PCAP-LM: An LLM-Native Text Representation for TLS Bulk Traffic Analysis

TL;DR - PCAP-LM converts verbose TLS packet captures into an LLM-oriented text format, shrinking them enough to fit entire captures in one context window while retaining strong forensic QA performance.

• Encodes packet direction, TCP/TLS state, size, and timing with a compact ASCII “PacketGlyph” alphabet.
• Combines constrained PMI-BPE tokenization, motif run-length encoding, and a lossless packet-reference side index.
• Achieved 812× compression over tshark -V and 99.3% QA accuracy, versus 51.0% for a token-matched tshark prefix.
• Evaluation was limited to homogeneous 4G/5G TLS 1.3 downloads; retransmission detection had a 24% false-negative rate.