TARNET: A Framework for Text-Aware Retrieval of Network Events Tracking Using Instruction-Tuned Language Models

Modern network monitoring systems produce huge amounts of stream-based data, making it challenging for analysts to retrieve and analyze significant security events in real time. Traditional techniques, such as rule-based detection and statistical analysis, often suffer from contextual awareness and fail to link multi-stage attack activities.In this work, we offer TARNET, a Text-Aware Retrieval Framework for Network Event Tracking that uses instruction-tuned language models to perform contextaware event analysis. Structured network flows from the UNSWNB15 & CIC IDS 2017 datasets are translated into naturallanguage representations, collecting information such source or destination IPs, ports, protocol, bytes transmitted, and attack type. These flows are integrated into textual documents to replicate contextual event sequences, which are then utilized to fine-tune models like Flan-T5 for intelligent retrieval tasks such as event explanation, sequence tracking, and highlighting anomalies. The experimental findings show that TARNET improves the interpretability and accuracy of network event retrieval, reducing the gap between raw flow data and intelligible cybersecurity insights. Code Implementation can be found at: https://github.com/Abishethvarman/ContextNetLLM