💻 computer science

Self-Adaptive Multi-Agent LLM-Based Security Pattern Selection for IoT Systems

This paper introduces ASPO, a self-adaptive multi-agent framework that combines LLM-based reasoning with deterministic optimization to select and execute conflict-free, resource-feasible security mitigation patterns for IoT edge systems, achieving significant reductions in tail latency and energy overhead while guaranteeing safety properties.

Original authors: Saeid Jamshidi, Foutse Khomh, Carol Fung, Kawser Wazed Nafi

Published 2026-05-04

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Saeid Jamshidi, Foutse Khomh, Carol Fung, Kawser Wazed Nafi

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine your home's smart security system as a busy airport control tower. Its job is to spot trouble (like a hacker trying to break in) and immediately decide which countermeasures to deploy: maybe locking a door, turning on a spotlight, or calling the police.

In the past, these systems were like rigid rulebooks: "If you see a red light, lock the door." But modern IoT (Internet of Things) systems are too complex for simple rules. They need to make quick, smart decisions while running on tiny, battery-powered devices that can't handle heavy workloads.

This paper introduces ASPO, a new way to manage these security decisions. Think of ASPO as a high-tech air traffic control team that uses a mix of creative brainstorming and strict, unbreakable safety laws.

Here is how it works, broken down into simple parts:

1. The Problem: Too Many Choices, Too Little Power

In a smart city or a home with hundreds of devices, a security system might have 10 different "tools" to stop an attack (like a firewall, a password lock, or a traffic filter).

The Old Way: Systems tried to learn the best tool through trial and error (like a student guessing answers on a test). Sometimes they guessed wrong, picked tools that didn't work together, or tried to use too much battery, causing the system to crash.
The Risk: If the system picks two tools that fight each other (like trying to lock a door while simultaneously unlocking it), the whole system could fail.

2. The Solution: ASPO (The "Brain" and the "Bouncer")

ASPO splits the job into two distinct teams to ensure safety and speed:

Team A: The Creative Brain (The LLM Agents)
Imagine a group of very smart, creative consultants. They look at the current situation (e.g., "We are being attacked by a flood of fake traffic") and brainstorm a list of possible solutions. They are fast and flexible, but they can be a bit "dreamy"—sometimes they suggest ideas that are impossible to do or that conflict with each other.
- Analogy: They are like a chef suggesting a menu of delicious but potentially incompatible dishes.
Team B: The Strict Bouncer (The Deterministic Core)
This is the hard-nosed security guard who stands at the door. Their only job is to check the chef's menu against a strict rulebook. They ask:
1. "Do we have enough battery for this?"
2. "Do these two tools fight each other?"
3. "Is this tool even on our approved list?"
  If the answer to any of these is "No," the Bouncer throws the plan in the trash. They only let through plans that are 100% safe, feasible, and conflict-free.
- Analogy: The Bouncer ensures the chef doesn't serve a meal that would poison the guests or burn down the kitchen.

3. The "Closed-World" Rulebook

ASPO doesn't let the "Brain" invent new tools on the fly. It only has a specific, pre-approved list of 10 security tools (like "Whitelist," "Blacklist," or "Secure Logging").

Why? This is like a pilot flying a plane. They can make complex decisions, but they can only use the buttons and switches that actually exist in the cockpit. They can't invent a new button that doesn't exist. This guarantees that whatever the system decides to do, it can actually physically perform.

4. What Happened in the Experiments?

The researchers tested ASPO on a simulated network of 10 small computers (like Raspberry Pis) acting as security gateways. They replayed thousands of real-world cyberattacks to see how the system handled the pressure.

The "Safety Funnel": The system was very picky. Out of 1,000 attempts to pick a security plan, the "Brain" suggested many ideas, but the "Bouncer" rejected 99.5% of them because they were unsafe or too expensive. Only the tiny fraction of perfect plans were allowed to run.
The Result: Even though the system was being very strict, it didn't slow down. In fact, by filtering out the bad ideas early, the system became more stable.
- Tail Latency: The "worst-case" delays (the times when the system got stuck) dropped by 21.9%.
- Energy: The "worst-case" battery drain dropped by 23.1%.
- Safety: There were zero conflicts. The system never tried to run two tools that fought each other.

5. The Big Takeaway

ASPO proves that you can have a security system that is both smart (using AI to understand complex threats) and safe (using hard rules to prevent mistakes).

Instead of letting an AI guess its way through a crisis, ASPO lets the AI dream up ideas, but forces a strict, mathematical check before anything actually happens. This ensures that even if the AI makes a mistake in its thinking, the system's physical actions remain safe, fast, and reliable, even on small, battery-powered devices.

In short: It's the difference between a chaotic brainstorming session and a well-rehearsed play where the director (the Bouncer) makes sure no one forgets their lines or breaks the set before the curtain rises.

1. Problem Statement

The rapid expansion of Internet of Things (IoT) systems has shifted security enforcement to resource-constrained edge gateways. While existing approaches focus on attack detection, the critical challenge lies in runtime mitigation selection: deciding which security controls to activate, how to combine them, and in what order, all while adhering to strict constraints on latency, energy, memory, and CPU.

Current solutions face a structural incompatibility:

Deep Reinforcement Learning (DRL): Offers adaptability but lacks explicit reasoning and cannot guarantee conflict-free or resource-feasible execution (safety is only implicitly encoded in rewards).
Optimization-based methods: Enforce constraints but lack the contextual reasoning to handle complex, evolving threat scenarios.
Large Language Models (LLMs): Provide powerful reasoning and multi-agent workflows but produce stochastic outputs that may be infeasible, unsafe, or violate resource budgets if not strictly controlled.

