Automated IoT Threat Monitoring & Mitigation using Tiny LLMs

Abstract

Traditional IoT Intrusion Detection Systems (IDS) lack semantic understanding and provide no automated response. We fine-tune three Tiny LLMs—Qwen3-4B, Gemma-3-270M, and Phi-3-mini—on the Edge-IIoTset dataset for simultaneous multi-class threat classification and MITRE CAPEC-aligned mitigation generation. Fine-tuned models achieve 100% binary accuracy and up to 76.93% on 15-class detection, surpassing XGBoost (53.56%) by over 23 points and matching prior LLM work at a smaller model size. Gemma-3-270M reaches only 45.4% multiclass accuracy despite perfect binary performance, establishing a 270M-parameter lower bound for complex semantic reasoning. All models deploy within IoT gateway hardware budgets, demonstrating Tiny LLMs as practical autonomous security agents.