Special Issue: Intrusion Detection and Resiliency in Cyber-Physical Systems and Networks

The rapid expansion of cyber-physical systems (CPSs) and networked environments—including the Internet of Things (IoT), Industrial IoT (IIoT), and the Internet of Vehicles (IoV)—has transformed modern infrastructures, enabling unprecedented connectivity, automation, and data-driven intelligence. However, this connectivity has simultaneously broadened the attack surface, exposing networks to sophisticated cyber threats such as denial of service (DoS), spoofing, zero-day exploits, multi-class intrusions, and malicious domain activities. Robust intrusion detection systems (IDSs) and resilient network architectures have therefore become essential for maintaining the security, reliability, and trustworthiness of these interconnected systems.

This Special Issue brings together ten high-quality contributions, reflecting both the rigor and novelty of current research into intrusion detection and resilience concerning both CPSs and networks. Collectively, these works explore emerging techniques, AI-driven frameworks, and practical solutions for protecting complex networked environments.

Several contributions focus on surveying and synthesizing the state of the art in IDS research. The authors of [1] present a comprehensive survey of Interest Flooding Attacks (IFAs) in Named Data Networking (NDN), highlighting vulnerabilities in the stateful forwarding plane and classifying IFA variants into fake, unsatisfiable, looping, and collusive types. Their analysis evaluates mitigation strategies—including rate limiting, PIT management, machine learning, reputation systems, and blockchain-based approaches—and addresses domain-specific adaptations for the IoT, wireless sensor networks, and vehicular networks. Similarly, the survey presented in [2] reviews ensemble learning approaches for multi-class IDSs in IoV networks, covering techniques such as bagging, boosting, stacking, and hybrid methods. It proposes a taxonomy of deployment strategies, data fusion techniques, and learning paradigms while identifying gaps in lightweight, scalable, and adversarially robust solutions.

A prominent theme in this Issue is the integration of deep learning and hybrid AI models. The transformer–GAN–AE framework presented in [3] for Edge and IIoT systems combines transformers for temporal feature extraction, GANs for synthetic data generation, and autoencoders for denoising, with improved chimp optimization algorithm (IChOA) hyperparameter tuning. The model achieves up to 98.92% accuracy, demonstrating scalability and resilience in real-world IIoT scenarios. Complementing this, the authors of [4] present a hybrid transformer–GAN framework with INSBBO-based optimization for IoT networks, reaching 99.67% accuracy with high stability and efficiency. CNN-based IDS approaches, as demonstrated in [5], leverage spatial pattern extraction to outperform traditional machine learning models across binary and multi-class IoT/IIoT detection tasks.

Several studies address data imbalance and minority-class detection, a persistent challenge in IDS. The SNNL-enhanced GAN framework outlined in [6] improves feature-space alignment between real and synthetic data, enhancing minority-class detection without compromising overall accuracy. In parallel, [7] introduces a federated learning framework with ResVGG-SwinNet, enabling privacy-preserving multi-label DDoS detection in IoT networks. This approach combines distributed training, advanced preprocessing, and hybrid deep learning, achieving 99% accuracy, low false alert rates, and high optimization efficiency.

IoV-specific IDS research is highlighted in [8,9]. The review presented in [8] emphasizes generative AI methods—GANs, VAEs, and transformers—for enhanced adaptability and synthetic data generation in vehicular networks. The experimental study in [9] evaluates ensemble methods for CAN bus security, showing that hyperparameter-optimized models such as XGBoost and Random Forest achieve perfect accuracy and macro-average F1-scores even under imbalanced traffic, demonstrating robust real-world performance.

Beyond conventional IDS, ref. [10] addresses malicious domain detection, improving TLS fingerprinting with HTTP header enrichment, MinHash, and locality-sensitive hashing. The method successfully identifies 67 previously unknown malicious domains, illustrating potential for early threat detection beyond traditional allow/deny lists or SIEM approaches.

Taken together, the ten contributions to this Special Issue highlight several key trends in contemporary IDS research:

• Hybrid architectures combining deep learning, GANs, transformers, and autoencoders for robust detection in high-dimensional, noisy environments.
• Ensemble and federated learning approaches that improve generalization, minority-class detection, and privacy-preserving capabilities.
• Advanced data augmentation and feature enrichment techniques to mitigate imbalance and enhance the detection of rare threats.
• Strong focus on real-world applicability, demonstrated through evaluations on benchmark IoT, IIoT, and IoV datasets.
• Emerging directions, including explainable AI, adaptive hybrid defenses, and standardized evaluation frameworks for next-generation CPS networks.

We are pleased to present these ten contributions, which collectively advance intrusion detection and resiliency in CPS, IoT, IIoT, and IoV networks. Each paper addresses distinct challenges while sharing the common goal of enhancing security, adaptability, and trustworthiness in increasingly interconnected environments. We thank the authors for their contributions, the reviewers for their insightful feedback, and the editorial team for their support. We believe that this Special Issue will serve as a valuable reference for researchers, practitioners, and policymakers working to safeguard critical infrastructure and digital ecosystems.