Federated Learning and LLM-Driven Threat Intelligence for Zero Trust IoT Architecture
Cryptography and Security
Summary
The authors explain that IoT devices, especially old or legacy ones, face big security risks like viruses and data theft, and fixing these devices is often too expensive. They created a system that uses a type of machine learning called Federated Learning to detect unusual behavior while protecting user privacy. Their system also verifies device identities continuously and uses advanced language models for automatic threat responses. They tested it on small devices like Raspberry Pis and showed it works well without trusting any communication by default, making IoT more secure.
Authors
Amal Alshehri, Cihan Tunc
Abstract
While the Internet of Things (IoT) has become essential, they introduced serious security and privacy challenges, especially for mission-critical environments. Legacy devices are vulnerable to viruses, data breaches, and unauthorized access, and updating these devices would be infeasibly costly. As a solution, this paper presents a Federated Learning and LLM-Driven Threat Intelligence for Zero Trust IoT Architecture, with FL for anomaly detection integrating privacy-preserving distributed learning, continuous identity verification, and LLM-driven autonomous threat response into a unified pipeline. Unlike existing solutions, our framework enforces Zero Trust at every communication layer via mutual TLS (mTLS) over MQTT, ensuring no device or message is implicitly trusted. Our experiments with Raspberry Pis and various sensors achieve an F1 score of 0.9091 and an ROC-AUC of 1.0, highlighting the effectiveness of the proposed framework in enabling privacy-preserving anomaly detection for resource-constrained IoT devices.