A Domain-Adaptive Large Language Model With Refinement Framework For IoT Cybersecurity

To address the increasingly complex security challenges in Internet-of-Things (IoT) environments, Large Language Models (LLMs) have demonstrated effectiveness in enhancing device and data security, as well as improving the security and reliability overall IoT system. However, general LLMs struggle to effectively handle IoT security data. Therefore, developing IoT security domain-specific LLMs based on IoT-specific corpus and terminologies has become a key focus for enhancing cybersecurity defense capabilities. These areas of focus can be broadly categorized into three main directions: training from scratch, retrieval-augmented prompting, and instruction fine-tuning. Training from scratch is discouraged in cybersecurity due to its high computational and data requirements, making effective model training and convergence difficult given the scarcity of cybersecurity data. Retrieval-augmented prompting may suffer from incomplete or conflicting information, impacting the accuracy and reliability of the model. Conversely, instruction fine-tuning allows for the usage of domain-specific task instructions to adjust the model, achieving effective domain adaptation on limited datasets. However, inadequate or inaccurate instructions may degrade the generalization ability and performance. For these shortcomings, we propose a novel and robust fine-tuning framework to refine the original corpus and output a refined corpus for high-quality domain adaptation. Furthermore, we introduce two auxiliary strategies in the training phase to enhance efficiency and accuracy. Finally, our framework is evaluated across multiple task scenarios and demonstrates the best performance on most of them, which proves the effectiveness and efficiency of the model presented in this work.