Edge environment relocates processing and storage resources to distributed, resource-constrained nodes at the network periphery, dramatically expanding the attack surface and introducing new security challenges [1]. Unlike centralized cloud data centers with consolidated security controls, edge nodes often operate with minimal oversight and heterogeneous hardware/software stacks, increasing misconfiguration risk and credential exposure. Modern adversaries exploit these weaknesses to mount data poisoning attacks during model training—manipulating Internet of Things (IoT) sensor streams to degrade inference accuracy—and adversarial-example assaults at inference time, where imperceptible perturbations in input signals induce model misclassifications that compromise both confidentiality and integrity of on-device intelligence [1]. Moreover, model-extraction techniques enable attackers to reconstruct proprietary Machine Learning (ML) models by systematically querying edge interfaces, leading to intellectual property theft and downstream privacy breaches [2].

Simultaneously, edge-enabled industrial and cyber-physical systems face volumetric distributed denial-of-service (DDoS) campaigns that overwhelm constrained network links and micro—data centers, effectively severing communication between edge devices and control services [3]. Ransomware has also expanded beyond enterprise servers into the edge domain, encrypting crucial control logic and data repositories to disrupt real-time processes and demand high remediation payments [4]. The physical accessibility of many edge deployments—ranging from roadside units in intelligent transportation systems to on-site gateways in smart factories—further increases exposure to tampering, hardware injection, and side-channel attacks. To realistically assess these multifaceted threats, this work conducts threat analysis on real-world Edge-IIoTset Cyber Security Dataset of IoT & IIoT datasets collected from operational testbeds, ensuring that our evaluations reflect genuine attack patterns rather than synthetic benchmarks [5].

Effective defense in edge environments requires systematic prioritization of limited security resources to address the most consequential threats [6]. From the perspective of cyber resilience, the use of experimental methods and tools for quantitative measurement is indispensable; such an approach enables the systematic enhancement of an organization’s resilience posture [7]. To this end, we develop a scoring framework comprising four quantitative indicators—impact, detection, difficulty, and frequency—that collectively inform risk-driven decision making under operational constraints. First, we map observed attack instances to Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) techniques and tactics by MITRE, standardizing threat descriptions to enable consistent comparison across diverse scenarios. This normalization is critical for edge contexts, where disjointed logs and telemetry often obscure attack lineage.

Impact is quantified using the Common Vulnerability Scoring System (CVSS) v3.1, which synthesizes metrics for exploitability, impact, and environmental factors into a single severity score. By applying CVSS to mapped ATT&CK techniques, we obtain a unified metric for technical and operational risk regardless of device type or deployment context. Detection performance is measured by training deep neural networks(DNN) classifiers on the same real-world datasets, producing empirical detection scores; training employs focal loss to handle class imbalance and hard examples, and task-appropriate data augmentation to improve generalization. This DNN model captures complex feature relationships in network and sensor data, yielding robust detection of both volumetric and subtle stealth attacks.

In this study, execution difficulties are computed across the seven phases of Lockheed Martin’s Cyber Kill Chain by reflecting the characteristic behaviors of each attack type. Attack types that require a larger number of techniques expand both the offensive and defensive surfaces—raising operational complexity and potential exposure—and are therefore classified as higher risk [8,9]. Frequency is derived from the observed prevalence of each attack type in our datasets, the relative proportions of attack types are incorporated through normalization. By integrating these four indicators into a composite scoring model inspired by quantitative risk analysis principles, the practical ranking of attack types is derived as an explainable quantitative measure.

To ensure robustness, we validate the scoring model via non-parametric Spearman and Kendall rank-correlation analyses, demonstrating stability of rankings under perturbations in indicator weights and data sampling. The resulting evidence-based prioritization provides actionable guidance for practitioners to allocate detection, mitigation, and response efforts where they yield the greatest security impact.

