Pith. sign in

REVIEW 5 major objections 6 minor 1 cited by

A Unified Framework for Context-Aware IoT Management and State-of-the-Art IoT Traffic Anomaly Detection

T0 review · 5 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims one framework can answer IoT admin questions with RAG-grounded LLMs and detect anomalies with a fine-tuned BERT at 99.87% accuracy.

desk verdict Useful integration prototype, but both headline results rest on evaluation artifacts: a circular RAG benchmark and a train/test split that leaks attack sessions. read the letter →

arxiv 2412.19830 v1 pith:KYJWOTDI submitted 2024-12-19 cs.NI cs.AI

Daniel Adu Worae , Athar Sheikh , Spyridon Mastorakis This is my paper · ORCID
classification cs.NIcs.AI
keywords IoTmanagementretrieval-augmentedgenerationanomalydetectionBERTfine-tuningEdge-IIoTsetlargelanguagemodelsnetworksecurityquestionanswering
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that a single framework can serve both sides of IoT administration: answering device-management questions with grounded, context-aware text and flagging malicious network traffic with a transformer-based classifier. It argues that retrieving relevant chunks from IoT manuals and operational documents before prompting an LLM turns near-useless generic responses into usable ones, and that a BERT model fine-tuned on Edge-IIoTset reaches 99.87% accuracy, beating prior published IoT detectors. If right, it would mean administrators could get reliable procedural answers and attack alerts from one modular system.

What carries the argument

Two modules carry the argument. The context-aware generation module is a retrieval-augmented generation pipeline: IoT manuals are parsed, split into character chunks with overlap, embedded, and stored in a vector database; a query is embedded with the same model, matched by similarity, and the top chunks are concatenated into the LLM prompt. The anomaly detection module converts each Edge-IIoTset row into a single text string of feature-value pairs such as 'ip.src: 192.168.1.1', tokenizes these strings with the BERT tokenizer, and fine-tunes a pretrained BERT sequence classifier with a classification head for the attack classes. The text-string conversion is the load-bearing trick: it lets a language model treat structured network traffic as language.

What would settle it

Re-run the anomaly detection on a temporally held-out slice of Edge-IIoTset, using traffic recorded after the training window, and check whether accuracy stays near 99.87%. Also build a new QA test set whose reference answers are written independently of the manual chunks used for retrieval, and compare RAG versus no-context scores on that set.

Watch

Extended reading notes

Core claim

The central discovery is that context retrieval and transformer fine-tuning can be packaged into one IoT administration framework with strong results on both tasks. On the question-answering side, RAG-augmented LLMs (Gemma2, Llama 3.2, Mistral, and Llava) show large gains over no-context baselines across five use cases: device management, maintenance, security and privacy, troubleshooting, and device setup. BERTScore reaches roughly 95 to 96 percent and BLEU reaches 70 to 79 for the strongest configuration, while no-context BLEU scores sit near 0.5 to 1. On the anomaly-detection side, a BERT model fine-tuned as a sequence classifier over textualized network-flow rows achieves weighted-average accuracy, precision, recall, and F1 of 99.87 percent on Edge-IIoTset, with perfect AUC for many attack classes and per-class recall never below 99.54 percent. The paper frames this as the first framework that unifies administrative question answering and traffic anomaly detection for IoT.

Load-bearing premise

The central assumption is that the evaluation setups are honest: the 600 handwritten QA pairs per use case must represent real administrator queries rather than paraphrases of the same chunks RAG retrieves, and the random 80/20 split must produce traffic that is genuinely unseen.

