# LLM-based Multi-class Attack Analysis and Mitigation Framework in IoT/IIoT Networks

arXiv: https://arxiv.org/abs/2510.26941 · HTML: https://mlsanity.com/paper/2510.26941/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 23 references that are in the map.
- First posted on arXiv 30 Oct 2025.

## Builds on (most cited first, 7 of 7)

- [DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning](https://mlsanity.com/paper/2501.12948/) (2025)
- [A Survey on LLM-as-a-Judge](https://mlsanity.com/paper/2411.15594/) (2024)
- [CyberMetric: A Benchmark Dataset based on Retrieval-Augmented Generation for Evaluating LLMs in Cybersecurity Knowledge](https://mlsanity.com/paper/2402.07688/) (2024)
- [ChatIDS: Advancing Explainable Cybersecurity Using Generative AI](https://mlsanity.com/paper/2306.14504/) (2023)
- [An Experimental Analysis of Attack Classification Using Machine Learning in IoT Networks](https://mlsanity.com/paper/2101.12270/) (2021)
- [ProveRAG: Provenance-Driven Vulnerability Analysis with Automated Retrieval-Augmented LLMs](https://mlsanity.com/paper/2410.17406/) (2024)
- [Adaptive Cyber-Attack Detection in IIoT Using Attention-Based LSTM-CNN Models](https://mlsanity.com/paper/2501.13962/) (2025)

## Built on by (most cited first, 1 of 1)

- [RAG-targeted Adversarial Attack on LLM-based Threat Detection and Mitigation Framework](https://mlsanity.com/paper/2511.06212/) (2025)

## Abstract (arXiv)

The Internet of Things has expanded rapidly, transforming communication and operations across industries but also increasing the attack surface and security breaches. Artificial Intelligence plays a key role in securing IoT, enabling attack detection, attack behavior analysis, and mitigation suggestion. Despite advancements, evaluations remain purely qualitative, and the lack of a standardized, objective benchmark for quantitatively measuring AI-based attack analysis and mitigation hinders consistent assessment of model effectiveness. In this work, we propose a hybrid framework combining Machine Learning (ML) for multi-class attack detection with Large Language Models (LLMs) for attack behavior analysis and mitigation suggestion. After benchmarking several ML and Deep Learning (DL) classifiers on the Edge-IIoTset and CICIoT2023 datasets, we applied structured role-play prompt engineering with Retrieval-Augmented Generation (RAG) to guide ChatGPT-o3 and DeepSeek-R1 in producing detailed, context-aware responses. We introduce novel evaluation metrics for quantitative assessment to guide us and an ensemble of judge LLMs, namely ChatGPT-4o, DeepSeek-V3, Mixtral 8x7B Instruct, Gemini 2.5 Flash, Meta Llama 4, TII Falcon H1 34B Instruct, xAI Grok 3, and Claude 4 Sonnet, to independently evaluate the responses. Results show that Random Forest has the best detection model, and ChatGPT-o3 outperformed DeepSeek-R1 in attack analysis and mitigation.