Unknown Attack Detection in IoT Networks using Large Language Models: A Robust, Data-efficient Approach

2026-02-12

AI Summary

This work addresses the limitations of existing IoT intrusion detection methods in handling unknown (zero-day) attacks, which are often hindered by data scarcity, encrypted traffic, and distribution shifts. To overcome these challenges, we propose SiamXBERT, a novel framework that uniquely integrates large language models with meta-learning. Leveraging a Siamese architecture, SiamXBERT fuses flow-level and packet-level multimodal features to enable rapid generalization under few-shot conditions. The approach supports encrypted traffic analysis and demonstrates strong cross-dataset transferability. Evaluated on multiple IoT benchmarks, SiamXBERT significantly outperforms current state-of-the-art methods, achieving up to a 78.8% improvement in F1-score for zero-day attack detection while substantially reducing the need for labeled training data.

Technology Category

• Application Domains: Internet of Things, Sensor Networks & Smart Cities
• Machine Learning: Large Multimodal Models (LMMs)
• Data Mining & Knowledge Management: Anomaly/Outlier Detection

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Security and Privacy: Large-scale security measurements
• Web Mining and Content Analysis: Large pretrained models with web data

Abstract

The rapid evolution of cyberattacks continues to drive the emergence of unknown (zero-day) threats, posing significant challenges for network intrusion detection systems in Internet of Things (IoT) networks. Existing machine learning and deep learning approaches typically rely on large labeled datasets, payload inspection, or closed-set classification, limiting their effectiveness under data scarcity, encrypted traffic, and distribution shifts. Consequently, detecting unknown attacks in realistic IoT deployments remains difficult. To address these limitations, we propose SiamXBERT, a robust and data-efficient Siamese meta-learning framework empowered by a transformer-based language model for unknown attack detection. The proposed approach constructs a dual-modality feature representation by integrating flow-level and packet-level information, enabling richer behavioral modeling while remaining compatible with encrypted traffic. Through meta-learning, the model rapidly adapts to new attack types using only a small number of labeled samples and generalizes to previously unseen behaviors. Extensive experiments on representative IoT intrusion datasets demonstrate that SiamXBERT consistently outperforms state-of-the-art baselines under both within-dataset and cross-dataset settings while requiring significantly less training data, achieving up to \num{78.8}\% improvement in unknown F1-score. These results highlight the practicality of SiamXBERT for robust unknown attack detection in real-world IoT environments.

Problem

• unknown attack detection
• IoT networks
• zero-day threats
• encrypted traffic
• data scarcity

Innovation

• Siamese network
• large language model
• meta-learning
• unknown attack detection
• IoT security