Search Results (515)

We set out to fix a “contamination” problem in reconstruction-based Temporal Convolutional Network VAEs (TCN-VAEs) for cross-dataset IoT flow anomaly detection: when attack flows share an encoder window with benign flows, the shared latent code is allegedly distorted, inflating benign reconstruction error and producing false positive rates (FPRs) of 22–65% despite an ROC-AUC above 0.93. Our proposed fix, TCN-Pred, excludes the target flow from the encoder and scores it by next-flow prediction error, reducing FPR to 0.65–13%. We subjected this causal explanation to a battery of controlled ablations, holding architecture, decoder, loss, and thresholding fixed while varying one factor at a time. Each one falsified the original hypothesis: target inclusion/masking changes FPR by at most 0.001; context shuffling/reversing/zeroing changes it by at most 0.003; a context-blind constant-output predictor matches TCN-Pred’s FPR and F1 to three decimal places on all three datasets. The actual cause, confirmed on the original trained models with no retraining, is a scoring-granularity mismatch: the TCN-VAE threshold is calibrated from per-window errors averaged over 20 flows but applied to per-flow errors at evaluation (standard deviation $\approx \sqrt{20}\times$ higher, measured ratio 4.46 against a predicted 4.47). Recalibrating the identical model at matching granularity drops FPR from 22.7/47.6/64.6% to 0.65/5.0/12.5% on BoT-IoT, IoT-23 and ToN-IoT, closing 89–97% of the reported FPR gap without changing a single model weight. We report this diagnostic chain, together with an attack-prevalence sensitivity analysis, sample-disjoint calibration, normality diagnostics, and label-free and redundancy-aware (mRMR) feature-selection benchmarks, as a methodology other work should apply before attributing fixed-threshold performance to architecture. The pipeline is supervised source-domain feature selection followed by benign-only detector training, not fully unsupervised, a distinction we quantify later in the paper. Investigating dataset representativeness, we found that all three provided files reduce to only ≈6000 genuinely distinct flows via an undocumented row-duplication procedure, causing 97.8% BoT-IoT train/test near-duplicate overlap; a leakage-free re-evaluation changes FPR by only 0.23 percentage points. We also found that the TLS-metadata columns are already transformed upstream of every available artefact, so the proportion of genuinely TLS-encrypted flows cannot be recovered, and we soften the paper’s encrypted-traffic framing accordingly. Full article

Federated, semi-supervised novelty detection is well suited for intrusion detection on resource-constrained Internet of Things (IoT) nodes: each device learns a model of benign traffic, shares only summary statistics, and does not transmit raw traffic samples. A previously published cross-layer federated detector, Baseline K-Means, showed that periodically merging worker statistics through a coordinator raises the detection rate, but it also exhibited a systematic side effect: after every merge, the precision decays, and the false-positive rate (FPR) climbs because the coordinator recomputes its threshold from streaming distances filtered by the closest observed anomaly, so tightens after every merge, flagging progressively more benign traffic; the threshold was also hand-tuned. We present AF-BKM, an Adaptive Federated Baseline K-Means that repairs the federated mechanism with two label-free, statistics-only enhancements, denoted as E1 and E2: (i) an adaptive decision threshold read from the benign Mahalanobis-distance distribution, requiring no manual percentile search and no attack labels (E1), and (ii) a robust, benignly anchored aggregation that blends worker means under quality weighting and outlier-worker filtering and recalibrates the threshold on a trusted benign anchor to a stable, anchor-referenced false-positive level, which a target-FPR rule can make operator-selectable instead of tightening it toward the nearest anomaly (E2). With MinMax scaling fit only on benign baseline data and non-IID federated streams on NSL-KDD, UNSW-NB15 and the N-BaIoT corpus of real traffic from commercial IoT devices, AF-BKM removes the merge-induced precision decay (the first-to-last-epoch precision change improves from $-0.134$ to $-0.002$ on NSL-KDD, from $-0.121$ to $-0.014$ on UNSW-NB15, and from $-0.170$ to $-0.009$ on N-BaIoT) and reduces the mean FPR by 30–$64\%$, depending on the dataset; all central improvements are significant across 10 seeds (Wilcoxon $p=0.002$, large effect sizes). AF-BKM preserves recall on NSL-KDD and N-BaIoT and, on the harder UNSW-NB15, exposes an explicit precision–recall trade-off through a benign target-FPR knob. In fp32, the deployed model serializes to $5.5$–52 KB, a packet is classified in 11–27 µs on a desktop CPU, and each merge round uploads a $d+3$-value summary (160–472 B) $94.6$–$98.3\%$ smaller than the same summary extended with the covariance upper triangle. A robustness study covering selected faulty-worker updates, contamination of the commissioning anchor, and detector-level white-box evasion reports the measured degradation patterns: fabricated threshold candidates have no direct path to the threshold, although a fabricated mean still reaches it indirectly through the blended centroid, and the anchor-referenced false-positive level remains stable under percent-level anchor contamination, while recall sensitivity is dataset-dependent and the evasion budget tracks the benign–attack margin of each dataset. We frame the contribution with a focused taxonomy that identifies merge-induced precision decay under non-IID workers as an open gap. Code is released for reproducibility. Full article

