{"id":"https://openalex.org/W7141527535","doi":"https://doi.org/10.1109/icce67443.2026.11449914","title":"Leveraging Large Language Models for Contextual Threat Hypothesis Generation in IoT Networks","display_name":"Leveraging Large Language Models for Contextual Threat Hypothesis Generation in IoT Networks","publication_year":2026,"publication_date":"2026-02-03","ids":{"openalex":"https://openalex.org/W7141527535","doi":"https://doi.org/10.1109/icce67443.2026.11449914"},"language":null,"primary_location":{"id":"doi:10.1109/icce67443.2026.11449914","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icce67443.2026.11449914","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 IEEE International Conference on Consumer Electronics (ICCE)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5130787252","display_name":"Abderrahman Elhajjout","orcid":null},"institutions":[{"id":"https://openalex.org/I119856527","display_name":"Cadi Ayyad University","ror":"https://ror.org/04xf6nm78","country_code":"MA","type":"education","lineage":["https://openalex.org/I119856527"]}],"countries":["MA"],"is_corresponding":true,"raw_author_name":"Abderrahman Elhajjout","raw_affiliation_strings":["Université Cadi Ayyad (UCA),Département d’informatique,Morocco"],"affiliations":[{"raw_affiliation_string":"Université Cadi Ayyad (UCA),Département d’informatique,Morocco","institution_ids":["https://openalex.org/I119856527"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5000776466","display_name":"Zahi Jarir","orcid":"https://orcid.org/0000-0002-6425-1031"},"institutions":[{"id":"https://openalex.org/I119856527","display_name":"Cadi Ayyad University","ror":"https://ror.org/04xf6nm78","country_code":"MA","type":"education","lineage":["https://openalex.org/I119856527"]}],"countries":["MA"],"is_corresponding":false,"raw_author_name":"Zahi Jarir","raw_affiliation_strings":["Université Cadi Ayyad (UCA),Département d’informatique,Morocco"],"affiliations":[{"raw_affiliation_string":"Université Cadi Ayyad (UCA),Département d’informatique,Morocco","institution_ids":["https://openalex.org/I119856527"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5027414521","display_name":"Hajar Moudoud","orcid":"https://orcid.org/0000-0003-2979-0862"},"institutions":[{"id":"https://openalex.org/I2799978770","display_name":"X-Fab (Germany)","ror":"https://ror.org/030bh9196","country_code":"DE","type":"company","lineage":["https://openalex.org/I2799978770"]},{"id":"https://openalex.org/I33217400","display_name":"Universit\u00e9 du Qu\u00e9bec en Outaouais","ror":"https://ror.org/011pqxa69","country_code":"CA","type":"education","lineage":["https://openalex.org/I33217400","https://openalex.org/I49663120"]}],"countries":["CA","DE"],"is_corresponding":false,"raw_author_name":"Hajar Moudoud","raw_affiliation_strings":["Université du Québec en Outaouais (UQO),Département d’informatique et d’ingénierie,Canada"],"affiliations":[{"raw_affiliation_string":"Université du Québec en Outaouais (UQO),Département d’informatique et d’ingénierie,Canada","institution_ids":["https://openalex.org/I33217400","https://openalex.org/I2799978770"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5055388091","display_name":"Alan Davoust","orcid":"https://orcid.org/0000-0002-3423-0942"},"institutions":[{"id":"https://openalex.org/I2799978770","display_name":"X-Fab (Germany)","ror":"https://ror.org/030bh9196","country_code":"DE","type":"company","lineage":["https://openalex.org/I2799978770"]},{"id":"https://openalex.org/I33217400","display_name":"Universit\u00e9 du Qu\u00e9bec en Outaouais","ror":"https://ror.org/011pqxa69","country_code":"CA","type":"education","lineage":["https://openalex.org/I33217400","https://openalex.org/I49663120"]}],"countries":["CA","DE"],"is_corresponding":false,"raw_author_name":"Alan Davoust","raw_affiliation_strings":["Université du Québec en Outaouais (UQO),Département d’informatique et d’ingénierie,Canada"],"affiliations":[{"raw_affiliation_string":"Université du Québec en Outaouais (UQO),Département d’informatique et d’ingénierie,Canada","institution_ids":["https://openalex.org/I33217400","https://openalex.org/I2799978770"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5130743790","display_name":"Zakaria Abou El Houda","orcid":null},"institutions":[{"id":"https://openalex.org/I39481719","display_name":"Institut National de la Recherche Scientifique","ror":"https://ror.org/04td37d32","country_code":"CA","type":"education","lineage":["https://openalex.org/I39481719","https://openalex.org/I49663120"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Zakaria Abou El Houda","raw_affiliation_strings":["Institut National de la Recherche Scientifique (INRS),Centre Énergie, Matériaux et Télécommunications (EMT),Canada"],"affiliations":[{"raw_affiliation_string":"Institut National de la Recherche Scientifique (INRS),Centre Énergie, Matériaux et Télécommunications (EMT),Canada","institution_ids":["https://openalex.org/I39481719"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5130787252"],"corresponding_institution_ids":["https://openalex.org/I119856527"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.9298181,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.16609999537467957,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.16609999537467957,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11714","display_name":"Multimodal