A Cloud-Edge Integrated Framework for Scalable, Real-time, and Privacy-conscious Threat Detection in IoT Environments

Details experimental

Literature review

The rise of the Internet of Things (IoT) has introduced new challenges in ensuring real-time and privacy-conscious threat detection, especially in environments constrained by computation and communication resources. Several prominent approaches have emerged, each contributing to specific aspects of this challenge.

Edge-Assisted Threat Detection: Edge-based models aim to reduce latency by processing data closer to its source. For example, Zhang, et al. [1] proposed an edge-enabled intrusion detection system (IDS) that leverages lightweight classifiers deployed on IoT gateways. While this method reduces detection delay and bandwidth use, it is constrained by limited edge resources, leading to trade-offs in model complexity and coverage.

Federated AI for Privacy Preservation: Federated learning (FL) allows distributed devices to collaboratively train a model without sharing raw data. In [2], Li, et al. presented a privacy-preserving anomaly detection framework using FL in industrial IoT. Though FL significantly improves data privacy and regulatory compliance, it suffers from slow convergence and increased overhead due to synchronization and model aggregation.

Hybrid Cloud-Edge Architectures: Hybrid models integrate cloud and edge computing to balance latency-sensitive tasks and intensive data processing. Shen, et al. [3] introduced a hybrid cloud-edge platform for threat analytics, where edge nodes perform initial filtering, and the cloud handles deeper analysis. However, this solution lacks built-in privacy safeguards and flexibility for modular deployment across heterogeneous devices.

Despite these advancements, existing solutions rarely address scalability, modularity, real-time processing, and privacy in a single, deployable framework. Our proposed model fills this gap by combining edge-driven detection, federated learning, and cloud support within a service-oriented architecture validated in real-world hybrid infrastructures (Figure 1).

Figure 1: Architecture and System Model.

The proposed architecture presents a privacy-preserving, real-time threat detection system designed for Internet of Things (IoT) environments using a cloud-edge integrated framework. At its core is a real-time data processing engine, responsible for analyzing data streams from IoT devices to detect anomalies and security threats with minimal latency. This engine interacts with a scalable cloud infrastructure that provides elastic computing and storage resources, enabling offloading of computationally intensive tasks such as deep learning model training and global pattern correlation. To ensure data privacy, the system integrates privacy-preserving mechanisms such as federated learning, differential privacy, and access control, which enforce local data retention and protect sensitive information before processing. All components are built on a modular design, supporting service-oriented deployment across cloud, fog, and edge layers. This modularity allows for plug-and-play integration of new threat models, analytics services, or privacy modules without disrupting existing operations. The architecture ensures high scalability, low-latency threat detection, and strong privacy guarantees, making it well-suited for real-world, heterogeneous IoT deployments [4-8].

Implementation and use case

Prototype deployment and evaluation

A. Deployment setup: To validate the proposed cloud-edge integrated threat detection framework, a prototype system was implemented within a smart building environment simulating a realistic, heterogeneous Internet of Things (IoT) deployment. The architecture consisted of three primary tiers: (i) IoT devices, including environmental sensors and smart actuators; (ii) edge gateways, responsible for local processing and model inference; and (iii) a centralized cloud control center, which handled global orchestration, model aggregation, and system-level analytics.

TensorFlow Federated (TFF) was employed to facilitate federated learning across edge nodes, enabling local model training without the need to transfer raw data to the cloud. This decentralized learning paradigm ensured privacy preservation while supporting collaborative model improvement. In parallel, Apache Flink was utilized for real-time data stream processing and event correlation, enabling the system to handle high-velocity input from edge sources in a fault-tolerant and scalable manner.

The framework was evaluated against a range of threat scenarios relevant to smart infrastructure, including:

Malware injection via firmware manipulation and external payloads,

• Unauthorized access attempts through credential spoofing and brute-force login simulations,
• Anomalous behavior patterns, such as data bursts, communication irregularities, and sensor spoofing.

B. Evaluation metrics: The system was assessed based on four core performance indicators:

1. Throughput: The architecture achieved a sustained processing rate of 50,000 events per second, confirming its suitability for large-scale IoT deployments. This throughput was achieved through distributed.
2. Micro services and Flink’s efficient event-processing engine.
3. Detection Accuracy: Across all threat types and device categories, the system attained an average detection accuracy of 96.5%. This high accuracy demonstrates the effectiveness of federated learning in capturing both global and local threat signatures, even in resource-constrained environments.
4. Latency: The average response time from event detection to mitigation was measured at under 180 milliseconds, meeting the real-time requirements of latency-sensitive applications such as smart access control and industrial safety systems.
5. Privacy audit: Privacy was validated using PrivCheck, an automated GDPR audit tool. The framework passed all compliance checks, confirming that no personally identifiable information (PII) was exposed during data collection, processing, or federated learning. This reinforces the architecture’s alignment with privacy-by-design and regulatory standards.

