An AI powered, proactive security framework for IoT threat detection and response

Abstract

The rapid expansion of Internet of Things (IoT) networks has introduced unprecedented connectivity and functionality across domains, but it has also exposed systems to increasingly sophisticated and evolving cyber threats. Traditional intrusion detection systems (IDS) are often inadequate for handling the complexity of modern attacks, creating an urgent need for intelligent, interpretable, and adaptive security solutions. This PhD research presents a novel Artificial Intelligence (AI)-driven security framework for automated threat detection and response in IoT environments. The framework integrates explainable artificial intelligence (XAI), neurosymbolic learning, structured cybersecurity domain knowledge, large language models (LLMs), and automated threat intelligence to address the limitations of conventional intrusion detection systems. Initial experimentation employed deep autoencoders for anomaly detection, augmented with XAI techniques such as SHapley Additive exPlanations (SHAP) to interpret feature contributions. This yielded 84% accuracy for benign traffic and 100% for attack traffic using the USB-IDS dataset, while enhancing transparency by reducing dependence on black-box models. Subsequently, an ensemble learning approach combining autoencoders with gradient boosting (XGBoost) was introduced, achieving 99.92% accuracy on the CIC-IDS2017 dataset. Feature selection based on importance scores enabled computational efficiency without compromising performance. A key innovation of this research lies in the integration of neurosymbolic learning, where neural pattern recognition is fused with symbolic reasoning grounded in cybersecurity domain knowledge. A custom cybersecurity knowledge graph maps detected anomalies to the CIA triad (Confidentiality, Integrity, Availability) and aligns them with the MITRE ATT&CK framework. This alignment supports structured threat interpretation and mitigation strategy generation. Furthermore, LLMs such as GPT-4 are employed in a retrieval-augmented generation (RAG) pipeline to produce human-readable explanations of threats and suggest context-aware countermeasures. Through this hybrid and explainable approach, the system achieved 97% accuracy in anomaly detection and 100% accuracy in mapping threats to MITRE ATT&CK tactics and techniques. It also significantly reduced false positives and analyst workload while enabling real-time, scalable, and interpretable threat response in dynamic IoT ecosystems. This research contributes a next-generation cybersecurity solution that bridges the gap between complex AI models and domain-specific expertise. It establishes a robust and adaptive security foundation for protecting IoT infrastructures against current and emerging cyber threats.