Closing the Loop: An Access-Control Architecture for Automated, Anomaly-Driven Network Revocation in IoT Deployments

Technical Summary: Closing the Loop: An Access-Control Architecture for Automated, Anomaly-Driven Network Revocation in IoT Deployments

Problem Statement
While network-based anomaly detection for IoT devices has achieved high accuracy, most existing research stops at generating alerts. The critical gap lies in the "last mile" of security: translating a detection signal into an automated, enforceable network action. Current literature often assumes the availability of programmable data planes (SDN/OpenFlow) or manufacturer-published MUD (Manufacturer Usage Description) profiles, neither of which are widely deployed in commercial enterprise or industrial LANs. Consequently, the transition from detecting an anomaly to physically disconnecting or permanently excluding a compromised device remains largely unaddressed in practical, standard-compliant environments.

Methodology and Architecture
The paper proposes a closed-loop access-control architecture that bridges this gap using only standard, widely deployed protocols: IEEE 802.1X, EAP-TLS, and RADIUS with dynamic authorization extensions. The system operates on the following principles:

1. Standardized Access Control: IoT devices authenticate via EAP-TLS using unique client certificates. A RADIUS server acts as the central policy decision point, managing session states and consulting a Certificate Revocation List (CRL).
2. Contextual Policy Engine: A central engine continuously consumes anomaly detection outputs. It operates on a set of condition-action rules (e.g., "If anomaly detected, restrict or terminate session"). Crucially, this engine does not require SDN; it interacts with the RADIUS server via a restricted SSH channel to issue Change-of-Authorization (CoA) Disconnect-Requests and with a Certificate Authority (CA) via a token-authenticated HTTP endpoint to revoke certificates.
3. Anomaly Detection Component: To trigger the response, the authors adapted a one-class clustering approach (based on Hamza et al.) but removed its dependency on MUD/SDN flow telemetry. Instead, the detector uses:
   • Passive Traffic Capture: A controlled benign-traffic generator on the device itself produces representative traffic (HTTP, DNS, NTP, etc.), which is captured passively.
   • Unified Fused Model: Replacing the reference's multi-model pipeline (which required per-flow models), this design uses a single model fusing three scores: a cluster-based score (derived from PCA and X-means clustering), a volumetric score (aggregate traffic volume), and a protocol-signature score (specific port/protocol patterns).
   • Alarm State Machine: To prevent transient noise from triggering actions, the system requires three consecutive anomalous windows to raise an alert and five consecutive normal windows plus a 180-second dwell time to clear it.

Key Contributions
The paper makes four primary contributions:

• A Standard-Protocol Closed-Loop Architecture: An enforcement mechanism that links anomaly detection to automated network eviction and certificate revocation without requiring SDN, OpenFlow, or MUD profiles.
• End-to-End Demonstration: A physical testbed evaluation showing that an anomaly signal reliably triggers a two-stage response: immediate disconnection via RADIUS CoA followed by permanent exclusion via certificate revocation.
• Data-Efficient Detection: A unified one-class detector that achieves comparable performance to MUD/SDN-based multi-model pipelines while using approximately 43 times less benign training data (345 windows vs. ~15,000 minutes).
• Contextual Policy Model: A rule-based engine designed to generalize beyond binary alarms to dynamic actions (deny, restrict) and unify audit logging across the architecture.

Experimental Results
The system was evaluated on a single Raspberry Pi device equipped with a passive-infrared motion sensor, subjected to eight attack types (direct and reflection) at three intensity levels (24 total scenarios).

• Detection Performance: The system achieved an Area Under the Curve (AUC) of 0.9964. It detected all 24 attack scenarios at the scenario level. At the window level, it achieved a True Positive Rate (TPR) of 97.46% and a False Positive Rate (FPR) of 2.92%.
• Response Latency: The automated response pipeline was measured to evict a device from the network in an average of 335.8 ms (via RADIUS CoA Disconnect-Request). Certificate revocation was completed in an additional 111.5 ms.
• Data Efficiency: The unified model reached these results using roughly 43× less training data than the reference MUD/SDN architecture it adapts.

Significance and Claims
The authors position this work not as a novel detection algorithm, but as a demonstration of the enforcement path. They argue that for IoT security, the ability to act on a detection signal is as critical as the detection itself.

• Practicality: By relying on 802.1X and RADIUS CoA, the architecture is deployable on existing enterprise infrastructure without the need for programmable switches or manufacturer cooperation.
• Complementarity: The paper notes that this network-traffic-based approach complements existing commercial Identity Threat Detection and Response (ITDR) systems, which focus on authentication behavior but lack visibility into post-authentication network traffic.
• Modesty in Scope: The authors explicitly state that the evaluation is limited to a single device type and a fixed set of attacks. They do not claim the detection performance generalizes across all device types without further study, nor do they claim robustness against adaptive adversaries who might exploit the system's hysteresis windows. The primary contribution is the validation of the closed-loop mechanism itself.