AI-Based Behavioral Monitoring in Zero Trust IoT Architectures

The proliferation of heterogeneous Internet of Things (IoT) devices has expanded the attack surface of modern networks, exposing the limitations of perimeter-based security models. Zero Trust Architecture (ZTA) addresses this by enforcing continuous verification, but static policy checks alone cannot detect compromised devices that behave abnormally after initial authentication. This paper proposes an AI-based behavioral monitoring framework integrated into a Zero Trust IoT environment, in which device and user behavior is continuously profiled using lightweight machine learning models to detect anomalies indicative of compromise, lateral movement, or policy violation. The framework combines flow-level traffic features, device fingerprinting, and sequence-based behavioral modeling with a trust-scoring engine that dynamically adjusts access privileges. We evaluate the approach on a simulated smart-building IoT testbed comprising sensors, actuators, and gateway nodes, comparing isolation forest, LSTM-autoencoder, and gradient-boosted classifier models. Results show that the LSTM-autoencoder achieves the highest detection accuracy for slow, low-signature attacks such as credential misuse and command-and-control beaconing, while maintaining low false-positive rates suitable for resource-constrained deployments. The findings demonstrate that coupling behavioral analytics with Zero Trust access control significantly improves the detection of post-authentication threats compared to static rule-based monitoring, and the approach is applicable to enterprise IoT, industrial control, and smart-building deployments.