💻 computer science

Unknown Attack Detection in IoT Networks using Large Language Models: A Robust, Data-efficient Approach

This paper proposes SiamXBERT, a robust and data-efficient Siamese meta-learning framework that leverages a transformer-based language model to integrate flow and packet-level features for detecting unknown attacks in IoT networks, achieving superior performance with minimal labeled data compared to existing state-of-the-art methods.

Original authors: Shan Ali, Feifei Niu, Paria Shirani, Lionel C. Briand

Published 2026-02-13

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Shan Ali, Feifei Niu, Paria Shirani, Lionel C. Briand

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine your home is filled with smart devices: a thermostat that talks to your phone, a camera that streams video, and a fridge that orders milk. This is the Internet of Things (IoT). While convenient, these devices are like an open door for hackers. The scary part isn't just the thieves we know about; it's the unknown thieves (zero-day attacks) who invent new ways to break in every day.

Current security systems are like bouncers at a club who only have a photo ID list of known bad guys. If a new criminal shows up wearing a disguise the bouncer has never seen, they get let in. Also, most bouncers need to study thousands of photos of criminals before they can learn the job, which is impossible when new threats appear faster than we can take pictures.

This paper introduces a new, smarter bouncer named SiamXBERT. Here is how it works, explained simply:

1. The Problem: The "Needle in a Haystack" Issue

Traditional security systems are like trying to find a specific needle in a haystack by looking at the entire haystack. They need massive amounts of data (thousands of examples of every attack) to learn.

The Issue: In the real world, we often don't have thousands of examples of a new attack. We might only have a few.
The Encryption Problem: Many systems try to read the "letter inside the envelope" (the data payload) to see if it's bad. But in the IoT world, most letters are in sealed, encrypted envelopes. You can't read the inside, so those systems go blind.

2. The Solution: SiamXBERT (The "Pattern Detective")

Instead of memorizing a list of bad guys, SiamXBERT learns to recognize behavior patterns. Think of it like a security guard who doesn't need a photo of a thief; they just know what "suspicious behavior" looks like.

The "Dual-Eye" Vision:
SiamXBERT looks at traffic in two ways simultaneously:
1. The Flow (The Highway): It watches the big picture: How many cars are passing? How fast are they going? Are they going in the right direction? (This works even if the cars are encrypted).
2. The Packet (The Car): It looks at the individual vehicles: What kind of car is it? Is the engine making a weird noise?
  By combining these two views, it gets a complete 3D picture of what's happening without needing to open the encrypted "envelopes."
The "Siamese Twin" Trick:
The system uses a technique called a Siamese Network. Imagine a pair of identical twins. You show them two things (e.g., a normal email and a suspicious email) and ask, "Are these the same?"
- If the answer is "Yes" (both are normal), they get closer together in their minds.
- If the answer is "No" (one is normal, one is an attack), they push far apart.
  This allows the system to learn the distance between "good" and "bad" without needing to memorize every specific bad thing.
The "Few-Shot" Superpower:
This is the magic part. Most security systems need a library of 10,000 bad examples to learn. SiamXBERT is like a genius student who can learn a new concept after seeing just five examples.
- Analogy: If a new type of lock-picking tool appears, SiamXBERT only needs to see it used once or twice to say, "Hey, that doesn't look like normal behavior," and flag it.

3. How It Handles the "Unknown"

When SiamXBERT sees a new piece of traffic, it asks: "Does this look like the 'Good' group or the 'Bad' group I know?"

If it looks like the known groups, it lets it pass.
If it looks strange (too far away from both groups), it screams, "I don't know what this is! It's an Unknown Attack!" and blocks it.
This is crucial because it catches the "Zero-Day" attacks that no one has ever seen before.

4. The Results: Why It Matters

The authors tested this new system against the best existing security guards (the "State-of-the-Art").

Data Efficiency: While other systems needed millions of data points to train, SiamXBERT got excellent results with a tiny fraction of that data. It's like learning to drive a car after just a few hours of practice, while others needed a whole semester.
Cross-Training: They tested it in a "real-world" scenario: Train the system on data from one city (Dataset A) and test it in a completely different city (Dataset B). Most systems failed miserably because the traffic patterns were different. SiamXBERT, however, adapted quickly and kept catching the bad guys.
The Score: It improved the detection of unknown attacks by nearly 79% compared to the best existing methods.

Summary

SiamXBERT is a new kind of digital security guard for smart devices. Instead of memorizing a list of known criminals, it learns to spot suspicious behavior by looking at the "shape" of the traffic. It works even when the data is locked (encrypted), it learns incredibly fast with very little data, and it is excellent at spotting brand-new, unknown threats that traditional systems miss.

It's the difference between a guard who only stops people with a specific "Wanted" poster and a guard who simply knows what a criminal feels like, even if they've never seen them before.

1. Problem Statement

The rapid proliferation of Internet of Things (IoT) devices has led to a surge in cyber threats, particularly unknown (zero-day) attacks. Existing Intrusion Detection Systems (IDS) face three critical limitations in addressing these threats:

Data Scarcity: Most Machine Learning (ML) and Deep Learning (DL) models require massive labeled datasets (thousands to millions of samples) to learn decision boundaries, which is unrealistic for emerging or rare attack types.
Encryption and Payload Dependency: Many state-of-the-art (SOTA) methods rely on inspecting raw packet payloads. This is ineffective in encrypted IoT traffic and raises privacy concerns.
Closed-Set Limitations: Traditional detectors are optimized for "closed-set" classification (known classes only). They struggle with open-set scenarios where they must distinguish between known attacks, benign traffic, and completely unseen attack behaviors, often suffering from distribution shifts across different IoT deployments.

