A Multi-Layer ICT Architecture for Real-Time Intrusion Detection and Autonomous Mitigation in Embedded Microcomputer Networks

Information and Communication Technologies (ICT) form the backbone of modern edge infrastructures, interconnecting embedded nodes, distributed microcomputers, and network gateways. Securing these environments requires more than passive threat detection: it demands a coherent architecture combining real-time packet capturing, on-node feature extraction, lightweight machine learning classification, and dynamic link-layer mitigation under realistic attack conditions. This paper presents a multi-layer ICT architecture for embedded network intrusion detection and prevention systems (NIDS/NIPS), paired with machine learning signal models to detect, signal, and autonomously block multi-class cyberattacks before network degradation occurs.
The proposed architecture organizes the security pipeline into six cooperating layers physical microcomputer nodes, live packet capturing, statistical feature extraction, machine learning classification, automated firewall control, and real-time monitoring dashboard. On-node processing combines flow-level traffic filtering with Random Forest and XGBoost classifiers for unsupervised and supervised characterization of multi-modal attack distributions, followed by an automated mitigation stage using dynamic iptables rules. Laboratory experiments on a physical multi-microcomputer testbed (incorporating Raspberry Pi nodes acting as attackers, targets, and gateway defense units) report mean attack detection accuracy above 98.7%, malicious traffic classification latency below 18 ms, and automated packet drop enforcement within 35 ms of detection. The contribution is a practically validated ICT security blueprint that couples machine learning-driven threat detection with communication-aware automated response for resilient edge computing networks.