Secure Lightweight Embedded HTTPS Server: Autonomous Threat Detection and Mitigation at the Edge

Abstract

This paper presents the design, implementation, and evaluation of a Secure Lightweight Embedded HTTPS Server (SLEHS) engineered for resource-constrained hardware and deployed on the RP2350-based Wiznet W6100-EVB-Pico2 platform. Traditional Hypertext Transfer Protocol Secure (HTTPS) implementations introduce significant computational overhead and remain highly vulnerable to low-volume resource exhaustion due to strict hardware socket limits. To mitigate these threats, we introduce a lightweight, two-phase operational protocol that combines a pre-shared key (PSK) cryptographic handshake with an exclusive, single-client TLS 1.3 session. To protect the underlying network stack, the system combines an adaptive anti-SYN-flooding mechanism featuring dynamic blacklists/whitelists with strict, hardware-level filtering for packet fragmentation and TCP header anomalies. The system was experimentally evaluated under various active exploit scenarios, including intensive Denial-of-Service (DoS) and malicious scanning attacks. The evaluation compared the security and stability of the SLEHS against an unprotected server to verify the overall effectiveness of our lightweight defensive architecture.