Abstract
Abstract Post-detection Internet of Things (IoT) botnet mitigation requires identifying non-flagged endpoints that may require proactive quarantine while limiting unnecessary service disruption. This study presents a prospective exposure-risk scoring framework for quarantine decision support in software-defined networking (SDN)-based IoT environments. Per-second network telemetry is transformed into communication graphs and lightweight endpoint features. A first-stage anomaly signal provides the current suspected-compromise context, while prospective exposure is defined by whether a currently non-flagged endpoint communicates with a Stage-A-flagged endpoint at a subsequent prediction horizon. This design separates the prediction target from same-second suspicious-neighbour adjacency. Standard graph neural network models are evaluated against direct-neighbour and topology-agnostic baselines, while quarantine thresholds are selected on validation data to maximise recall subject to a false-positive-rate budget of 0.05. Experiments using CICIoT2023 packet-capture data and CICIoT-DIAD2024 show that the value of graph-based scoring depends on the traffic representation and evaluation scenario. On CICIoT2023-PCAP, graph models achieved substantially higher mean AUPRC than the topology-agnostic baseline, although performance varied across random seeds. On CICIoT-DIAD2024, the ordinary split showed no consistent graph-learning advantage, whereas under the evaluated scenario-disjoint Mirai condition, all three graph models achieved higher AUPRC than both the topology-agnostic MLP and the direct-neighbour rule. The findings demonstrate the potential of prospective exposure-risk scoring for controlled post-detection quarantine while highlighting the effects of telemetry representation and distribution shift.