2. Methodology: SiamXBERT

The authors propose SiamXBERT, a robust, data-efficient framework that combines Siamese networks, Meta-learning, and Domain-specific Large Language Models (LLMs) to detect unknown attacks without relying on payload inspection.

A. Dual-Modality Feature Extraction

To ensure compatibility with encrypted traffic, the system avoids payload inspection. Instead, it constructs a rich feature representation using:

Flow-level Features (Zeek): 21 features capturing connection statistics (duration, byte counts, protocol, etc.).
Packet-level Features (DPKT): 45 features derived from packet headers (IP, TCP/UDP flags, TTL, etc.).
Derived Features: Four additional features capturing directional asymmetry and rate normalization (e.g., byte ratio, packet rate).
Preprocessing: Redundant identifiers (IPs, ports) are removed to prevent overfitting to specific environments. Features are aggregated (mean/mode), one-hot encoded, normalized, and filtered via feature importance selection.

B. Architecture and Meta-Learning

Backbone: The model uses SecBERT, a transformer-based language model pre-trained on large-scale cybersecurity corpora.
Siamese Network: The architecture employs a Siamese structure where input features are serialized into text prompts (LLM prompts) and passed through the SecBERT encoder to generate 512-dimensional embeddings.
Meta-Learning Strategy:
- Task Decomposition: The training process is decomposed into binary meta-tasks ( $MT_i$ ), where each task pairs the Benign class (B) with one specific Known Attack class ( $C_i$ ).
- Triplet Loss: For each task, the model learns a similarity function using triplets: an Anchor ( $x_a$ ), a Positive ( $x_p$ from the same class), and a Negative ( $x_n$ from the other class). The goal is to minimize the distance between similar classes and maximize the distance between dissimilar ones in the embedding space.
- Threshold Selection: A decision threshold ( $\tau$ ) is calibrated by simulating "pseudo-unknown" scenarios (treating one known class as unknown during training) to determine the optimal cutoff for rejecting unknown samples.

C. Inference (Meta-Testing)

During inference, a query sample is compared against support sets of all known classes and the benign class.

The model computes the average cosine similarity between the query and the support embeddings across all trained meta-models.
Decision Rule: If the average similarity score is below the calibrated threshold $\tau^*$ , the sample is classified as Unknown. Otherwise, it is assigned to the majority-voted known class.

3. Key Contributions

Systematic Evaluation: A comprehensive benchmark of ML, DL, and LLM-based approaches for IoT attack detection, analyzing their data efficiency and scalability.
Novel Framework (SiamXBERT): Introduction of a Siamese-SecBERT framework that achieves high accuracy in unknown attack detection using extremely few labeled samples (100 samples per class) without payload inspection.
Robustness to Distribution Shifts: Demonstration of superior performance in cross-dataset scenarios, proving the model's ability to generalize to unseen environments.
Open-Source Release: Publication of datasets, implementations, and baseline models to facilitate reproducibility.

4. Experimental Results

The authors evaluated SiamXBERT on two major datasets: CICIoT2023 (complex, fine-grained) and IoT-23 (larger scale, distinct behaviors).

RQ1 (Known Attacks): In large-scale settings, LLM-based models (SecBERT, SecureBERT+) consistently outperformed traditional ML (Random Forest) and DL (DNN, LSTM) models. In small-scale settings, ML models were competitive, but LLMs showed better scalability.
RQ2 (Configuration): The combination of flow-level and packet-level features with feature importance selection yielded the best results. Token length (256 vs. 512) had a minor impact compared to feature composition.
RQ3 (Within-Dataset Unknown Detection):
- SiamXBERT significantly outperformed SOTA baselines (ACGAN, SAFE-NID, IDS-Agent, RFG-HELAD).
- On CICIoT2023, it achieved an Unknown F1-score of 0.388, outperforming the best baseline (IDS-Agent) by 78.8%.
- On IoT-23, it achieved an Unknown F1-score of 0.536, outperforming IDS-Agent by 415%.
- Crucially, it achieved this while being trained on only 100 samples per class, whereas baselines required 10% of the dataset (thousands of samples).
RQ4 (Cross-Dataset Unknown Detection):
- SiamXBERT demonstrated strong generalization. When trained on IoT-23 and tested on CICIoT2023, it achieved a U-F1 of 0.816, significantly outperforming baselines.
- While performance dropped when training on the complex CICIoT2023 and testing on IoT-23 (due to dataset bias), SiamXBERT still maintained higher recall than most baselines.

5. Significance

Data Efficiency: The paper proves that unknown attack detection does not require massive datasets. By leveraging meta-learning and semantic embeddings from pre-trained LLMs, high performance is achievable with minimal labeled data.
Privacy and Encryption: The approach is payload-free, making it viable for modern, encrypted IoT networks where deep packet inspection is impossible or illegal.
Practical Deployment: The ability to detect zero-day attacks in cross-dataset scenarios addresses the "distribution shift" problem, a major hurdle in real-world IoT security deployments.
Paradigm Shift: The study suggests a shift from "learning decision boundaries" (closed-set) to "learning similarity relationships" (open-set) for robust intrusion detection.