Abstract: A computer-implemented method comprising: generating, based on input network packet data, a target flow summary comprising information relating to packet flow between two addresses during a target time period; generating, based on the target flow summary, a target latent space representation; identifying k reference latent space representations most similar to the target latent space representation, wherein the plurality of reference latent space representations correspond to a plurality of reference flow summaries; generating, using a first LLM and based on the target flow summary, a target flow report in natural language format and generating, using the first LLM and based on k reference flow summaries, k reference flow reports in natural language format; generating, using a second LLM and based on the target flow report and the k reference flow reports with their corresponding classifications, a classification of the packet flow as malicious or benign.