Mobility-aware language model improves roaming iot device security detection
MAPLE-Sec: Mobility-Aware Partitioned Language-Model Engine for Roaming IoT Security
Networking and Internet Architecture
Summary
Devices like connected cars, wearables, and drones move across different networks, which creates gaps where security detectors can miss attacks. The authors present MAPLE-Sec, a method that splits a smart language model between the device and nearby edge servers to keep detecting threats quickly. MAPLE-Sec predicts when devices will switch networks and smartly shares the information needed, saving energy and speeding up detection. Their tests show it works better than current cloud-only or edge-based methods, especially during network switches.
What this means in practice
- •For iot security engineers: Maintain accurate real-time threat detection on IoT devices that frequently move across network zones using MAPLE-Sec’s device-edge cooperative model splitting.
- •For edge computing operators: Optimize resource use and reduce latency by dynamically adjusting processing splits and state transfers during IoT device handovers.
Authors
Yuhang Qiu, Ziwei Li, Jinfeng Xu, Jialiang Xie, Fangmin Ren, Shirong Guo, Jing Yang, Sunil Prajapat, Por Lip Yee
Abstract
Mobile Internet-of-Things (IoT) endpoints such as connected vehicles, wearables, and drones continuously cross heterogeneous network domains, creating handover-driven attack surfaces that static, cloud-anchored detectors cannot follow. However, three obstacles block real-time detection on such roaming endpoints: detection state is lost at every inter-domain handover; transmitting raw telemetry to a fixed detector exhausts the uplink and the device battery; and full-depth language model inference cannot meet millisecond latency budgets on constrained hardware. To tackle these challenges, we propose MAPLE-Sec, a mobility-aware partitioning framework that splits a compact, security-tuned language model across a roaming device and its nearest edge node. First, a trajectory-conditioned partition scheduler recomputes the split point from predicted handover timing, residual battery, and uplink quality. Second, a token-budgeted early-exit mechanism emits a verdict at the shallowest layer that meets a confidence threshold. Finally, a learned activation-compression codec migrates the intermediate inference state across edge nodes during handover without retransmitting raw telemetry. We formalize the partition-and-migration decision as an on-device constrained optimization solved in sub-millisecond time. Extensive experiments across the CIC-IoT and Edge-IIoTset corpora under both IID and non-IID roaming conditions demonstrate that MAPLE-Sec sustains detection across mobility events, improving the converged F1-score by up to 9.3\% relative to Cloud-only and by 2.9 percentage points over the strongest edge-collaborative baseline (EdgeShard), while reducing end-to-end latency by up to 2.5$\times$. Ablation confirms that the activation-compression codec reduces migration energy by 2.4$\times$ versus the raw-activation migration variant.