Closing the Loop: An Access-Control Architecture for Automated, Anomaly-Driven Network Revocation in IoT Deployments

Research Question and Approach

Most research on IoT security focuses on detecting anomalies but fails to provide a practical, automated mechanism for enforcing network-level responses. This paper addresses this gap by building a closed-loop architecture that connects anomaly detection to existing network infrastructure. Instead of relying on specialized, programmable data planes (like SDN/OpenFlow) or manufacturer-provided MUD profiles—which are rarely available—the authors leverage standard, widely deployed protocols: IEEE 802.1X for authentication and RADIUS for dynamic policy enforcement.

The system uses a central access policy engine that consumes output from a lightweight, one-class anomaly detector. When the detector identifies malicious traffic, the engine triggers a two-stage response: it sends a RADIUS Change-of-Authorization (CoA) Disconnect-Request to immediately evict the device, followed by a certificate revocation request to ensure the device cannot rejoin the network.

The authors demonstrate that this architecture is both effective and efficient. The anomaly detector, which uses a fused model combining cluster-based, volumetric, and protocol-signature scores, achieved an AUC of 0.9964. Crucially, the system successfully detected all 24 evaluated attack scenarios across eight different attack types. In terms of response time, the architecture proved highly responsive, evicting a device in an average of 335.8 ms, with certificate revocation completing in an additional 111.5 ms. The authors highlight that their approach requires significantly less training data than previous MUD-based designs while maintaining high detection accuracy.

This work bridges the gap between theoretical anomaly detection and real-world network operations. By utilizing standard protocols already present in most enterprise and industrial networks, the architecture provides a deployable path for automated incident response. It demonstrates that organizations do not need to overhaul their network infrastructure to implement robust, automated security for IoT devices, effectively turning passive detection into active, enforceable defense.