Aquaculture requires continuous environmental monitoring, yet low-cost IoT sensing in marine conditions remains poorly characterised, and the data it produces is rarely accompanied by mechanisms establishing its provenance. This paper presents an IoT sensor system for marine and coastal aquaculture, comprising solar-powered 4G multiparameter nodes, a cloud-native back-end with a RESTful layer, and integration with a blockchain-based change-detection mechanism supplying a GS1-compliant digital product passport. Four nodes in adjacent cages were deployed at a marine site on the Montenegrin Adriatic for eight weeks, measuring temperature, pH, dissolved oxygen, oxidation–reduction potential and conductivity at five-minute resolution. Lacking reference instrumentation, we use agreement between nodes for validation. Temperature showed the closest cross-node agreement, with nodes agreeing to within 0.28 °C, and resolved a coherent cold, low-salinity intrusion detected simultaneously by all four nodes. The electrochemical and optical channels proved precise but not accurate: they tracked relative change coherently while their absolute values diverged, with oxidation–reduction potential moving from 9 mV of agreement to 71 mV over the following weeks. Cross-node coherence in conductivity and dissolved oxygen degraded progressively over the deployment, with no electrochemical or optical channel remaining coherent beyond roughly six weeks. Such sensors suit anomaly detection without calibration but require periodic recalibration for absolute reporting. Tamper-evident provenance is therefore necessary but not sufficient: sensor-level quality assurance is its missing half. Full article

With the ever-evolving and constantly growing need for electric vehicles (EVs) in the automotive industry, the importance of reliable, efficient, and dynamic EV chargers is increasing. Power electronics is the enabler and forms the execution layer of any charging station. EV charging must now integrate fast control, wide adaptability, bidirectionality, and reliability. The existing literature provides overview studies on the EV charging system, its infrastructure, and necessary power electronics. However, the integration of 5G-enabled EV charging (i.e., data transmission/communication via the 5G network) has introduced new performance expectations that go beyond the capabilities of conventional power converters. This paper presents an in-depth overview of power electronics applications in a 5G-enabled EV charging system. Several key aspects such as advanced converter topologies, a resonant converter for 5G charging, the integration of power electronics with 5G communication, and anomaly and intrusion detection models for a 5G-enabled Blink-2-level EV charger are discussed. Moreover, the challenges and risks of integrating 5G into EV charging infrastructure are discussed. Some recommendations on future research opportunities are provided. This study provides a basic guideline on power electronics applications in a 5G-enabled EV charging system and is therefore valuable to the researchers, scientists, and engineers working in this interesting field. Full article