Editorial extensions

If this is right

  • Context augmentation via RAG yields large gains in BLEU, ROUGE, METEOR, and BERTScore across all five administrative use cases, turning near-zero lexical overlap into usable scores.
  • The fine-tuned BERT model reports 99.87% weighted accuracy, precision, recall, and F1 on Edge-IIoTset, exceeding prior published results including SecurityBERT's 98.2%.
  • Context-aware processing cuts execution time and token counts substantially; for example, Gemma2 drops from 3.89 seconds to 0.71 seconds per query.
  • GPU utilization stays below 0.0022% in all tested configurations, suggesting the question-answering module could run on modest hardware.
  • The two modules are designed as complementary pieces of one workflow, so an administrator could receive both procedural guidance and traffic-threat alerts from a single system.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A temporal-split re-run of Edge-IIoTset would clarify whether 99.87% reflects generalization or memorization of attack sessions, since the paper's random 80/20 split cannot rule out leakage between training and test windows.
  • The QA evaluation would be more convincing if reference answers were written independently of the retrieval chunks; otherwise the RAG gains could be inflated by paraphrase overlap between the gold answers and the retrieved context.
  • An obvious next step is an end-to-end workflow where anomaly-detection alerts automatically trigger RAG-based remediation instructions, rather than keeping the two modules evaluated separately.
  • The paper's resource measurements cover the LLM question-answering path but not the deployment cost of the fine-tuned BERT on edge hardware, so real-device feasibility remains untested.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes a unified IoT management framework with two components: a retrieval-augmented generation (RAG) module that supplies context from IoT manuals to four LLMs (Gemma2, Llama 3.2, Mistral, Llava) for administrative question answering, and a fine-tuned BERT module for traffic anomaly detection on the Edge-IIoTset dataset. The authors report large improvements in QA metrics (BLEU, ROUGE, METEOR, BERTScore) when retrieval context is added, and claim state-of-the-art anomaly detection with 99.87% accuracy, surpassing SecurityBERT's 98.2%. They also report resource-consumption metrics (execution time, memory, GPU utilization, token counts) for the QA module and position the work as the first framework to combine RAG-based IoT administration with BERT-based anomaly detection.

Significance. If the quantitative claims held, the framework would be a useful integration of two currently separate IoT capabilities: grounded administrative assistance and traffic anomaly detection. The paper's design idea is coherent, and the choice of Edge-IIoTset for evaluation is reasonable. However, the evaluation as presented does not support the central claims: the QA evaluation is circular (ground truth answers are generated from the same manual corpus used for retrieval), the anomaly-detection evaluation uses a random split that may leak temporally correlated attack sessions, the comparison with prior art is uncontrolled, and the reported resource metrics are implausibly low. The paper does not provide code, data, or a reproducible experimental protocol, which further weakens confidence. The significance of the contribution cannot be assessed until these load-bearing evaluation issues are addressed.

