Search Results (451)

The Internet of Things (IoT) is envisioned to link billions of diverse devices together. To safeguard privacy of user data, ensure authenticity of the data communicated between these devices, and guarantee their availability, robust authentication is needed. On the other hand, authentication techniques face several security challenges because IoT devices are resource-constrained (memory, battery, processor, etc.). To elaborate on this, we perform an extensive survey of authentication mechanisms in IoT, addressing the resource-constrained nature of devices, heterogeneity of networks, and prospective security challenges. We focus on five major classes of authentication protocols—namely, password-based, MAC-based, public identity-based, token-based, and biometrics-based protocols—and compare them based on communication and computation overhead, energy efficiency, scalability, and security. We also highlight the applicability of authentication mechanisms to four popular IoT platforms: RFID systems, smart grids, the Internet of Vehicles (IoV), and smart homes. Finally, we survey trending solutions such as implicit authentication using biometrics, blockchain-based identity management, and trusted computing. Beyond the qualitative comparison, this updated survey presents a formal, PRISMA-style review process including inclusion and exclusion criteria; a quantitative/information theoretic comparison of authentication classes (using Shannon entropy and confusion- matrix-derived metrics, the false acceptance rate, false rejection rate, equal error rate, and receiver operating characteristic reasoning); and discussion of higher-layer auth architectures including federated identity management, single sign-on (SSO), and OAuth/OpenID Connect that enable device-level protocols. Existing systematic reviews and auth schemes published since 2023 are also included to supplement previously compared device-centric works. Our analysis shows that token-based authentication currently offers the most balanced trade-off among security, scalability, and energy overhead for general-purpose IoT deployments, while biometric and implicit biometric schemes provide the strongest resistance to impersonation at higher computational cost and public-identity (asymmetric) schemes scale well but remain impractical for the most resource-constrained endpoints. In summary and to guide future work directly, the survey also outlines four promising directions towards which the community should further research: (i) hybrid schemes based on lightweight cryptography and behavioral or physiological biometrics; (ii) lightweight post-quantum authentication schemes, resistant to quantum computer attacks and deployable on constrained devices; (iii) continuous authentication and anomaly detection based on machine learning techniques; and (iv) federated and decentralized (blockchain-enabled) identity management solutions towards the minimization of single points of failure among heterogeneous IoT areas. Full article

This paper provides the design and simulation of a lightweight cryptographic protocol on smart house IoT devices using ChaCha20 and Ascon-AEAD128. The protocol, implemented in Python 3.14.6 and tested on a virtual ESP32 platform using Wokwi and CloudAMQP, uses stream cipher encryption with authenticated message tagging to provide confidentiality and integrity. Two conditions, normal and tampered transmission, were experimented to confirm tag validation and successful decryption. Findings affirmed sound detection of tampering and unauthorized access prevention, proving usefulness of current AEAD ciphers on limited devices. The protocol highlights cryptographic systems that prioritize computationally efficiency and robustness, which is essential in smart homes that have limited power and memory. The hybrid design provides confidentiality and authenticity using a minimal overhead by utilizing ChaCha20 to provide lightweight encryption and Ascon-AEAD128 as authentication. The resilience to the replay and modification attacks was demonstrated in experiments based on message queues and injected packet modifications simulating real-world conditions. Even though benchmarking of hardware was not carried out, the simulated values reveal stability and flexibility to use in low-power systems. This article emphasizes the necessity of authenticated encryption as default, which is consistent with the NIST standards and reflects the appropriateness of Ascon to new IoT security requirements. It also creates a reconfigurable structure that can be used in other highly constrained systems, such as healthcare monitoring and industrial IoT. The main contribution is the gap between theoretical cryptography and practical IoT security provided by the practical prototype. Further development will include tests on physical ESP32 modules and fine performance profiling, yet already, the current implementation proves a scalable, secure model of smart home IoT. Finally, this research demonstrates that the demand of reliable and low-power-based communication in resource constrained networks can be met efficiently without sacrificing device performance by means of lightweight cryptography. In addition to the cryptographic protocol design, this study integrates a machine learning-based intrusion detection layer trained on the Edge-IIoTset dataset, in which Logistic Regression, Decision Tree, Random Forest, and Gradient Boosting classifiers are evaluated to complement the encryption–authentication framework with anomaly-aware monitoring of network traffic. Full article

