Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

An LLM-Powered AI Agent Framework for Holistic IoT Traffic Interpretation

Daniel Adu Worae, Spyridon Mastorakis

TL;DR

The paper tackles the challenge of interpreting IoT network traffic beyond traditional anomaly detection by introducing Revelation, an LLM-powered agent framework that converts raw PCAPs into a structured, semantically enriched corpus spanning protocol logs, packet-layer views, flow summaries, anomaly reports, and threat-intelligence enrichment. It integrates Zeek and Tshark-based ingestion, transformer-based anomaly detection, threat-intel augmentation, and a retrieval-augmented generation pipeline that grounds operator queries in concrete evidence while selectively consulting external sources. A multi-stage retrieval system combining dense semantics, BM25 lexical signals, and keyword fallbacks, followed by cross-encoder reranking, yields higher quality, more concise answers compared with dense-only baselines, across multiple IoT use cases and open models. System profiling shows the approach maintains practical resource use, enabling local deployment, and the authors provide an open-source implementation to promote reproducibility and adoption.

Abstract

Internet of Things (IoT) networks generate diverse and high-volume traffic that reflects both normal activity and potential threats. Deriving meaningful insight from such telemetry requires cross-layer interpretation of behaviors, protocols, and context rather than isolated detection. This work presents an LLM-powered AI agent framework that converts raw packet captures into structured and semantically enriched representations for interactive analysis. The framework integrates feature extraction, transformer-based anomaly detection, packet and flow summarization, threat intelligence enrichment, and retrieval-augmented question answering. An AI agent guided by a large language model performs reasoning over the indexed traffic artifacts, assembling evidence to produce accurate and human-readable interpretations. Experimental evaluation on multiple IoT captures and six open models shows that hybrid retrieval, which combines lexical and semantic search with reranking, substantially improves BLEU, ROUGE, METEOR, and BERTScore results compared with dense-only retrieval. System profiling further indicates low CPU, GPU, and memory overhead, demonstrating that the framework achieves holistic and efficient interpretation of IoT network traffic.

An LLM-Powered AI Agent Framework for Holistic IoT Traffic Interpretation

TL;DR

The paper tackles the challenge of interpreting IoT network traffic beyond traditional anomaly detection by introducing Revelation, an LLM-powered agent framework that converts raw PCAPs into a structured, semantically enriched corpus spanning protocol logs, packet-layer views, flow summaries, anomaly reports, and threat-intelligence enrichment. It integrates Zeek and Tshark-based ingestion, transformer-based anomaly detection, threat-intel augmentation, and a retrieval-augmented generation pipeline that grounds operator queries in concrete evidence while selectively consulting external sources. A multi-stage retrieval system combining dense semantics, BM25 lexical signals, and keyword fallbacks, followed by cross-encoder reranking, yields higher quality, more concise answers compared with dense-only baselines, across multiple IoT use cases and open models. System profiling shows the approach maintains practical resource use, enabling local deployment, and the authors provide an open-source implementation to promote reproducibility and adoption.

Abstract

Internet of Things (IoT) networks generate diverse and high-volume traffic that reflects both normal activity and potential threats. Deriving meaningful insight from such telemetry requires cross-layer interpretation of behaviors, protocols, and context rather than isolated detection. This work presents an LLM-powered AI agent framework that converts raw packet captures into structured and semantically enriched representations for interactive analysis. The framework integrates feature extraction, transformer-based anomaly detection, packet and flow summarization, threat intelligence enrichment, and retrieval-augmented question answering. An AI agent guided by a large language model performs reasoning over the indexed traffic artifacts, assembling evidence to produce accurate and human-readable interpretations. Experimental evaluation on multiple IoT captures and six open models shows that hybrid retrieval, which combines lexical and semantic search with reranking, substantially improves BLEU, ROUGE, METEOR, and BERTScore results compared with dense-only retrieval. System profiling further indicates low CPU, GPU, and memory overhead, demonstrating that the framework achieves holistic and efficient interpretation of IoT network traffic.
Paper Structure (26 sections, 5 figures, 3 tables)

This paper contains 26 sections, 5 figures, 3 tables.

Table of Contents

  1. Introduction
  2. System Design
  3. PCAP Ingestion and Protocol Log Generation
  4. Packet-Layer Representation
  5. Flow Summary Generator
  6. Feature Extractor
  7. Semantic Anomaly Detection and Reporting
  8. Threat Intelligence Enrichment
  9. Vectorization and Semantic Ingestion
  10. Unified Knowledge Integration
  11. Chunking and Metadata Schema
  12. Embedding, Storage, and Session Control
  13. Deduplication and Session Management
  14. Contextual Retrieval and Query Engine
  15. Query Vectorization
  16. ...and 11 more sections

Figures (5)

  • Figure 1: System Design of Revelation
  • Figure 2: Retrieval-Augmented Generation Pipeline
  • Figure 3: Hybrid Semantic Retrieval and Reranking Workflow
  • Figure 4: ROC AUC scores showcasing our fine-tuned BERT model's performance in IoT anomaly detection.
  • Figure 5: Confusion matrix showcasing the classification performance of our fine-tuned BERT model for IoT anomaly detection.