END-TO-END METHODS OF LARGE LANGUAGE MODELS USAGE FOR PROACTIVE CYBER INTELLIGENCE IN IOT/EDGE INFRASTRUCTURES

Abstract

The rapid expansion of Internet of Things (IoT) networks and distributed edge computing, coupled with the increasing sophistication of cyber threats, has rendered traditional reactive security systems inadequate against targeted attacks and zero-day threats. This article aims to substantiate the architecture of an end-to-end framework and methods for utilizing Large Language Models (LLMs) in cyber threat intelligence to transition from traditional reactive defence to a proactive, context-aware security paradigm across distributed and enterprise IT infrastructures. The study proposes a three-tier ecosystem architecture within which the covered methods function as its specialized subcomponents: contextual anomaly detection in the network and system behavior of IoT/Edge devices; proactive prediction of the next packet and network activity type; extraction and classification of Indicators of Compromise (IoCs); attribution of threat actors and Tactics, Techniques, and Procedures (TTPs); vulnerability prioritization based on CVSS and EPSS metrics; and the correlation of cyberattacks and campaigns. For each method, the paper describes the theoretical model and the LLM integration approach (in-context learning, fine-tuning, RAG) and presents empirical results from analyzed sources. The tiers of the proposed architecture (strategic, synchronization, and operational levels) unite the considered methods into a single proactive cyber intelligence cycle. Additionally, the study identifies key constraints for practical implementation, such as the high resource demands of LLMs on edge devices, temporal asynchrony between edge and cloud layers, the risk of cascading error propagation, and the lack of unified semantic standards for communicating the models' probabilistic inferences.