There is a lack of a unified runtime mechanism that combines context-aware agentic reasoning with deterministic enforcement to ensure that selected security portfolios are always safe, feasible, and executable under edge constraints.

2. Methodology: The ASPO Framework

The authors propose ASPO, a self-adaptive multi-agent system grounded in the MAPE-K (Monitor, Analyze, Plan, Execute, Knowledge) autonomic control loop. The core innovation is the explicit separation of stochastic deliberation from deterministic enforcement.

A. Architecture & Workflow

Monitor & Analyze:
- Collects raw telemetry (traffic features, resource indicators) from the edge gateway.
- Uses a deterministic encoder to construct a structured, bounded context ( $S_t$ ) including threat class, severity, confidence, and available resource budgets.
Plan (Hybrid Stochastic-Deterministic Core):
- Agentic Deliberation (Stochastic): A multi-agent LLM system (Context, Reasoner, Constraint, Planner, and Audit agents) proposes candidate mitigation portfolios based on the structured context. These agents operate within a schema-constrained JSON format but remain stochastic.
- Deterministic Enforcement (Hard Constraints): A local, deterministic optimization core takes the LLM's candidates and applies hard constraints:
  - Closed-World Membership: Only patterns from a predefined catalog (e.g., Whitelist, Segmentation, Secure Fog) are allowed.
  - Conflict-Free Composition: Ensures no mutually exclusive patterns are selected simultaneously using a conflict matrix.
  - Resource Feasibility: Verifies that the combined cost (CPU, memory, latency, energy) fits within the current budget.
  - Execution Ordering: Determines a valid activation sequence using topological sorting based on precedence rules.
Execute:
- Activates the validated portfolio. If the deterministic gate rejects the LLM's proposal (due to conflicts or resource violations), a lightweight "fail-safe" baseline policy is activated instead.
Knowledge:
- Maintains a closed-world catalog of 10 specific security patterns, each with defined costs, capabilities, and interaction rules.

B. Threat Model

The system assumes an adversary can manipulate telemetry and context inputs (e.g., via prompt injection or context poisoning) to distort the LLM's reasoning. However, because the final actuation is determined solely by the deterministic optimization core against a fixed catalog and hard constraints, the system guarantees that even if the reasoning stage is manipulated, the executed actions remain safe and feasible.

3. Key Contributions

Hybrid Agentic-Deterministic Paradigm: ASPO moves beyond pure policy learning by integrating multi-agent LLM reasoning with a deterministic validation core. This enables complex decision-making while preventing unsafe or infeasible actions at runtime.
Deterministic Enforcement of Security Composition: The authors reformulate mitigation selection as a closed-world optimization problem. They guarantee conflict-free composition and adherence to latency/energy budgets as hard constraints at every decision epoch, rather than soft penalties.
Operational Validation on Edge Testbeds: The system was implemented on a distributed edge-gateway testbed (10 Raspberry Pi 4 nodes) and evaluated using the Bot-IoT dataset with replayed attack traffic (500 and 1000 decision epochs).

4. Experimental Results

The evaluation demonstrated that ASPO achieves invariant safety properties and improved efficiency under workload scaling:

Safety Enforcement: The deterministic gate acts as a strict filter. In the 1000-run workload, 99.5% of LLM-generated candidate plans were rejected due to constraint violations (conflicts, resource limits, or ordering issues), leaving only a small, verified set for execution. This confirms the system prioritizes safety over activation frequency.
Stability & Consistency:
- Pattern Ranking: The selection of security patterns remained perfectly stable across workloads (Spearman rank correlation = 1.0), indicating no drift in decision logic.
- Gate-Audit Agreement: There was 100% agreement between the deterministic gate and the audit agent on approved plans.
Edge Efficiency (Tail Latency & Energy):
- Increasing the decision depth (from 500 to 1000 runs) did not increase median latency or energy consumption.
- Crucially, it significantly reduced extreme-case costs:
  - P99 Latency decreased by 21.9% (from 36.0s to 28.1s).
  - P99 Energy decreased by 23.1% (from 216J to 166J).
- This suggests that deeper exploration allows the system to filter out "tail" inefficiencies, leading to more predictable performance.
Robustness: The system maintained consistent behavior across different threat types (DDoS, DoS, Botnet, etc.) and showed no statistically significant bias toward specific attack categories.

5. Significance

This work addresses a critical gap in autonomous cybersecurity for IoT. It demonstrates that LLMs can be safely deployed in safety-critical, resource-constrained environments if their stochastic nature is contained within a rigorous, deterministic control loop.

Shift from Policy Learning to Deliberation: ASPO reframes runtime defense from learning a policy to performing bounded, verifiable deliberation.
Predictability: By enforcing hard constraints, ASPO ensures that edge gateways do not crash or become unresponsive due to resource exhaustion, a common failure mode in adaptive AI systems.
Practical Deployment: The results prove that complex, multi-agent reasoning can be integrated into edge devices without sacrificing the strict safety and feasibility guarantees required for real-world IoT security.

In conclusion, ASPO provides a blueprint for trustworthy autonomous defense, showing that combining the reasoning power of LLMs with the rigor of deterministic optimization yields systems that are both adaptive and safe.