Extending SOC Capabilities to LoRaWAN: A Cloud-Integrated Intrusion Detection Framework for IoT Networks

The rapid expansion of LoRaWAN-based IoT deployments in critical infrastructure, industrial environments, and smart city applications introduces novel cybersecurity challenges that traditional IT security architectures are neither optimized for nor capable of fully addressing.In this paper, we present a stateful, protocol-aware intrusion detection architecture specifically tailored for LoRaWAN communication, with seamless integration into existing Security Operations Center (SOC) frameworks.Our approach identifies key monitoring points along the communication chain and implements a multistage telemetry pipeline that supports protocol-level analysis -even for encrypted traffic.The system successfully detects complex attack scenarios, including man-in-the-middle payload tampering and decryption attacks, validating the framework's effectiveness in practical conditions.The proposed methodology bridges a crucial gap between IoT-specific anomaly detection and enterprise-grade SOC capabilities, offering a scalable and transferable solution for extending cybersecurity visibility into low-power, protocolconstrained networks.Our results highlight both the feasibility and the strategic importance of integrating LoRaWAN telemetry into unified threat detection pipelines.