NAISS
SUPR
NAISS Projects
SUPR
AIR2 Experiments
Dnr:

NAISS 2025/22-1241

Type:

NAISS Small Compute

Principal Investigator:

Federica Uccello

Affiliation:

Linköpings universitet

Start Date:

2025-09-12

End Date:

2026-10-01

Primary Classification:

10211: Security, Privacy and Cryptography

Webpage:

Allocation

Abstract

We will study automated detection and attribution of 4G/5G control-plane attacks from radio and core network traces using medium-size instruction-tuned large language models (LLMs). The tests employ publicly available datasets to perform anomaly detection using unsupervised Regression Models (this step is already implemented and the models have been pre-trained). The models are used to produce alerts, which are then explained through our logic-based explainable AI (XAI) method to obtain feature-value pairings that provide insights on "why" the alert was issued. The XAI output will be included in the prompts to the LLMs, together with contextual information, to analyse to what extent the integration of XAI and LLMs can aid in network anomaly detection. The work will aim to answer the following (preliminary) research questions: RQ1: Can large language models (LLMs) accurately classify wireless network attacks when given structured, logic-based explainable AI (XAI) outputs as input features? RQ2: How does a base LLaMA model perform compared to a 5G fine-tuned (LoRA-adapted) version in terms of accuracy, robustness, and generalization on attack classification tasks? RQ3: Can LLMs provide meaningful and technically valid mitigation recommendations in addition to attack classification, and under what conditions is this reliable?