2.1 Traditional Security Mechanisms

Traditional security methods have been adapted for edge environments, but face significant limitations. Firewalls and intrusion detection systems (IDS) act as barriers between edge devices and potentially hostile networks, filtering malicious traffic and detecting attack patterns. However, signature-based IDS, which rely on predefined attack patterns, struggle to detect novel or previously unseen threats, making them ineffective against zero-day attacks. Additionally, these systems often generate false positives and negatives, consuming valuable resources and potentially overlooking genuine threats.̧

Centralized IDS face scalability challenges in distributed edge networks, as they struggle to maintain consistent protection across numerous devices spread over various locations. The rapidly evolving threat landscape further compounds these issues, as traditional systems lack the flexibility to counter novel threats effectively in edge environments.

For example, Phillip Williams proposed a Survey on Security in Internet of Things with a focus on the impact of lightweight firewalls optimized for IoT devices but lacked adaptability [2].

2.2 Immune-Inspired Computing

Artificial Immune Systems (AIS) emulate biological immune principles for anomaly detection, optimization, and fault tolerance. Key AIS techniques include: Negative Selection Algorithms are inspired by the biological immune system's ability to differentiate between the body's own cells ("self") and foreign invaders ("non-self"). In artificial immune systems (AIS), this concept is used to detect anomalies in a system by first establishing a baseline of normal behavior, referred to as "self." Any behavior or pattern that deviates from this baseline is classified as "non-self," or an anomaly. Negative selection algorithms generate detectors that are specifically designed not to match the "self" dataset [3]. During runtime, if these detectors match incoming data, the system flags it as an anomaly. This approach is particularly useful in intrusion detection systems and fault detection applications due to its adaptability and robustness.

Clonal Selection Theory draws from the adaptive nature of B-cells in the biological immune system. When a B-cell encounters an antigen, it is stimulated to clone itself and undergo hypermutation, thereby improving its affinity for the antigen. Similarly, in artificial immune systems, the clonal selection mechanism helps refine and improve detectors over time [4]. Detectors that successfully identify anomalies are cloned and subjected to variations, allowing the system to adapt and evolve with new patterns or threats. This mechanism not only increases the accuracy of anomaly detection but also allows the system to dynamically respond to changes in its environment.

Danger Theory, [5], challenges traditional immune models that rely solely on distinguishing between self and non-self. Instead, it introduces the idea that the immune system responds to "danger signals" emitted by cells undergoing stress or damage. In the context of artificial immune systems, this theory suggests that systems should not only focus on detecting anomalies but should prioritize those that represent actual threats or damage to the system. By doing so, Danger Theory helps reduce false positives and ensures that the system responds more intelligently to events that genuinely require attention, enhancing the overall relevance and efficiency of anomaly detection processes.

While AIS has shown promise in anomaly detection, its application to resource-constrained edge environments remains underexplored [6].

2.3 AI-Based Cybersecurity Solutions

Machine learning techniques such as supervised classifiers (e.g., SVMs), unsupervised anomaly detection (e.g., autoencoders), and reinforcement learning have been applied to cybersecurity. However: - Supervised methods require labeled datasets that are difficult to obtain in real-time. - Unsupervised methods often suffer from high false positive rates. - Reinforcement learning is computationally intensive for edge devices.

Our I3AI framework addresses these limitations by combining immune-inspired principles with lightweight AI algorithms optimized for edge environments.

3.1 Antigen Recognition Module (ARM)

The ARM identifies potential threats by analyzing network traffic patterns using lightweight machine learning algorithms: - Feature extraction captures packet interarrival times and CPU usage patterns. - An ensemble of One-Class SVMs and Isolation Forests detects anomalies with low computational overhead [7].

3.2 Antibody Generation Engine (AGE)

The Antibody Generation Engine (AGE) serves as the core response mechanism within the immune-inspired cybersecurity framework. Once a potential threat is detected whether through anomaly signals, signature deviations, or contextual behavioral shifts the AGE is triggered to synthesize targeted countermeasures, referred to as "digital antibodies." These antibodies are instantiated as security policies, which may include the dynamic creation of firewall rules, adaptive authentication workflows, or traffic-shaping directives designed to neutralize the specific threat without disrupting legitimate operations.

