A Deployment-Oriented Framework for Explainable AI-Assisted eBPF/XDP Mitigation at the IoT Edge

• URL: http://arxiv.org/abs/2606.10508v2
• Date: Wed, 10 Jun 2026 03:56:48 GMT
• Title: A Deployment-Oriented Framework for Explainable AI-Assisted eBPF/XDP Mitigation at the IoT Edge
• Abstract summary: This article presents a conceptual framework and research agenda for a Linux-based IoT edge gateway.<n>It combines resource-aware flow-level AI-assisted risk scoring, event-level explainability, and bounded mitigation through eBPF/XDP.<n>It also defines a future hardware-aware evaluation pathway covering detection quality, resource cost, response timing, rollback behaviour, and legitimate-traffic preservation.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Internet of Things (IoT) deployments combine heterogeneous, resource-constrained devices with weak security configurations, exposed services, limited logging, patching constraints, and long lifecycles. Signature- and threshold-based controls remain useful baselines, but they are insufficient as standalone mechanisms in dynamic IoT networks. Likewise, offline artificial intelligence (AI) benchmark performance alone does not establish operational deployability. This article presents a conceptual framework and research agenda for a Linux-based IoT edge gateway that combines resource-aware flow-level AI-assisted risk scoring, event-level explainability, and bounded mitigation through eBPF/XDP. The controller applies reversible, time-limited actions subject to critical-device safeguards, updates packet-level enforcement state, and records structured logs. The architecture separates complex reasoning and policy control in user space from concise packet-handling decisions in the kernel. It also defines a future hardware-aware evaluation pathway covering detection quality, resource cost, response timing, rollback behaviour, and legitimate-traffic preservation. The paper does not report new experimental measurements or claim measured superiority or completed real-time performance.