The MITRE ATT&CK framework has emerged as a cornerstone of modern cybersecurity practice, serving as a globally recognized knowledge base that systematically categorizes adversary tactics, techniques, and procedures based on real-world observations [10]. Academic analysis demonstrates that ATT&CK’s structured approach to threat intelligence has fundamentally enhanced the systematic detection and analysis of cyber threats, particularly advanced persistent threats, across industries including healthcare, finance, and critical infrastructure [10]. Research shows that over 80% of large enterprises utilize the framework for threat protection, with 57% employing it to identify security gaps and 55% leveraging it for security policy implementation [11]. The framework’s comprehensive documentation of attack behaviors enables security professionals to develop more effective defense strategies and improve incident response capabilities through standardized threat representation.

Edge environments introduce distinctive security challenges characterized by distributed architectures, resource constraints, and dynamic device topologies that significantly expand traditional attack surfaces. These environments face multifaceted threats including data tampering attacks where adversaries alter transmitted or stored data, denial-of-service campaigns targeting resource-constrained edge nodes, and service manipulation attacks where attackers gain control over edge data centers to misrepresent services [12]. Privacy leakage emerges as a critical concern due to the proximity of edge nodes to users and the substantial volumes of sensitive data they process [12]. Physical attacks represent another unique vulnerability, as distributed edge server deployments often operate with weaker physical protection compared to centralized data centers [12]. Research indicates that edge computing networks possess limited computational resources compared to cloud environments, preventing implementation of complex encryption algorithms and creating additional security vulnerabilities [12]. The dynamic nature of edge environments, where devices continuously join and leave networks, further complicates the establishment of consistent security policies and access controls [13].

The integration of MITRE ATT&CK with edge environment security analysis enables systematic mapping of attack behaviors specific to distributed computing environments to standardized threat taxonomies. Academic research demonstrates that ATT&CK’s enterprise and mobile matrices can be effectively extended to address edge-specific attack patterns, including those targeting 5G networks and cellular communications [10]. Studies have successfully mapped cellular attack techniques and procedures to ATT&CK tactics, creating structured frameworks for analyzing threats in mobile edge environments [14]. This integration proves particularly valuable for edge deployments where initial access may occur through compromised IoT devices or physical tampering, enabling defenders to track lateral movement and persistence techniques across distributed infrastructures. Research shows that attack graph methodologies combined with ATT&CK mapping provide dynamic threat modeling capabilities essential for edge environments characterized by continuous topology changes, allowing security practitioners to assess evolving attack paths as devices join or leave networks [14]. The framework’s emphasis on post-compromise behavior analysis addresses the unique characteristics of edge deployments, where traditional enterprise security models inadequately account for physical accessibility vulnerabilities and resource constraints.

ML techniques, particularly DNN, are increasingly adopted for cyber threat detection due to their capacity to model complex, non-linear patterns in high-dimensional data and to generalize to novel attack variants [15–17]. DNN automatically learn hierarchical feature representations from raw network traffic and system logs, enabling superior detection accuracy and lower false positive rates compared to signature-based methods [18]. Furthermore, DNN architectures support real-time inference on streaming data, facilitating rapid identification of volumetric and stealth attacks even in resource-constrained environments such as edge and IoT deployments [18].

The quantitative assessment of cyber threats demands a standardized method to compare vulnerabilities and adversary behaviors across diverse environments. CVSS provides a structured vector of base, temporal, and environmental metrics, translating technical details—such as exploitability, impact, and required privileges—into a unified severity score [19]. Fig. 1 presents the flow from individual evaluation metrics to the final severity rating bands. This allows organizations to prioritize remediation and allocate defensive resources based on objective, comparable risk ratings. Without such an approach, prioritization becomes subjective, and critical threats may be overlooked amidst a flood of alerts and vulnerabilities [19].