Existing architectural backdoors embed malicious logic directly into model structures to persist after clean training, but they typically rely on handcrafted trigger patterns vulnerable to preprocessing and lack the mechanism to dynamically update attack targets. Addressing these limitations, this paper proposes ArchLock, a dynamic-target architectural backdoor framework designed exclusively for stateful inference deployments that maintain persistent mutable state across requests. ArchLock comprises two core components: a correlation-based statistical trigger detector that utilizes local red-green channel Pearson correlations as the activation signal, thereby reducing dependence on absolute pixel values and exhibiting theoretical invariance to linear transformations; and an Adaptive Confidence Calibration module, which maintains a persistent memory buffer to enable post-deployment target switching through a two-phase protocol. Extensive experiments on CIFAR-10, CIFAR-100, Tiny-ImageNet, and ImageNet-100 demonstrate that ArchLock achieves a dynamic target success rate exceeding 90% while preserving clean accuracy. Furthermore, the method exhibits robustness against fine-tuning and pruning and evades three behavioral detectors under the stated stateful deployment assumptions. This work highlights the security risks of mutable architectural components in stateful inference services while explicitly discussing the limitations of the proposed approach under stateless deployment and aggressive preprocessing conditions. Full article

The Internet of Vehicles (IoV) relies on Basic Safety Messages (BSMs) for cooperative awareness, yet these broadcasts remain vulnerable to falsification, replay, flooding, Sybil-based, and motion-manipulation attacks. This paper proposes a temporal-window-aware physics-informed edge-oriented Intrusion Detection System (IDS) for 20-class IoV misbehavior detection under two simulation-based BSM observability regimes: ideal noise-free kinematics and realistic noise-inclusive observables reconstructed using the sensor-error components supplied separately by VeReMi Extension. Accordingly, “realistic” denotes a noise-inclusive simulation condition rather than real-world validation. From VeReMi Extension streams, the framework derives a compact 20-feature representation capturing kinematics, timing, replay cues, pseudonym dynamics, position-consistency residuals, zero-pattern behavior, and long-horizon motion indicators. These features are normalized with a training-only robust scaler, organized into sender-specific temporal windows, and classified using a lightweight three-layer stacked Long Short-Term Memory (LSTM) with residual temporal pooling. Four implementation variants are evaluated: dense Keras, default-optimized TensorFlow Lite, pruning-only Keras, and pruning-plus-compression TensorFlow Lite. Temporal sensitivity identifies $T=40$ as the best robustness–latency compromise under the realistic noise-inclusive regime. At $T=40$, the final pruned-and-compressed TensorFlow Lite model achieves $99.60\%$ accuracy and $99.09\%$ macro-F1 under ideal observability, and $99.38\%$ accuracy and $98.67\%$ macro-F1 under realistic noise-inclusive observability, with an $88.38$ KB footprint and $0.1283$ ms controlled-runtime latency. Large-scale Central Processing Unit (CPU) benchmarks on $\mathrm{150,000}$ noise-inclusive test sequences provide a platform-dependent runtime reference, with the pruned TensorFlow Lite model reaching $99.14\%$ accuracy, $98.18\%$ macro-F1, and $3.544$ ms average latency on a multi-core Intel Xeon CPU. To complement this high-throughput evaluation, edge-deployment potential is profiled using the official C++ TensorFlow Lite benchmark tool. When evaluated using a single CPU thread without batching, the final artifact achieves an unbatched per-sequence latency of $1.356$ ms, corresponding to less than $1.4\%$ of the standard 100 ms BSM generation interval. An architecture-width ablation identifies the $64/32/32$ recurrent stack as the performance–resource knee point: expanding it to $128/64/64$ improves validation macro-F1 by only $0.0019$ percentage points while increasing TensorFlow Lite footprint and latency by factors of $2.46$ and $2.32$, respectively. A training-time architecture-preserving feature-family ablation confirms that engineered descriptors are essential: raw kinematics alone reduce noise-inclusive macro-F1 from $98.67\%$ to $67.49\%$, with pseudonym dynamics and position-consistency cues producing the largest individual degradations. Full article

