively handle obfuscation variants such as URL encoding and case-mixing. This paper proposes a detection method based on the DeepSeek-R1-Distill-Qwen-14B large language model. In terms of paradigm, the 14B-parameter model is directly used as the detection engine, encoding HTTP request fields into semantic text sequences via a fixed template to replace statistical features. In terms of methodology, a reverse-weighted cross-entropy loss is designed -applying a $1.5 \times$ weight to the normal class, equivalent to shifting the decision boundary outward by 0.41 logit units to suppress false positives in production environments. On a dataset constructed by fusing CSIC 2010, HTTPParamsDataset, PayloadsAllTheThings, and proprietary POC data, the model achieves an F1 score of 0.9931 on 17,479 test samples, with a false positive rate of 0.07% (only 4 false alarms among 5,827 normal requests), approximately a $12 \times$ reduction compared with XGBoost (0.86%). The model employs 4-bit quantization, with only 13.58 million trainable parameters (0.0969% of 14B), enabling both training and deployment on a single consumer-grade GPU.