Agentic AI at the Edge: Self-Explaining Autonomous Framework for IoT Incident Response
TL;DR
A fully local, autonomous incident-response framework for edge gateways that combines a compact classifier that routes traffic by confidence, a tool-using language-model agent restricted to vetted mitigation actions, and an Explanation Engine grounded in the agent's recorded observations is presented.
Abstract
Incident response in Internet of Things (IoT) environments is difficult because devices are resource-constrained, visibility is limited, and remediation requires both contextual reasoning and explainable decisions. We present a fully local, autonomous incident-response framework for edge gateways. It combines a compact classifier that routes traffic by confidence, a tool-using language-model agent restricted to vetted mitigation actions, and an Explanation Engine grounded in the agent's recorded observations. Implemented with a 4-bit 3B model, the framework uses approximately 2.1,GB of memory and operates without cloud access. Evaluation on CIC IoT-DIAD 2024 shows that the detector achieves a weighted F1 score of 0.74 while limiting LLM-based triage to 30% of flows. The response agent selects appropriate mitigations in 92.4% of evaluated incidents, and its explanations achieve 0.99 faithfulness to the decision trace. These results demonstrate that autonomous, auditable IoT incident response is feasible within an edge-class resource budget.