major comments (5)
  1. [Section III-A (Context-Aware Generation Module) and Section II-A (IoT Knowledge Repository)] The RAG evaluation is circular by construction. The ground truth for the 600 question-answer pairs per use case is 'derived from device manuals, FAQs, and operational documentation' (Section III-A), and the retrieval corpus is the same set of IoT manuals and FAQs described in Section II-A. With-context responses are generated from the very chunks that the reference answers paraphrase, so high BLEU/ROUGE/METEOR scores (e.g., Gemma2 BLEU rising from 0.59 to 70.2 for device management) are largely an artifact of lexical overlap rather than evidence of improved correctness or usefulness. The claim that 'integrating RAG with LLMs significantly improves the accuracy and relevance of responses' (RQ1) requires an evaluation with questions written independently of the retrieval corpus, human assessment of answer quality, or a task-completion metric that measures whether an administrator can perform the requested action.
  2. [Section III-B (Transformer-Based Anomaly Detection Module)] The 99.87% accuracy claim rests on a random 80/20 split of Edge-IIoTset ('126,240 data points' for training and '31,560 data points' for evaluation), with no evidence that the test set is temporally or semantically disjoint from the training set. Edge-IIoTset contains bursty attack traffic; a random split can place near-identical flows from the same attack session on both sides of the boundary. Since each row is serialized into feature:value text before being fed to BERT, the model may memorize session-specific patterns rather than learn a general detector. The near-perfect AUC scores (1.0 for many classes in Figure 5) are consistent with this leakage. I ask for a timestamp-based split, a session-ID holdout, a duplicate-flow overlap analysis, and confidence intervals over multiple seeds before the state-of-the-art claim in Table III can be accepted.
  3. [Table III and Section III-B.2] The comparison with prior work is not controlled. The accuracies for Decision Tree, Random Forest, SVM, KNN, CNN, LSTM, SecurityBERT, and other methods come from different papers that use different feature sets, preprocessing pipelines, class groupings, and train/test partitions; no common evaluation protocol is defined or reproduced. In particular, SecurityBERT's 98.2% uses PPFLE encoding and its own split, so the direct claim of setting 'a new standard' is not justified. Additionally, the paper is internally inconsistent about the headline number: the abstract, contributions, and Table III state 99.87%, while Section III-B.2 states 'an unparalleled accuracy of 99.89%'.
  4. [Section III-A.3 and Table II] The resource-consumption numbers in Table II are not credible as reported. Memory usage values such as 0.0004 MB for Gemma2 without context and 0.0295 MB with context, and GPU utilization of at most 0.0022%, are orders of magnitude below what is expected for running LLM inference locally. The claim that context-aware processing reduces execution time (e.g., Gemma2 from 3.8876 s to 0.7095 s) is counterintuitive because RAG adds embedding and retrieval steps; no measurement methodology (e.g., profiling tool, number of runs, hardware) is given. Without a sound measurement protocol, the scalability and resource-efficiency conclusions are unsupported.
  5. [Section II and RQ3] The paper claims a 'unified framework' that integrates RAG-based question answering with BERT-based anomaly detection, but the two modules are evaluated in isolation and there is no experiment or mechanism demonstrating joint operation. RQ3 asks 'How can a unified framework effectively integrate...?' and the answer is only an architectural diagram. The paper should either report an end-to-end evaluation of the integrated system (e.g., anomaly-detection alerts triggering or informing administrative queries) or temper the claim from 'unified framework' to 'combined system design'.
minor comments (6)
  1. [Abstract / Section III-B.2] The anomaly-detection accuracy is stated as 99.87% in the abstract, contributions, and Table III, but as 99.89% in Section III-B.2. Please standardize the reported value.
  2. [Section III-A] The text says '600 curated question-answer pairs for each use case' but does not state how many of these were used per LLM, whether the same pairs were used for all models, or whether the sets for the five use cases are disjoint. Please clarify the evaluation protocol.
  3. [Section II-B and III-B] The fine-tuning procedure for BERT is described only qualitatively. Please provide the embedding model, tokenizer settings, batch size, learning rate, number of epochs, and hardware used, plus a statement on code/data availability, to meet reproducibility standards.
  4. [Figure 1] The 'Performance Score' in Figure 1 is not defined; it is unclear whether it is an average of the metrics in Table I or a separate measure. Please define it or replace the figure with a more informative summary.
  5. [Section III-C] The phrase 'achieving up to 82.95% improvements in BLEU, ROUGE, METEOR, and BERTScore' is ambiguous because these metrics have different scales and ranges. Please specify the metric, the model, and the baseline for each claimed improvement.
  6. [Section IV-A] The paper lists Llava among 'four state-of-the-art LLMs' for text-based administrative QA, but Llava is a vision-language model. Please explain the rationale for including it or remove it from the set of LLMs.

Circularity Check

1 steps flagged · score 6.0 of 10

The RAG improvement is partly self-referential because the ground-truth QA answers are drawn from the same manual corpus that RAG retrieves; the anomaly-detection claim is an external benchmark and is not circular, though its random split raises validity risks.

  1. self definitional [Section III-A (dataset construction) and Section II-A.1 (knowledge repository sources)]
    "we prepared a dataset of 600 curated question-answer pairs for each use case, representing realistic IoT administrative scenarios derived from device manuals, FAQs, and operational documentation. ... Content Sources The IoT knowledge repository consists of device manuals, troubleshooting guides, FAQs, and other domain-specific resources."

    The RAG evaluation measures BLEU/ROUGE/METEOR/BERTScore between LLM outputs and reference answers. Those references are constructed from device manuals, FAQs, and operational documentation, which is the same corpus the retriever indexes and returns as context. In the with-context condition, the LLM is handed the source text from which the reference answer was written, so high lexical and semantic overlap is largely forced; the no-context model has no access to those strings and cannot match the reference wording. The reported RAG gain is therefore substantially an artifact of defining the target answer from the retrieval corpus, not an independent demonstration that RAG improves administrative usefulness.

full rationale

Only one genuinely circular step was identified, and it concerns the RAG evaluation rather than the anomaly detector. The paper's other headline claim (99.87% accuracy on Edge-IIoTset) is checked against published baselines in Table III and uses an external dataset; that comparison is independently falsifiable, so it does not reduce to the paper's own inputs by construction. The 80/20 random split could allow temporally correlated attack sessions to appear on both sides of the split, which is a correctness/validity risk, but that is not circularity in the derivation-chain sense and I did not count it. There is no load-bearing self-citation chain, no imported uniqueness theorem, and no ansatz smuggled in via citation. The circularity score is driven by the RAG evaluation design: the ground-truth QA answers and the retrieved context come from the same manuals/FAQs, so the with-context versus no-context comparison measures, to a significant degree, whether the model can echo the supplied source rather than whether RAG improves independent response quality. This is a partial circularity: the RAG claim is central to the paper, but the framework's anomaly-detection contribution remains independent.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

