Smart manufacturing, powered by Long Range (LoRa) communication-assisted Industrial Internet of Things (IIoT), offers significant benefits but also incurs security concerns due to device compromise. In addition, various application scenarios and inherent heterogeneity of IIoT devices induce significant challenges for reliable behavior detection of compromised devices. While existing work is mostly on detecting compromised devices and there exists limited work on modeling system behavior, an open question is how to model the per-device behavior in an IIoT deployment and how behavioral changes can be automatically adapted in different scenarios. This paper proposes Misbehav, a novel self-learning device behavior anomaly detection system to detect sophisticated and stealthy attacks. First, Misbehav builds the behavior model per device using events and actions, which enables us to define acceptable and permissible actions. We use an autoencoder based unsupervised approach to train the per-device behavior model and detect malicious actions. This approach guarantees that Misbehav not only detects known attacks, but is equally capable of detecting zero-day attacks. We evaluated Misbehav on a data set collected from standard heterogeneous LoRa devices. Our results show that Misbehav exhibits a significant improvement in robustness, accuracy, and latency. In particular, Misbehav improves the detection accuracy by over 88.25% under different evasion attacks and reduces the detection latency by 11.94% than the state-of-the-art solutions.

Networks of Unmanned Aerial Vehicles (UAVs) are emerging in many application domains, e.g., military surveillance. To perform collaborative tasks, the involved UAVs exchange several types of information, e.g., sensor data and commands. The major question here is how to schedule the tasks under dynamic traffic flows to provide network services. Existing solutions use the Round-Robin Strategy (RRS), where the tasks are scheduled statistically by dividing the time into fixed-length rounds. However, the RRS wastes significant network and device resources due to task scheduling in each round. This paper proposes DROVE– a novel clustering approach that allows the UAVs for dynamic task scheduling. However, determining the task scheduling is crucial, as it significantly affects several network parameters, e.g., throughput. Therefore, we devise the problem of distributed task scheduling under dynamic traffic flow scenarios to optimize the throughput. We propose a clustering task scheduling algorithm to serve dynamic traffic flows. Particularly, we integrate the dynamic traffic flows into the Lyapunov drift analysis framework, and determine the throughput optimality of our proposed scheduling algorithm. We perform extensive simulations to validate the effectiveness of DROVE. The results show that DROVE outperforms the state-of-the-art solutions in terms of energy consumption, clustering overhead, throughput, end-to-end delay, flow success rate and packet drop rate.

Abstract The increasing complexity delivered by the heterogeneity of the cyber-physical systems is being addressed and decoded by edge technologies, IoT development, robotics, digital twin engineering, and AI. Nevertheless, tackling the orchestration of these complex ecosystems has become a challenging problem. Specially the inherent entanglement of the different emerging technologies makes it hard to maintain and scale such ecosystems. In this context, the usage of model-driven engineering as a more abstract form of glue-code, replacing the boilerplate fashion, has improved the software development lifecycle, democratising the access to and use of the aforementioned technologies. In this paper, we present a practical use case in the context of Smart Manufacturing, where we use several platforms as providers of a high-level abstraction layer, as well as security measures, allowing a more efficient system construction and interoperability.

Microsoft Office may be by far the most widely used suite for processing documents, spreadsheets, and presentations. Due to its popularity, it is continuously utilised to carry out malicious campaigns. Threat actors, exploiting the platform’s dynamic features, use it to launch their attacks and penetrate millions of hosts in their campaigns. This work explores the modern landscape of malicious Microsoft Office documents, exposing the means that malware authors use. We leverage a taxonomy of the tools used to weaponise Microsoft Office documents and explore the modus operandi of malicious actors. Moreover, we generated and publicly shared a specially crafted dataset, which relies on incorporating benign and malicious documents containing many dynamic features such as VBA macros and DDE. The latter is crucial for a fair and realistic analysis, an open issue in the current state of the art. This allows us to draw safe conclusions on the malicious features and behaviour. More precisely, we extract the necessary features with an automated analysis pipeline to efficiently and accurately classify a document as benign or malicious using machine learning with an F1 score above 0.98, outperforming the current state of the art detection algorithms.

