Triarchy-Based for DDoS-Resilient IoT Networks

Identifying cost-effective attack scenarios in large-scale IoT networks from an adversarial perspective is vital for proactive defense planning, since protecting even a subset of nodes can significantly improve overall resilience. However, no dedicated algorithm currently pinpoints the most efficient attack paths under realistic cost constraints. In this paper, we introduce a new graph structure, the triarchy graph, to formalize cost-efficient attack-path identification and establish the problem's NP-completeness. Building on this formulation, we propose CRL-MTD, a cost-effective reinforcement learning (RL)-based moving target defense strategy that learns to identify high-impact attack paths and strategically perturbs them to delay adversaries while minimizing operational burden. We evaluate CRL-MTD on real-world SNDlib-based IoT topologies under simulated Mirai botnet attacks. Experimental results show that CRL-MTD improves solution efficiency by 15%, increases attack execution delay by 111%, and reduces system overhead by 90% compared with representative baseline approaches, demonstrating strong practicality for DDoS-resilient IoT deployments.