Machine Learning Applications","score":0.1339000016450882,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.09520000219345093,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.3424000144004822},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.3334999978542328},{"id":"https://openalex.org/keywords/internet-of-things","display_name":"Internet of Things","score":0.33059999346733093},{"id":"https://openalex.org/keywords/field","display_name":"Field (mathematics)","score":0.322299987077713},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.2587999999523163}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6528000235557556},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.41440001130104065},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3424000144004822},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.3334999978542328},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.33059999346733093},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.322299987077713},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3066999912261963},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.2587999999523163},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.25850000977516174},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.2522999942302704}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/icce67443.2026.11449914","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icce67443.2026.11449914","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 IEEE International Conference on Consumer Electronics (ICCE)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":21,"referenced_works":["https://openalex.org/W2282821441","https://openalex.org/W2564147261","https://openalex.org/W2955014922","https://openalex.org/W2969468102","https://openalex.org/W3015471529","https://openalex.org/W3162956350","https://openalex.org/W3185341429","https://openalex.org/W4214917250","https://openalex.org/W4283313119","https://openalex.org/W4367309662","https://openalex.org/W4382281941","https://openalex.org/W4388419817","https://openalex.org/W4388666470","https://openalex.org/W4389673153","https://openalex.org/W4390561469","https://openalex.org/W4392575302","https://openalex.org/W4409045454","https://openalex.org/W4410973753","https://openalex.org/W4413222984","https://openalex.org/W4414594130","https://openalex.org/W4416723600"],"related_works":[],"abstract_inverted_index":{"Modern":[0],"Security":[1],"Operations":[2],"Centers":[3],"face":[4],"numerous":[5],"challenges":[6],"in":[7,71,115],"managing":[8],"the":[9,111,127],"volume":[10],"and":[11],"complexity":[12],"of":[13,18,79,99,113,131],"security":[14,116],"alerts":[15,63],"from":[16],"Internet":[17],"Things":[19],"(IoT)":[20],"networks.":[21],"While":[22],"traditional":[23],"rule-based":[24],"systems":[25],"excel":[26],"at":[27],"detection,":[28],"they":[29],"provide":[30,126],"limited":[31],"contextual":[32,185],"reasoning":[33],"to":[34,54],"help":[35],"analysts":[36],"understand":[37],"ambiguous":[38,61],"alerts.":[39],"Large":[40,80,175],"Language":[41,81,176],"Models":[42,177],"(LLMs)":[43],"have":[44],"shown":[45],"promise":[46],"across":[47],"various":[48],"cybersecurity":[49],"domains.":[50],"However,":[51],"their":[52],"potential":[53],"generate":[55],"rich,":[56],"explanatory":[57],"threat":[58,83,106],"hypotheses":[59],"for":[60],"IoT":[62,137],"remains":[64],"largely":[65],"unexplored.":[66],"To":[67],"address":[68],"these":[69],"issues,":[70],"this":[72],"paper,":[73],"we":[74,91,109,125],"present":[75],"a":[76,93,118],"systematic":[77],"investigation":[78],"Model-based":[82],"hypothesis":[84],"generation":[85],"with":[86],"three":[87],"key":[88],"contributions.":[89],"First,":[90],"introduce":[92],"context-aware":[94],"structured":[95],"prompting":[96],"framework":[97],"capable":[98],"synthesizing":[100],"heterogeneous":[101],"device":[102],"telemetry":[103],"into":[104],"coherent":[105],"narratives.":[107],"Second,":[108],"formalize":[110],"assessment":[112],"explainability":[114],"through":[117],"rigorous":[119],"multidimensional":[120],"quality":[121],"metric":[122],"system.":[123],"Third,":[124],"first":[128],"comparative":[129],"analysis":[130,164],"five":[132],"state-of-the-art":[133],"models":[134],"on":[135,150,160],"real-world":[136],"incidents,":[138],"revealing":[139],"critical":[140],"performance":[141],"tradeoffs.":[142],"Results":[143],"show":[144,171],"that":[145,172,187],"GPT-4o-mini":[146],"achieves":[147,157],"88.2%":[148],"accuracy":[149,159],"diverse":[151],"attack":[152],"types,":[153],"while":[154],"Qwen":[155],"3-235B":[156],"95.2%":[158],"network-focused":[161],"attacks.":[162],"Statistical":[163],"reveals":[165],"significant":[166],"model-dataset":[167],"interactions.":[168],"These":[169],"findings":[170],"properly":[173],"guided":[174],"can":[178],"augment":[179],"analyst":[180],"capabilities":[181],"by":[182],"providing":[183],"detailed,":[184],"explanations":[186],"facilitate":[188],"efficient":[189],"alert":[190],"triage.":[191]},"counts_by_year":[],"updated_date":"2026-03-29T06:01:01.467347","created_date":"2026-03-28T00:00:00"}