An Intelligent Zero-Trust Framework for Securing Next-Generation IoT Ecosystems

Abstract

The rapid growth of Internet of Things (IoT) deployments has exposed a large population of resource-constrained, heterogeneous devices to attacks that perimeter defenses cannot contain. This paper proposes an intelligent zero-trust framework that combines certificate-based device identity and attestation, a hybrid machine-learning trust engine, and adaptive micro-segmentation enforced at the edge gateway. The trust engine fuses an Isolation Forest anomaly score, a Random Forest attack probability, attestation posture, and contextual risk into a continuously updated device trust score. The framework was evaluated on 600,000 flow records drawn from the TON_IoT and Bot-IoT datasets and on a testbed of 64 emulated devices under six attack scenarios. The hybrid detector reached an F1-score of 98.3% with a 1.2% false-positive rate and retained 94.1% F1 in cross-dataset testing. In the testbed, the framework contained 95.6% of attack sessions, compared with 70.4% for static zero trust and 52.8% for a perimeter baseline, and reduced mean time to contain from 96.2 s to 8.4 s relative to static zero trust, at a median added latency of 7.4 ms and a 6.3% throughput reduction. Ablation results show that behavioral trust scoring contributes most to this performance.