A Large Language Model-based Intrusion Detection Model for Smart Buildings

Smart building automation systems provide convenience and efficiency but remain vulnerable to cyberattacks.This study proposes an intrusion detection model specifically designed for smart buildings using a large language model.Targeting HVAC systems, normal and malicious behaviors were identified to create training datasets, and the LLaMA 3 8B model was fine-tuned.Benign datasets were developed from physical processes and devices such as HMIs, PLCs, and sensors, while malicious datasets incorporated attack tactics and techniques from the MITRE ATT&CK for ICS matrix.The fine-tuned model demonstrated 90% accuracy on evaluation prompts, significantly outperforming the base model.Inaccuracies were attributed to limited training data, suggesting that additional dataset development and retraining could further enhance performance.These results demonstrate the effectiveness of large language models in intrusion detection for smart building environments.