Parameter-Efficient LLMs for Flow-Based Intrusion Detection auf der IFIP SEC 2026
From 09 to 11 June 2026, the 41st IFIP SEC Conference 2026 was held in Perth, Australia. The
conference provided an international forum for research on information security, privacy, cyber resilience,
and trustworthy digital infrastructures. It brought together academic and applied perspectives on current
security challenges in networked systems.
What was on offer?
IFIP SEC 2026 featured a broad technical program covering information security and privacy. Topics
included intrusion detection, network security, artificial intelligence for cybersecurity, secure distributed
systems, risk management, and the protection of digital infrastructures. The conference offered paper
sessions and scientific exchange on both theoretical and practical security challenges.
Our presentation
Mamdouh Muhammad presented the paper “Parameter-Efficient LLMs for Flow-Based Intrusion Detec-
tion”, co-authored with Anton Wunsch and Loui Al Sardy. The paper investigates whether a compact
instruction-tuned large language model can support binary flow-level intrusion detection under limited
compute resources.
The proposed system classifies network flows as either benign or attack traffic. Each flow is converted
into a compact text representation combining selected flow features with a short connection-log string.
The study uses Qwen2.5-0.5B-Instruct and adapts it with Low-Rank Adaptation, a parameter-efficient
fine-tuning method that trains only lightweight adapter parameters while keeping the base model frozen.
The work compares zero-shot prompting, LoRA-based supervised fine-tuning, pure in-context learning,
and a hybrid LoRA plus in-context learning approach. Instead of relying on free-text generation, the
model scores the two fixed labels “benign” and “attack” and applies a calibrated bias term for the final
decision.
Experiments on CIC-DDoS2019 show that the zero-shot baseline performs close to chance, while LoRA
fine-tuning and in-context learning improve detection performance. The best setup combines LoRA and
in-context learning, reaching 91% accuracy and 90% macro-F1 on a 10,000-flow test set. The results
suggest that small LLMs can be useful for flow-based IDS when representation, adaptation, and decision
logic are carefully constrained.