Research Projects

Rationale: The rapid growth of the Internet of Things (IoT) in critical domains (smart homes, healthcare, vehicles, etc.) has led to an explosion of data and new security challenges. Traditional IoT security solutions struggle with scalability, privacy, and real-time threat detection. Networks of IoT devices produce high-volume, heterogeneous data that is difficult to centrally collect and analyse due to bandwidth, latency, and privacy constraints. This research proposes a novel hybrid intrusion detection and analysis framework that leverages Large Language Models (LLMs) alongside lightweight on-device models to address these challenges. The core hypothesis is that combining small, edge-based anomaly detectors with the contextual understanding of a large LLM (in a cloud or server) will enable accurate, real-time detection of IoT security threats while preserving data privacy. Scientific Objectives: - Employ LLMs for contextual reasoning on IoT device data, enabling the system to autonomously interpret unstructured inputs and detect anomalous behaviours or cyber-attacks in real-time. - Leverage Federated Learning (FL) across distributed IoT devices to collaboratively train security models without centralized raw data, preserving privacy and reducing communication overhead while continuously adapting to new threats. - Incorporate cognitive computing modules that mimic human reasoning to provide contextual intrusion analysis, refining model predictions to reduce false alarms and improve decision reliability during attack. - Design a hybrid edge–cloud architecture that distributes AI workloads, allowing low-latency threat detection on IoT edge devices while ofloading intensive analytics to the cloud for global security intelligence – ensuring scalable, efficient protection across heterogeneous IoT networks. Key Experiments: - Evaluate the framework on multiple real-world IoT security datasets across domains – e.g., IoT-23 Network Security Dataset, CICIoT2023 or CICIoV2024 – to assess detection accuracy against a wide range of attack types and device behaviours. - Benchmark the system’s performance against state-of-the-art intrusion detection methods (classical ML and deep learning baselines), demonstrating improvements in detection rates, lower false alarm counts, and faster response times over existing solutions. - Deploy a prototype of the proposed solution in a hybrid edge–cloud testbed (with IoT edge devices and a cloud coordinator) to measure end-to-end performance (detection latency, throughput, energy usage). This validates that on-device processing enables real-time threat response while cloud coordination provides robust global learning. Expected Significance: - Improve the resilience of critical IoT-enabled infrastructures (from healthcare monitors and smart vehicles to smart city utilities) by autonomously thwarting cyber-attacks – preventing cascading failures or safety incidents in systems where reliability is paramount. - Surpass current security solutions by unifying generative AI and cognitive reasoning – yielding higher detection accuracy and significantly fewer false alarms than traditional IoT IDS approaches. - Enable wider adoption of AI-driven security in privacy-sensitive environments (e.g. medical IoT) by training models on-device via FL, so that sensitive data remains local. This approach meets data protection regulations while still pooling collective intelligence against threats. - Offer a practical and efficient defense, i.e., the edge–cloud synergy achieves real-time threat detection with reduced latency and energy consumption compared to centralized models, making it viable for resource-constrained IoT settings while maintaining high accuracy.