Mobile-network operators must interpret spatial anomalies in aggregated cell-level telemetry and decide whether, where, and how to respond. This paper presents a privacy-conscious, intrusion detection system (IDS)-oriented triage and response architecture that consumes cell-level anomaly signatures and couples spatial reconstruction, short-horizon forecasting, origin inference, self-resolution and remaining-time estimation, adaptive gating, ETA-aware team selection, conservative redeployment, explanation, and audit logging. It is a downstream spatial-attribution and response-orchestration layer, not a packet- or flow-level attack detector. The evaluated configuration uses transparent deterministic, heuristic, and optimization-based procedures and synthetic aggregated signatures without subscriber identifiers; aggregation is treated as data minimization, not a formal privacy guarantee. Across 20 paired synthetic scenarios, the full policy reduced conditional mean response time from 37.58 to 22.86 min, total travel from 576.0 to 273.5 min, and coverage ETA from 32.28 to 26.76 min, while on-time service increased from 54.0% to 60.0%. These benefits were accompanied by lower persistent-incident coverage (91.1% to 72.1%) and a higher miss rate (8.9% to 27.9%). The inverse-origin configuration showed no repeated localization-error advantage, and conservative redeployment had only a marginal average effect. The results therefore demonstrate a configurable downstream triage trade-off under controlled synthetic conditions, not attack-classification accuracy, adversarial robustness, formal privacy, or deployment readiness. Full article

Cooperative sensing systems that exchange state estimates are exposed to two types of adversaries, namely, insiders who transmit correctly authenticated falsified content and outsiders who modify messages in transit after compromising a symmetric link key, each requiring a distinct mitigation strategy. These attacks are observationally identical to a detector that examines only message content, although an insider must be revoked and an outsider must be countered through key rotation and link hardening. To distinguish between insider falsification and outsider in-transit message modification, a cross-layer intrusion detection and attack-attribution framework named QSec-DAI is proposed. Per-message anomaly scores are supplied by a recurrent detector, and a hybrid-symmetric, post-quantum and quantum authentication stack is arbitrated by belief-desire-intention agents under a finite-key budget. Authentication is used as an active probe because a suspicious link is hardened, and the persistence or disappearance of the anomaly is then observed. On real cooperative-localization data, an area under the receiver operating characteristic curve of 0.981 is achieved. Benign, insider and outsider classes are attributed with a macro-averaged accuracy of 0.794 and a man-in-the-middle recall of 0.719. Under the explicitly defined attribution mapping, outsider recall is zero for the evaluated baselines that remain in fixed-symmetric mode after key exposure. In the real-data evaluation, malicious influence on fusion is limited to 0.10 percent. The no-cooperation control indicates that several classical defenses suppress attacks mainly by discarding cooperative information rather than by preserving useful cooperation. Protocol-level fault injection shows that replay is rejected while monotonic freshness state is intact, whereas compromise of the verifier or of all independent strong credentials removes defensible outsider identifiability. The quantum component is therefore presented as one resource-constrained strong-authentication option rather than as a source of quantum-enhanced anomaly detection. Full article