No new physical or conceptual entities beyond the system itself; the framework is a named integration of existing components.

free parameters (4)
  • RAG chunk size / overlap = 800 chars / 80 chars
    Chosen in Section II-A2 for document chunking; affects retrieval quality but not tuned against an external objective.
  • BERT fine-tuning hyperparameters = not reported
    Section II-B4 states batch size, learning rate, and evaluation strategies are 'tailored', but concrete values are absent; these were presumably tuned on the validation split and directly affect the 99.87% accuracy.
  • QA pairs per use case = 600 per use case (3,000 total)
    Hand-curated by the authors from manuals and FAQs; the size and content of this set determine the RAG metrics and are not independently benchmarked.
  • Train/test split ratio = 80/20 (126,240 / 31,560)
    Random split without temporal stratification; the choice affects whether the reported AUC of 1.0 reflects generalization or leakage.
assumptions (5)
  • domain assumption BLEU, ROUGE, METEOR, and BERTScore are valid proxies for the quality of IoT administrative answers.
    Section III-A uses these lexical and semantic overlap metrics as the sole evaluation of the QA module; they measure similarity to reference text, not correctness of operational advice.
  • domain assumption The 600 hand-written QA pairs per use case are representative of real administrator queries and the reference answers are correct.
    Section III-A states 'we prepared a dataset of 600 curated question-answer pairs for each use case, representing realistic IoT administrative scenarios derived from device manuals, FAQs, and operational documentation.'
  • domain assumption Edge-IIoTset's random 80/20 split gives an unbiased test of generalization to unseen attacks.
    Section III-B specifies 'split into 80% for training and 20% for evaluation.' Random splitting of network captures can leak correlated flows between train and test.
  • domain assumption Converting each network flow into a text string of feature-value pairs preserves enough information for BERT to classify attacks.
    Section II-B3 describes the serialization; the method assumes no information loss that matters for classification.
  • domain assumption Excluding high-cardinality and redundant features (e.g., ip.src host, http.request.full_uri) improves generalization.
    Section II-B2 justifies these exclusions, but they are made after inspection of the dataset and are not tested for their effect on the reported accuracy.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Unified Framework for Context-Aware IoT Management and State-of-the-Art IoT Traffic Anomaly Detection." pith.science (2026). https://pith.science/paper/KYJWOTDI

@misc{pith2026241219830,
  author       = {Pith},
  title        = {Pith review of: A Unified Framework for Context-Aware IoT Management and State-of-the-Art IoT Traffic Anomaly Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KYJWOTDI}},
  note         = {Machine review of arXiv:2412.19830}
}
read the original abstract

The rapid expansion of Internet of Things (IoT) ecosystems has introduced growing complexities in device management and network security. To address these challenges, we present a unified framework that combines context-driven large language models (LLMs) for IoT administrative tasks with a fine-tuned anomaly detection module for network traffic analysis. The framework streamlines administrative processes such as device management, troubleshooting, and security enforcement by harnessing contextual knowledge from IoT manuals and operational data. The anomaly detection model achieves state-of-the-art performance in identifying irregularities and threats within IoT traffic, leveraging fine-tuning to deliver exceptional accuracy. Evaluations demonstrate that incorporating relevant contextual information significantly enhances the precision and reliability of LLM-based responses for diverse IoT administrative tasks. Additionally, resource usage metrics such as execution time, memory consumption, and response efficiency demonstrate the framework's scalability and suitability for real-world IoT deployments.

Figures

Figures reproduced from arXiv: 2412.19830 by the authors.

