This study revealed the strengths and limitations of LLMs in firewall anomaly detection. We evaluated four state-of-the-art Large Language Models on two tasks: generating and detecting anomalies in firewall rules. The experimental results indicate that while advanced models show potential for detecting firewall rule anomalies, they lack the precision and consistency required for complex firewall management without additional fine-tuning.

This work significantly improves LLM performance in firewall rule anomaly detection from 36% to 99% by applying fine-tuning methods. Our experiments demonstrate that both Supervised Fine-Tuning and Reinforcement Learning effectively enhance the models’ understanding of firewall-related knowledge. Through parameter exploration, we also identify the optimal configuration for the best performance. Furthermore, we are the first to develop a program capable of automatically generating training data and verifying its correctness for this task.

TWC_Mesh provides resilient wireless mesh networking for disaster scenarios, enabling long-distance, low-power communication and high-bandwidth connectivity without relying on existing infrastructure. The system is built on ESP32 development boards running Meshtastic, which is based on LoRa, and integrates with ATAK to deliver geospatial information and real-time collaboration capabilities.