The rapid growth of Internet of Things (IoT) devices has increased the scale and diversity of cyberattacks, exposing limitations in traditional intrusion detection systems. Classical machine learning (ML) models such as Random Forest and Support Vector Machine perform well on known attacks but require retraining to detect unseen or zero-day threats. This study investigates lightweight decoder-only Large Language Models (LLMs) for IoT attack detection by integrating structured-to-text conversion, Quantized Low-Rank Adaptation (QLoRA) fine-tuning, and Retrieval-Augmented Generation (RAG). Network traffic features are transformed into compact natural-language prompts, enabling efficient adaptation under constrained hardware. Experiments on the CICIoT2023 dataset show that a QLoRA-tuned LLaMA-1B model achieves an F1-score of 0.7124, comparable to the Random Forest (RF) baseline (0.7159) for known attacks. With RAG, the system attains 42.63% accuracy on unseen attack types without additional training, demonstrating practical zero-shot capability. These results highlight the potential of retrieval-enhanced lightweight LLMs as adaptable and resource-efficient solutions for next-generation IoT intrusion detection.

翻译：物联网设备的快速增长扩大了网络攻击的规模和多样性，暴露出传统入侵检测系统的局限性。经典机器学习模型（如随机森林和支持向量机）对已知攻击表现良好，但需要重新训练才能检测未知或零日威胁。本研究通过整合结构化到文本转换、量化低秩自适应微调和检索增强生成技术，探索轻量级仅解码器大语言模型在物联网攻击检测中的应用。网络流量特征被转换为紧凑的自然语言提示，从而实现在受限硬件下的高效适配。在CICIoT2023数据集上的实验表明，经过QLoRA微调的LLaMA-1B模型在已知攻击检测中取得了0.7124的F1分数，与随机森林基线模型的0.7159性能相当。结合RAG技术后，该系统对未见攻击类型实现了42.63%的检测准确率，且无需额外训练，展现了实用的零样本检测能力。这些结果凸显了检索增强型轻量级LLM作为下一代物联网入侵检测的适应性强且资源高效的解决方案潜力。