An LLM-Assisted AutoML Framework for Intrusion Detection in IoT Networks

Bounded LLM policies outperform traditional AutoML under low trial budgets

Li Yang· 2026· DOI 10.48550/arXiv.2609.23097

The core problem

Internet of Things (IoT) systems are increasingly deployed in smart homes, transportation, energy systems, and critical infrastructure. This broad connectivity improves service intelligence but also enlarges the attack surface of IoT networks. Machine Learning (ML)-based Intrusion Detection Systems (IDSs) are widely used to identify malicious network threats and protect IoT systems. However, developing effective ML-based IDS models often requires human expertise and repeated manual decisions on many procedures, including data pre-processing, feature selection, model selection, and hyperparameter tuning. Automated Machine Learning (AutoML) reduces this burden by automating steps of the ML pipeline using optimization techniques, but conventional AutoML methods can consume substantial optimization time because they explore broad candidate model families and large hyperparameter spaces. This paper proposes a Large Language Model (LLM)-assisted AutoML framework for IoT intrusion detection. The proposed framework uses an LLM as a policy generator that converts dataset profiles into bounded and validated AutoML policies for automated data balancing, automated feature engineering, and Comb

Under an equal 10-trial budget, the proposed LLM-assisted policy achieves higher weighted test F_{1} -score than traditional AutoML using the Tree-structured Parzen Estimator (TPE) on both datasets. Specifically, the proposed method reaches 99.680% on CICIDS2017 and 99.186% on IoTID20. Relative to the broader 30-trial Traditional AutoML-TPE baseline, the 10-trial proposed method reduces optimizer time by 63.7% and 49.9%, respectively, while achieving slightly higher F_{1} -score. These results demonstrate that a bounded LLM policy can improve the quality of a low-budget AutoML search while retaining a clear efficiency advantage relative to a larger conventional search budget. The table below summarizes the key outcomes: | Dataset | Method | Trials | F_{1} -score (%) | Optimizer Time Reduction (%) | |---------|--------|--------|--------------|-------------------------------| | CICIDS2017 | LLM-assisted AutoML | 10 | 99.680 | 63.7 (vs 30-trial TPE) | | CICIDS2017 | Traditional AutoML-TPE | 10 | Lower | - | | IoTID20 | LLM-assisted AutoML | 10 | 99.186 | 49.9 (vs 30-trial TPE) | | IoTID20 | Traditional AutoML-TPE | 10 | Lower | - |

Internet of Things (IoT) systems are increasingly deployed in smart homes, transportation, energy systems, and critical infrastructure. This broad connectivity improves service intelligence but also enlarges the attack surface of IoT networks. Machine Learning (ML)-based Intrusion Detection Systems (IDSs) are widely used to identify malicious network threats and protect IoT systems. However, developing effective ML-based IDS models often requires human expertise and repeated manual decisions on many procedures, including data pre-processing, feature selection, model selection, and hyperparameter tuning. Automated Machine Learning (AutoML) reduces this burden by automating steps of the ML pipeline using optimization techniques, but conventional AutoML methods can consume substantial optimization time because they explore broad candidate model families and large hyperparameter spaces. This paper proposes a Large Language Model (LLM)-assisted AutoML framework for IoT intrusion detection. The proposed framework uses an LLM as a policy generator that converts dataset profiles into bounded and validated AutoML policies for automated data balancing, automated feature engineering, and Combined Algorithm Selection and Hyperparameter Optimization (CASH).

The proposed framework employs an LLM as a policy generator that takes dataset profiles as input and outputs bounded and validated AutoML policies. These policies govern three key stages: automated data balancing, automated feature engineering, and Combined Algorithm Selection and Hyperparameter Optimization (CASH). The LLM generates policies that are constrained to a predefined search space, ensuring that the resulting configurations are valid and executable. The framework is evaluated on two datasets: CICIDS2017 and IoTID20. The performance is compared against traditional AutoML using the Tree-structured Parzen Estimator (TPE) under an equal 10-trial budget. Additionally, a broader 30-trial Traditional AutoML-TPE baseline is used to assess efficiency gains. The optimization process can be formalized as finding a policy π that maximizes the expected F_{1} -score:

The results indicate that leveraging an LLM to generate bounded AutoML policies can significantly enhance the efficiency and effectiveness of intrusion detection model development for IoT networks. By constraining the search space through validated policies, the LLM-assisted approach avoids the extensive exploration typical of traditional AutoML methods, leading to faster optimization without sacrificing performance. The higher F_{1} -scores achieved under a low trial budget suggest that the LLM's ability to incorporate domain knowledge and dataset characteristics into policy generation is beneficial. Furthermore, the substantial reduction in optimizer time compared to a 30-trial baseline highlights the practical advantage of the proposed method, especially in resource-constrained environments. However, the study is limited to two datasets and a specific LLM; future work could explore broader datasets and different LLMs. Overall, the framework presents a promising direction for automating IoT intrusion detection with reduced human expertise and computational cost.

CS practitioners and researchers

Opening member content…