Zero-Trust Architecture for Securing IoT Edge Networks Against Advanced Persistent Threats

Abstract

The rapid expansion of Internet of Things (IoT) edge networks has introduced significant cybersecurity challenges due to the increasing number of resource-constrained devices operating outside traditional security perimeters. Conventional perimeter-based defenses are inadequate against Advanced Persistent Threats (APTs), which exploit compromised edge devices through stealthy, multi-stage attacks involving reconnaissance, lateral movement, command-and-control communication, and data exfiltration. This study presents Edge-ZTA, a lightweight Zero-Trust Architecture specifically designed for securing Industrial IoT edge environments. The proposed framework integrates three complementary components: dynamic device identity verification based on trusted attestation and behavioral fingerprinting, continuous behavioral monitoring using a Federated Deep Autoencoder for privacy-preserving anomaly detection, and Software-Defined Networking (SDN)-based dynamic micro-segmentation for real-time isolation of compromised devices. A comprehensive hybrid experimental testbed comprising physical edge devices, virtualized nodes, and 500,000 network flow records derived from benchmark cybersecurity datasets was developed to evaluate the proposed architecture under realistic APT scenarios. Experimental results demonstrated a weighted macro-average F1-score of 97.1%, with detection rates of 98.9%, 97.9%, 96.8%, and 95.9% for reconnaissance, lateral movement, command-and-control, and exfiltration attacks, respectively. Furthermore, the decentralized edge-based policy decision mechanism maintained end-to-end latency below 50 ms, while CPU utilization remained below 17%, confirming the framework's suitability for resource-constrained IoT deployments. Scalability experiments involving up to 500 edge nodes further verified stable detection accuracy and predictable latency under heterogeneous operating conditions. These findings demonstrate that Edge-ZTA provides an efficient, privacy-preserving, and scalable cybersecurity framework capable of mitigating sophisticated multi-stage cyberattacks while satisfying the stringent performance requirements of next-generation Industrial IoT infrastructures.