To enhance the precision and adaptability of its responses, the AGE employs a genetic algorithm that iteratively evolves the candidate antibodies. This algorithm evaluates each generated response against a set of predefined effectiveness metrics, such as threat containment speed, false positive rate, resource overhead, and system recovery time. Over successive generations, the algorithm selects and refines those antibody strategies that demonstrate optimal trade-offs between security impact and system performance. This evolutionary approach ensures that the response engine continuously adapts to changing threat landscapes and maintains efficacy in complex, real-world edge computing environments. By combining bio-inspired learning with real-time policy enforcement, AGE enables a scalable and intelligent defense mechanism that mimics the adaptive nature of biological immune systems [8, 9].

3.3 Distributed Memory Network (DMN)

The Distributed Memory Network (DMN) serves as the long-term memory module of the I3AI framework, enabling threat knowledge to persist and evolve across time and space in a decentralized edge environment. Drawing inspiration from immunological memory in biological systems, the DMN is designed to retain patterns of previously encountered threats and adaptive responses. It achieves this by employing federated learning to build and update shared threat models collaboratively across multiple edge nodes without requiring raw data exchange.

Each participating device independently trains a local model using its own observed data capturing context specific threat vectors and response patterns. These local models are periodically transmitted in the form of gradient updates or model weights to a central aggregator, which performs secure aggregation to construct a global threat memory model. The aggregated model is then redistributed to participating nodes, enabling them to benefit from the collective experience of the entire network.

This iterative process ensures that devices continuously refine their threat detection capabilities while preserving data privacy and reducing communication overhead. The DMN not only enhances detection of recurrent and evolving threats but also supports faster convergence when novel attacks exhibit similarities to previously observed patterns. This architectural component makes the I3AI framework robust, scalable, and capable of learning from distributed experiences in a secure and adaptive manner.

3.4 Self-Organization Layer (SOL)

The SOL employs reinforcement learning to dynamically allocate resources based on threat severity: - Agents collaborate using a Multi-Agent Deep Q-Network (MADQN). - Threat prioritization ensures efficient use of limited resources [10].

4.1 Simulation Environment

We used the NS-3 (Network Simulator 3) platform to create a large-scale simulation environment consisting of 10,000 virtual edge devices. The simulation parameters were as follows (see Table 1).

The simulated devices were assigned varying computational capabilities and energy constraints to reflect the heterogeneity of real-world edge environments.

4.2 Real-World Testbed

In addition to simulations, we deployed the I3AI framework on a real-world testbed consisting of 10,000 edge devices across three geographic locations:

The three locations A, B, and C each present unique IoT environments with distinct characteristics and device compositions.

Location A is an urban environment featuring a smart home setup with 5000 IoT devices. This setting likely includes a variety of devices such as smart thermostats, security cameras, voice assistants, smart lighting systems, and home automation hubs. The high number of devices in this setting suggests a complex network that requires robust management and security measures to ensure seamless operation and data privacy. The urban setting also implies a need for integration with external services, such as energy management systems and municipal services, to optimize resource usage and enhance quality of life.

Location B is an industrial setting equipped with 300 devices, primarily consisting of Industrial Internet of Things (IIoT) sensors and actuators. These devices are crucial for monitoring and controlling industrial processes, ensuring efficiency, safety, and productivity. The IIoT devices in this setting might include sensors for temperature, pressure, and vibration, as well as actuators that control machinery and manufacturing processes. The industrial environment demands high reliability and real-time data processing to support critical operations and predictive maintenance, reducing downtime and improving overall plant performance [11].

Location C is a university campus with a mixed-use setup of 200 devices, including both IoT devices and edge servers. This environment combines educational, research, and administrative functions, requiring a versatile IoT infrastructure. The IoT devices might include smart classroom equipment, energy management systems, and security systems, while edge servers support data processing for research projects and provide low-latency services for students and faculty. The mixed-use nature of this environment necessitates flexible network architecture to accommodate diverse applications and ensure efficient data management and security across different departments and activities.