Figure 1
Figure 1. Comparative performance analysis of IoT use cases with and without contextual augmentation. Grounded in task-specific knowledge retrieval, RAG with LLMs significantly improves performance across all use cases, delivering accurate and context-aware responses. In contrast, the absence of context results in markedly poor performance, highlighting the importance of augmentation. shortcomings can lead to unreliable outco… view at source ↗
Figure 4
Figure 4. This ensures that the LLM produces domain [PITH_FULL_IMAGE:figures/full_fig_p002_4.png] view at source ↗
Figure 2
Figure 2. High-Level Overview of our framework 1) IoT Knowledge Repository: • Content Sources The IoT knowledge repository consists of device manuals, troubleshooting guides, FAQs, and other domain-specific resources. These documents form the backbone of the knowl￾edge hub, ensuring that responses to administrator queries are grounded in accurate, specialized infor￾mation. • Preprocessing: Documents are parsed and prepro￾cess… view at source ↗
Figures from the paper (3 more)
Figure 3
Figure 3. Figure 3: System Design threat categories: DoS/DDoS, Information Gathering, Man-in-the-Middle (MITM), Injection, and Malware. These attacks encompass techniques such as TCP SYN flood, port scanning, DNS spoofing, SQL injection, and ransomware, making the dataset highly represent…
Figure 4
Figure 4. Figure 4: Retrieval-Augmented Generation Pipeline representations are stored in a structured format, such as a new column in the dataset, and are used as input for the BERT model. This structured approach allows BERT to analyze network data contextually, capturing meaningful pat…
Figure 5
Figure 5. Figure 5: ROC AUC scores showcasing our fine-tuned [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. LLM-Based Threat Detection and Prevention Framework for IoT Ecosystems

    cs.CR 2025-05 reject novelty 3.0 of 10

    Fine-tuned BERT-small reaches 99.75% test accuracy on combined IoT-23 and TON IoT attack classification, but the claimed real-time prevention advantage over traditional methods is not demonstrated.

Reference graph

Works this paper leans on

32 extracted references · 21 canonical work pages · cited by 1 Pith paper

  1. [1]

    Internet of things (iot)—statistics & facts,

    Statista Report, “Internet of things (iot)—statistics & facts,” Blog Post, [Online], Sep. 2023, available: https://www.statista.com/ aboutus/

    work page 2023

  2. [2]

    Rag based question-answering for contextual response predic- tion system,

    S. Veturi, S. Vaichal, R. L. Jagadheesh, N. I. Tripto, and N. Yan, “Rag based question-answering for contextual response predic- tion system,” arXiv preprint arXiv:2409.03708 , 2024

    arXiv 2024

  3. [3]

    Improving language models by retrieving from trillions of tokens,

    S. Borgeaud, A. Mensch, J. Hoffmann, T. Cai, E. Rutherford, K. Millican, G. B. Van Den Driessche, J.-B. Lespiau, B. Damoc, A. Clark et al., “Improving language models by retrieving from trillions of tokens,” in International conference on machine learning. PMLR, 2022, pp. 2206–2240

    work page 2022

  4. [4]

    Atlas: Few-shot learning with retrieval augmented language models,

    G. Izacard, P. Lewis, M. Lomeli, L. Hosseini, F. Petroni, T. Schick, J. Dwivedi-Yu, A. Joulin, S. Riedel, and E. Grave, “Atlas: Few-shot learning with retrieval augmented language models,” Journal of Machine Learning Research , vol. 24, no. 251, pp. 1–43, 2023

    work page 2023

  5. [5]

    Retrieval- augmented generation for knowledge-intensive nlp tasks,

    P. Lewis, E. Perez, A. Piktus, F. Petroni, V . Karpukhin, N. Goyal, H. K¨uttler, M. Lewis, W.-t. Yih, T. Rockt¨aschel et al., “Retrieval- augmented generation for knowledge-intensive nlp tasks,” Ad- vances in Neural Information Processing Systems , vol. 33, pp. 9459–9474, 2020

    2020

  6. [6]

    Generalization through memorization: Nearest neigh- bor language models,

    U. Khandelwal, O. Levy, D. Jurafsky, L. Zettlemoyer, and M. Lewis, “Generalization through memorization: Nearest neigh- bor language models,” arXiv preprint arXiv:1911.00172 , 2019

    arXiv 1911

  7. [7]

    Retrieval- augmented multimodal language modeling,

    M. Yasunaga, A. Aghajanyan, W. Shi, R. James, J. Leskovec, P. Liang, M. Lewis, L. Zettlemoyer, and W.-t. Yih, “Retrieval- augmented multimodal language modeling,” arXiv preprint arXiv:2211.12561, 2022

    arXiv 2022

  8. [8]