The rapid deployment of Internet of Things (IoT) devices across smart cities, healthcare systems, industrial automation, transportation networks, smart grids, and cyber-physical infrastructures has expanded the modern cyberattack surface. IoT devices are often constrained by limited processing capacity, memory, battery power, and communication bandwidth, making conventional security mechanisms difficult to deploy consistently at scale. Intrusion detection systems (IDSs) provide an important defensive layer; however, many machine-learning-based IDSs are developed under static assumptions and may experience performance degradation as traffic distributions evolve due to firmware changes, device onboarding, protocol updates, user behavior variation, or adaptive attacks. This paper presents a hybrid IDS framework that integrates supervised Random Forest classification, unsupervised Isolation Forest anomaly monitoring, and Kolmogorov–Smirnov (KS)-based concept drift monitoring. In the experimental pipeline, Isolation Forest is trained exclusively on benign traffic to ensure that the anomaly detector models normal behavior rather than an attack-dominated training distribution. The evaluation uses a large-scale chronologically sampled subset of the CICIoT2023 dataset containing 3,890,621 records while preserving the natural class distribution of 2.35% benign traffic and 97.65% attack traffic. The chronological 80/20 train/test split is established first at the file level, followed by systematic sampling within each split to reduce the risk of leakage across the evaluation boundary. On the 746,094-record test set, the proposed hybrid IDS achieved 99.73% accuracy, 99.89% precision, 99.83% recall, 99.86% F1-score, and a false positive rate of 4.77%. The corresponding confusion matrix contains TN = 16,683, FP = 836, FN = 1205, and TP = 727,370, yielding 95.23% specificity and 97.53% balanced accuracy. Standalone Random Forest marginally outperformed the hybrid model in raw accuracy and false positive rate; therefore, the contribution of the proposed framework is centered on deployment-oriented anomaly monitoring, drift awareness, and generalization rather than absolute superiority in static classification metrics. A leave-one-attack-family-out experiment withholding MITM-ArpSpoofing from training showed that the hybrid model detected 85.26% of the unseen attack-family samples, compared with 85.18% for Random Forest alone and 7.05% for Isolation Forest alone. These findings provide initial evidence of generalization to one held-out attack family but should not be interpreted as proof of broad zero-day detection capability. The framework is therefore positioned as a competitive IDS that combines supervised detection with anomaly monitoring and concept drift awareness for deployment-oriented IoT security. Full article

This study proposes a zero-shot cross-domain intrusion detection framework for industrial control systems (ICS) using a canonical feature representation and domain-adversarial learning. While prior approaches relied on labeled target data, the proposed method generalizes across heterogeneous SCADA datasets without target supervision. Our experimental results across SWaT, BATADAL, Mississippi, and HAI datasets show that our proposed approach outperforms traditional unsupervised baselines. Specifically, PCA-based detection achieves a ROC-AUC of 0.84 on SWaT and 0.63 on Mississippi, compared to near-random performance (0.50 ROC-AUC, 0 F1-score) for Isolation Forest and One-Class SVM due to threshold calibration limitations. A two category negative transfer taxonomy is introduced to explain performance degradation under domain divergence, and domain-adversarial analysis confirms domain-invariant representations with accuracy converging to chance level. These findings highlight the robustness of the proposed framework for real-world cross-domain ICS anomaly detection and its potential for deployment in environments with limited labeled data. Full article

Deep learning has been widely deployed in critical scenarios such as the Internet of Things (IoT), industrial sensing, network intrusion detection, and cyber-physical system monitoring, where model inference directly affects system security, operational reliability, and service continuity. However, existing adversarial example detection studies remain insufficient for practical IoT deployment, as their validation often overlooks endpoint resource constraints, heterogeneous data modalities, physical environmental interference, communication protocol specifications, adaptive attacks, and adversary capability models. Moreover, detection outcomes are rarely connected with deployment locations, computational overhead, formal security assurance, and subsequent response strategies, which limits their engineering applicability. To address these limitations, this review systematically synthesizes recent representative studies in adversarial example detection and constructs a unified analytical framework integrating detection evidence, IoT deployment feasibility, and adaptive-attack evaluation. Based on the source of detection evidence, existing methods are categorized into input-consistency-based, feature-statistics-based, predictive-uncertainty-based, model-reconstruction-based, runtime-context-aware, and multi-strategy fusion detection, while formal certification is discussed as an independent security-assurance dimension. The review further analyzes the principles, applicable conditions, limitations, compatibility conflicts with IoT deployment constraints, and typical failure modes of these methods. The analysis identifies four key challenges: the lack of IoT-native adaptive evaluation, limited anomaly-boundary identification and cross-modal generalization, insufficient deployment-time security assurance, and weak coordination between detection decisions and security responses. Future research should therefore emphasize feasible attack paradigms, hierarchical lightweight detection, reliable multimodal fusion, certifiable operational boundaries, and auditable end-to-end response mechanisms, thereby supporting the evaluation and deployment of adversarial example detection in IoT scenarios. Full article

