A closed-loop authentication-detection security framework for edge computing environments integrating trusted computing and distilled pre-trained language models

Abstract

Edge computing environments hosting tens of thousands of nodes face concurrent threats including node spoofing, data tampering, and distributed denial-of-service attacks, yet existing security solutions address authentication, intrusion detection, and resource scheduling in isolation. This paper proposes a closed-loop authentication-detection security framework integrating three tightly coupled modules. The Detection-Feedback-driven Adaptive Authentication module combines Trusted Platform Module hardware attestation with a Bayesian-decay composite trust metric and three-level adaptive credential verification. The Trust-Guided Distilled Multi-modal Intrusion Detection System applies contrastive knowledge distillation from SecureBERT to a lightweight student model with cross-modal attention fusion across network traffic, system log, and system-call streams, conditioned on trust scores received through the bidirectional Trust-Feedback Token channel. A MAB-UCB1 adaptive scheduler co-optimizes resource allocation across both workloads simultaneously, achieving 91.7% of the theoretical optimal cumulative reward by round 200 against a random baseline of 70.4%. Experiments spanning 20 comparison groups, 10 ablation conditions, 6 attack scenarios, 3 public datasets, node scales from 1,000 to 50,000, and 30 repeated trials with Wilcoxon and Friedman statistical validation confirm that the proposed framework demonstrates competitive performance across six performance dimensions captured by the Security Performance Utility score, including authentication latency of 239.4 ms at 10,000 nodes, detection F1-score of 0.968, mean resource utilization of 38.2%, and system stability of 0.871 under DDoS conditions, outperforming all evaluated baseline methods under the tested conditions with statistical significance.