With the escalating frequency of sophisticated zero-day attacks, overcoming the critical limitations of signature-based Intrusion Detection Systems (IDSs) has become paramount. This study proposes a hybrid multi-layered intrusion detection framework combining traditional machine learning, Deep Neural Architectures (DenseNN), and ensemble methods to evaluate zero-day resilience within cloud-level backend connectivity interfacing EV and V2X management ecosystems. Using the comprehensive CSE-CIC-IDS2018 benchmark as a surrogate environment, a code-executed Leave-One-Attack-Out (LOAO) cross-validation protocol across 13 distinct attack families was implemented to assess unseen-attack-family generalization within the benchmark to unseen threats. Furthermore, Explainable Artificial Intelligence (XAI) auditing, utilizing SHapley Additive exPlanations (SHAP) and Integrated Gradients, was integrated to inspect decision boundaries and resolve feature-attribution failure modes. Critically, the audit identified an artifact-driven data leakage caused by the Timestamp and identifier features, demonstrating that models learned temporal schedules rather than behavioral network signatures. Re-executing all experiments post-leakage removal quantified performance drops across all classifiers (e.g., Gaussian NB dropping by up to 20.88 percentage points in accuracy (at the 60% training ratio; 18.30 points at the 80% ratio)). Under standard binary classification metrics, tree ensembles (Random Forest and Extra Trees) achieved high in-distribution detection (F1 > 0.95) with rapid inference latency (≈0.05–−0.07 ms/sample). However, the rigorous LOAO evaluation revealed a substantial generalization penalty on truly unseen zero-day families (e.g., SQL Injection and Infiltration), where simpler linear models demonstrated broader generalization robustness (mean LOAO F1 = 0.397) compared with complex tree-ensemble models. By rectifying dataset leakage and benchmarking deployment trade-offs (training runtime, throughput, and memory footprint), this study delivers actionable, transparent guidelines for deployment-oriented IDS evaluation in dynamic network infrastructures. Full article

Wireless sensor networks (WSNs) play a critical role in cyber-physical applications such as industrial monitoring, environmental sensing, and critical infrastructure management. In these environments, security mechanisms must not only detect malicious activities but also explain how compromised measurements propagate through sensing, aggregation, and decision processes while operating under stringent resource constraints. Existing approaches typically address intrusion detection, trust management, provenance analysis, or blockchain-based integrity independently, providing limited support for integrated and explainable security. This paper presents PhyProvTrust-WSN, a physics-aware framework that combines physics-consistency validation, dynamic provenance graphs, evidence-based trust propagation, multi-factor risk fusion, and selective evidence anchoring to improve the transparency and auditability of secure sensor data aggregation. The framework models sensing, forwarding, aggregation, validation, and response events as a bounded provenance directed acyclic graph (DAG), enabling causal tracing of suspicious activities while maintaining low memory and communication overhead. A weighted risk fusion mechanism integrates anomaly evidence, domain-consistency assessment, trust evolution, and inherited provenance risk to support explainable security decisions. Rather than continuously recording all events, only high-risk or decision-relevant evidence hashes are anchored to a permissioned audit layer, reducing storage and communication costs. To avoid overclaiming, the proposed framework is evaluated using a hybrid methodology that combines attack-labeled WSN datasets, real sensor measurements for physics-consistency validation, and simulation-based overhead analysis. The results demonstrate that the integrated framework provides strong detection capability while improving explainability, supporting root-cause analysis, and maintaining bounded communication and storage overhead suitable for resource-constrained WSN deployments. Full article

