@inproceedings{elhajjoutLeveragingLargeLanguage2026,

title = {Leveraging Large Language Models for Contextual Threat Hypothesis Generation in IoT Networks},

author = {A. Elhajjout and Z. Jarir and H. Moudoud and A. Davoust and Z. A. El Houda},

url = {https://www.scopus.com/pages/publications/105037351870?origin=resultslist},

doi = {10.1109/ICCE67443.2026.11449914},

isbn = {0747668X (ISSN); 979-833155343-2 (ISBN)},

year  = {2026},

date = {2026-01-01},

booktitle = {Dig Tech Pap IEEE Int Conf Consum Electron},

publisher = {Institute of Electrical and Electronics Engineers Inc.},

abstract = {Modern Security Operations Centers face numerous challenges in managing the volume and complexity of security alerts from Internet of Things (IoT) networks. While traditional rule-based systems excel at detection, they provide limited contextual reasoning to help analysts understand ambiguous alerts. Large Language Models (LLMs) have shown promise across various cybersecurity domains. However, their potential to generate rich, explanatory threat hypotheses for ambiguous IoT alerts remains largely unexplored. To address these issues, in this paper, we present a systematic investigation of Large Language Model-based threat hypothesis generation with three key contributions. First, we introduce a context-aware structured prompting framework capable of synthesizing heterogeneous device telemetry into coherent threat narratives. Second, we formalize the assessment of explainability in security through a rigorous multidimensional quality metric system. Third, we provide the first comparative analysis of five state-of-the-art models on real-world IoT incidents, revealing critical performance tradeoffs. Results show that GPT-4o-mini achieves 88.2% accuracy on diverse attack types, while Qwen 3-235B achieves 95.2% accuracy on network-focused attacks. Statistical analysis reveals significant model-dataset interactions. These findings show that properly guided Large Language Models can augment analyst capabilities by providing detailed, contextual explanations that facilitate efficient alert triage. © 2026 IEEE.},

note = {Journal Abbreviation: Dig Tech Pap IEEE Int Conf Consum Electron},

keywords = {Alert Triage, Cybersecurity, Hypotheses generation, Internet of thing security, Internet of things, IoT Security, Language model, Large datasets, Large language model, large language models, Network security, Prompt Engineering, Security alerts, Security operation center, Security Operations, Security systems, Threat Hypothesis Generation},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{soultanaAdaptiveHeterogeneousEnsemble2025,

title = {Adaptive Heterogeneous Ensemble Learning for Attack Detection in IoT Networks},

author = {O. A. Soultana and H. Moudoud},

url = {https://www.scopus.com/pages/publications/105033149093?origin=resultslist},

doi = {10.1109/SMC58881.2025.11343130},

isbn = {1062922X (ISSN); 979-833153358-8 (ISBN)},

year  = {2025},

date = {2025-01-01},

booktitle = {Conf. Proc. IEEE Int. Conf. Syst. Man Cybern.},

pages = {27–32},

publisher = {Institute of Electrical and Electronics Engineers Inc.},

abstract = {The proliferation of Internet of Things (IoT) devices has introduced significant security vulnerabilities, particularly in detecting zero-day attacks within highly dynamic and heterogeneous environments. Traditional machine learning models often fall short due to their static nature and computational demands. In this paper, we propose an adaptive ensemble learning framework that dynamically selects optimal detection models on a per-attack-class basis to improve detection accuracy while maintaining computational efficiency. Our approach combines multiple base classifiers (Random Forest, K-Nearest Neighbors, and Support Vector Machine) using ensemble techniques including bagging, boosting, and stacking. Ensemble techniques such as Bagging, Boosting, Voting, and Stacking. The key innovation lies in a class-aware model selection mechanism that identifies the most effective classifier-ensemble combination for each specific attack category, rather than applying a single model across all threat types. This targeted approach recognizes that different attack patterns exhibit distinct characteristics that may be better captured by different algorithmic approaches. Finally, we propose a decision-rule mechanism that selects the best-performing model for each attack class to improve detection accuracy. The proposed framework is evaluated through extensive experiments. The results show that our approach significantly enhances classification performance, especially for complex and rare attack types. © 2025 IEEE.},

note = {Journal Abbreviation: Conf. Proc. IEEE Int. Conf. Syst. Man Cybern.},

keywords = {Attack detection, Classification (of information), Computational efficiency, Detection accuracy, Ensemble learning, Ensemble techniques, Heterogeneous ensembles, Internet of thing security, Internet of things, Intrusion Detection, Intrusion-Detection, IoT Security, Learning systems, Nearest neighbor search, Security vulnerabilities, Stackings, Support vector machines, Zero-day attack, Zero-day detection},

pubstate = {published},

tppubtype = {inproceedings}

}