Automation systems involve a range of cyber-physical system components such as sensors, actuators, control equipment, machines, robots, AGVs, etc. Seamless interoperability among these entities is a significant challenge. A well-designed Industrial Internet of Things (IIoT) platform at the network edge can offer several services by acting as a transformation engine between these field devices and various enterprise applications. We consider the EdgeX Foundry platform as such an IIoT middleware, discuss how EdgeX can provide ready-to-use integration of IoT devices, and show how we connect it with a low-code XMDD coordination layer that interfaces with EdgeX microservices through a Native DSL mechanism. We consider this technology landscape from the point of view of a building automation system example that supports high reconfigurability and security. We show how to produce all the essential elements of a complex Web based application to control the considered building systems. We demonstrate various features of the application's data and process models, how DSLs play a role at various levels, and how to add security capabilities that go beyond the cross-layer concerns and mechanisms offered by EdgeX. To this end, we introduce a declarative policy layer to be implemented using the open source ADD-Lib in form of an additional DSL for Attribute Based Encryption, with the aim of further enriching the capabilities around the EdgeX platform.

Abstract In many industries, traditional automation systems (operating technology) such as PLCs are being replaced with modern, networked ICT-based systems as part of a drive towards the Industrial Internet of Things (IIoT). The intention behind this is to use more cost-effective, open platforms that also integrate better with an organisation’s information technology (IT) systems. In order to deal with heterogeneity in these systems, middleware platforms such as EdgeX Foundry, IoTivity, FI-WARE for Internet of Things (IoT) systems are under development that provide integration and try to overcome interoperability issues between devices of different standards. In this paper, we consider the EdgeX Foundry IIoT middleware platform as a transformation engine between field devices and enterprise applications. We also consider security as a critical element in this and discuss how to prevent or mitigate the possibility of several security risks. Here we address secure data access control by introducing a declarative policy layer implementable using Ciphertext-Policy Attribute-Based Encryption (CP-ABE). Finally, we tackle the interoperability challenge at the application layer by connecting EdgeX with DIME, a model-driven/low-code application development platform that provides methods and techniques for systematic integration based on layered Domain-Specific Languages (DSL). Here, EdgeX services are accessed through a Native DSL, and the application logic is designed in the DIME Language DSL, lifting middleware development/configuration to a DSL abstraction level. Through the use of DSLs, this approach covers the integration space domain by domain, technology by technology, and is thus highly generalizable and reusable. We validate our approach with an example IIoT use case in smart manufacturing.

Current trends forecast that Over-The-Air (OTA) software updates will be highly significant for future autonomous vehicles. The OTA update will enable fast distribution of software updates and fixing bugs in the embedded software installed on its electronic control units. However, in terms of security, OTA updates are highly critical due to complexity, numerous attack surfaces, and unsafe and old techniques. In addition, OTA updates must be scalable to large number of vehicles without incurring additional network bandwidth. In this work, we propose STRIDE, a scheme for OTA software updates over cloud that is secure against malicious attacks while being scalable to concurrent software updates in a large number of vehicles. STRIDE enables fast and secure distribution of update packages from software providers to vehicles. STRIDE ensures end-to-end security using ciphertext-policy attribute-based encryption. We evaluate the performance of our proposal through extensive experiments. Experimental results show that STRIDE significantly reduces the overheads, without compromising the network load and software update retrieval time than the best performed scheme in the state-of-the-art.

Internet of Multimedia Things (IoMT) are receiving significant attention due to a wide variety of applications, e.g., wildlife habitat monitoring, but they are often highly resource constrained. Compared to Internet of Things, preserving battery power of nodes, and maximizing the lifespan of IoMT are more critical and challenging as sensed data are mostly image/video instead of simple scalar. Recent studies have shown that clustering is an efficient solution to reduce energy consumption. In clusters, the role of each node changes to reduce energy consumption, thereby, prolonging lifespan. In this paper, we address the lifespan maximization problem in IoMT by designing a clustering protocol where clusters are formed dynamically. Specifically, we analyze and solve an optimization problem aiming to maximize the lifespan by reducing the energy consumption among cluster heads. Based on the analysis, we propose a novel DIStributed on-demand Clustering (DISC) protocol. Our cluster head election procedure is not periodic, but adaptive, based on the dynamism of the occurrence of events. This on-demand execution of DISC aims to significantly reduce computation and message overheads. We validate the performance of DISC through extensive experiments. Experimental results show that DISC is 25% more energy balanced and achieves 32% more lifespan as compared to two state-of-the-art solutions.

