Toward Stress-Adaptive Cyber Defense: Cognitive–Physiological Synchronization in IoT Environments

Security Operations Center (SOC) analysts experience notable performance degradation under elevated cognitive stress, yet existing systems treat stress detection and decision support as separate problems. This paper presents a Cognitive–Physiological Synchronization (CPS) Framework for IoT-based Security Operations Centers (IoT-SOCs) that integrates multimodal physiological stress inference with cognitive decision-making agents to enable real-time, uncertainty-aware action selection in cybersecurity environments. Our framework employs a calibrated DNN-XGBoost ensemble to estimate stress probability from electrocardiogram (ECG), electrodermal activity (EDA), and respiration signals collected via wearable biosensors. The CPS layer converts these physiological beliefs into actionable cognitive utilities through Bayesian log-odds updates, dynamically aligning decision policies with the analyst’s momentary stress state. We further introduce a Utility-Aware Temporal Reasoner (UATR) that smooths sequential evidence over time and a Stress-Weighted Memory (SWM) mechanism that adapts experience recall within the SpeedyIBL cognitive model. Evaluated using leave-one-subject-out cross-validation on the WESAD dataset, the framework achieves 95.8% accuracy (AUC = 0.967) with sub-second latency. In zero-shot SOC simulations using CICIDS2017 tasks, unsupervised calibration enhances decision stability and reduces false escalations relative to rule-based baselines. Results confirm that synchronizing physiological stress inference with cognitive policy selection improves end-to-end action quality under uncertainty, laying a foundation for Internet of Things (IoT)-connected, human-centered adaptive cybersecurity operations across cyber–physical and edge environments.