Myco-barrier: edge-orchestrated post-detection mitigation of IoT botnets via an SDN-based virtual dynamic demilitarized zone

Internet of Things (IoT) devices are highly vulnerable to botnet attacks because they are heterogeneous, resource-constrained, and often weakly managed. Although many existing studies focus on IoT botnet detection, the post-detection stage remains comparatively underdeveloped, particularly when mitigation must be rapid, lightweight, and able to preserve service continuity. This paper presents Myco-Barrier, a bio-inspired post-detection mitigation architecture implemented as a virtual dynamic demilitarized zone (DDMZ) at the network edge. The framework translates principles from fungal mycorrhizal networks and the blood-brain barrier into an SDN-controlled overlay that supports three complementary mitigation modes: Myco-Scout for rapid isolation, Myco-Box for sandbox-based forensic routing, and Myco-Swap for continuity-preserving virtual proxy substitution. Myco-Barrier assumes that suspicious behaviour has already been identified by an upstream intrusion detection system and focuses on mitigation orchestration after alert generation. The framework is evaluated through a dual-tier methodology consisting of large-scale discrete-event simulation and Mininet/OVS emulation. The evaluation indicates that Myco-Scout provides the fastest containment and lowest control-plane actuation latency, whereas Myco-Swap provides the strongest service continuity, maintaining about 85% legitimate delivery under the evaluated flooding scenario. Overall, these findings support the feasibility of edge-orchestrated post-detection mitigation and clarify the trade-offs among containment, inspection, and service continuity in heterogeneous IoT environments.