Related papers

• Diffusion Language Models for Mobile Edge Agentic AI: Foundations, Applications, and Challenges [58.887152635127165]
  Diffusion language models (DLMs) offer a non-autoregressive alternative for mobile edge agentic artificial intelligence (AI)<n>DLMs can update multiple uncertain tokens in parallel and exploit bidirectional context throughout the generation process.<n>This survey reviews DLM foundations and analyzes their suitability for edge settings under latency, memory, energy, bandwidth, privacy, and reliability constraints.
  arXiv  Detail & Related papers  (2026-09-04T06:16:49Z)
• CRAWO: Custom Resources for Adaptive Workload Orchestration [0.08910173568215411]
  This paper introduces CRAWO, an architectural framework for coordinating AI pipelines across distributed edge environments.<n>The framework incorporates a hardware-aware allocator with a pluggable multi-criteria decision layer that enables adaptive workload placement.
  arXiv  Detail & Related papers  (2026-06-08T15:45:03Z)
• Toward a Modular Architecture for Embedded AI Agent Systems at the Edge [0.0]
  This paper proposes a modular reference architecture for embedded agent systems.<n>We introduce a tiered design that decouples On-Device Agents and Cloud-Augmented Agents.<n>A key contribution is the integration of a cross-cutting Governance Layer.
  arXiv  Detail & Related papers  (2026-06-01T20:24:18Z)
• SECUREVENT: Hybrid AI/ML Security Monitoring for Distributed Event-Based Systems [0.8557392136621891]
  This paper proposes SECUREVENT, a hybrid AI/ML security-monitoring architecture for distributed event-based systems.<n>The architecture combines traditional protections such as authenticated transport, topic-level authorization, and signed events with online anomaly detection, graph-aware behavioral features, complex-event policy rules, federated learning, and adversarial-ML governance.
  arXiv  Detail & Related papers  (2026-06-01T06:04:16Z)
• Intent-based Security Management Using the TM Forum TR292I Security Ontology [0.0]
  This paper presents a declarative, autonomous, self-protecting framework based on our design and standardization of the TM Forum TR292I Security Ontology v4.0.0.<n>Our approach leverages Description Logic (DL) and automated graph reasoning within a closed-loop execution pipeline to dynamically neutralize live threats.<n>We validate our model-driven architecture through a structural formal verification walkthrough of a distributed Denial of Service (DDoS) attack mitigation sequence on a disaggregated Next-Generation NodeB slice, demonstrating how automated reasoning resolves runtime constraint conflicts without human intervention.
  arXiv  Detail & Related papers  (2026-05-26T22:35:01Z)
• Adaptive RAN Slicing Control via Reward-Free Self-Finetuning Agents [26.34195733862222]
  We propose a novel self-finetuning framework that enables agentic systems to learn continuously through direct interaction with the environment.<n>Our framework implements a bi-perspective reflection mechanism that generates autonomous linguistic feedback to construct preference datasets from interaction history.<n>A subsequent preference-based fine-tuning process distills long-horizon experiences into the model's parameters.<n> Experimental results show that our framework outperforms standard Reinforcement Learning (RL) baselines and existing Large Language Model (LLM)-based agents in sample efficiency, stability, and multi-metric optimization.
  arXiv  Detail & Related papers  (2026-03-11T09:14:56Z)
• SBOMs into Agentic AIBOMs: Schema Extensions, Agentic Orchestration, and Reproducibility Evaluation [11.812618112854116]
  Software supply-chain security requires provenance mechanisms that support and vulnerability assessment under dynamic execution conditions.<n>This paper introduces agentic Artificial Intelligence Bills of Materials (AIBOMs)<n>We present an agentic AIBOM framework based on a multi-agent architecture comprising (i) a baseline environment reconstruction agent (MCP), (ii) a runtime dependency and drift-monitoring agent (A2A), and (iii) a policy-aware vulnerability and VEX reasoning agent (AGNTCY)
  arXiv  Detail & Related papers  (2026-03-09T19:11:45Z)
• Toward Autonomous O-RAN: A Multi-Scale Agentic AI Framework for Real-Time Network Control and Management [39.17062930275755]
  This article proposes a multi-scale agentic AI framework for Open Radio Access Networks (O-RAN)<n>It organizes RAN intelligence as a coordinated hierarchy across the Non-Real-Time (Non-RT), Near-Real-Time (Near-RT), and Real-Time (RT) control loops.<n>We show how these agents cooperate through standardized O-RAN interfaces and telemetry.
  arXiv  Detail & Related papers  (2026-02-15T12:34:01Z)
• AJAR: Adaptive Jailbreak Architecture for Red-teaming [1.356919241968803]
  AJAR is a proof-of-concept framework designed to bridge the gap between "red-teaming" and "action security"<n>AJAR decouples adversarial logic from the execution loop, encapsulating state-of-the-art algorithms like X-Teaming as standardized, plug-and-play services.<n> AJAR is open-sourced to facilitate the standardized, environment-aware evaluation of this emerging attack surface.
  arXiv  Detail & Related papers  (2026-01-16T03:30:40Z)
• CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents [60.98294016925157]
  AI agents are vulnerable to prompt injection attacks, where malicious content hijacks agent behavior to steal credentials or cause financial loss.<n>We introduce Single-Shot Planning for CUAs, where a trusted planner generates a complete execution graph with conditional branches before any observation of potentially malicious content.<n>Although this architectural isolation successfully prevents instruction injections, we show that additional measures are needed to prevent Branch Steering attacks.
  arXiv  Detail & Related papers  (2026-01-14T23:06:35Z)
• eBPF-PATROL: Protective Agent for Threat Recognition and Overreach Limitation using eBPF in Containerized and Virtualized Environments [0.23332469289621782]
  eBPF-PATROL is a lightweight runtime security agent that monitors and enforces policies in containerized environments.<n>eBPF-PATROL detects and prevents real-time boundary violations, such as reverse shells, privilege escalation, and container escape attempts.
  arXiv  Detail & Related papers  (2025-11-22T18:51:36Z)
• A Federated Fine-Tuning Paradigm of Foundation Models in Heterogenous Wireless Networks [43.049216349313575]
  Edge devices switch to LoRA modules dynamically for federated fine-tuning with base station to jointly mitigate the impact of heterogeneous transmission.<n>An online optimization algorithm is developed to solve problems with computational complexity.<n>The simulation results on the SST-2 and QNLI data sets demonstrate the performance gains in test accuracy and energy efficiency.
  arXiv  Detail & Related papers  (2025-09-05T06:38:36Z)
• DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents [52.92354372596197]
  Large Language Models (LLMs) are increasingly central to agentic systems due to their strong reasoning and planning capabilities.<n>This interaction also introduces the risk of prompt injection attacks, where malicious inputs from external sources can mislead the agent's behavior.<n>We propose a Dynamic Rule-based Isolation Framework for Trustworthy agentic systems, which enforces both control and data-level constraints.
  arXiv  Detail & Related papers  (2025-06-13T05:01:09Z)
• Artificial Intelligence Empowered Multiple Access for Ultra Reliable and Low Latency THz Wireless Networks [76.89730672544216]
  Terahertz (THz) wireless networks are expected to catalyze the beyond fifth generation (B5G) era. To satisfy the ultra-reliability and low-latency demands of several B5G applications, novel mobility management approaches are required. This article presents a holistic MAC layer approach that enables intelligent user association and resource allocation, as well as flexible and adaptive mobility management.
  arXiv  Detail & Related papers  (2022-08-17T03:00:24Z)
• Safe RAN control: A Symbolic Reinforcement Learning Approach [62.997667081978825]
  We present a Symbolic Reinforcement Learning (SRL) based architecture for safety control of Radio Access Network (RAN) applications. We provide a purely automated procedure in which a user can specify high-level logical safety specifications for a given cellular network topology. We introduce a user interface (UI) developed to help a user set intent specifications to the system, and inspect the difference in agent proposed actions.
  arXiv  Detail & Related papers  (2021-06-03T16:45:40Z)
• Towards AIOps in Edge Computing Environments [60.27785717687999]
  This paper describes the system design of an AIOps platform which is applicable in heterogeneous, distributed environments. It is feasible to collect metrics with a high frequency and simultaneously run specific anomaly detection algorithms directly on edge devices.
  arXiv  Detail & Related papers  (2021-02-12T09:33:00Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.