An intrusion-prevention framework that treats a stream of IoT network packets as a language: packet header fields are serialised into text, tokenised, and fed to a fine-tuned BART encoder-decoder that predicts the NEXT packet in the flow rather than classifying the current one. A separately fine-tuned BERT classifier then labels the predicted packet as benign or one of the attack families, so an attack can be flagged before its traffic actually arrives. The paper reports accuracy on the CICIoT2023 benchmark and argues the generator-plus-classifier pairing is what buys the lead time; the known failure mode is that the prediction quality degrades once the observed prefix is short or the attack family is absent from pre-training.
An intrusion detection system is reactive: it fires once a packet matching a malicious pattern has already arrived. BARTPredict asks whether the next packet can be predicted before it is sent, so tha…