Toward LLM-Driven Adaptive Policy Orchestration for Host-Based Intrusion Detection Systems in IoT Environments
Binod Karunanayake, Ibrahim Khalil, Xun Yi, Kwok‐Yan Lam · IEEE Network · 2025
Large language models (LLMs) have emerged as powerful tools for text generation, demonstrating remarkable capabilities in reasoning, function calling, and generating structured outputs. When equipped with access to functions and memory, they can be transformed into interactive and intelligent LLM agents. However, the applicability of such LLM agents in real-time Internet of things (IoT) applications remains constrained by resource limitations. One critical area is IoT security, particularly in intrusion detection systems (IDS), where LLM agents hold the potential to enhance the effectiveness of existing solutions significantly. Current IDS approaches in IoT, predominantly reliant on signature-based or anomaly-based techniques, struggle to adapt to the dynamic and evolving nature of modern threats. Recent studies reveal a prevalence of false positives in existing IDS, complicating the alert reasoning and decision-making process. To address these limitations, this research proposes a novel adaptive IDS policy orchestration framework that leverages LLM agents in conjunction with advanced prompting strategies. Our framework generates adaptive IDS policies, enhancing precision with intelligent alert reasoning. It enables efficient policy deployment without needing LLM inference during policy execution. We validate the effectiveness of the proposed framework through experiments conducted on five real-world IDS datasets. The results demonstrate that the framework achieves over 97% precision on three IoT network datasets and over 80% on two more challenging datasets. Notably, our framework reduces the detection latency by 50% compared to traditional machine learning (ML) models with the requirement of fewer than 10k total completion tokens, offering a highly cost-effective, efficient, and scalable solution. These findings establish a new benchmark for IoT-IDS frameworks utilising LLM agents, underscoring the potential for further advancements in this domain.