BARTPredict: Empowering IoT Security with LLM-Driven Cyber Threat Prediction
Open accessAbstract
The integration of Internet of Things (IoT) technology in various domains has led to operational advancements, but it has also introduced new vulnerabilities to cybersecurity threats, as evidenced by recent widespread cyberattacks on IoT devices. Intrusion detection systems are often reactive, triggered by specific patterns or anomalies observed within the network. To address this challenge, this work proposes a proactive approach to anticipate and preemptively mitigate malicious activities, aiming to prevent potential damage before it occurs. This paper proposes an innovative intrusion prediction framework empowered by Pre-trained Large Language Models (LLMs). The framework incorporates two LLMs: a fine-tuned Bidirectional and Auto-Regressive Transformers (BART) model for predicting network traffic and a fine-tuned Bidirectional Encoder Representations from Transformers (BERT) model for evaluating the predicted traffic. By harnessing the bidirectional capabilities of BART the framework then identifies malicious packets among these predictions. Evaluated using the CICIoT2023 IoT attack dataset, our framework showcases a notable enhancement in predictive performance, attaining an impressive 98% overall accuracy, providing a powerful response to the cybersecurity challenges that confront IoT networks.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
BARTPredict achieves 98% accuracy in predicting IoT attacks on the BoT-IoT benchmark by fine-tuning a BART encoder on temporal traffic sequences.
“BARTPredict achieves 98% accuracy in predicting IoT attacks on the BoT-IoT benchmark (80/20 stratified train/test split as reported in the primary study) by fine-tuning a BART encoder on temporal traffic sequences”
From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [71]
BARTPredict reports 98% accuracy in IoT attack prediction.
“Quantitatively, BARTPredict reports 98% accuracy in IoT attack prediction [71].”
From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [71]
Across the full 153-paper corpus, only five studies report observing a compound failure mode at all.
“across the full 153-paper corpus, only five studies (≈3%)- [22,71,125] for error propagation and [26,87] for tool-use amplification-report observing a compound failure mode at all”
From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [71]
Cites
Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, L., & Polosukhin, I. (2017) · arXiv · doi:10.48550/arxiv.1706.03762 · Cited by 120,404 · see citing works
Transformers: State-of-the-Art Natural Language Processing
Wolf, T., Debut, L., Sanh, V., Chaumond, J., Delangue, C., Moi, A., Cistac, P., Rault, T., Louf, R., Funtowicz, M., et al. (2020) · Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations · doi:10.18653/v1/2020.emnlp-demos.6 · Cited by 8,741 · see citing works
CICIoT2023: A Real-Time Dataset and Benchmark for Large-Scale Attacks in IoT Environment
Neto, E. C. P., Dadkhah, S., Ferreira, R., Zohourian, A., Lu, R., & Ghorbani, A. A. (2023) · Sensors · doi:10.3390/s23135941 · Cited by 1,368 · see citing works
Artificial intelligence for cybersecurity: Literature review and future research directions
Kaur, R., Gabrijelčič, D., & Klobučar, T. (2023) · Information Fusion · doi:10.1016/j.inffus.2023.101804 · Cited by 615 · see citing works