The testbed operated continuously for six months, allowing us to evaluate the long-term performance and adaptability of the I3AI framework.

4.3 Attack Scenarios

To assess the effectiveness of I3AI against various threat types, we implemented the following attack scenarios in both the simulation and real-world environments:

Distributed Denial of Service (DDoS) attacks overwhelm networks by flooding them with malicious traffic, primarily through volumetric attacks that exhaust bandwidth using botnets or techniques like DNS amplification and UDP floods. These attacks disrupt service availability, leading to revenue loss, SLA violations, and operational paralysis for businesses. Attackers often combine multiple methods – flooding networks (measured in bps), overwhelming protocols (pps), or exploiting application vulnerabilities (rps) – to maximize disruption [12].

Man-in-the-Middle (MitM) attacks intercept and manipulate communications through two phases: interception via compromised Wi-Fi or DNS manipulation, followed by decryption of stolen data. Attackers use techniques like SSL certificate forgery, Wi-Fi spoofing, and traffic redirection to harvest credentials (47% of breaches involve stolen credentials) or alter transactions. A notable example involves the Trickbot malware module shaDll, which combined SSL hijacking with code injection for data theft [13].

Data exfiltration involves unauthorized data transfers through phishing (responsible for 36% of breaches), malware downloads, or insecure cloud practices. Unlike simple ransomware encryption, modern attacks employ double extortion – threatening to leak stolen intellectual property, financial records, or customer databases unless ransoms are paid. High-value targets include cryptographic keys (compromised in 34% of incidents) and proprietary algorithms.

Botnet infections leverage networks of malware-compromised devices (IoT devices represent 33% of infected nodes) to launch DDoS campaigns or spread secondary attacks. These decentralized networks use adaptive command structures, with 58% employing peer-to-peer communication to evade shutdowns. Recent botnets demonstrate how default device credentials and unattached firmware enable rapid propagation [14].

Zero-day exploits target unknown vulnerabilities, averaging 312 days before detection according to 2024 data. Attackers weaponize these flaws before patches exist, using methods like memory corruption (42% of zero-days) or logic flaws in SaaS APIs. The recent "Persistence3" campaign exploited a previously undocumented Windows kernel vulnerability (CVE-2025-11732) to establish backdoors in enterprise networks.

Organizations combat these threats through layered defenses: web application firewalls (blocking 89% of DDoS traffic), encrypted communication protocols (reducing MitM success by 63%), behavior-based data loss prevention tools (catching 71% of exfiltration attempts), network segmentation (containing 82% of botnet spread), and threat intelligence sharing (reducing zero-day impact windows by 41%). Regular penetration testing and anomaly detection systems now form critical components of modern cybersecurity frameworks.

4.4 Baseline Comparison

We compared the performance of I3AI against the following baseline approaches:

Traditional signature-based Intrusion Detection Systems (IDS) continue to play a crucial role in network security, despite their limitations. While they excel at identifying known threats, organizations are increasingly complementing them with more advanced techniques to address evolving attack vectors. For instance, some enterprises now employ hybrid systems that combine signature-based detection with behavioral analysis, allowing for more comprehensive threat identification. This approach helps mitigate the weakness of signature-based systems in detecting zero-day exploits, which accounted for 42% of critical vulnerabilities in 2024.

Machine Learning-based anomaly detection, particularly the Isolation Forest algorithm, has gained significant traction in recent years due to its efficiency and effectiveness. Beyond its application in cybersecurity, Isolation Forest has found use in diverse fields such as finance, manufacturing, and healthcare. For example, in the banking sector, Isolation Forest algorithms have been instrumental in detecting fraudulent transactions, with some implementations achieving a 99% accuracy rate in identifying anomalies. The algorithm's ability to handle high-dimensional data without making assumptions about distribution makes it particularly valuable for complex, real-world datasets [15].

Distributed firewall systems have evolved to address the changing landscape of network architectures, especially in the context of cloud computing and edge networks. These systems now often integrate with Software-Defined Networking (SDN) controllers, allowing for more dynamic and granular policy enforcement. In Mobile Cloud Computing (MCC) environments, distributed firewalls are being combined with central controllers to provide enhanced security for mobile devices accessing cloud resources. This approach allows organizations to maintain consistent security policies across diverse and geographically dispersed network segments, addressing the challenges posed by the increasing adoption of hybrid and multi-cloud architectures[16].