The use of Artificial Intelligence (AI) and Machine Learning (ML) in cybersecurity, especially for creating Intrusion Detection Systems (IDSs), has become increasingly important. These systems are essential for detecting malicious behaviour, identifying network issues, and stopping cyberattacks in real time. Despite extensive research on various ML and Deep Learning (DL) models for IDS, the current literature remains incomplete. It has many different datasets, methods, and evaluation standards. As cyber threats become more advanced, it is crucial to conduct a thorough analysis of ML techniques for intrusion detection. The goal of this Systematic Literature Review (SLR) is to provide a full picture of the most recent academic articles on ML-based IDS. The study addresses important research questions about the most widely used algorithms, the types of attacks and network environments covered, the methodological problems that remain unsolved, and the new trends that should shape future research. Following the PRISMA framework, we conducted a systematic review of peer-reviewed articles published between January 2022 and May 2025. We searched IEEE Xplore, ACM Digital Library, and SpringerLink, yielding 22,558 initial records. After carefully applying strict inclusion criteria, 125 papers were selected for the final analysis. We created a standardised data extraction form (i.e., using MS Excel) to gather bibliographic details, research emphasis, methodological strategies, datasets, evaluation criteria, and recognised constraints. We employed thematic analysis to develop a clear taxonomy. We identified five main research themes in our analysis: (1) ensemble and hybrid learning pipelines focused on performance optimisation (30 papers), (2) context-specific IDS designs for Internet of Things (IoT), cloud, and Software-Defined Networking (SDN) environments (34 papers), (3) data-centric engineering that deals with class imbalance and feature selection (20 papers), (4) deep neural architectures for representation learning (31 papers), and (5) trustworthiness concerns like adversarial robustness, zero-day detection, and Explainable AI (XAI) (10 papers). Convolutional Neural Networks (CNNs), Long Short-Term Memory (LSTM), and Random Forests are the most commonly used algorithms, often combined. Nonetheless, significant deficiencies remain: about 2% of papers incorporate XAI, only 4% focus on adversarial robustness, and none validate their models in real-world production settings. Denial-of-Service (DoS) and Distributed DoS (DDoS) attacks are the most common types in the literature, whereas Web attacks, ransomware, and advanced persistent threats remain poorly studied. The number of publications grows at an average of 30.2% annually, but the field still relies on legacy benchmark datasets rather than operational validation. Full article

The increasing number of Internet of Things (IoT) devices in smart cities creates several challenges of trust management, resource allocation, and secure offloading. This paper introduces BTM-IoT, a blockchain-based trust management solution to improve the multi-access IoT offloading networks in urban areas. The proposed framework employs a hybrid consensus system that combines Delegated Proof-of-Stake (DPoS) with Practical Byzantine Fault Tolerance (PBFT) to make offloading decisions efficiently and securely while keeping the latency and throughput low. A trust-aware offloading optimization model is proposed, which combines the direct and indirect trust evaluation to increase the accuracy of the decisions and attack resistance. Our extensive experiments show that the average reduction in energy consumption of BTM-IoT is 31% over the baseline models, whereas the average reduction in task completion time comes to 27%, and the average improvement in attack detection accuracy is 43%. Further, scalability tests show that it takes only 26% longer to complete when scaling up from 50 to 500 devices, a significant improvement over traditional method. It also provides optimal use of resources, such as CPU, memory, and bandwidth, while delivering an average of 20% improvement in efficiency. Even when analyzed from the overhead of the blockchain, it is light on the IOT device, requiring 0.5 MB of storage and 2% CPU usage. The study results confirm the energy efficiency, scalability and security of BTM-IoT as a solution for multi-access IoT offloading in smart city infrastructures. Full article