Visual sensor networks are receiving significant attention due to their potential applications ranging from surveillance to tracking domains. Nevertheless, due to the funneling effect, the unbalanced energy usage among visual sensor nodes (SNs) increases and leads to premature decrease in network lifetime. First, considering Rayleigh fading channel and routing models, we analyze the optimization of network lifetime by balancing the energy consumption among different SNs. From the analysis, it is revealed that the number of SNs and relay nodes and their locations have significant influence on limiting the energy hole problem and optimization of network lifetime. Based on the derived principle of energy balancing, we develop a heterogeneous SNs deployment strategy leading to optimization in network lifetime. Exhaustive simulation is performed, primarily to measure the extent of achieving our design goal of optimizing network lifetime while attaining energy balancing. We also measure the effect of placement errors on the performance and robustness of the scheme. The results show that even in the presence of placement error the performance is comparable and provides better robustness compared with the competing scheme. Further, the simulation results show that our scheme does not compromise with other performance metrics, e.g., end-to-end delay and throughput, while achieving the design goal. Finally, all the comparative results confirm our scheme's supremacy over the competing schemes.

In wireless sensor networks (WSNs), preserving energy requires utmost attention, as they are highly resource constrained. Clustering is commonly considered as one of the efficient energy conservation technique. Firstly, we analyze the maximization of network lifetime by balancing the energy consumption among different cluster heads (CHs). It is found that number of clusters and number of member nodes (MNs) associated with each cluster has significant role in maximization of network lifetime. To meet the requirement of maximization of network lifetime, we devise a routing aware optimal clustering strategy. We also identify Archimedes' spiral, based on which a deployment function is proposed for distributing MN and CH. Performance of the optimal clustering strategy is evaluated in terms of energy balance and network lifetime. Simulation results demonstrate that the propose technique significantly outperforms two competing schemes in terms of both the performance metrics.

Visual sensor networks are widely used for surveillance, environmental monitoring and tracking. However, due to the funneling effect, visual sensor nodes (SNs) close to the sink tend to deplete their energy sooner than SNs farther away from the sink resulting in energy hole problem. This energy hole problem significantly increases the unbalanced energy usage among SNs and leads to premature decrease in network lifetime. Initially, we have analyzed network lifetime and found number of relay nodes and their location has significant influence on limiting the energy hole problem and enhancement of network lifetime. Based on the principle of energy balancing, derived from this analysis, we have developed a heterogeneous SNs deployment strategy leading to an enhancement of network lifetime. Exhaustive simulation is performed to substantiate our claim of energy balancing and subsequent enhancement of network lifetime. Finally, the scheme is compared with one existing deployment scheme. The results confirm our scheme's supremacy over the existing scheme in terms of performance metrics such as energy balancing and network lifetime.

ABSTRACT Wireless sensor networks (WSNs) are susceptible to various attacks, and these attacks pose a major threat to the normal functioning of WSNs. Jamming is one such attack, which affects network operations by blocking frequencies. Hence, the need of defending such attack is of utmost importance. This paper proposes three variants of a data forwarding scheme using multi‐level multi‐tier architecture, which employs judicious surfing of a pair of channels to defend jamming attack in WSNs. Variant I defends the attack at the cost of an affordable delay. Improvement of the scheme in minimizing data transmission time is made in variant II. Further improvement in transmission time is made in variant III and is made more realistic by introducing sensing capability at all tiers, thereby increasing network coverage. Simulation is performed to establish each of the successor's variant's improvement over its predecessor. The performance of the scheme in terms of area coverage, packet delivery ratio, and control message overhead is compared with an existing jamming‐defending scheme for infrastructure‐based wireless network. Finally, comparison results establish that although the proposed scheme is equivalent to its infrastructure‐based counterpart in terms of coverage, it provides a more lightweight solution and maintains improved performance in terms of packet delivery ratio. Copyright © 2013 John Wiley & Sons, Ltd.