Ozkan-Okay, M., Akin, E., Aslan, Ö., Koşunalp, S., Iliev, T. B., Stoyanov, I. S., & Beloev, I. H. (2024) · IEEE Access · doi:10.1109/access.2024.3355547 · Cited by 287 · see citing works
A systematic literature review for network intrusion detection system (IDS)
Abdulganiyu, O. H., Ait Tchakoucht, T., & Saheed, Y. K. (2023) · International Journal of Information Security · doi:10.1007/s10207-023-00682-2 · Cited by 279 · see citing works
SecureBERT: A Domain-Specific Language Model for Cybersecurity
Aghaei, E., Niu, X., Shadid, W., & Al-Shaer, E. (2023) · Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-031-25538-0_3 · Cited by 210 · see citing works
Intrusion Detection Method Using Bi-Directional GPT for in-Vehicle Controller Area Networks
Nam, M., Park, S., & Kim, D. S. (2021) · IEEE Access · doi:10.1109/access.2021.3110524 · Cited by 81 · see citing works
Mulders, M. (2019) · Routledge eBooks · doi:10.4324/9781003022022-6 · Cited by 75 · see citing works
Korba, A. A., Boualouache, A., & Ghamri-Doudane, Y. M. (2024) · IEEE Transactions on Vehicular Technology · doi:10.1109/tvt.2024.3385916 · Cited by 66 · see citing works
Self-citationFog Computing-Based Intrusion Detection Architecture to Protect IoT Networks
Labiod, Y., Korba, A. A., & Ghoualmi‐Zine, N. (2022) · Wireless Personal Communications · doi:10.1007/s11277-022-09548-7 · Cited by 55 · see citing works
Self-citationVulDetect: A novel technique for detecting software vulnerabilities using Language Models
Omar, M., & Shiaeles, S. N. (2023) · IEEE International Conference on Cyber Security and Resilience (CSR) · doi:10.1109/csr57506.2023.10224924 · Cited by 54 · see citing works
Beyond Detection: Leveraging Large Language Models for Cyber Attack Prediction in IoT Networks
Diaf, A., Korba, A. A., Karabadji, N. E. I., & Ghamri-Doudane, Y. M. (2024) · International Conference on Distributed Computing in Smart Systems and the Internet of Things (DCOSS-IoT) · doi:10.1109/dcoss-iot61029.2024.00026 · Cited by 52 · see citing works
Self-citationTranalyzer: Versatile high performance network traffic analyser
Burschka, S., & Dupasquier, B. (2016) · IEEE Symposium Series on Computational Intelligence (SSCI) · doi:10.1109/ssci.2016.7849909 · Cited by 49 · see citing works
Federated Learning for Zero-Day Attack Detection in 5G and Beyond V2X Networks
Korba, A. A., Boualouache, A., Brik, B., Rahal, R., Ghamri-Doudane, Y. M., & Senouci, S. (2023) · International Conference on Communications · doi:10.1109/icc45041.2023.10279368 · Cited by 42 · see citing works
Self-citationMulti-agent Reinforcement Learning-based Network Intrusion Detection System
Tellache, A., Mokhtari, A., Korba, A. A., & Ghamri-Doudane, Y. M. (2024) · IEEE/IFIP Network Operations and Management Symposium (NOMS) · doi:10.1109/noms59830.2024.10575541 · Cited by 36 · see citing works
Self-citationLiu, J., Zhao, Y., Feng, Y., Hu, Y., & Ma, X. (2023) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2023.103690 · Cited by 29 · see citing works
A Life-long Learning Intrusion Detection System for 6G-Enabled IoV
Korba, A. A., Sebaa, S., Mabrouki, M., Ghamri-Doudane, Y. M., & Benatchba, K. (2024) · International Wireless Communications and Mobile Computing Conference (IWCMC) · doi:10.1109/iwcmc61514.2024.10592500 · Cited by 22 · see citing works
Self-citationKorba, A. A., Diaf, A., & Ghamri-Doudane, Y. M. (2024) · International Wireless Communications and Mobile Computing Conference (IWCMC) · doi:10.1109/iwcmc61514.2024.10592525 · Cited by 17 · see citing works