    Bert: Pre-training of deep bidirectional transformers for language understanding,

    J. D. M.-W. C. Kenton and L. K. Toutanova, “Bert: Pre-training of deep bidirectional transformers for language understanding,” in Proceedings of naacL-HLT, vol. 1. Minneapolis, Minnesota, 2019, p. 2

    2019

Show all 32 references
  1. [9]

    Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning,

    M. A. Ferrag, O. Friha, D. Hamouda, L. Maglaras, and H. Jan- icke, “Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning,” IEEE Access, vol. 10, pp. 40 281–40 306, 2022

    2022

  2. [10]

    F-bids: Federated-blending based intrusion detection system,

    O. Aouedi and K. Piamrat, “F-bids: Federated-blending based intrusion detection system,” Pervasive and Mobile Computing , vol. 89, p. 101750, 2023

    2023

  3. [11]

    An automatic and efficient malware traffic classification method for secure internet of things,

    X. Zhang, L. Hao, G. Gui, Y . Wang, B. Adebisi, and H. Sari, “An automatic and efficient malware traffic classification method for secure internet of things,” IEEE Internet of Things Journal , 2023

    2023

  4. [12]

    2df-ids: Decentralized and differentially private federated learning-based intrusion detection system for industrial iot,

    O. Friha, M. A. Ferrag, M. Benbouzid, T. Berghout, B. Kantarci, and K.-K. R. Choo, “2df-ids: Decentralized and differentially private federated learning-based intrusion detection system for industrial iot,” Computers & Security, vol. 127, p. 103097, 2023

    2023

  5. [13]

    A deep learning integrated blockchain framework for securing industrial iot,

    A. Aljuhani, P. Kumar, R. Alanazi, T. Albalawi, O. Taouali, A. N. Islam, N. Kumar, and M. Alazab, “A deep learning integrated blockchain framework for securing industrial iot,” IEEE Internet of Things Journal , 2023

    2023

  6. [14]

    Felids: Federated learning-based intrusion detection system for agricultural internet of things,

    O. Friha, M. A. Ferrag, L. Shu, L. Maglaras, K.-K. R. Choo, and M. Nafaa, “Felids: Federated learning-based intrusion detection system for agricultural internet of things,” Journal of Parallel and Distributed Computing , vol. 165, pp. 17–31, 2022

    2022

  7. [15]

    Deepak-iot: An effective deep learning model for cyberattack detection in iot networks,

    W. Ding, M. Abdel-Basset, and R. Mohamed, “Deepak-iot: An effective deep learning model for cyberattack detection in iot networks,” Information Sciences, vol. 634, pp. 157–171, 2023

    2023

  8. [16]

    A hybrid cnn- lstm model for iiot edge privacy-aware intrusion detection,

    E. M. de Elias, V . S. Carriel, G. W. De Oliveira, A. L. Dos Santos, M. Nogueira, R. H. Junior, and D. M. Batista, “A hybrid cnn- lstm model for iiot edge privacy-aware intrusion detection,” in 2022 IEEE Latin-American Conference on Communications (LATINCOM). IEEE, 2022, pp. 1–6

    2022

  9. [17]

    Generative ai for cyber threat-hunting in 6g-enabled iot networks,

    M. A. Ferrag, M. Debbah, and M. Al-Hawawreh, “Generative ai for cyber threat-hunting in 6g-enabled iot networks,” in 2023 IEEE/ACM 23rd International Symposium on Cluster, Cloud and Internet Computing Workshops (CCGridW) . IEEE, 2023, pp. 16–25

    2023

  10. [18]

    Revolutionizing cyber threat detection with large language models: A privacy-preserving bert- based lightweight model for iot/iiot devices,

    M. A. Ferrag, M. Ndhlovu, N. Tihanyi, L. C. Cordeiro, M. Deb- bah, T. Lestable, and N. S. Thandi, “Revolutionizing cyber threat detection with large language models: A privacy-preserving bert- based lightweight model for iot/iiot devices,” IEEE Access, 2024

    2024

  11. [19]

    Iot-llm: Enhancing real- world iot task reasoning with large language models,

    T. An, Y . Zhou, H. Zou, and J. Yang, “Iot-llm: Enhancing real- world iot task reasoning with large language models,” arXiv preprint arXiv:2410.02429, 2024

    2024

  12. [20]

