An Adaptive End-to-End IoT Security Framework Using Explainable AI and LLMs

TL;DR

This paper introduces an adaptive, end-to-end IoT security framework that combines explainable AI, large language models, and machine learning to improve real-time attack detection, interpretability, and response in complex IoT environments.

Contribution

It presents a novel, scalable security framework integrating XAI and LLMs with ML for real-time IoT attack detection and interpretability, adaptable across various algorithms.

Findings

Gemini provides precise attack mitigation strategies.

OPENAI LLMs offer extensive security insights.

SHAP and LIME enhance feature-based attack explanations.

Abstract

The exponential growth of the Internet of Things (IoT) has significantly increased the complexity and volume of cybersecurity threats, necessitating the development of advanced, scalable, and interpretable security frameworks. This paper presents an innovative, comprehensive framework for real-time IoT attack detection and response that leverages Machine Learning (ML), Explainable AI (XAI), and Large Language Models (LLM). By integrating XAI techniques such as SHAP (SHapley Additive exPlanations) and LIME (Local Interpretable Model-agnostic Explanations) with a model-independent architecture, we ensure our framework's adaptability across various ML algorithms. Additionally, the incorporation of LLMs enhances the interpretability and accessibility of detection decisions, providing system administrators with actionable, human-understandable explanations of detected threats. Our end-to-end framework not only facilitates a seamless transition from model development to deployment but also represents a real-world application capability that is often lacking in existing research. Based on our experiments with the CIC-IOT-2023 dataset \cite{neto2023ciciot2023}, Gemini and OPENAI LLMS demonstrate unique strengths in attack mitigation: Gemini offers precise, focused strategies, while OPENAI provides extensive, in-depth security measures. Incorporating SHAP and LIME algorithms within XAI provides comprehensive insights into attack detection, emphasizing opportunities for model improvement through detailed feature analysis, fine-tuning, and the adaptation of misclassifications to enhance accuracy.