Automated Intrusion Detection and Prevention for IoT Security Using Machine Learning and Large Language Models

Abstract

The Internet of Things (IoT) has recently seen exponential growth in usage and the introduction of severe security vulnerabilities that expose edge networks to sophisticated threats, such as Distributed Denial of Service (DDoS) attacks and zero-day exploits. Traditional Intrusion Detection Systems (IDS) often struggle in these constrained environments where signature-based methods fail against novel attacks, while anomaly-based approaches frequently generate false-positive results. Furthermore, modern automated tools that include Machine Learning (ML), Deep Learning (DL), and Artificial Intelligence (AI) models often act as opaque "black boxes" and impose heavy computational complexity and latency through sequential detection flows in their architecture, while also lacking an active Intrusion Prevention System (IPS).

This thesis proposes a lightweight, AI-driven parallel hybrid Intrusion Detection and Prevention System (IDPS) specifically designed for resource-constrained edge gateways, such as Raspberry Pi hardware. The architecture diverges from traditional cascade models by simultaneously deploying a supervised signature engine (composed of Random Forest, XGBoost, and LightGBM ML models) and an unsupervised anomaly engine (employing a DL based Autoencoder and ML based Isolation Forest and Local Outlier Factor models) to ensure rapid, low latency threat processing. To bridge the semantic gap of ML classifiers, the framework integrates a Large Language Model (LLM) in the form of Ministral to act as an Explainable AI (XAI) translator, generating human-readable threat narratives and allowing human-in-the-loop verification. Finally, the system automates mitigation by dynamically generating iptables firewall rules to drop malicious nodes based on AI confidence levels and human confirmation.

Trained and evaluated on the CICIoT2023, the framework demonstrated high precision: the binary-optimized signature engine achieved a macro-average F1-score of 0.98, while the anomaly engine reached 0.96. Containerized deployment and real-time testing confirmed the system's ability to detect and actively block high-volume common attacks, such as TCP SYN and ICMP floods, directly at the network edge. Although several architectural challenges were identified during real-time testing, such as Layer 2 blindness and TCP self backstabbing, this research provides a robust proof-of-concept for democratizing intelligent, autonomous cybersecurity in IoT ecosystems.