Large language model (LLM) agents are becoming cognitive interfaces to data lakes, enterprise knowledge bases, vector memories, browsers, files, and software tools. This shift creates a data-governance gap: an agent may reason over large private context, yet the protected resource often lacks a verifiable record of which user intent, data object, action, destination, and semantic release were authorized. This paper proposes CapAgent, a semantic data-flow governance middleware for LLM agents in big-data cognitive-computing environments. CapAgent maps human-attested task intent into signed, attenuable, and purpose-bound capability tokens that are checked by a reference monitor before sensitive tool invocation, memory retrieval, data export, and inter-agent delegation. Its policy layer combines task templates, resource labels, destination rules, caveats, semantic release modes, and audit obligations; its runtime enforces both symbolic scope checks and semantic recoverability checks over protected facts. We present formal governance semantics, a conservative intent compiler, an explainable data-flow decision workflow, and a runnable Python middleware. A reproducible trace-replay benchmark with 600 benign and adversarial traces across five data-intensive agent scenarios reports attack success, benign success, false blocking, latency, component ablations, and audit quality. In this synthetic trace-replay evaluation, the full monitor reduces measured attack success from 100.00% under ambient execution and 12.50% under scope-only authorization to 0.00% (Wilson 95% CI [0.00, 0.95]), while retaining 75.00% benign success. In addition, we conduct a 520-trial end-to-end tool-calling benchmark with representative prompt-only, task-shield-style, CaMeL-style, scope-only, and full-CapAgent configurations; a 210-task compiler gold-standard evaluation; a 240-item semantic-release calibration set; and a 12-cell BDCC-style scalability microbenchmark. In these supplemental tests, full CapAgent obtains 0.00% ASR (95% CI [0.00, 1.06]) in the tool-calling benchmark, 87.50% exact-policy compiler match with 0.00% over-authorization, 88.89% semantic-release recall with 0.00% false-block rate, and sub-millisecond in-process authorization latency up to 100,000 resources. The results support CapAgent as an auditable governance layer for cognitive LLM agents rather than as a replacement for model-level alignment or public end-to-end agent benchmarks. Full article

Software-Defined Networking (SDN) provides fine-grained control over network architectures, yet integrating intrusion detection systems (IDSs) into the control plane frequently introduces prohibitive computational overhead. This issue is compounded by the fact that existing machine learning models, typically trained on static benchmark datasets, often degrade under real-time polling conditions and unpredictable traffic bursts. To bridge this gap, this paper evaluates an ultra-compact five-feature polling scheme (F1–F5) designed to preserve statistical symmetry between control-plane monitoring and telemetry overhead within a dynamic Mininet–Ryu testbed. The experimental framework incorporates 15% background noise, and a 10% stealth attack overlaps across a 120 s dynamic trace. Four distinct classifiers—Random Forest (RF), Decision Tree (DT), Multi-Layer Perceptron (MLP), and Long Short-Term Memory (LSTM)—were evaluated across frame-by-frame snapshot and windowed prediction tasks. Empirical findings reveal that tree-based ensembles consistently outperform deep learning approaches, with RF attaining an overall accuracy of 97.57% and DT achieving 96.74%, compared to 90.77% for MLP and 90.73% for LSTM. Analysis of the time-series logs demonstrates that RF’s orthogonal decision boundaries successfully isolate transient, high-intensity threats such as WebAttack and PortScan vectors without needing memory-intensive recurrent architectures. Ultimately, pairing minimal feature extraction with lightweight tree ensembles offers an optimal balance between low control-plane latency and high detection efficacy. Full article

Availability-oriented monitoring may require low-latency anomaly inference, but deploying a lightweight model as a separate service adds process, serialization, and network-path overhead. This article evaluates the inference-path architecture used by a prototype availability-response loop; it does not evaluate the effectiveness of a new DoS/EDoS detector or claim production attack mitigation. The same IsolationForest model and telemetry vectors were executed through an external Python/FastAPI sidecar and through ONNX Runtime embedded in a Spring Boot JVM. The prototype also included a LSTM Autoencoder and a bounded rule layer producing SCALE_UP, RETRY, FALLBACK, or NONE. The main Kubernetes benchmark used Docker Desktop 4.73.1 (Docker Engine 29.4.3) with Kubernetes v1.34.3 on a single-node cluster. Embedded ONNX reduced request-response latency from 26.090 ms to 4.839 ms on average, from 62.065 ms to 5.367 ms at P95, and from 76.487 ms to 6.244 ms at P99; calculated sequential throughput increased from 38.3 to 206.7 requests/s. Additional checks covered concurrent load, gRPC transport, cold start, memory footprint, and limited Kubernetes actions. In an extended comparison using 15 runs of 950 s for each active configuration, CPU-based HPA, rules-only, and AI+rules produced overlapping aggregate SLA-violation rates; no aggregate benefit of the ML gate over rules alone was observed under the tested degradation proxies. The evidence supports a narrow architectural conclusion: in-process ONNX is a lower-latency and lower-footprint execution path for the tested lightweight model. Detection quality, superiority over rule-only or established autoscaling mechanisms, and effectiveness against real adversarial traffic remain open validation tasks. Full article

