Security Without Detection: Economic Denial as a Primitive for Edge and IoT Defense
About
Sophisticated attackers can evade detection-based security by using encryption, stealth tactics, and low-rate attack patterns. This challenge is particularly acute in Internet of Things (IoT) and edge environments, where limited resources make ML-based intrusion detection systems impractical. Hereby, we present Economic Denial Security (EDS), a framework that renders attacks economically infeasible rather than trying to detect them. EDS exploits a fundamental asymmetry. Defenders control their own environment, whereas attackers do not. The four mechanisms in this framework amplify attack costs superlinearly. These mechanisms include adaptive computational puzzles, decoy-driven interaction entropy, temporal stretching, and bandwidth taxation. This paper uses game theory to mathematically prove the optimal configuration of EDS, and we found that combining multiple safety mechanisms usually costs 2.1 times as much as using them separately, a key trade-off to consider during design. The good news is that EDS is extremely efficient, using less than 12 KB of memory, making it practical to run on small embedded devices like microcontrollers rather than on expensive servers. EDS is tested on 20 different IoT devices under four attack scenarios. The results showed that attacks slow down significantly, costs become asymmetric, attack success rates drop, and the system adds only 20 ms of latency with no false positive results. When tested against real malware (Mirai, Torii, and Hajime), combining EDS with machine learning detection improved protection from 67 % to 88 %. Adding both techniques together reached 94 % protection, a 27 % improvement overall. Unlike traditional detection-based approaches, EDS operates independently, without requiring attack identification, making it practical for resource-limited IoT devices where other methods simply don't work.