This study proposes a machine learning and deep learning framework to detect application layer DDoS attacks using web server access logs. A realistic dataset was generated using eight DDoS tools, along with benign traffic. Multiple ML models, including Random Forest, SVM, and KNN, as well as DL models such as ANN and LSTM, were evaluated. The results show high detection performance, with the LSTM achieving up to 99% accuracy and outperforming other models. Additional validation on non-DDoS attacks revealed that ML models performed poorly, while LSTM maintained strong performance (92.89%). The findings highlight the effectiveness of log-based datasets and the superiority of LSTM for handling sequential and mixed-feature data in cybersecurity detection tasks. Full article

Industrial Internet of Things (IIoT) production environments rely on automated communication between control systems and embedded devices while operating under strict availability constraints that limit the deployment of conventional IT security controls. Despite extensive research on intrusion detection systems, empirical studies based on long-term observations of real industrial networks remain scarce. This paper presents a longitudinal 92-day passive monitoring study of a production-line IIoT network comprising 22 monitored devices. A containerised instance of Zeek was deployed in promiscuous mode to collect flow-level and application-layer telemetry without interfering with operations. The resulting dataset contains more than 41.5 million network flows and 520.5 million packets, represented by 48.48 GB of structured Zeek logs. The results reveal highly deterministic communication patterns dominated by periodic HTTP polling between a central server and distributed devices. In particular, the hourly mean HTTP response size remained highly stable at 132.76 bytes, with a standard deviation of 1.37 bytes and a coefficient of variation of 1.0%. Although no confirmed malicious activity was observed, transient deviations were identified and attributed to planned production stoppages restart periods, which caused temporary traffic reductions and short-lived packet bursts. These findings demonstrate that production-line IIoT networks can exhibit predictable behaviour regimes suitable for statistical anomaly detection. The study contributes a longitudinal empirical characterisation of a real operational IIoT network, a reproducible methodology for behavioural baseline extraction using passive telemetry, and practical insights for safe monitoring deployment. Full article

The expansion of the Internet of Things (IoT) has increased the complexity of securing distributed systems against growing threats to data security, privacy, and reliability. Conventional centralised cybersecurity methods are often insufficient for environments characterised by scale, heterogeneity, and dynamic behaviour. This paper presents a structured review of Distributed Artificial Intelligence (DAI) for IoT security, focusing on how local, cooperative intelligence can support intrusion detection, anomaly recognition, secure data processing, and collaborative defence. We synthesise the current literature on Federated Learning (FL), Multi-Agent Systems, and related approaches, highlighting their benefits, limitations, and practical deployment constraints. Particular attention is given to critical infrastructure contexts, where resilience is essential for operational continuity and public safety. The review concludes by outlining key gaps and future research directions for DAI-enabled IoT security. Full article

Contemporary cyber threats increasingly employ multi-stage and behaviourally adaptive strategies that challenge static intrusion detection and non-adaptive deception mechanisms. Existing approaches typically treat threat detection, deception deployment, and adversarial attribution as separate functions, limiting timely response and underusing the behavioural evidence generated during attacker interaction. This study develops and evaluates a theory-informed computational and operational framework for autonomous cyber deception. The principal research artefact is a reusable closed-loop architecture rather than a single predictive model: it specifies the interacting components, interfaces, data and control flows, decision rules, and feedback mechanisms that connect detection, deception, telemetry, and attribution. Methodologically, the study follows an engineering design-and-evaluation approach comprising problem and requirement identification from the literature, architectural synthesis, component-level mathematical modelling, prototype implementation, and controlled cyber-range evaluation. In this context, modelling refers to the distinct computational models embedded within the framework: a hybrid detection model combining supervised classification, anomaly detection, and temporal sequence analysis; a Markov Decision Process and reinforcement-learning policy model for selecting and reconfiguring deception actions under engagement, intelligence-gain, resource, and containment objectives; and similarity-based and Bayesian attribution models for estimating MITRE ATT&CK techniques from incomplete behavioural evidence. The component models were developed offline using the NSL-KDD, CICIDS2017, UNSW-NB15, and ToN-IoT datasets, while the integrated prototype was evaluated separately in a controlled enterprise-like cyber range using reconnaissance, brute-force, exploitation, and multi-stage attack scenarios. The reported classification metrics were calculated from the labelled cyber-range evaluation events, not by pooling the four benchmark datasets. On this integrated cyber-range evaluation set, the system achieved 95.4% detection accuracy, 93.6% precision, 94.7% recall, and a 94.1% F1-score, with a mean detection latency of 85 ms. It also achieved 100% honeypot deployment reliability, 92% dynamic reconfiguration success, 88% fingerprinting resistance, and attacker engagement durations of up to 280 s. The attribution component demonstrated end-to-end generation of ATT&CK-aligned technique hypotheses from deception-derived telemetry; however, the present archived evaluation does not support per-technique or baseline-comparative performance claims. These findings show that specialised models and operational services can be coordinated within a unified adaptive defence process, while also identifying the additional class-level and ablation evidence required for rigorous attribution validation. Full article

