Exploiting LLM Embeddings for Content-Based IoT Anomaly Detection

The Internet of Things (IoT) consists of enormous special-purpose devices whose security is hard to guarantee due to their simple design. Compared to data content on the Internet, the data content generated from IoT devices reflects the special application context of this device and thus can be treated as the special “language” this device speaks. Leveraging the power of large language models, we use ChatGPT embeddings to extract the features in the IoT traffic payload, with which we train an effective and efficient IoT traffic anomaly model. We evaluate this content-based IoT anomaly model using real-world IoT attack data. Our experimental results demonstrate the high detection accuracy and low false rates of our method.