Publication

LLMEdgeSec: LLM-Enabled Log Reasoning for Zero-Day IoT Threat Detection

2026

Abstract

The proliferation of IoT devices has expanded the attack surface, making zero-day threat detection an urgent priority. This paper proposes LLMEdgeSec, a framework that leverages large language models (LLMs) for log reasoning to detect and contextualize zero-day exploits in real-time. Unlike conventional anomaly detectors that rely on static signatures or pre-defined rules, LLMEdgeSec applies prompt-based reasoning over system logs, communication metadata, and device telemetry, enabling proactive identification of previously unseen attack vectors. The framework employs a dual-stream architecture: (1) a lightweight transformer encoder on edge nodes for local feature extraction, and (2) a cloud-based LLM interface for contextual reasoning and cross-device threat correlation. A zero-shot calibration method mitigates hallucinations and reduces false positives. Evaluation on TON IoT, CIC-IDS2018, and a real-world smart factory dataset demonstrates F1 scores exceeding 92% on zero-day samples with communication overhead below 8MB per federated round. Results show significant improvements in accuracy, interpretability, and adaptability over state-of-the-art baselines.

Official source

https://infoscience.epfl.ch/entities/publication/66898f80-3d0e-4a64-9243-deaf76d82228

About this result

This page is automatically generated and may contain information that is not correct, complete, up-to-date, or relevant to your search query. The same applies to every other page on this website. Please make sure to verify the information with EPFL's official sources.

Graph Chat

Chat with Graph Search

Ask any question about EPFL courses, lectures, exercises, research, news, etc. or try the example questions below.

DISCLAIMER: The Graph Chatbot is not programmed to provide explicit or categorical answers to your questions. Rather, it transforms your questions into API requests that are distributed across the various IT services officially administered by EPFL. Its purpose is solely to collect and recommend relevant references to content that you can explore to help you answer your questions.

2026

Abstract

Official source

https://infoscience.epfl.ch/entities/publication/66898f80-3d0e-4a64-9243-deaf76d82228

About this result

Related concepts (32)

Endpoint security

Endpoint security or endpoint protection is an approach to the protection of computer networks that are remotely bridged to client devices. The connection of endpoint devices such as laptops, tablets, mobile phones, Internet-of-things devices, and other wireless devices to corporate networks creates attack paths for security threats. Endpoint security attempts to ensure that such devices follow a definite level of compliance to standards.

Internet of things

The Internet of things (IoT) describes devices with sensors, processing ability, software and other technologies that connect and exchange data with other devices and systems over the Internet or other communications networks. The Internet of things encompasses electronics, communication and computer science engineering. Internet of things has been considered a misnomer because devices do not need to be connected to the public internet, they only need to be connected to a network, and be individually addressable.

Attack surface

The attack surface of a software environment is the sum of the different points (for "attack vectors") where an unauthorized user (the "attacker") can try to enter data to, extract data, control a device or critical software in an environment. Keeping the attack surface as small as possible is a basic security measure. Worldwide digital change has accelerated the size, scope, and composition of an organization's attack surface. The size of an attack surface may fluctuate over time, adding and subtracting assets and digital systems (e.

Related publications (1)

LLMEdgeSec: LLM-Enabled Log Reasoning for Zero-Day IoT Threat Detection

Chat with Graph Search

DISTIL: Data-Free Inversion of Suspicious Trojan Inputs via Latent Diffusion