Building on the mapping between MITRE ATT&CK techniques and Common Vulnerabilities and Exposures (CVE) identifiers, and leveraging the established correlation between CVEs and their corresponding CVSS vectors, we can quantitatively assess the risk posed by attack paths by synthesizing adversary techniques with documented vulnerability characteristics [20]. This integration enables security teams not only to catalogue threat behaviors but also to rank them by severity, sharpening risk assessments and focusing response on the most impactful attacks [19].

The Cyber Kill Chain is a framework developed by Lockheed Martin that systematizes the cyber-attack lifecycle into seven distinct phases to support analysis and defense planning. The Cyber Kill Chain comprises seven stages—reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives—commonly used to structure analysis and response [21]. The attack execution difficulty increases nonlinearly with the number of Cyber Kill Chain stages traversed and this leads to the defensive surface expands, thereby raising defender-side difficulty [22,23].

As IoT technologies continue to evolve, they have become increasingly intelligent and are delivering value to society in ever more diverse ways [24]. However, alongside these advances in network technology, new security challenges have emerged which must be addressed; accordingly, research into robust methodologies for assessing and prioritizing these risks is actively ongoing [24].

Among the various risk assessment models, we selected the Factor Analysis of Information Risk (FAIR) framework to establish the foundational structure for evaluating cyber threats. A close examination of the FAIR model reveals that it quantifies risk primarily through two core indicators: Loss Event Frequency and Loss Magnitude, treating these as equally significant determinants of overall risk exposure, as illustrated in Fig. 2 [25]. In this study, we extend the FAIR framework by introducing additional dimensions—namely, attack difficulty and detection rate—thereby developing a scalable yet robust risk scoring model that enhances the granularity and applicability of cyber threat assessments.

The Edge-IIoTset Cyber Security Dataset of IoT & IIoT comprises normal logs as well as attack-specific logs stratified by threat category, and provides separate CSV files tailored for ML and DNN workflows. As the raw data are not precurated, it is necessary to perform preprocessing to remove non-informative columns and extraneous records prior to analysis. The resulting curated dataset serves as the foundational corpus for all subsequent risk quantification procedures [26]. The distribution of log counts by attack category in the cleaned dataset is summarized in Table 1.

An examination of the preprocessed data reveals pronounced inter-class imbalance. In particular, the Man-in-the-Middle (MITM) category contains a substantial number of degenerate records that exhibit zero values across all features, further diminishing the already limited effective sample size for this class. Overall, Fingerprinting and MITM possess markedly fewer instances than the other attack types, indicating a need for targeted rebalancing where appropriate. In the section Detection in Noise Environment Using DNN, we detail our strategy to mitigate this imbalance via data augmentation and loss-function design tailored to skewed class distributions [27].

Following data preprocessing, enumeration of attack categories within the curated dataset yields a total of 15 distinct attack types, including a separate class for normal traffic. Excluding the normal class, 14 unique attack signatures are identified. Notably, the security threats observed in actual Edge-IoT & Industrial IoT (IIoT) environments are sufficiently heterogeneous to map across multiple MITRE ATT&CK matrix categories, including Industrial Control System (ICS), Enterprise, and Mobile [28,29]. Accordingly, the mapping process primarily emphasizes techniques rather than general tactics, with each attack signature analyzed for correspondence to specific ATT&CK techniques. In the case of techniques, MITRE ATT&CK assigns distinct identifiers depending on the operational context—for example, Enterprise, Mobile, or ICS. In Table 2, the mapping of techniques is performed by selectively referencing a subset of techniques from multiple operational matrices, prioritizing those most representative of the relevant environments. Notably, many techniques share nomenclature but have different unique identifiers across matrices, reflecting the inherent heterogeneity of edge environments discussed previously [28,29]. Certain attack types, such as DDoS, admit direct mapping to ATT&CK technique identifiers, while others require careful examination of operational characteristics to assign the closest matching technique. This mapping framework further serves as the foundation for quantitative risk assessment when integrated with external vulnerability indices such as CVE and CVSS.

