Adaptive edge-cloud isolation forest-autoencoder pipeline in real-time with delta policy feedback for zero-day IoT smartwatch intrusion detection.

Smartwatches and other wearable IoT devices constantly stream physiological and behavioral data, making them vulnerable to zero-day attacks that traditional signature-based intrusion detection systems (IDS) are unable to identify and that current hybrid edge-cloud IDS leave momentarily unprotected while a cloud verdict is awaited. This approach outlines a fully reproducible three-tier detection pipeline: publisher, edge, and cloud. An edge-resident Isolation Forest scores anomalies in <50 ms and instantly isolates suspicious traffic before consulting the cloud; a cloud-resident Autoencoder and Random Forest confirm and categorize the anomaly; and a lightweight delta policy update is sent back to the edge so that its classifier adjusts to newly identified threats without requiring full model retransmission. The process is detailed step-by-step with governing equations, decision thresholds, and pseudocode so that it may be extended to various wearable or resource-constrained IoT security issues and reimplemented on any edge-cloud REST architecture.•Outlines a repeatable edge-isolation-before-verdict process that eliminates the exposure window that allows malicious traffic to continue while a hybrid intrusion detection system awaits a cloud decision.•Offers a delta-policy feedback mechanism that prevents full-model redeployment over limited IoT uplinks by allowing the edge Isolation Forest to gradually absorb cloud-discovered zero-day patterns.•Provides worked thresholds and equations, along with a rigorous held-out zero-day evaluation process, to enable independent validation and re-parameterization of the method for different datasets.