SentineLLM: An LLM-based intrusion detection framework for software-defined internet of things
EXPERT SYSTEMS WITH APPLICATIONS, cilt.333, 2027 (SCI-Expanded, Scopus)
- Yayın Türü: Makale / Tam Makale
- Cilt numarası: 333
- Basım Tarihi: 2027
- Doi Numarası: 10.1016/j.eswa.2026.134239
- Dergi Adı: EXPERT SYSTEMS WITH APPLICATIONS
- Derginin Tarandığı İndeksler: Science Citation Index Expanded (SCI-EXPANDED), Scopus, Aerospace Database, Applied Science & Technology Source, Compendex, INSPEC, Public Affairs Index, Academic Search Ultimate (EBSCO), Engineering Source (EBSCO), Technology Collection (ProQuest)
- Gazi Üniversitesi Adresli: Evet
Özet
Software-Defined Internet of Things (SD-IoT) has emerged as a critical enabler for managing large-scale, heterogeneous IoT deployments, providing flexibility through centralized control and dynamic resource management. However, these architectures introduce unique security vulnerabilities, and traditional Intrusion Detection Systems (IDS) often struggle to mitigate these threats, particularly when encountering evolving and previously unseen cyber attacks. To address these limitations, Large Language Models (LLMs) offer a promising alternative to conventional deep learning methods due to their advanced ability to model complex dependencies and patterns within sequential data. In this study, we introduce SentineLLM, which is, to the best of our knowledge, the first LLM-based intrusion detection framework for SD-IoT environments. By transforming network flow data into natural language representations, we develop five LLM-based IDSs spanning three distinct architectural paradigms: (i) the encoder-based BERT and RoBERTa, (ii) encoder-decoder-based Flan-T5 and BART, and (iii) decoder-based Qwen. We evaluate the proposed framework against traditional deep learning baselines, namely DNN and 1D-CNN based IDSs, as well as a recent transformer-based FT-Transformer, across three key scenarios: (i) standard intrusion detection and classification, (ii) cross-dataset generalization, and (iii) unseen attack detection. Experimental results demonstrate that SentineLLM exhibits strong performance compared to traditional and modern baselines and state-of-the-art approaches in the literature, achieving high classification accuracy across the evaluated scenarios. Furthermore, the framework demonstrates improved robustness in cross-dataset evaluations, although performance decreases on the independent CICIoT2023 dataset due to substantial domain differences, while still outperforming the evaluated baseline models. These findings confirm that LLM-based approaches provide a significant advancement in system resilience, establishing them as a robust security layer for future SD-IoT infrastructures.