物联网/工业物联网网络中基于LLM的多类攻击分析与缓解框架
LLM-based Multi-class Attack Analysis and Mitigation Framework in IoT/IIoT Networks
AI总结：
本文提出一种结合机器学习与LLM的混合框架，用于物联网多类攻击检测、行为分析与缓解建议，并引入新评估指标和评判LLM集成模型进行定量评估，发现Random Forest检测效果最佳且ChatGPT-o3优于DeepSeek-R1。
摘要：
物联网的快速扩展改变了各行业的通信与运营，但也扩大了攻击面并增加了安全漏洞。人工智能在保障物联网安全方面发挥着关键作用，能够实现攻击检测、攻击行为分析和缓解建议。尽管取得了一定进展，但评估仍纯粹是定性的，且缺乏用于定量衡量基于人工智能的攻击分析与缓解的标准化客观基准，这阻碍了对模型有效性的持续评估。在这项工作中，我们提出了一个混合框架，将用于多类攻击检测的机器学习（ML）与用于攻击行为分析和缓解建议的大型语言模型（LLM）相结合。在Edge-IIoTset和CICIoT2023数据集上对几种机器学习和深度学习（DL）分类器进行基准测试后，我们应用了结合检索增强生成（RAG）的结构化角色扮演提示工程，以引导ChatGPT-o3和DeepSeek-R1生成详细的、具有上下文感知的回复。我们引入了新的评估指标进行定量评估以指导我们，并使用一个由评判LLM组成的集成模型，即ChatGPT-4o、DeepSeek-V3、Mixtral 8x7B Instruct、Gemini 2.5 Flash、Meta Llama 4、TII Falcon H1 34B Instruct、xAI Grok 3和Claude 4 Sonnet，来独立评估这些回复。结果显示，Random Forest是最佳的检测模型，并且ChatGPT-o3在攻击分析和缓解方面优于DeepSeek-R1。
英文摘要：
The Internet of Things has expanded rapidly, transforming communication and operations across industries but also increasing the attack surface and security breaches. Artificial Intelligence plays a key role in securing IoT, enabling attack detection, attack behavior analysis, and mitigation suggestion. Despite advancements, evaluations remain purely qualitative, and the lack of a standardized, objective benchmark for quantitatively measuring AI-based attack analysis and mitigation hinders consistent assessment of model effectiveness. In this work, we propose a hybrid framework combining Machine Learning (ML) for multi-class attack detection with Large Language Models (LLMs) for attack behavior analysis and mitigation suggestion. After benchmarking several ML and Deep Learning (DL) classifiers on the Edge-IIoTset and CICIoT2023 datasets, we applied structured role-play prompt engineering with Retrieval-Augmented Generation (RAG) to guide ChatGPT-o3 and DeepSeek-R1 in producing detailed, context-aware responses. We introduce novel evaluation metrics for quantitative assessment to guide us and an ensemble of judge LLMs, namely ChatGPT-4o, DeepSeek-V3, Mixtral 8x7B Instruct, Gemini 2.5 Flash, Meta Llama 4, TII Falcon H1 34B Instruct, xAI Grok 3, and Claude 4 Sonnet, to independently evaluate the responses. Results show that Random Forest has the best detection model, and ChatGPT-o3 outperformed DeepSeek-R1 in attack analysis and mitigation.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
