TrustEdge-AI: Uncertainty-Aware Dynamic Trust Intelligence for Adaptive Cyber Defense in IoT Edge Networks

Abstract

Conventional Internet-of-Things (IoT) intrusion detection typically maps a model score directly to an alert, although autonomous defense must also determine whether the evidence is reliable, whether suspicious behavior persists over time, and whether a disruptive response is justified. This study proposes TrustEdge-AI, an uncertainty-aware dynamic-trust framework for adaptive cyber defense at the IoT edge. For each monitored device, the framework converts anomaly and classification outputs into reliability-weighted evidence, fuses this evidence with temporal behavioral consistency and optional neighborhood context, and maintains a bounded trust state that evolves over successive monitoring intervals. A hysteretic policy then maps trust regions to graduated actions: allow, observe, restrict, and isolate/escalate. The formulation explicitly separates predictive confidence, uncertainty, instantaneous risk, accumulated trust, and enforcement authority. Analytical trust-state trajectories derived from the proposed update equations demonstrate the intended response to stable benign behavior, uncertain drift, sustained compromise, and post-incident recovery. In addition, a leakage-safe evaluation protocol is specified for BoT-IoT, TON-IoT, and UNSW-NB15, covering known-attack detection, withheld-family stress testing, calibration, trust dynamics, ablation, latency, and communication overhead. Experimental evaluation on BoT-IoT, TON-IoT, and UNSW-NB15 demonstrates strong detection performance, improved calibration, low false-restriction rates, stable policy behavior, and low-latency edge operation. The results further show that uncertainty weighting, temporal trust, contextual fusion, and hysteresis contribute complementary gains to decision reliability and response stability.