CVSS enables quantitative assessment of risk severity by assigning a computed score for each vulnerability based on its unique vector string. To generate the CVSS vector for each identified threat, the mitigation techniques were systematically mapped to corresponding CVE entries. This mapping was accomplished utilizing CVE data and attack pattern taxonomies provided by the MITRE group [30,31]. Moreover, leveraging dataset-provider descriptions of each attack type and their mapped ATT&CK techniques, CVEs from the past four years were heuristically queried to derive practitioner-aligned associations [26]. Following mapping, each CVSS vector was validated, the associated score was determined, and the results were recorded. The integration of CVE identifiers with CVSS metrics constitutes the foundation of the National Vulnerability Database (NVD), which has emerged as a globally recognized standard for comprehensive vulnerability assessment [32]. The mapped CVEs and their corresponding CVSS values are summarized in Table 3. CVSS v3.1 Base Scores are adopted, and the table records, among CVEs with an available CVSS score, the single CVE with the highest score as the representative entry. For candidate CVEs mapped to each attack type and the CVSS vectors underlying the tabulated scores, as detailed in Appendix A.

DNN have demonstrated state-of-the-art performance in modern security domains and have established themselves as essential tools for intrusion and anomaly detection [18]. Building upon the demonstrated efficacy of DNN in these contexts, the present study systematically evaluates detection rates across various experimental configurations, including the deliberate introduction of synthetic noise and data augmentation techniques to emulate real-world conditions, as well as the selection of appropriate loss functions [33]. These procedures represent a foundational methodology for establishing reliable detection baselines, distinct from the optimized architectures typically employed for achieving maximal detection performance. Specifically, this study employs a Gaussian + Spike (Mixed) distribution as the noise profile.

Gaussian Noise: Following a Gaussian (normal) distribution, characterized by a bell-shaped curve centered at the mean. Gaussian noise is considered a fundamental model in signal processing and communication channel analysis, owing to its prevalence in both theoretical and empirical studies [34].

For the loss function, we employ the standard loss for multi-class classification tasks, sparse categorical focal loss(Focal), which is specifically designed to address class imbalance [37]. This selection is made to reflect the inherent characteristics of the dataset and, together with the chosen noise profile, supports a reliable evaluation of detection performance using Focal.

Sparse Categorical Focal Loss(Focal): Derived by introducing a weighting mechanism into cross-entropy. It dynamically adjusts the weights assigned to easy and difficult samples, thereby improving model performance in scenarios characterized by significant inter-class imbalance [37].

To train the DNN, data proportions were adjusted and noise was introduced during preprocessing. DDoS_UDP was disproportionately large among the attack types; for each training run, it was randomly downsampled by half, after which the Normal-to-Attack ratio was equalized, and Mixed noise was applied to double the sample count of each type. The severely imbalanced minority classes, Fingerprinting and MITM, were augmented tenfold to mitigate class imbalance as far as practicable. Dataset statistics after preprocessing and augmentation are reported in Table 4. Please refer to Appendix B for the DNN layer configuration, optimizer specifications, and other implementation details.

In the context of security threat detection, undetected threats pose far more severe consequences—including significant security breaches, data compromise, and system disruption—than false positives or over-detection [38]. Consequently, quantitative evaluation of detection results is centered on Recall. Training was conducted with three random seeds in total. The noise-free setting is denoted as Clean, and the noise-added setting is denoted as Mixed.

Training was conducted with three random seeds in total. The noise-free setting is denoted as Clean, and the noise-added setting is denoted as Mixed. Figs. 3 and 4 illustrate epoch-wise learning curve for the Clean and Mixed environments, with lines indicating the mean over random seeds and shading corresponding to the standard deviation across seeds.

For the Clean and Mixed environments, the per–attack-type training metrics are reported in Tables 5 and 6. Overall, results in the Clean environment are marginally superior, although certain attack types occasionally exhibit better performance in the Mixed environment.

