Abstract
In artificial-intelligence-of-things (AIoT) deployments, fleets of heterogeneous, long-lived sensing devices sit behind an edge tier whose cloud is not always reachable, so a device trusted at enrolment must be re-assessed continuously, with a response it can afford and with knowledge shared across sites. We present EASA, an Edge-centric Adaptive Security API: a gateway fuses per-flow anomaly evidence with each device’s reported posture and decision history into a composite trust score, maps it with hysteresis to four persistent enforcement levels, budgets the step-up action by the device’s reported energy, and uses a cloud security service only for cross-gateway state—a federated detector and a credential-revocation registry. Every component can be disabled, so baselines are configurations of one implementation. We evaluate the prototype on per-address traces of 65 real consumer devices (CIC IoT-DIAD 2024) under synthetic campaigns built from weakly labelled attacker traces, with three emulated gateways and a cloud service deployed on Google Cloud Run, all calibrated to one target false-positive rate. Over 30 paired seeds, federated aggregation raised recall on attack families unseen at a gateway from 0.24 to 0.60, the shared registry caught 81% of credential-replay device-epochs across all runs, the full EASA configuration isolated about 45% fewer clean devices than per-alarm blocking, the energy-aware selector performed 37% fewer re-authentications under simulated low battery, and a 15-minute cloud outage after warm-up reduced replay rejection with no change detected in the evaluated local metrics (103 ms mean per-run median round trip); the composite score’s history term, in contrast, prolonged benign-side restriction without a demonstrated detection gain. The released simulator, cloud service and protocol give AIoT operators and API designers a reproducible basis for graded, resource-aware enforcement at the edge.