Self-Adaptive Multi-Agent LLM-Based Security Pattern Selection for IoT Systems

2026-05-01

AI Summary

This work addresses the challenge of reconciling dynamic security policy selection with stringent runtime constraints—such as conflict-freedom, resource feasibility, and execution correctness—in resource-constrained IoT edge environments. To this end, the authors propose ASPO, a novel framework that synergistically integrates multi-agent large language model (LLM) reasoning with deterministic optimization within a MAPE-K adaptive control loop. ASPO decouples stochastic policy generation from deterministic verification: LLM agents generate candidate security configurations, while a deterministic core ensures action completeness, conflict-free composition, and adherence to resource limits. Experimental evaluation on an edge gateway platform demonstrates that ASPO achieves 100% conflict-free and resource-feasible policy deployment, reducing tail latency and energy consumption by 21.9% and 23.1%, respectively, without increasing average energy usage.

Abstract

The adoption of Internet of Things (IoT) systems at the network edge of smart architectures is increasing rapidly, intensifying the need for security mechanisms that are both adaptive and resource-efficient. In such environments, runtime defence mechanisms are no longer limited to detection alone but become a resource-constrained task of selecting mitigation actions. Security controls must be carefully selected, combined, and executed under latency, energy, and computational constraints, while preventing unsafe interactions between controls. Existing approaches predominantly rely on static rule sets and learned policies, which provide limited guarantees of feasibility, conflict safety, and execution correctness in resource-constrained edge settings. To address this limitation, we introduce ASPO, a self-adaptive multi-agent security pattern selection that integrates Large Language Model (LLM)-based reasoning with deterministic enforcement within a MAPE-K control loop. ASPO explicitly separates stochastic decision generation from execution: LLM agents propose candidate mitigation portfolios, while a deterministic optimisation core enforces closed-world action integrity, conflict-free composition, and resource feasibility at every decision epoch. We deploy ASPO on a distributed edge-gateway testbed and evaluate it across two workloads, each comprising 500 and 1000 runtime security decisions, using replayed IoT attack traffic. In addition, the results demonstrate invariant safety properties, including 100% conflict-free activation, consistent resource feasibility across workloads, and stable pattern dominance with perfect rank preservation. Importantly, deeper decision exploration reduces extreme-case execution costs, compressing tail latency and energy overheads by 21.9% and 23.1%, respectively, without increasing mean energy consumption.

Problem

• IoT security
• resource-constrained edge
• adaptive security
• conflict-free mitigation
• runtime decision-making

Innovation

• self-adaptive
• multi-agent
• LLM-based reasoning
• security pattern selection
• resource-constrained edge