The rapid expansion of IoT deployments has intensified cybersecurity threats, notably Distributed Denial of Service (DDoS) attacks, characterized by increasingly sophisticated patterns. Leveraging Generative AI through On-Device Large Language Models (ODLLMs) provides a viable solution for real-time threat detection at the network edge, though limited computational resources present challenges for smaller ODLLMs. This paper introduces a novel detection framework that integrates Chain-of-Thought (CoT) reasoning with Retrieval-Augmented Generation (RAG), tailored specifically for IoT edge environments. We systematically evaluate compact ODLLMs, including LLaMA 3.2 (1B, 3B) and Gemma 3 (1B, 4B), using structured prompting and exemplar-driven reasoning strategies. Experimental results demonstrate substantial performance improvements with few-shot prompting, achieving macro-average F1 scores as high as 0.85. Our findings highlight the significant advantages of incorporating exemplar-based reasoning, underscoring that CoT and RAG approaches markedly enhance small ODLLMs' capabilities in accurately classifying complex network attacks under stringent resource constraints.

翻译：物联网部署的快速扩张加剧了网络安全威胁，尤其是分布式拒绝服务（DDoS）攻击，其模式日益复杂。通过设备端大语言模型（ODLLM）利用生成式人工智能，为网络边缘的实时威胁检测提供了可行方案，但有限的计算资源对小型ODLLM构成了挑战。本文提出了一种新颖的检测框架，该框架将思维链（CoT）推理与检索增强生成（RAG）相结合，专为物联网边缘环境定制。我们系统评估了紧凑型ODLLM，包括LLaMA 3.2（1B, 3B）和Gemma 3（1B, 4B），使用了结构化提示和基于范例的推理策略。实验结果表明，少样本提示带来了显著的性能提升，宏平均F1分数最高可达0.85。我们的研究结果凸显了融入基于范例的推理的显著优势，表明CoT和RAG方法在严格资源限制下，能显著增强小型ODLLM准确分类复杂网络攻击的能力。