Machine learning-driven self-healing zero-trust architecture for secure edge–cloud continuum

The rapid proliferation of Internet of Things (IoT) devices and distributed computing platforms has accelerated the adoption of the edge–cloud continuum, an architectural paradigm that integrates edge devices, fog nodes, and centralized cloud infrastructures to support real-time data processing and latency-sensitive applications. While this architecture enhances scalability, responsiveness, and intelligent service delivery, it simultaneously expands the cyber-attack surface due to the presence of heterogeneous, resource-constrained, and geographically distributed devices. Traditional perimeter-based security mechanisms are increasingly inadequate for protecting such dynamic environments, while many existing Zero Trust Architecture (ZTA) implementations rely on static access control policies and centralized decision mechanisms that limit scalability and real-time responsiveness. This study proposes a Machine Learning-Driven Self-Healing Zero Trust Architecture (SH-ZTA) designed to enable autonomous cyber resilience across the edge–cloud continuum. The framework integrates Graph Neural Networks (GNNs) for relational anomaly detection and Deep Reinforcement Learning (DRL) for adaptive security policy orchestration. Network telemetry data collected from IoT devices and edge gateways are represented as communication graphs, enabling the detection of abnormal interactions, compromised nodes, and potential lateral movement attacks. The reinforcement learning agent dynamically enforces micro-segmentation policies, isolates malicious entities, and reconfigures network pathways to maintain operational continuity without human intervention. Experimental evaluation conducted in a simulated edge computing environment demonstrates that the proposed SH-ZTA framework significantly improves threat mitigation efficiency while maintaining low computational overhead suitable for resource-constrained devices. The results show improved detection accuracy, faster response latency, and enhanced network resilience compared to conventional security approaches.