High-throughput firewall telemetry increasingly demands real-time interpretation from short, dense observation windows rather than long historical baselines. We operationalize behavioral slicing, a privacy-preserving approach that extracts interpretable micro-behavioral signals—timing irregularities, destination dispersion (entropy), and intensity cues—from sub-minute traffic segments. This study does not claim confirmed intrusion detection. Instead, it evaluates whether short-window firewall telemetry can support privacy-preserving candidate triage under high-throughput conditions and quantifies the limits, feature stability, detector complementarity, and real-time feasibility of such a pipeline. Our case study uses a real operational firewall telemetry slice that was irreversibly anonymized prior to analysis. Using unsupervised outlier detection with explainable summaries, the slice-level pipeline produces investigation-oriented anomaly candidates for triage, without making longitudinal routine or habit claims. Synthetic anomaly injection is used only for relative validation, while behavioral findings are derived from the real telemetry slice. Scenario-level ablations show strong separation for scanning and exfiltration but weak performance for low-variance C2 beaconing, indicating that behavioral slicing should be treated as a triage pre-filter rather than a universal detector. In the context of IoT and edge-network monitoring, firewall telemetry can be treated as a high-rate network sensing stream that reflects device-level communication behavior under operational constraints. Overall, results support behavioral slicing as an operationally feasible pre-filtering and triage method under extreme network load, with clear trade-offs and limits. Full article

Intrusion detection systems (IDSs) for industrial control networks are commonly evaluated using random stratified splits, placing rows from every recorded attack in both training and test sets. Although convenient, this practice measures a model’s ability to recognise repetitions of patterns it has already seen rather than its ability to detect novel attacks. We revisit supervised and unsupervised machine-learning IDSs on the Secure Water Treatment (SWaT) dataset’s network-traffic modality, extending a prior conference study, and quantify the effect of more rigorous evaluation protocols. We evaluate five model families (XGBoost, a convolutional–MLP hybrid, a bidirectional LSTM classifier, an unsupervised LSTM-Autoencoder, and a temporal convolutional network) under three protocols: stratified random, attack-held-out, and leave-one-attack-out (LOO). Under LOO on a 30-file subsample, every supervised classifier scores below random on the majority of held-out attacks; the unsupervised LSTM-Autoencoder retains the best solo mean of 0.550 with a strongly bimodal per-attack distribution spanning 0.046 to 0.894. A sign-adjusted oracle-bound ensemble flips members whose per-attack AUROC inverts achieves a mean LOO AUROC of 0.844; adding the TCN as a fourth ensemble member does not improve the result, providing evidence that what is needed is an additional detection mode rather than another supervised classifier. We additionally report recall at a 5% false-positive-rate budget, paired Wilcoxon significance tests, and bootstrap confidence intervals. The full preprocessing, evaluation, and ensemble pipeline is released, and we argue that attack-held-out and LOO should be standard protocols for network-traffic IDS benchmarks on SWaT. Full article