LLM-Based Threat Detection and Prevention Framework for IoT Ecosystems

TL;DR

The paper tackles securing large-scale IoT ecosystems against evolving threats by introducing an LLM-based threat detection and automated prevention framework. It fine-tunes lightweight LLMs on IoT-23 and TON_IoT data to enable real-time anomaly detection at the edge, with a companion edge-based decision-tree prevention layer and a cloud-driven performance-monitoring component. The approach demonstrates high detection accuracy (e.g., 99.75% with BERT Small), low latency, and resource efficiency in Docker-based simulations, outperforming traditional security methods. The work lays groundwork for scalable, autonomous IoT security powered by AI, with future avenues including federated learning, XAI, and large-scale real-world validation.

Abstract

The increasing complexity and scale of the Internet of Things (IoT) have made security a critical concern. This paper presents a novel Large Language Model (LLM)-based framework for comprehensive threat detection and prevention in IoT environments. The system integrates lightweight LLMs fine-tuned on IoT-specific datasets (IoT-23, TON_IoT) for real-time anomaly detection and automated, context-aware mitigation strategies optimized for resource-constrained devices. A modular Docker-based deployment enables scalable and reproducible evaluation across diverse network conditions. Experimental results in simulated IoT environments demonstrate significant improvements in detection accuracy, response latency, and resource efficiency over traditional security methods. The proposed framework highlights the potential of LLM-driven, autonomous security solutions for future IoT ecosystems.

Figures (5)

• Figure 1: Model Architecture Overview
• Figure 2: Training and Validation Loss of LLMs
• Figure 3: Confusion Matrix of Tiny BERT
• Figure 4: Confusion Matrix of BERT Small
• Figure 5: Confusion Matrix of BERT Mini