•  
  •  
 

Abstract

The rapid expansion of the Internet of Things (IoT) has introduced significant cybersecurity challenges, particularly for resource-constrained devices that traditional intrusion detection systems often fail to protect effectively. This paper proposes a novel, two-phase autonomous security pipeline designed to bridge the gap between probabilistic threat detection and deterministic network enforcement. The framework first utilizes a custom Time Series Transformer (TST) to classify multivariate network traffic and identify specific attack vectors, such as ransomware, SQL injections, and malicious file uploads. In the second phase, an agentic AI layer, comprising a locally hosted Large Language Model (LLM) orchestrated via LangGraph, processes the TST’s output alongside network metadata. Guided by strict Zero-Trust heuristics, the LLM agent autonomously evaluates probabilistic confidence scores to generate technical justifications and precise countermeasures to mitigate identified threats in real time. Our proposed Agentic AI system demonstrates high detection accuracy for aggressive attack vectors and maintains a robust baseline for normal traffic, consistently achieving F1-scores of 80% or higher. By combining automated threat detection and incident response together, this research provides a scalable, explainable, and autonomous countermeasure generation system. This approach empowers IoT environments to move beyond simple anomaly detection toward immediate, automated defense, significantly enhancing the resilience of critical industrial infrastructures against an evolving landscape of sophisticated cyber threats.

DOI

https://doi.org/10.5038/2378-0789.9.1.1152

Download

Share

COinS