Zero-Trust Architecture for Securing IoT Edge Networks Against Advanced Persistent Threats
Ahmed Ramzi Rashid
Zaydon L. Ali Ahmed Sedeeq Baker Al-Doori
Aug 2026· Al-Noor Journal of Engineering Management and Computer Science· 0 citations· 7 references
TL;DR
These findings demonstrate that Edge-ZTA provides an efficient, privacy-preserving, and scalable cybersecurity framework capable of mitigating sophisticated multi-stage cyberattacks while satisfying the stringent performance requirements of next-generation Industrial IoT infrastructures.
Abstract
The rapid expansion of Internet of Things (IoT) edge networks has introduced significant cybersecurity challenges due to the increasing number of resource-constrained devices operating outside traditional security perimeters. Conventional perimeter-based defenses are inadequate against Advanced Persistent Threats (APTs), which exploit compromised edge devices through stealthy, multi-stage attacks involving reconnaissance, lateral movement, command-and-control communication, and data exfiltration. This study presents Edge-ZTA, a lightweight Zero-Trust Architecture specifically designed for securing Industrial IoT edge environments. The proposed framework integrates three complementary components: dynamic device identity verification based on trusted attestation and behavioral fingerprinting, continuous behavioral monitoring using a Federated Deep Autoencoder for privacy-preserving anomaly detection, and Software-Defined Networking (SDN)-based dynamic micro-segmentation for real-time isolation of compromised devices. A comprehensive hybrid experimental testbed comprising physical edge devices, virtualized nodes, and 500,000 network flow records derived from benchmark cybersecurity datasets was developed to evaluate the proposed architecture under realistic APT scenarios. Experimental results demonstrated a weighted macro-average F1-score of 97.1%, with detection rates of 98.9%, 97.9%, 96.8%, and 95.9% for reconnaissance, lateral movement, command-and-control, and exfiltration attacks, respectively. Furthermore, the decentralized edge-based policy decision mechanism maintained end-to-end latency below 50 ms, while CPU utilization remained below 17%, confirming the framework's suitability for resource-constrained IoT deployments. Scalability experiments involving up to 500 edge nodes further verified stable detection accuracy and predictable latency under heterogeneous operating conditions. These findings demonstrate that Edge-ZTA provides an efficient, privacy-preserving, and scalable cybersecurity framework capable of mitigating sophisticated multi-stage cyberattacks while satisfying the stringent performance requirements of next-generation Industrial IoT infrastructures.
Internet of Things (IoT) device security remains a concern due to their limited computational resources and increasing exposure to network-based cyberattacks. While recent IoT security research has focused on machine-learning and blockchain-based defense mechanisms, many of these approaches introduce computational overhead that may not be suitable for resource-constrained devices. This study investigates lightweight host-based countermeasures against network-level spoofing and phishing attacks targeting IoT environments. Specifically, the research examines attack entry points, classifies associated vulnerabilities, and evaluates three practical defense mechanisms: packet analysis using Wireshark, port monitoring using iptables, and host file reconfiguration. Detection is performed through the identification of abnormal TCP communication patterns, unauthorized port activity, and malicious-domain access attempts. A controlled experimental environment based on a Raspberry Pi IoT platform was used to assess the effectiveness and resource consumption of each approach. The results indicate that host file reconfiguration achieved the highest detection accuracy (96%) with the lowest CPU overhead (7%), while the combined deployment of all mechanisms achieved a 99% blocking success rate. The findings demonstrate that lightweight host-based defenses can provide protection against phishing and spoofing attacks while maintaining operational suitability for resource-constrained IoT devices.
Kuberan Dharmalingam, S. Yogarayan, Ang Ee Mae· International Conference on...· 0 citations
A Federated Learning and LLM-Driven Threat Intelligence for Zero Trust IoT Architecture is presented, with FL for anomaly detection integrating privacy-preserving distributed learning, continuous identity verification, and LLM-driven autonomous threat response into a unified pipeline.
