FlagThis

Abstract

Internet of Things (IoT) deployments increasingly combine heterogeneous and resourceconstrained devices with weak security configurations, exposed services, limited logging, patching constraints, and long lifecycle dependencies, creating a broad attack surface across domestic, healthcare, educational, industrial, and smart-city environments. Signature-based and thresholdbased controls remain useful baseline defences, but they are insufficient as standalone mechanisms in dynamic IoT networks; similarly, offline artificial intelligence (AI) benchmark performance alone does not establish operational deployability. Practical edge defence also requires efficient feature extraction, bounded inference cost, timely response, preservation of legitimate traffic, explainable decisions, and safe mitigation. This article is a conceptual framework and research agenda, and it does not report new experimental measurements. It proposes a Linux-based IoT edge-gateway architecture in which resource-aware flow-level AIassisted detection provides a risk signal, event-level explainability supports administrator interpretation, and a bounded mitigation controller applies reversible and time-limited actions subject to critical-device safeguards. The controller updates eBPF/XDP packet-level enforcement state, records structured logs, and allows future support for validated local or privacy-aware model updates. The conceptual contribution is to connect detection, explanation, and enforcement while separating complex reasoning and policy control in user space from concise packet-handling decisions in the kernel. The framework also defines an evaluation pathway for future hardware-aware validation, including detection quality, resource cost, response timing, rollback behaviour, and legitimate-traffic preservation. Its intended value is to guide the design and assessment of safer AI-assisted IoT edge mitigation without claiming measured superiority or completed real-time performance.