Edge-distributed adaptive security for cyber-physical systems: anomaly-gated detection, decentralized trust and joint network-level evaluation

Cyber-physical systems (CPS) distribute sensing and inference across devices, edge servers and the cloud, yet their defences are rarely evaluated jointly for detection quality and network cost. We present an edge-distributed framework in which each edge server runs a two-stage detector (benign-trained autoencoder gate plus XGBoost classifier) and a decentralized trust protocol that drives graded response and trust-weighted routing. We prove that the trust recursion is a max-norm contraction, so it converges under asynchronous execution. On UNSW-NB15 and TON_IoT, the gate raises the mean zero-day catch rate over nine withheld classes from 88.0% to 93.5% and from 83.6% to 88.0%, but increases false positives; on CIC-IDS2017 DDoS it only adds false positives. In NS-3 simulations with 50–500 nodes and identical link capacities, edge rather than central inspection raises legitimate delivery from 40.0% to 94.7% at 500 nodes, and graded per-node response raises it to 99.0% without quarantining benign nodes.