There was a security engineer at my work doing something similar to this. He wanted to use LLMs as an IDS. I begged him to use BPF and stop wasting sprint cycles trying to reinvent a shittier slower wheel.