Evaluating Language Models For Threat Detection in IoT Security Logs

Jorge J. Tejero-Fernández, Alfonso Sánchez-Macián
7/3/2025
cs.CRcs.AI

No official code found. Best implementation: Jorge-Tejero-Fdez/ThreatLogLLM (6 stars, last commit 2025-12-12).

Abstract

Log analysis is a relevant research field in cybersecurity as they can provide a source of information for the detection of threats to networks and systems. This paper presents a pipeline to use fine-tuned Large Language Models (LLMs) for anomaly detection and mitigation recommendation using IoT security logs. Utilizing classical machine learning classifiers as a baseline, three open-source LLMs are compared for binary and multiclass anomaly detection, with three strategies: zero-shot, few-shot prompting and fine-tuning using an IoT dataset. LLMs give better results on multi-class attack classification than the corresponding baseline models. By mapping detected threats to MITRE CAPEC, defining a set of IoT-specific mitigation actions, and fine-tuning the models with those actions, the models are able to provide a combined detection and recommendation guidance.

View on arXivView PDF

Code Implementations(1)

Jorge-Tejero-Fdez/ThreatLogLLMCommunity100%

This project consists of fine-tuning a LLM (Large Language Model) to detect security threats in logs from IoT devices.

61Python, Jupyter NotebookFeb 7, 202510 months ago

Similar Papers

Intrusion Detection System with Machine Learning and Multiple Datasets

85% match2023

Malware Detection in IOT Systems Using Machine Learning Techniques

84% match2023

Explainable Threat Attribution for IoT Networks Using Conditional SHAP and Flow Behavior Modelling

84% match2026

CodeAD: Synthesize Code of Rules for Log-based Anomaly Detection with LLMs

84% match2025

Leveraging Log Instructions in Log-based Anomaly Detection

83% match1 repo62022

Next-generation cyberattack detection with large language models: anomaly analysis across heterogeneous logs

83% match2026

Cite this paper

@article{tejerofernndez2025evaluating,
  title  = {Evaluating Language Models For Threat Detection in IoT Security Logs},
  author = {Jorge J. Tejero-Fernández and Alfonso Sánchez-Macián},
  year   = {2025},
  eprint = {2507.02390},
  archivePrefix = {arXiv},
  url    = {http://arxiv.org/abs/2507.02390v1}
}

Add a badge to your README

Shows whether official code is linked for this paper.

Code of Paper badge
[![Code of Paper](https://codeofpaper.com/badge/2507.02390.svg)](https://codeofpaper.com/paper/2507.02390)

Discussion