用大模型构建智能代理，全面解析物联网流量异常。
An LLM-Powered AI Agent Framework for Holistic IoT Traffic Interpretation
- 基于大模型的智能代理，融合多层分析与检索增强问答。
- 混合检索策略使生成结果在多项指标上显著提升。
- 轻量部署适合实际系统，兼顾准确率与效率。
物联网网络产生多样且高流量的数据，反映正常行为与潜在威胁。仅靠孤立检测难以获取深层洞察，需跨层分析行为、协议和上下文。本文提出一个基于大语言模型的AI代理框架，将原始数据包捕获转化为结构化、语义丰富的表示，支持交互式分析。该框架整合特征提取、基于Transformer的异常检测、数据包与流摘要、威胁情报增强及检索增强问答。由大模型驱动的智能体对索引的流量数据进行推理，聚合证据生成准确且可读的解释。在多个物联网数据集和六种开源模型上的实验表明，结合词法与语义搜索并经过重排序的混合检索策略，显著提升了BLEU、ROUGE、METEOR和BERTScore等指标。系统性能评估显示其在CPU、GPU和内存占用方面开销极低，证明了该框架在实现全面高效物联网流量解析方面的可行性。
原文摘要 · Abstract (English)
Internet of Things (IoT) networks generate diverse and high-volume traffic that reflects both normal activity and potential threats. Deriving meaningful insight from such telemetry requires cross-layer interpretation of behaviors, protocols, and context rather than isolated detection. This work presents an LLM-powered AI agent framework that converts raw packet captures into structured and semantically enriched representations for interactive analysis. The framework integrates feature extraction, transformer-based anomaly detection, packet and flow summarization, threat intelligence enrichment, and retrieval-augmented question answering. An AI agent guided by a large language model performs reasoning over the indexed traffic artifacts, assembling evidence to produce accurate and human-readable interpretations. Experimental evaluation on multiple IoT captures and six open models shows that hybrid retrieval, which combines lexical and semantic search with reranking, substantially improves BLEU, ROUGE, METEOR, and BERTScore results compared with dense-only retrieval. System profiling further indicates low CPU, GPU, and memory overhead, demonstrating that the framework achieves holistic and efficient interpretation of IoT network traffic.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。