Network behavior twin-driven traffic anomaly detection for the Internet of things

To overcome the limitations of existing Internet of things (IoT) traffic anomaly detection methods, which predominantly rely on machine or deep learning algorithms and thus incur high resource consumption and frequent false positives, a novel detection framework based on the network behavioral twin was proposed. The proposed method harnessed large language model (LLM) to automatically extract network interaction rules from device source code, thereby constructing a digital twin that accurately mirrors the IoT device’s network behavior. This digital twin was employed to simulate the device’s legitimate network activities in real time, enabling precise and efficient detection of anomalous traffic. Experimental results demonstrate that the proposed method significantly outperforms existing detection methods in detection tasks under typical scenarios, such as denial of service (DoS) attacks, command and control (C&C) communication, and intranet scanning. Meanwhile, compared with the latest pre-trained model TrafficFormer, the model size is reduced from 682 MB to 17 KB, and the computation and storage resource consumption are reduced by 85.44% and 94.06%, respectively. By combining high detection accuracy with exceptional computational efficiency, the proposed method is well-suited for resource-constrained IoT environments and establishes a new approach of dynamic, cyber-physical protection in IoT network security.