Autonomous cyber-physical security middleware for IoT: anomaly detection and adaptive response in hybrid environments
William Villegas-Ch, Iván Ortiz-Garcés, Sergio Luján-Mora
Frontiers in Artificial Intelligence, 8, 1675132, p. 1-24, 2025. ISSN: 2624-8212. https://doi.org/10.3389/frai.2025.1675132
(FIA'25b)
Revista / Journal
JCR IF (2025): 6.7 - ESCI. Computer Science, Artificial Intelligence: 43/210 (Q1); Computer Science, Information Systems: 38/266 (Q1) SJR IF (2025): 1.007 - Artificial Intelligence: 103/463 (Q1)
Resumen
The rapid adoption of Internet of Things (IoT) devices in cyber-physical systems introduces significant security challenges, particularly in distributed and heterogeneous environments where operational resilience and real-time threat response are critical. Previous efforts have explored lightweight encryption and modular authentication. Still, few solutions provide a unified framework that integrates real-time anomaly detection, automated mitigation, and performance evaluation under hybrid experimental conditions. This work presents an autonomous multi-layered security architecture for IoT networks, implemented through microservices-based middleware with native support for detection and adaptive response mechanisms. The architecture integrates lightweight anomaly inference models, based on entropy metrics and anomaly scores, with a rule-based engine that executes dynamic containment actions such as node isolation, channel reconfiguration, and key rotation. The system runs on edge hardware (Raspberry Pi, sensors, actuators) and is validated in a hybrid testbed with NS-3 simulations. Experimental results show an F1-Score of 0.931 in physical deployments and 0.912 in simulated scenarios, with anomaly detection latencies below 130 ms and containment actions triggered within 300 ms. Under high-load conditions, CPU usage remains under 60 % and memory consumption below 300 MB. Compared to representative middleware platforms such as BlendSM-DDM and Claimsware, the proposed system uniquely integrates detection, response, and auditability, achieving high scalability and resilience for IoT deployments in real-world hybrid environments.