A Unified Framework for Context-Aware IoT Management and State-of-the-Art IoT Traffic Anomaly Detection

TL;DR

This work tackles IoT administration and security by integrating Retrieval-Augmented Generation with context-aware LLMs for task answering and a fine-tuned BERT model for IoT traffic anomaly detection. The system grounds LLM responses in a curated IoT knowledge repository via a vector hub, while the anomaly detector, trained on Edge-IIoTset, achieves $99.87\%$ accuracy and near-perfect ROC AUC across attack types. Experimental results show substantial QA performance gains from contextual augmentation and state-of-the-art anomaly detection, with favorable resource usage indicative of scalability. The proposed architecture offers a practical, scalable solution for unified IoT ecosystem management that combines governance and security with high accuracy.

Abstract

The rapid expansion of Internet of Things (IoT) ecosystems has introduced growing complexities in device management and network security. To address these challenges, we present a unified framework that combines context-driven large language models (LLMs) for IoT administrative tasks with a fine-tuned anomaly detection module for network traffic analysis. The framework streamlines administrative processes such as device management, troubleshooting, and security enforcement by harnessing contextual knowledge from IoT manuals and operational data. The anomaly detection model achieves state-of-the-art performance in identifying irregularities and threats within IoT traffic, leveraging fine-tuning to deliver exceptional accuracy. Evaluations demonstrate that incorporating relevant contextual information significantly enhances the precision and reliability of LLM-based responses for diverse IoT administrative tasks. Additionally, resource usage metrics such as execution time, memory consumption, and response efficiency demonstrate the framework's scalability and suitability for real-world IoT deployments.

Figures (6)

• Figure 1: Comparative performance analysis of IoT use cases with and without contextual augmentation. Grounded in task-specific knowledge retrieval, RAG with LLMs significantly improves performance across all use cases, delivering accurate and context-aware responses. In contrast, the absence of context results in markedly poor performance, highlighting the importance of augmentation.
• Figure 2: High-Level Overview of our framework
• Figure 3: System Design
• Figure 4: Retrieval-Augmented Generation Pipeline
• Figure 5: ROC AUC scores showcasing our fine-tuned BERT model's performance in IoT anomaly detection.