Machine unlearning (MU) is increasingly studied across artificial intelligence systems in which target information may remain in model weights, adapters, retrieval indexes, caches, federated states, and temporally derived representations. However, existing reviews often examine methods, benchmarks, or deployment settings separately. Therefore, this scoping review collected and synthesized 159 sources to compare unlearning evidence across these connected system components. The evidence map separates 42 core MU sources—26 primary empirical or theoretical studies, 12 benchmark or evaluation frameworks, and 4 secondary evidence syntheses—from 117 contextual sources. First, a three-dimensional taxonomy distinguishes guarantee or reference type, update mechanism, and deployment or memory context. This structure prevents partitioning from being treated as a guarantee and influence estimation from being treated as an outcome. Next, the quantitative map identifies 13 centralized or general sources, 16 LLM- or benchmark-focused sources, 3 graph sources, 3 federated sources, 2 temporal sources, 2 quantized-network sources, and 3 cross-domain reviews. These results indicate a stronger reference-based foundation for centralized MU and a benchmark-rich but transformation-sensitive evidence base for large language models. In contrast, graph, federated, and temporal unlearning remain less mature because they are supported by smaller core evidence sets. Moreover, recent studies show that apparent forgetting may fail after 4-bit quantization, probabilistic decoding, alternative reference selection, recovery testing, benign query changes, or overlap between forget and retain knowledge. Accordingly, we present an audit-oriented deletion lifecycle that connects forgetting evidence, retained-utility testing, threat-model-specific attacks, post-transformation verification, and redeployment decisions. Calibration, citation grounding, provenance, and human review are treated as supplementary decision-readiness checks rather than direct proof of unlearning. Finally, the lifecycle is presented as a structured synthesis and reporting framework that still requires prospective validation in real systems and independent practitioner assessment. Full article

Industrial control networks based on Supervisory Control and Data Acquisition (SCADA) systems used in critical infrastructure systems require reliable, scalable, and generalizable attack detection mechanisms in the face of increasing cyber-threats. However, a large portion of the datasets commonly used in the literature are based on general-purpose network traffic and do not adequately reflect the cyclical, deterministic, and process-oriented communication structure of industrial protocols such as Modbus/TCP. In this study, a completely isolated virtual SCADA environment was designed to address this limitation. A SCADA-specific multi-class attack dataset called SCADANet was developed, containing 13 different attack scenarios generated concurrently with legitimate network traffic. In this context, a hybrid deep learning architecture consisting of parallel dilated Convolutional Neural Network (CNN) structures, Residual-SE blocks, and Long Short-Term Memory (LSTM) layers, capable of modeling multi-scale spatial patterns and feature-level sequential and contextual relationships within transformed traffic representations, was proposed. To examine the generalizability of the proposed approach, the developed model was tested on both the SCADANet dataset and the WUSTL-IIoT-2021 dataset, which is widely used in the literature. Experimental results show that the proposed architecture achieves high accuracy and macro-F1-score on both datasets, particularly demonstrating a significant increase in sensitivity in minority attack classes. Furthermore, the ablation study conducted reveals that each component in the architecture contributes meaningfully and complementarily to the overall performance. The findings demonstrate that the proposed deep learning-based approach can effectively model traffic characteristics specific to SCADA systems and exhibits stable attack detection performance across different data sources. In this respect, the study makes important methodological and experimental contributions to the literature on cyber-attack detection in SCADA-based critical infrastructure systems. Full article