C. Summary of findings: The experimental evaluation substantiates that the proposed hybrid cloud–edge framework offers a robust, scalable, and privacy-preserving approach for real-time threat detection in Internet of Things (IoT) environments. By coupling edge-level analytics with cloud-driven intelligence, the system sustains high throughput and accuracy while maintaining low-latency responses suitable for mission-critical contexts such as smart infrastructure, healthcare, and industrial automation. The integration of federated learning ensures data sovereignty by enabling localized model training without exposing raw data, thereby achieving compliance with privacy regulations such as GDPR and HIPAA. Empirical results highlight that the architecture achieves an average detection accuracy of 96.5%, a processing rate exceeding 50,000 events per second, and sub-200 ms reaction time—all indicative of operational maturity for real deployments. Comparative analysis with recent studies confirms that the proposed framework outperforms existing approaches in modularity, scalability, and privacy assurance. Furthermore, its microservice-based design facilitates seamless integration of evolving AI models, threat signatures, and privacy modules. Collectively, these findings establish the framework as a viable foundation for next-generation IoT security systems, bridging the performance–privacy divide that constrains current cloud-centric solutions.

Results and discussion

The proposed architecture successfully tackles the critical challenges of latency, scalability, and privacy in IoT threat detection. By utilizing edge computing, the system ensures low-latency performance, enabling quick responses to security incidents without overwhelming edge devices. This is crucial in real-time threat detection scenarios, such as in healthcare or industrial environments, where immediate actions are necessary to mitigate potential risks. The framework excels in low-resource environments by offloading computationally expensive tasks to cloud nodes, ensuring that edge devices can focus on lightweight processing without compromising performance. A significant strength of the architecture lies in its ability to maintain privacy through federated learning, where models are trained locally on edge devices rather than sending sensitive data to central servers. This approach adheres to privacy regulations like GDPR, making the system well-suited for environments where data security is paramount. However, despite these advantages, there are still limitations that need to be addressed. Communication overhead is one such challenge, as the model updates must be transmitted between the edge nodes and the cloud, which could result in higher bandwidth consumption, especially in large-scale IoT networks. Moreover, the system requires adaptive models capable of evolving in response to dynamic threat environments. As IoT networks are highly dynamic and new threats constantly emerge, the architecture's ability to quickly update and adapt its models to detect novel attack patterns remains an area for improvement. This is particularly challenging in federated learning, where model updates must be synchronized across numerous distributed devices. Lastly, while offloading computation to the cloud alleviates some of the strain on edge devices, the computational limitations of these devices must be considered, especially when more complex tasks or sophisticated models are required. The system would benefit from further optimization to reduce the resource requirements of edge nodes and improve their ability to handle more complex threat detection tasks locally. Models in dynamic threat environments.

A comparative analysis of the proposed framework with existing state-of-the-art models, as summarized in Table 1, further reinforces its superior performance and architectural flexibility. Unlike conventional edge-based systems that struggle with scalability and centralized privacy constraints, the proposed hybrid model achieves an optimal balance between low-latency local processing and cloud-level orchestration. The integration of federated learning and modular microservices enables decentralized intelligence while maintaining compliance with data protection regulations. Recent studies, including those by Kaur, et al. [9], Nguyen and Sharma [10], and Patel and Reddy [11], highlight similar advancements, but the present framework demonstrates improved adaptability and deployment readiness across heterogeneous IoT infrastructures. Overall, this comparison underscores the practical viability and technological maturity of the proposed solution for large-scale, real-world IoT security deployments (Figure 2).

Figure 2: Block diagram.

Conclusion

The integration of zero-trust security frameworks, predictive AI capabilities, and blockchain-driven data integrity mechanisms marks a significant step forward in the evolution of the proposed hybrid cloud–edge threat detection system. These advancements will not only expand the system’s capacity to anticipate, prevent, and detect sophisticated cyber threats but also reinforce data confidentiality, integrity, and trust across the entire IoT ecosystem. Zero-trust principles will enforce rigorous, continuous verification across every layer of communication, while predictive AI models will enable proactive defense by identifying anomalous behaviors before they escalate into attacks. In parallel, blockchain will ensure immutable and verifiable data transactions, eliminating risks associated with tampering or unauthorized modification. Collectively, these enhancements will empower the system to stay ahead of emerging cybersecurity challenges, making it more resilient, adaptive, and secure for next-generation IoT deployments.