MICRO-SEGMENTATION OF IOT NETWORKS IN THE ZERO TRUST ARCHITECTURE

Abstract

The scaling of Internet of Things (IoT) infrastructures is accompanied by redundant network connectivity that expands the attack surface and enables lateral movement of an adversary after a single node has been compromised. The article proposes an automated hybrid method for micro-segmentation of IoT networks that implements the principles of the Zero Trust architecture by combining spectral clustering of the network graph with heuristic role-based pruning. The network is modeled as a directed graph with hierarchical device levels (edge, aggregation, gateway, cloud) and node criticality coefficients. A synthetic topology generator with a controlled noise level has been developed; it reproduces the functional core of connections and a stochastic entropy component using preferential attachment and zone affinity mechanisms. To quantify the quality of segmentation, a system of weighted metrics has been formed: weighted Attack Surface Reduction (wASR), weighted Lateral Movement Index (wLMI), False Block Rate (FBR), and Policy Compression Ratio (PCR). The experimental study covers three network scales (about 30, 330, and 950 devices) with noise intensity from 0 to 5; the results are averaged over three runs, and 95% confidence intervals are provided. It is shown that for large-scale networks the method reduces the weighted lateral movement index by 72–88% depending on the noise level, while keeping the false block rate within 1.5–3% at noise levels up to 3, which preserves the functional integrity of the system. The synthesized access policies are compact (policy compression ratio of 0.71–0.83 under high noise), which reduces the operational complexity of security administration. The limitations of the method for small networks, where graph sparsity increases sensitivity to noise, are identified. Prospects for further research are outlined: dynamic re-segmentation in real time, automatic selection of the number of segments, and validation on real IoT traffic datasets.