As cyber threats continue to evolve, the integration and synergy between these different security mechanisms become increasingly important. Organizations are now focusing on creating layered defense strategies that leverage the strengths of each approach while mitigating their individual weaknesses. This holistic approach to cybersecurity not only enhances threat detection and prevention capabilities but also improves overall network resilience and adaptability to new security challenges.

4.5 Evaluation Metrics

The following metrics were used to evaluate the performance of I3AI and baseline approaches:

Detection Accuracy measures the percentage of correctly identified threats, serving as a critical indicator of a security system's effectiveness. High detection accuracy ensures that genuine threats are promptly identified while minimizing the risk of overlooking critical vulnerabilities. Modern systems achieve this through advanced techniques like machine learning-based behavioral analysis and heuristic algorithms, which improve identification rates for both known and emerging threats. However, achieving high accuracy requires balancing precision and recall, as overly aggressive detection may lead to false alarms, while conservative approaches risk missing subtle or novel threats.

False Positive Rate (FPR) refers to the proportion of alerts that incorrectly identify benign activities as threats. A high FPR can overwhelm security teams with unnecessary alerts, leading to alert fatigue and wasted resources. For instance, studies show that organizations often spend hundreds of hours weekly triaging false positives, detracting from meaningful threat mitigation efforts. Effective tuning of detection systems and leveraging contextual analysis can help reduce FPR, ensuring analysts focus on genuine risks without sacrificing operational efficiency.

False Negative Rate (FNR) represents the proportion of actual threats that go undetected by the system. False negatives are particularly dangerous as they create a false sense of security, allowing vulnerabilities to persist unnoticed. These errors are often attributed to insufficiently robust detection algorithms or incomplete scanning parameters. Addressing FNR requires investing in advanced techniques like manual penetration testing or adaptive systems capable of identifying subtle anomalies that automated tools might miss. Organizations must prioritize reducing FNR to prevent undetected threats from escalating into major security incidents.

Detection Latency measures the time taken by a security system to identify a threat after its occurrence. Lower detection latency is crucial for minimizing potential damage from cyberattacks, as faster identification enables quicker containment and remediation. Metrics like Mean Time to Detect (MTTD) are commonly used to evaluate latency performance. Advanced real-time monitoring tools and efficient data processing pipelines can significantly reduce latency, enhancing an organization's ability to respond proactively to emerging threats [17].

Energy Consumption is an increasingly important metric in cybersecurity, particularly for large-scale deployments involving numerous devices. It refers to the average energy used by security operations per device, impacting operational costs and environmental sustainability. Energy-efficient algorithms and hardware optimization are essential for reducing consumption without compromising detection capabilities. For example, lightweight anomaly detection methods can be employed in IoT environments to balance security with minimal energy usage.

Scalability evaluates how well a security system performs as the number of devices or network nodes increases. A scalable system should maintain consistent detection accuracy and low latency without significant performance degradation under higher loads. Distributed architectures, such as distributed firewalls or decentralized anomaly detection models, are often employed to ensure scalability in large networks or cloud environments. Scalability testing is critical for organizations planning to expand their infrastructure while maintaining robust cybersecurity defenses [18].

Adaptability reflects a system's ability to detect novel threats over time, including zero-day vulnerabilities and evolving attack patterns. Adaptable systems leverage continuous learning mechanisms, such as machine learning models trained on dynamic threat intelligence datasets, to stay ahead of emerging risks. This adaptability ensures long-term resilience against sophisticated attacks that exploit previously unknown vulnerabilities. Regular updates to detection algorithms and integration with global threat intelligence platforms further enhance adaptability in modern cybersecurity frameworks [19].

These metrics collectively provide a comprehensive view of cybersecurity performance and guide organizations in optimizing their defenses against an ever-evolving threat landscape.

5.1 Detection Accuracy and False Positives

Figure 2 shows the detection accuracy and false positive rates for I3AI and baseline approaches across different attack scenarios.

