Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces a hybrid framework that combines ML-based multi-class attack detection with LLMs for attack behavior analysis and mitigation in IoT/IIoT networks. The authors employ structured role-play prompt engineering with RAG to guide ChatGPT-o3 and DeepSeek-R1 in producing detailed, context-aware responses for attack analysis and mitigation. They propose novel quantitative evaluation metrics and use an ensemble of judge LLMs to independently assess the responses, demonstrating that Random Forest performs best for attack detection and ChatGPT-o3 outperforms DeepSeek-R1 in attack analysis and mitigation.
LLMs can now quantitatively analyze and mitigate IoT attacks, but ChatGPT-o3 edges out DeepSeek-R1 in providing the best context-aware responses.
The Internet of Things has expanded rapidly, transforming communication and operations across industries but also increasing the attack surface and security breaches. Artificial Intelligence plays a key role in securing IoT, enabling attack detection, attack behavior analysis, and mitigation suggestion. Despite advancements, evaluations remain purely qualitative, and the lack of a standardized, objective benchmark for quantitatively measuring AI-based attack analysis and mitigation hinders consistent assessment of model effectiveness. In this work, we propose a hybrid framework combining Machine Learning (ML) for multi-class attack detection with Large Language Models (LLMs) for attack behavior analysis and mitigation suggestion. After benchmarking several ML and Deep Learning (DL) classifiers on the Edge-IIoTset and CICIoT2023 datasets, we applied structured role-play prompt engineering with Retrieval-Augmented Generation (RAG) to guide ChatGPT-o3 and DeepSeek-R1 in producing detailed, context-aware responses. We introduce novel evaluation metrics for quantitative assessment to guide us and an ensemble of judge LLMs, namely ChatGPT-4o, DeepSeekV3, Mixtral 8x7B Instruct, Gemini 2.5 Flash, Meta Llama 4, TII Falcon H1 34B Instruct, xAI Grok 3, and Claude 4 Sonnet, to independently evaluate the responses. Results show that Random Forest has the best detection model, and ChatGPT03 outperformed DeepSeek-R1 in attack analysis and mitigation.