HyLLM-IDS: A Conceptual Hybrid LLM-Assisted Intrusion Detection Framework for Cyber-Physical Systems

The increasing complexity of cyberattacks on Cyber-Physical Systems (CPS) demands advanced intrusion detection strategies that can effectively interpret contextual threats. Conventional hybrid Intrusion Detection Systems (IDSs) suffer from outdated attack signature databases and limited attack insights. This paper proposes a conceptual work-in-progress framework for an advanced hybrid IDS assisted by Large Language Models (LLMs) with Retrieval-Augmented Generation (RAG) integration in CPS environments (e.g., industrial control systems, smart grids). Our framework combines signature-based and anomaly-based detection with an LLM-RAG threat analysis module to provide context-aware classification of network traffic events using domain-specific knowledge. We outline potential implementation challenges and propose preliminary mitigation strategies. Future work will focus on empirical validation through experimental evaluation.