Multi-Agent Collaborative Intrusion Detection for Low-Altitude Economy IoT: An LLM-Enhanced Agentic AI Framework

TL;DR

Low-altitude economy IoT networks face dynamic 3D mobility, distributed autonomy, and tight resource constraints that challenge traditional intrusion detection. The authors propose an LLM-enabled agentic AI framework with perception, memory, reasoning, and action, implemented via a three-agent collaboration to enable proactive, adaptive defense in LAE-IoT. Case studies across multiple datasets show classification accuracies above 90% and improved label efficiency, validating the approach's effectiveness and generalization. This work signals a shift toward cognitive, collaborative security architectures for LAE-IoT with practical implications for real-time, energy-aware defense in dynamic aerial networks.

Abstract

The rapid expansion of low-altitude economy Internet of Things (LAE-IoT) networks has created unprecedented security challenges due to dynamic three-dimensional mobility patterns, distributed autonomous operations, and severe resource constraints. Traditional intrusion detection systems designed for static ground-based networks prove inadequate for tackling the unique characteristics of aerial IoT environments, including frequent topology changes, real-time detection requirements, and energy limitations. In this article, we analyze the intrusion detection requirements for LAE-IoT networks, complemented by a comprehensive review of evaluation metrics that cover detection effectiveness, response time, and resource consumption. Then, we investigate transformative potential of agentic artificial intelligence (AI) paradigms and introduce a large language model (LLM)-enabled agentic AI framework for enhancing intrusion detection in LAE-IoT networks. This leads to our proposal of a novel multi-agent collaborative intrusion detection framework that leverages specialized LLM-enhanced agents for intelligent data processing and adaptive classification. Through experimental validation, our framework demonstrates superior performance of over 90\% classification accuracy across multiple benchmark datasets. These results highlight the transformative potential of combining agentic AI principles with LLMs for next-generation LAE-IoT security systems.

Figures (5)

• Figure 1: An overview of LLM-enabled agentic LAE-IoT intrusion detection. Part A introduces three key challenges for intrusion detection in LAE-IoT networks. Part B presents the evaluation metrics of IDSs. Part C provides a comparison between agentic AI and traditional AI paradigms. Part D gives important LLM-enabled agentic AI applications, including adaptive anomaly detection, intelligent rule generation, distributed network monitoring, and enhanced public safety.
• Figure 2: The general agentic AI framework for intrusion detection in LAE-IoT networks. The framework operates in a continuous loop, consisting of four core components: perception, memory, reasoning, and action, which interact with the LAE-IoT environment.
• Figure 3: The multi-agent collaborative intrusion detection framework, which consists of three agents, namely, a perception and memory agent based on feature extraction for network traffic processing, a reasoning agent based on LLM-enhanced feature selection for dimensionality reduction, and a classification agent for threat identification.
• Figure 4: Classification accuracy comparison between the proposed framework and 2D-CNN baseline across varying percentages of labeled data on three datasets.
• Figure 5: Performance comparison between our proposed framework and baseline methods on three datasets.