Results indicate that combining tiered trust evaluation with machine learning based classification yields a measurably more scalable and resilient security layer for 6G-enabled IoT deployments than existing static or purely cryptographic approaches.
Nelli Yaswanth Kumar, Singothu Jhansi Rani, Setti Sarika· International Journal for Re...· 0 citations
The rapid proliferation of Internet of Things (IoT) devices has fundamentally transformed global network infrastructure while simultaneously creating an expanding attack surface for advanced Distributed Denial of Service (DDoS) threats. IoT endpoints are inherently resource-constrained, making them vulnerable to exploitation as botnet nodes for large-scale DDoS campaigns. Conventional security mechanisms including statically configured firewalls and signature-based intrusion detection systems are insufficiently scalable and adaptive for heterogeneous IoT environments. This paper proposes a lightweight, hybrid Software-Defined Networking (SDN)-based framework for real-time DDoS detection and automated mitigation. The proposed system integrates Shannon entropy-based traffic anomaly detection at the data plane with a Random Forest (RF) classifier deployed at the Ryu SDN controller. Training and evaluation are performed on the CICDDoS2019 benchmark dataset, and end-to-end validation is conducted using Mininet network simulation. Experimental results demonstrate an average detection accuracy of 98.2%, a mean false positive rate (FPR) of 1.6%, a mean F1-score of 98.2%, and a mean mitigation time of 43 ms across four DDoS attack categories: UDP Flood, TCP SYN Flood, ICMP Flood, and HTTP Flood. The proposed approach achieves a favorable accuracy-overhead balance and outperforms state-of-the-art baselines in multiple evaluation dimensions.
Xodjayeva Mavluda Sabirovna, Sevinch Jovlieva, Bayjanov Furkat Bakhramovich et al.· 2026 International Conferenc...· 0 citations
This survey research work proposes a lifecycle-based understanding of AI security threats and proposed a unified taxonomy for the four major categories of threats observed in real-world settings, namely, data poisoning and backdoor attacks on learning model updates, adversarial attacks on model outputs through input manipulation, privacy leakage through model-based queries, and model extraction for intellectual property theft and creation of rogue replicas of learning models.
Venkatesan Cherappa, Hsin-Hung Cho, Yasir Abdullah Rabi et al.· Journal of Internet Technolo...· 0 citations
The rise of the Industrial IoT (IIoT) will result in a surge of IIoT devices with high-velocity data streams requiring rapid, real-time analysis of these data streams to power predictive maintenance and assure cybersecurity. Centralized cloud-based approaches to anomaly detection are hindered by their inherent latency and privacy issues while independent or stand-alone approaches to edge-based anomaly detection do not have enough data to effectively detect anomalies. This paper presents a federated learning framework to collaboratively develop an anomaly detection model from multiple edge nodes, without sharing the raw sensor data, so that data sovereignty is preserved. Two major contributions of this research include a lightweight hybrid secure aggregation method that utilizes pairwise additive masking and differential privacy, which mitigates the threat of inversion attacks achieved via a reconstruction SSIM < 0.05, and successfully detects >90% of model poisoning attempts, where as traditional homomorphic encryption solutions incur excessively high computational costs (approximately 68 ms/node) and 70 KB of communication overhead/round). Our architecture was validated using a synthetic IIoT data set containing 600,000 rows of data correlated across 12 edge nodes and 10 different types of sensors, and further validated using the real-world SWaT data set. The experimental results demonstrated the effectiveness of the framework, achieving an F1 score of 0.944 for anomaly detection, an F2 from centralized training of only 2.3%, and a 60-70% reduction in communication costs compared to the use of homomorphic encryption. The experimental results also demonstrate that local edge inference latency is <50 ms, meeting the real-time requirements of IIoT systems. Overall, the framework demonstrates that practical, deployable security for federated learning in IIoT is achievable without sacrificing accuracy or responsiveness, and open-source implementations are provided to ensure full reproducibility.
