Search papers, labs, and topics across Lattice.
This paper introduces a two-timescale SDN-IoT defense framework where fast, per-switch PPO agents perform mitigation, while a slower multi-agent LLM governance engine generates updates to the global policy constitution. The LLM-generated policy updates are validated through stress testing to ensure non-regression and safety before deployment, providing auditable policy evolution without retraining the RL agents. Experiments demonstrate that this approach improves Macro-F1 score by 9.1% compared to PPO and reduces worst-case degradation by 36.8% under adversarial stress.
Forget retraining: this SDN-IoT defense system uses LLMs to safely evolve reinforcement learning policies through interpretable policy updates, slashing catastrophic overloads by 80%.
Software-Defined Networking (SDN) is increasingly adopted to secure Internet-of-Things (IoT) networks due to its centralized control and programmable forwarding. However, SDN-IoT defense is inherently a closed-loop control problem in which mitigation actions impact controller workload, queue dynamics, rule-installation delay, and future traffic observations. Aggressive mitigation may destabilize the control plane, degrade Quality of Service (QoS), and amplify systemic risk. Existing learning-based approaches prioritize detection accuracy while neglecting controller coupling and short-horizon Reinforcement Learning (RL) optimization without structured, auditable policy evolution. This paper introduces a self-reflective two-timescale SDN-IoT defense solution separating fast mitigation from slow policy governance. At the fast timescale, per-switch Proximal Policy Optimization (PPO) agents perform controller-aware mitigation under safety constraints and action masking. At the slow timescale, a multi-agent Large Language Model (LLM) governance engine generates machine-parsable updates to the global policy constitution Pi, which encodes admissible actions, safety thresholds, and reward priorities. Updates (Delta Pi) are validated through stress testing and deployed only with non-regression and safety guarantees, ensuring an auditable evolution without retraining RL agents. Evaluation under heterogeneous IoT traffic and adversarial stress shows improvements of 9.1% Macro-F1 over PPO and 15.4% over static baselines. Worst-case degradation drops by 36.8%, controller backlog peaks by 42.7%, and RTT p95 inflation remains below 5.8% under high-intensity attacks. Policy evolution converges within five cycles, reducing catastrophic overload from 11.6% to 2.3%.
