LLM-Integrated Anomaly Detection for IoT Networks: Framework Structure

Authors

• Mamoon M. Saeed, Department of Communications and Electronics Engineering, Faculty of Engineering, University of Modern Sciences (UMS), YemenFollow
• Rashid A. Saeed, College of Commerce and Business, Lusail University, Doha, QatarFollow
• Salah Hagahmoodi, Department of Information Technology, College of Science, Al-Esraa University, Baghdad, IraqFollow
• Rania A. Mokhtar, Electronics Engineering Department, Sudan University of Science and Technology, Khartoum, SudanFollow
• Khalid Hamid, Department of Communication Systems Engineering, University of Science & Technology, Omdurman P.O. Box 30, SudanFollow

Abstract

Internet of Things (IoT) devices are vulnerable to zero-day attacks because most of them have weak or no inherent security due to the resource constraints of the devices. This weakness underscores the growing need for anomaly-based intrusion detection systems tailored to IoT networks. Nevertheless, general anomaly detection traditionally has a high number of false positives that drain analysts' time. Also, a semantic difference exists between the system's results and the operators' interpretations. We introduce a machine learning-based framework to tackle these issues in traditional systems in this paper by combining large language models (LLMs). Our model is effective in identifying possible threats as well as filling the semantic gap. The framework uses isolation forests to detect anomalies and random forests to measure device integrity. To further improve the assessment of anomalies and increase interpretability, system insights are further refined using GPT-4o mini, an LLM. The model gives statistical summaries of the IoT traffic, a risk score, and an explanation in easy language, which is easy to understand and therefore makes the process of decision-making easier. Such a novel system reduces the reliance on dedicated network operators and allows non-technical users to better understand and act on the results of the system.

Keywords

Detection of anomalies, Identification of malicious devices, Internet of things (IoT), Intrusion detection systems (IDS), Large language models (LLMs), Machine learning techniques

Subject Area

Computer Science

Article Type

Article

First Page

3010

Last Page

3025

Creative Commons License

This work is licensed under a Creative Commons Attribution 4.0 International License.

How to Cite this Article

Saeed, Mamoon M.; Saeed, Rashid A.; Hagahmoodi, Salah; Mokhtar, Rania A.; and Hamid, Khalid (2026) "LLM-Integrated Anomaly Detection for IoT Networks: Framework Structure," Baghdad Science Journal: Vol. 23: Iss. 8, Article 23.
DOI: https://doi.org/10.21123/2411-7986.5392