# Hybrid LLM-Enhanced Intrusion Detection for Zero-Day Threats in IoT Networks

arXiv: https://arxiv.org/abs/2507.07413 · HTML: https://mlsanity.com/paper/2507.07413/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 16 references that are in the map.
- First posted on arXiv 10 Jul 2025.

## Builds on (most cited first, 5 of 5)

- [Language Models are Few-Shot Learners](https://mlsanity.com/paper/2005.14165/) (2020)
- [LLMs meet Federated Learning for Scalable and Secure IoT Management](https://mlsanity.com/paper/2504.16032/) (2025)
- [LLM-Based Threat Detection and Prevention Framework for IoT Ecosystems](https://mlsanity.com/paper/2505.00240/) (2025)
- [Deep Adversarial Learning in Intrusion Detection: A Data Augmentation Enhanced Framework](https://mlsanity.com/paper/1901.07949/) (2019)
- [Differential Privacy-Driven Framework for Enhancing Heart Disease Prediction](https://mlsanity.com/paper/2504.18007/) (2025)

## Built on by (most cited first, 2 of 2)

- [HIDBench: Benchmarking Large Language Models for Host-Based Intrusion Detection](https://mlsanity.com/paper/2605.21773/) (2026)
- [Semantic Multi-Agent Intrusion Detection for IoT:Zero-Day and Adversarial Threats with Risk-Aware Reasoning](https://mlsanity.com/paper/2606.10323/) (2026)

## Abstract (arXiv)

This paper presents a novel approach to intrusion detection by integrating traditional signature-based methods with the contextual understanding capabilities of the GPT-2 Large Language Model (LLM). As cyber threats become increasingly sophisticated, particularly in distributed, heterogeneous, and resource-constrained environments such as those enabled by the Internet of Things (IoT), the need for dynamic and adaptive Intrusion Detection Systems (IDSs) becomes increasingly urgent. While traditional methods remain effective for detecting known threats, they often fail to recognize new and evolving attack patterns. In contrast, GPT-2 excels at processing unstructured data and identifying complex semantic relationships, making it well-suited to uncovering subtle, zero-day attack vectors. We propose a hybrid IDS framework that merges the robustness of signature-based techniques with the adaptability of GPT-2-driven semantic analysis. Experimental evaluations on a representative intrusion dataset demonstrate that our model enhances detection accuracy by 6.3%, reduces false positives by 9.0%, and maintains near real-time responsiveness. These results affirm the potential of language model integration to build intelligent, scalable, and resilient cybersecurity defences suited for modern connected environments.