Sažetak
The increasing volume of network traffic and the widespread use of encrypted protocols significantly complicate network forensic analysis. As payload inspection becomes less feasible, analysts must increasingly rely on metadata extracted from PCAP files, which can still be large and time-consuming to interpret. This paper evaluates the use of Large Language Models (LLMs) as a triage support tool in network forensic analysis, focusing exclusively on PCAP metadata rather than raw packet contents.The paper combines classical network forensic techniques with LLM-assisted interpretation of structured artifacts, including protocol hierarchy statistics, conversation-level metadata, and auxiliary DNS, ARP, and ICMP data. The results show that LLMs can effectively summarize large datasets and highlight dominant communication patterns, central hosts, and potentially interesting connections that warrant further investigation.However, the evaluation also reveals clear limitations. Without access to packet payloads, temporal context, and network topology, LLMs cannot reliably distinguish benign from malicious activity. Consequently, LLMs should be viewed as a triage and decision-support mechanism rather than a source of forensic evidence, with all findings requiring validation through classical forensic methods.
Ključne riječi
engleski
