With the rapid growth of digital transformation, DDoS attacks remain a major threat. To improve detection accuracy and generalization, we leverage the Large Language Model (Llama2) by converting network traffic into textual representations. Our model better distinguishes between malicious and benign traffic by QLoRA fine-tuning and PPO optimization with a new reward function. Experiments on CIC-IDS2017 confirm that this reward-driven design enhances real-time DDoS detection.