Figs. 5 and 6 visualize recall across environments. Values are reported to two decimal places, and this visualization serves as input to the scoring model. Because operational settings typically contain mixed noise, the final metric selection adopts the Mixed environment.

To enable the quantitative assessment of risk, our evaluation model adopts key concepts from the FAIR framework. While FAIR employs a multiplicative approach centered on the product of impact and frequency, the present study introduces a lightweight, additive model based on weighted linear combinations of four independently measured factors: the MITRE Impact Score (MIS), Frequency Score (FS), Detection Score (DS), and Difficulty Score (DifS) [25,39]. This revised structure facilitates independent evaluation and targeted feedback for each risk component [39].

MIS: The previously mapped CVSS risk scores, which range from 0.0 to 10.0, are normalized to a 0–1 interval via division by 10 for incorporation into the risk scoring framework.

Based on the aforementioned factors, the risk scoring model is formulated as follows: (1)RiskScore=MIS∗α+FS∗β+DS∗γ+DifS∗δ

The weights assigned to each factor are as follows: MIS (35%, α = 0.35), FS (30%, β = 0.30), DS (25%, γ = 0.25), and DifS (10%, δ = 0.10). MIS and FS are regarded as the two most influential components within the risk scoring model; however, MIS is allocated a slightly greater weighting than FS due to its heightened impact on overall risk variation [25,39]. Following model formulation, real-world risk assessment is conducted, after which the robustness of the risk evaluation framework itself is systematically validated.

An additive scoring model enables meaningful evaluation of low-frequency yet high-impact attacks, while preserving the independent interpretability of each indicator and preventing the severe distortions that multiplicative aggregation can induce [43,44]. By managing multiple threat dimensions for cyber attack types as independent components and combining them additively via weights, the model maintains priority across indicators and captures multidimensional risk characteristics in a realistic and effective manner.

The outcomes of the risk scoring model, incorporating all specified factors and their corresponding ground truth values, are summarized in Table 9.

Based on the proposed model, quantitative risk scores were generated for each attack type. The weights assigned to individual model components are subject to variation, and changes to these weights may significantly impact the resultant risk scores—a phenomenon referred to as sensitivity [45]. A model exhibiting low sensitivity to such variations is considered robust, as its output remains stable despite perturbations in parameter weighting [45].

For model validation, statistical measures widely employed across diverse disciplines—specifically, Spearman’s and Kendall’s rank correlation coefficients—are utilized to assess agreement between model outputs and empirical observations [46].

Spearman’s correlation coefficients: Spearman’s correlation coefficients quantifies the linear association between ranked variables; a value δ≥0.9 is interpreted as indicative of a robust model [47].

Each of the four model parameters was systematically perturbed by varying proportions (−10%, −5%, +5%, +10%), while the remaining components were adjusted proportionally to ensure the aggregate weighting remained normalized to 100%. This set of perturbations was applied to both correlation-based validation frameworks, and the resulting robustness profiles are presented in Figs. 7 and 8.

Spearman’s and Kendall’s rank correlation coefficients are nonparametric; accordingly, bootstrap resampling with replacement is used to obtain standard errors and confidence intervals, thereby strengthening the robustness of the scoring model [49]. After generating 2000 bootstrap samples for the results across 14 attack types, scores and ranks are computed by applying the respective indicator weights to each resample. Based on these, 95% confidence intervals are obtained as shown in Table 10, demonstrating the stability of the ranks and the robustness of the model. When the DifS indicator is decreased by 10%, its weight effectively drops to 0%, causing substantial sensitivity shifts; excluding this condition, the results remain highly stable under nearly all perturbations [49].

Based on our risk scoring model, we have quantified each component of the attack types to compute an aggregate risk score. Furthermore, we conducted a sensitivity analysis of the risk scoring model using Spearman’s and Kendall’s rank correlation coefficients. The results confirmed the model’s robustness. Table 11 presents the risk scores in descending order, thereby establishing a ranked prioritization of the attack types.