    Penetrative ai: Making llms comprehend the physical world,

    H. Xu, L. Han, Q. Yang, M. Li, and M. Srivastava, “Penetrative ai: Making llms comprehend the physical world,” in Proceedings of the 25th International Workshop on Mobile Computing Systems and Applications, 2024, pp. 1–7

    2024

  13. [21]

    Iot-lm: Large multisensory language models for the internet of things,

    S. Mo, R. Salakhutdinov, L.-P. Morency, and P. P. Liang, “Iot-lm: Large multisensory language models for the internet of things,” arXiv preprint arXiv:2407.09801 , 2024

    2024 arXiv

  14. [22]

    Efficient prompting for llm-based generative internet of things,

    B. Xiao, B. Kantarci, J. Kang, D. Niyato, and M. Guizani, “Efficient prompting for llm-based generative internet of things,” arXiv preprint arXiv:2406.10382 , 2024

    2024 arXiv

  15. [23]

    When iot meet llms: Applications and challenges,

    I. Kok, O. Demirci, and S. Ozdemir, “When iot meet llms: Applications and challenges,” arXiv preprint arXiv:2411.17722 , 2024

    2024 arXiv

  16. [24]

    Pllm-cs: Pre-trained large language model (llm) for cyber threat detection in satellite networks,

    M. Hassanin, M. Keshk, S. Salim, M. Alsubaie, and D. Sharma, “Pllm-cs: Pre-trained large language model (llm) for cyber threat detection in satellite networks,” Ad Hoc Networks , vol. 166, p. 103645, 2025

    2025

  17. [25]

    Detecting command injection vulnerabilities in linux- based embedded firmware with llm-based taint analysis of library functions,

    J. Ye, X. Fei, X. d. C. de Carnavalet, L. Zhao, L. Wu, and M. Zhang, “Detecting command injection vulnerabilities in linux- based embedded firmware with llm-based taint analysis of library functions,” Computers & Security , vol. 144, p. 103971, 2024

    2024

  18. [26]

    Can- bert do it? controller area network intrusion detection system based on bert language model,

    N. Alkhatib, M. Mushtaq, H. Ghauch, and J.-L. Danger, “Can- bert do it? controller area network intrusion detection system based on bert language model,” in 2022 IEEE/ACS 19th In- ternational Conference on Computer Systems and Applications (AICCSA). IEEE, 2022, pp. 1–8

    2022

  19. [27]

    Malbert: Malware detection using bidirectional encoder representations from transformers,

    A. Rahali and M. A. Akhloufi, “Malbert: Malware detection using bidirectional encoder representations from transformers,” in 2021 IEEE International Conference on Systems, Man, and Cybernetics (SMC). IEEE, 2021, pp. 3226–3231

    2021

  20. [28]

    Bert-log: Anomaly detection for system logs based on pre-trained language model,

    S. Chen and H. Liao, “Bert-log: Anomaly detection for system logs based on pre-trained language model,” Applied Artificial Intelligence, vol. 36, no. 1, p. 2145642, 2022

    2022

  21. [29]

    Efficient federated intrusion detection in 5g ecosystem using optimized bert-based model,

    F. Adjewa, M. Esseghir, and L. Merghem-Boulahia, “Efficient federated intrusion detection in 5g ecosystem using optimized bert-based model,” arXiv preprint arXiv:2409.19390 , 2024

    2024 arXiv

  22. [30]

    Pac-gpt: A novel approach to generating synthetic network traffic with gpt-3,

    D. K. Kholgh and P. Kostakos, “Pac-gpt: A novel approach to generating synthetic network traffic with gpt-3,” IEEE Access , 2023

    2023

  23. [31]

    Cybert: Contextu- alized embeddings for the cybersecurity domain,

    P. Ranade, A. Piplai, A. Joshi, and T. Finin, “Cybert: Contextu- alized embeddings for the cybersecurity domain,” in 2021 IEEE International Conference on Big Data (Big Data) . IEEE, 2021, pp. 3334–3342

    2021

  24. [32]

    A lightweight iot intrusion detection model based on improved bert-of-theseus,

    Z. Wang, J. Li, S. Yang, X. Luo, D. Li, and S. Mahmoodi, “A lightweight iot intrusion detection model based on improved bert-of-theseus,” Expert Systems with Applications , vol. 238, p. 122045, 2024

    2024

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.