ANMAS (AI Network Malicious Analysis System) is a new AI product to analysis PCAP files of network traffic. The ANMAS can provide the report of potential network activity threats without rules but AI Model. This system performs deep AI-based packet analysis using a local language model and RAG data. Compared to rule-based network packet analysis, this system fine-tunes the AI ​​data using SLM (Small Language Model) and employs enhanced RAG retrieval technology to train the AI's intelligent recognition and learning by combining packet data from over 400 types of malicious program activities with normal network activity packet data. Through parameter fine-tuning, the AI ​​model (which can be set by the user) interfaces with the fine-tuned packet training data and RAG data to generate potential malicious program network activity identification alerts and cybersecurity reports. This system advances traditional network packet analysis from network information statistical reports to potential network threat pattern reports, and from rule-based detection mechanisms to specialized small language model mechanisms, thereby improving and optimizing the packet analysis capabilities for potential network activity threats.