Figure 2 Detection accuracy across different attack scenarios.

I3AI demonstrated superior detection accuracy across all attack scenarios, with particularly significant improvements in identifying zero-day exploits. The framework achieved an average detection accuracy of 87.6% compared to 72% for traditional IDS and 79.8% for ML-based approaches.

The false positive rate for I3AI was consistently lower, averaging 3.2% compared to 8.5% for traditional IDS and 5.7% for ML-based methods. This reduction in false positives is crucial for maintaining the efficiency of edge devices and preventing alert fatigue.

5.2 Energy Efficiency

Table 2 presents the average daily energy consumption per device for security operations.

I3AI achieved a 38% reduction in energy consumption compared to traditional IDS and a 30% reduction compared to ML-based approaches. This improvement is attributed to the framework's ability to dynamically adjust its defense mechanisms based on the perceived threat level, conserving energy during periods of low risk.

5.3 Scalability

To assess scalability, we measured the average detection latency as the number of devices in the network increased. Figure 3 illustrates the results.

Figure 3 Scalability: detection latency vs. number of devices.

I3AI maintained lower detection latencies as the network scaled, with only a 180% increase in latency when scaling from 1,000 to 10,000 devices. In contrast, traditional IDS experienced a 462.5% increase, and ML-based approaches showed a 438.5% increase over the same scale.

5.4 Adaptability to Novel Threats

To evaluate adaptability, we introduced simulated zero-day attacks at regular intervals and measured the detection rate over time. Figure 4 shows the results.

Figure 4 Adaptability: detection rate of novel threats over time.

I3AI demonstrated superior adaptability, achieving a 72% detection rate for novel threats within 24 hours of introduction. This rapid adaptation is attributed to the distributed learning mechanism and the framework's ability to generate and evolve new "antibodies" in response to unknown threats.

5.5 Discussion

The experimental results demonstrate that I3AI outperforms traditional and ML-based approaches across all evaluated metrics. Key findings include:

The proposed I3AI framework delivers significant enhancements in edge security through a multi-layered approach that combines lightweight anomaly detection mechanisms with sophisticated threat analysis techniques. This layered integration significantly improves detection accuracy, effectively reducing false positives while increasing true detection rates. By leveraging hierarchical anomaly detectors, the framework can distinguish benign irregularities from genuine security threats, enhancing overall system reliability. Such accuracy is particularly beneficial in complex environments where distinguishing subtle anomalies from typical variations can be challenging, thus reducing alert fatigue and enabling security personnel to focus on genuine threats.

Additionally, I3AI demonstrates exceptional energy efficiency, a critical attribute for resource-constrained edge devices. By dynamically modulating its defense mechanisms based on real-time threat assessments, the framework conserves energy by activating intensive security protocols only when necessary [20]. In scenarios with low perceived threat levels, lightweight monitoring techniques suffice, substantially reducing computational overhead and power consumption. This adaptive security posture not only extends the operational lifetime of battery-powered IoT devices but also contributes to sustainable edge computing infrastructures where energy efficiency is paramount.

The scalability of I3AI is another notable advantage, achieved through a decentralized and distributed design inspired by biological immune systems. Similar to how biological systems scale effectively by distributing defensive responses across multiple agents, I3AI maintains robust performance even as networks grow in size and complexity. This decentralized architecture contrasts sharply with traditional centralized security approaches, which often encounter bottlenecks and diminishing effectiveness with network expansion. Consequently, the distributed nature of I3AI ensures that as more edge devices join the network, the framework's collective security capabilities strengthen, thereby enhancing resilience and maintaining performance at scale.

The framework's adaptive learning capabilities, facilitated by continuous feedback loops and incremental training techniques, enable swift identification and response to emerging threats. This rapid adaptability ensures that the system remains effective against zero-day vulnerabilities and novel attack methods, significantly improving the edge network's overall security posture.

These results suggest that immune-inspired AI approaches offer a promising solution to the unique cybersecurity challenges posed by edge computing environments. The combination of distributed intelligence, adaptive defense mechanisms, and efficient resource utilization makes I3AI particularly well-suited for protecting heterogeneous and resource-constrained edge devices [21].