Fig. 9 illustrates the influence of each evaluation factor on the risk scores and their resultant rankings. A histogram analysis reveals that for the majority of attack types, a higher MIS tends to correlate with a higher overall rank. Among the top-ranked categories, SQL_injection and Uploading stood out due to their relative difficulty of detection, distinguishing them from other high-ranking attack types. DDoS variants achieved high FS values; however, their inherently lower MIS led to mid-to-lower tier rankings overall.

SQL_injection was ranked overwhelmingly first, achieving exceptionally high scores across all evaluation metrics. This finding aligns with the real-world industrial assessment where SQL injection is consistently classified as one of the top-tier security risks [50]. The most conspicuous metric was its DS, which was the highest among all 14 attack types. The DNN model recorded a detection rate of less than 20%, which is consistent with research findings indicating that advanced and polymorphic SQL injection attacks are difficult to detect and thus pose a significant vulnerability [51].

Ransomware, while assigned very high MIS and DifS scores given its well-known destructive impact, ranked fourth because detection proved comparatively easier in our evaluation. Nevertheless, given its sustained destructive potential, it remains a key attack category that warrants constant vigilance. This inference is supported by other research, which warns that although the core behaviors of ransomware can be relatively straightforward to detect, a successful attack can lead to catastrophic financial and societal damage [52,53].

While the Edge-IoT dataset utilized for our risk model contained a ‘frame.time’ column, it was ultimately excluded during preprocessing due to significant data quality issues. The logged timestamps lacked a consistent format, and many entries were ambiguous, rendering the data unsuitable for rigorous time-series analysis. This is a notable limitation, as time-series data can serve as a critical indicator, enabling the modeling of various distributions and mass functions beyond simple frequency counts [54]. Consequently, the absence of reliable temporal data restricted our ability to model more sophisticated functions for the FS calculation in this study.

There is a notable scarcity of publicly available cybersecurity datasets, and even when such datasets exist, they often present significant analytical challenges. A fundamental problem is that many available datasets do not reflect the contemporary technological landscape, thus providing an inadequate basis for evaluating modern threats and validating new models [55]. This scarcity of relevant, high-quality data ultimately impedes the development of robust and timely security metrics [55].

While assessing aggregate, ecosystem-wide cyber risk is important, it is equally necessary to evaluate threats using site-specific datasets tailored to particular operational contexts. Although proprietary datasets are more constrained than aggregated benchmarks, they enable risk assessments that align with the realities of a given industry environment. Achieving this requires high-quality time-series telemetry and consistent log collection across heterogeneous edge devices, ensuring comparability and longitudinal reliability.

Cyber-attacks are growing in sophistication and intelligence, leading to a commensurate surge in financial and societal damages [56]. The recent advent of generative AI has magnified this risk, yet new technologies are often adopted without adequate security assessment procedures, creating a reality where defensive capabilities lag behind the non-linear growth of threats [57].

In this context, our research introduces a lightweight model designed to provide quantitative risk metrics. While the threat landscape is evolving rapidly, the development of indicators and frameworks to accurately measure and evaluate these changes has not kept pace [55]. We contend that in such a dynamic environment, a lightweight model enabling at least a baseline security evaluation is a valuable and pragmatic approach, allowing organizations to maintain alignment with and respond to the rapidly changing threat environment.

While greater rigor in designing quantitative evaluation metrics generally improves reliability, it also increases complexity and slows updates. In this study, limitations arising from reliance on a single dataset, the constraints of DNN models, and skepticism toward alternative metrics are all acknowledged as valid concerns. Nevertheless, to deliver a highly portable, field-ready lightweight scoring model, deliberate trade-offs were made, enabling a challenging yet effective approach that culminated in actionable conclusions. The community should continue to debate which values to prioritize and at what point to reach consensus so that defensible, practically acceptable evaluation models can be developed.