Researchers are tackling the escalating threat of cyberattacks targeting the ever-expanding Internet of Things (IoT) with a new approach to intrusion detection. Piyumi Bhagya Sudasinghe, Kushan Sudheera Kalupahana Liyanage, and Harsha S. Gardiyawasam Pussewalage from the Universities of Luhuna and Agder (UiA) demonstrate the potential of lightweight large-scale language models (LLMs) to identify both known and never-before-seen threats. Their work addresses the critical limitations of traditional machine learning models, which struggle with zero-day attacks and require continuous retraining, and instead leverages techniques such as Quantized Low-Rank Adaptation (QLoRA) and Search Augmentation Generation (RAG) to create adaptive and resource-efficient systems. It achieves performance comparable to established techniques such as random forests against known attacks, and an impressive 42.63% accuracy against unknown attacks. without it With retraining, this research represents an important step towards robust and scalable IoT security solutions.
This breakthrough allows us to detect both known and, importantly, never-before-seen “zero-day” attacks without the need for continuous retraining.
In this work, we focused on converting network traffic features into compact natural language prompts, allowing LLM to be efficiently adapted even on resource-limited hardware. Experiments were conducted using the CICIoT2023 dataset, a benchmark in IoT security research, to evaluate the performance of the proposed system. The QLoRA-tuned LLaMA-1B model achieved an F1 score of 0.7124. This result is significantly comparable to the F1 score of 0.7159 achieved by the Random Forest (RF) baseline for identifying known attacks. This demonstrates the potential of LLM to match the performance of established machine learning techniques in critical security applications.
Additionally, this study reveals important features for detecting zero-shot attacks. By incorporating RAG, the system achieved 42.63% accuracy in identifying invisible attack types without any additional training. This zero-shot capability is a major innovation as it allows the system to adapt in real time to evolving threats, a feature missing from traditional machine learning models that require retraining with new data. This study proves that lightweight LLMs with enhanced search capabilities are a promising path toward next-generation IoT intrusion detection systems, offering both adaptability and resource efficiency.
In this study, we present an integrated LLM-based framework that can handle both known and unknown attacks, addressing key limitations of current cybersecurity solutions. The team investigated several decoder-only LLMs, GPT-2, LLaMA-3.2-1B, Meta-LLaMA-3-8B, and Mistral-v0.3-7B, and adapted them to QLoRA for multi-class IoT attack detection. By reformulating the features of numerical networks into concise natural language prompts, the system effectively bridges the gap between structured data and LLM’s semantic understanding. The results of this research will be presented at the 7th Computing, Communications and IoT Applications Conference (ComComAp 2025) in Madrid, Spain in December 2025, and will represent its contribution to the field.
QLoRA-LLaMA-1B matches IoT detection accuracy of Random Forest
The scientists achieved an F1 score of 0. Our experiments focused on converting network traffic characteristics into concise natural language prompts, allowing LLM to be efficiently adapted even when hardware resources are limited. The team carefully measured the model’s ability to identify established attack patterns and validated its effectiveness against previously identified threats.
The results show significant progress in zero-shot attack detection, with the system achieving 42.63% accuracy against invisible attack types without additional training. This is achieved through the integration of Search Augmentation and Generation (RAG), allowing LLM to leverage external knowledge and reasoning about emerging threats. Data shows that RAG-powered systems effectively generalize previously unknown attacks by capturing relevant information and applying contextual understanding. Scientists noted this zero-shot capability as a key advantage over traditional machine learning models, which require retraining to deal with new threats.
This study details an integrated LLM-based framework that can handle both known and unknown attacks and overcome the limitations of traditional intrusion detection systems. Researchers converted numerical network features to natural language and used QLoRA fine-tuning to facilitate adaptation of decoder-only LLMs such as LLaMA-1B, GPT-2, LLaMA-3.2-1B, Meta-LLaMA-3-8B, and Mistral-v0.3-7B. This structured-to-text conversion is critical for efficient processing and adaptation under resource constraints, and measurements confirm that this approach is viable for deployment to IoT devices. Tests demonstrate the effectiveness of the methodology across multiple LLM architectures and highlight the versatility of the proposed framework. This breakthrough provides a practical solution for next-generation IoT intrusion detection, increasing adaptability and resource efficiency. Experiments conducted on the CICIoT2023 dataset reveal that the QLoRA-tuned LLaMA-1B model achieves an F1 score of 0.7124, which closely matches the performance of the Random Forest baseline (0.7159) in detecting known attacks. Additionally, the RAG-powered system achieved 42.63% accuracy in identifying invisible attack types without the need for additional training, demonstrating practical zero-shot capabilities over traditional machine learning techniques.
This combination of parametric efficiency and retrieval-based context foundation provides a scalable solution to the dynamic context of IoT environments. The authors acknowledge limitations in the scope of their study, noting that the results were obtained using a single dataset and require broader validation across a variety of IoT benchmarks. Future research will focus on improving acquisition strategies, expanding the knowledge base, and exploring lightweight ensemble techniques to improve detection of subtle and overlapping attack patterns.
