Network security is a crucial challenge facing Internet-of-Things (IoT) systems worldwide, which leads to serious safety alarms and great economic loss. This paper studies the problem of malicious interdicting network exploitation of IoT systems that are modeled as a bi-layer logical–physical network. In this problem, a virtual attack takes place at the logical layer (the layer of Things), while the physical layer (the layer of Internet) provides concrete support for the attack. In the interdiction problem, the attacker attempts to access a target node on the logical layer with minimal communication cost, but the defender can strategically interdict some key edges on the physical layer given a certain budget of interdiction resources. This setting generalizes the classic single-layer shortest-path network interdiction problem, but brings in nonlinear objective functions, which are notoriously challenging to optimize. We reformulate the model and apply Benders decomposition process to solve this problem. A layer-mapping module is introduced to improve the decomposition algorithm and a random-search process is proposed to accelerate the convergence. Extensive numerical experiments demonstrate the computational efficiency of our methods.