Self-citationVubangsi, M., Mangai, T. R., Olukayode, A., Mubarak, A. S., & Al-Turjman, F. M. (2024) · Elsevier eBooks · doi:10.1016/b978-0-443-13268-1.00021-2 · Cited by 6 · see citing works
BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding
Devlin, J., Chang, M.-W., Lee, K., & Toutanova, K. (2018) · arXiv · doi:10.48550/arxiv.1810.04805
Flagged first, then by citations
Cited by
Sorted by citations
Govindarajan, V., & Muzamal, J. H. (2025) · Scientific Reports · doi:10.1038/s41598-025-07956-w · Cited by 46 · see citing works
A Comprehensive Survey on LLM‐Based Network Management and Operations
Hong, J., Tu, N. V., & Hong, J. W. (2025) · International Journal of Network Management · doi:10.1002/nem.70029 · Cited by 27 · see citing works
From Edge Transformer to IoT Decisions: Offloaded Embeddings for Lightweight Intrusion Detection
Adjewa, F., Esseghir, M., & Merghem-Boulahia, L. (2026) · Sensors · doi:10.3390/s26020356 · Cited by 23 · see citing works
Mitigating IoT botnet attacks: An early-stage explainable network-based anomaly detection approach
Korba, A. A., Diaf, A., Bouchiha, M. A., & Ghamri-Doudane, Y. M. (2025) · Computer Communications · doi:10.1016/j.comcom.2025.108270 · Cited by 19 · see citing works
Self-citationA Vulnerable-by-Design IoT Sensor Framework for Cybersecurity in Smart Agriculture
Pașca, E. M., Delinschi, D., Erdei, R., Bărăian, I., & Matei, O. (2025) · Agriculture · doi:10.3390/agriculture15121253 · Cited by 17 · see citing works
Garg, S., Goyal, S., & Bhandari, A. (2025) · Scientific Reports · doi:10.1038/s41598-025-19989-2 · Cited by 12 · see citing works
Kumar, A., Salim, M. M., Camacho, D., & Park, J. H. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111379 · Cited by 12 · see citing works
Transformers model for DDoS attack detection: A survey
Farias, E. P., de Neira, A. B., Borges, L. F., & Nogueira, M. (2025) · Computer Networks · doi:10.1016/j.comnet.2025.111433 · Cited by 12 · see citing works
Jamshidi, S., Shahabi, N., Nikanjam, A., Nafi, K. W., Khomh, F., & Fung, C. (2025) · Internet of Things · doi:10.1016/j.iot.2025.101735 · Cited by 11 · see citing works
Upender, T., Neelakantappa, M., Rao, C. S., Gera, J., Reddy, V. L., & Yamsani, N. (2025) · Scientific Reports · doi:10.1038/s41598-025-24459-w · Cited by 9 · see citing works
Siam, A. A., Faruqui, N., Azad, A. K. M., & Moni, M. A. (2026) · Expert Systems · doi:10.1111/exsy.70217 · Cited by 9 · see citing works
ChatIot: Large Language Model-Based Security Assistant for Internet of Things with RAG
Dong, Y. H., Aung, Y. L., Chattopadhyay, S., & Zhou, J. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-32578-5_4 · Cited by 9 · see citing works
A survey of foundation models for IoT: taxonomy and criteria-based analysis
Wei, H., Lee, D. Y., Rohal, S., Hu, Z., Rossi, R. A., Fang, S., & Pan, S. (2025) · CCF Transactions on Pervasive Computing and Interaction · doi:10.1007/s42486-025-00208-w · Cited by 8 · see citing works
Nageshwaran, V., & Ezekiel, S. (2026) · Electronics · doi:10.3390/electronics15122740 · Cited by 4 · see citing works
“BARTPredict achieves 98% accuracy in predicting IoT attacks on the BoT-IoT benchmark (80/20 stratified train/test split as reported in the primary study) by fine-tuning a BART encoder on temporal traffic sequences [71].”