The rapid deployment of Internet of Things (IoT) devices across smart cities, healthcare systems, industrial automation, transportation networks, smart grids, and cyber-physical infrastructures has expanded the modern cyberattack surface. IoT devices are often constrained by limited processing capacity, memory, battery power, and communication bandwidth, making conventional security mechanisms difficult to deploy consistently at scale. Intrusion detection systems (IDSs) provide an important defensive layer; however, many machine-learning-based IDSs are developed under static assumptions and may experience performance degradation as traffic distributions evolve due to firmware changes, device onboarding, protocol updates, user behavior variation, or adaptive attacks. This paper presents a hybrid IDS framework that integrates supervised Random Forest classification, unsupervised Isolation Forest anomaly monitoring, and Kolmogorov–Smirnov (KS)-based concept drift monitoring. In the experimental pipeline, Isolation Forest is trained exclusively on benign traffic to ensure that the anomaly detector models normal behavior rather than an attack-dominated training distribution. The evaluation uses a large-scale chronologically sampled subset of the CICIoT2023 dataset containing 3,890,621 records while preserving the natural class distribution of 2.35% benign traffic and 97.65% attack traffic. The chronological 80/20 train/test split is established first at the file level, followed by systematic sampling within each split to reduce the risk of leakage across the evaluation boundary. On the 746,094-record test set, the proposed hybrid IDS achieved 99.73% accuracy, 99.89% precision, 99.83% recall, 99.86% F1-score, and a false positive rate of 4.77%. The corresponding confusion matrix contains TN = 16,683, FP = 836, FN = 1205, and TP = 727,370, yielding 95.23% specificity and 97.53% balanced accuracy. Standalone Random Forest marginally outperformed the hybrid model in raw accuracy and false positive rate; therefore, the contribution of the proposed framework is centered on deployment-oriented anomaly monitoring, drift awareness, and generalization rather than absolute superiority in static classification metrics. A leave-one-attack-family-out experiment withholding MITM-ArpSpoofing from training showed that the hybrid model detected 85.26% of the unseen attack-family samples, compared with 85.18% for Random Forest alone and 7.05% for Isolation Forest alone. These findings provide initial evidence of generalization to one held-out attack family but should not be interpreted as proof of broad zero-day detection capability. The framework is therefore positioned as a competitive IDS that combines supervised detection with anomaly monitoring and concept drift awareness for deployment-oriented IoT security. Full article

Smart-manufacturing Industrial Internet of Things (IIoT) deployments increasingly depend on low-latency device-to-device (D2D) communication among resource-constrained, physically exposed field devices. This setting makes mutual authentication and session-key establishment difficult: public-key-intensive or cloud-dependent schemes add overhead, availability dependence, and single points of failure, while weak PUF-based designs may expose challenge-response pairs (CRPs) to replay, disclosure, and modeling attacks. This paper proposes PASMAP, a lightweight PUF-ASCON mutual authentication protocol for gateway-assisted D2D communication in smart-manufacturing IIoT. PASMAP combines SRAM-PUF key reconstruction, fuzzy-extractor helper data, hash- and XOR-based obfuscation, and ASCON authenticated encryption with associated data (AEAD) to protect hardware-rooted identities, hide raw PUF responses, and establish fresh session keys for post-authentication data exchange under an explicitly trusted local-gateway model. The protocol is evaluated against physical, protocol-level, and insider threats, including cloning, tampering, replay, man-in-the-middle, CRP disclosure, PUF modeling, stolen-verifier, and known-key attacks. A real-or-random (ROR) analysis bounds the adversary’s session-key advantage using hash collisions, PUF-response prediction, online guessing, and ASCON AEAD security. A mixed-platform evaluation based on ESP32 primitive timings for the edge devices and desktop timings for the resource-rich gateway yields an estimated total computation cost of 4.762 ms. The initiator and responder require 2.006 ms/264.79 $\mathsf{\mu }$J and 2.679 ms/353.63 $\mathsf{\mu }$J of computational energy, respectively, while the five-message exchange carries 4704 bits. These results indicate low computational overhead under the stated benchmark and power-model assumptions. However, the protocol totals are operation-count-based estimates, the PUF and fuzzy-extractor operations are simulated, and the energy model excludes several platform- and communication-dependent costs. A complete embedded implementation is therefore required to validate end-to-end latency, memory use, energy consumption, communication-stack overhead, SRAM-PUF reliability, and fuzzy-extractor performance. Full article