InfluentialJoshi, A., & Baidya, S. (2026) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp6020063 · Cited by 4 · see citing works
LLM-Driven Approach for Safe and Secure Network Management by Design in IoT-Based Systems
Petrović, N., Krstic, D. S., & Głąbowski, M. (2026) · Symmetry · doi:10.3390/sym18020337 · Cited by 4 · see citing works
Houache, M., Boubiche, D. E., Toral-Cruz, H., Martínez-Peláez, R., & Sánchez‐Lara, R. (2026) · AI · doi:10.3390/ai7050179 · Cited by 4 · see citing works
ModernBERT-DoS: Transformer-Based Multi-Class Network Traffic Classifier for DDoS Detection
Lira, O. G., Marroquín, A., & To, M. A. (2025) · IEEE Latin-American Conference on Communications · doi:10.1109/latincom67778.2025.11345413 · Cited by 3 · see citing works
CRISP: Cyber-Resilient Intelligent Systems for Predicting Threats in Digital Ecosystems
Verma, P., Lemley, J., Schukat, M., O’Shea, D., & Newe, T. (2026) · IEEE Access · doi:10.1109/access.2026.3658507 · Cited by 2 · see citing works
User-Centric Phishing Detection: A RAG and LLM-Based Approach
Barwani, A. H. A., Korba, A. A., & Anwar, R. W. (2026) · International Conference on Consumer Electronics · doi:10.1109/icce67443.2026.11449651 · Cited by 2 · see citing works
Self-citationOwusu, E., Rahouti, M., Verma, D. C., Xin, Y., Hsu, D. F., & Schweikert, C. (2025) · ACM Transactions on Privacy and Security · doi:10.1145/3749374 · Cited by 1 · see citing works
Shahraeeni, A., Kaur, R., Kochari, A., Mohammadi, F. A., & Asad, A. (2025) · ACIS International Conference on Software Engineering, Artificial Intelligence, Networking and Parallel/Distributed Computing (SNPD) · doi:10.1109/snpd65828.2025.11252601
НАДТОЧИЙ, М., БАЛАГУРА, Д., Шулік, П. В., & Просолов, В. В. (2025) · Herald of Khmelnytskyi National University Technical sciences · doi:10.31891/2307-5732-2025-359-7
A Comparative Analysis of LLM-Based AI Assistants in Developing and Troubleshooting IoT Systems
Berrouyne, I., & Adda, M. (2026) · Lecture notes on data engineering and communications technologies · doi:10.1007/978-3-032-23271-7_33
LLM-Based Intrusion and Anomaly Detection for IoT Networks: A Systematic Survey
Vítek, S. (2026) · IEEE Internet of Things Journal · doi:10.1109/jiot.2026.3714987
Willson Joseph, C., Radhakrishnan, V., Tharageswari, K., Aruna, S., Anirudh, N. M., & Keerthana, N. V. (2026) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-2600-3280-0.ch002
Korba, A. A., & Anwar, R. W. (2026) · International Conference on Electronic Information Technology and Computer Engineering (EITCE) · doi:10.1109/eitce70137.2026.11634545
Self-citationDiaf, A., Korba, A. A., Jaafar, W., Karabadji, N. E. I., & Ghamri-Doudane, Y. M. (2026) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2026.3725365
Self-citationWhen Will the Next Attack Start? Calibrated Time-Window Prediction Using Multi-Agent LLMs
Kalari, S., Lokesh, M., & Mukkamala, R. (2026) · International Conference on Intelligent Digitization of Systems and Services (IDSS) · doi:10.1109/idss69894.2026.11691499
- Authors
- Diaf, A., Korba, A. A., Elislem Karabadji, N., & Ghamri-Doudane, Y.
- Affiliations
- Badji Mokhtar-Annaba University (DZ)
- National Higher School of Technology and Engineering,Annaba,Algeria
- La Rochelle Université (FR)
- Venue
- GLOBECOM 2024 - 2024 IEEE Global Communications Conference
- Publisher
- IEEE
- Published
- 2024-12-08
- Pages
- 1239-1244
- ISSN
- 1930-529X (ISSN-L)
- OpenAlex
- W4408324826
- Cited by
- 28
- References
- 21
- Citations by year
- 2026: 15 · 2025: 13
- FWCI
- 12.23
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- Globecom (publishedVersion)
- arXiv (Cornell University) (submittedVersion, cc-by)
- arXiv (Cornell University) (cc-by)
- Funders
- Agence Nationale de la Recherche (ANR-20-CE25-0015)
- Fonds National de la Recherche Luxembourg (14891397)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- Internet of Things security, cyberattack prediction, intrusion detection, large language models, BART, BERT, network traffic prediction, malicious packet detection, CICIoT2023
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
