The integration of emerging uncrewed aerial vehicle (UAV) with artificial intelligence (AI) and ground-embedded robots (GERs) has transformed emergency rescue operations in unknown environments. However, the high computational demands of such missions often exceed the capacity of a single UAV, making it difficult for the system to continuously and stably provide high-level services. To address these challenges, this paper proposes a novel cooperation framework involving UAVs, GERs, and airships. This framework enables resource pooling through UAV-to-GER (U2G) and UAV-to-airship (U2A) communications, providing computing services for UAV offloaded tasks. Specifically, we formulate the multi-objective optimization problem of task assignment and exploration optimization in UAVs as a dynamic long-term optimization problem. Our objective is to minimize task completion time and energy consumption while ensuring system stability over time. To achieve this, we first employ the Lyapunov optimization method to transform the original problem, with stability constraints, into a per-slot deterministic problem. We then propose an algorithm named HG-MADDPG, which combines the Hungarian algorithm with a generative diffusion model (GDM)-based multi-agent deep deterministic policy gradient (MADDPG) approach, to jointly optimize exploration and task assignment decisions. In HG-MADDPG, we first introduce the Hungarian algorithm as a method for exploration area selection, enhancing UAV efficiency in interacting with the environment. We then innovatively integrate the GDM and multi-agent deep deterministic policy gradient (MADDPG) to optimize task assignment decisions, such as task offloading and resource allocation. Simulation results demonstrate the effectiveness of the proposed approach, with significant improvements in task offloading efficiency, latency reduction, and system stability compared to baseline methods.

uncrewed aerial vehicles (UAVs) offer high mobility and flexible deployment capabilities, making them ideal for Internet of Things (IoT) applications. However, the substantial amount of data generated by various applications within the existing low-altitude network requires processing through deep neural networks (DNN) on UAVs, which is challenging due to their limited computational resources. To address this issue, we propose a two-stage optimization method for flight path planning and task allocation based on a mother-child UAV swarm system. In the first stage, we employ a greedy algorithm to solve the path planning problem by considering the task size of the target area to be inspected and the shortest flight path as constraints. The goal is to minimize both the flight path of the UAV and the overall cost of the system. In the second stage, we introduce a novel DNN task assignment algorithm that combines multiagent deep deterministic policy gradient (MADDPG) and generative diffusion models (GDMs), named GDM-MADDPG. This algorithm takes advantage of the reverse denoising process of GDM to replace the actor network in MADDPG. It enables UAVs to generate specific DNN task assignment actions based on agents’ observations in a dynamic environment, thereby improving the efficiency of task assignment and overall system performance. The simulation results demonstrate that our algorithm outperforms the benchmarks in terms of path planning, Age of Information (AoI), task completion rate, and system utility, demonstrating its effectiveness.

In recent years, there has been a proliferation of Edge Intelligence (EI) services, especially within Internet of Vehicles (IoV) scenarios, accompanied by a growing demand for multi-modal content generation. In response, Generative Artificial Intelligence (GAI) has emerged as a promising solution, equipping EI to produce diverse Artificial Intelligence-Generated Content (AIGC) for ubiquitous edge services. However, existing cloud-based GAI capabilities, which are mostly provided via the web and the Internet, introduce unacceptable latency overhead and heightened security risks for vehicular services. To address the above shortcomings and the lack of endogenous mechanisms for applying GAI to IoV scenarios, in this paper, we propose a layered vehicular GAI framework that seamlessly integrates GAI and EI. Within this framework, we devise a distributed collaborative inference mechanism between Road-Side Units (RSUs) and vehicles. Furthermore, we formulate the shared and local inference splitting problem, a pivotal challenge influencing both GAI service latency and content-generation capability. To tackle this issue, we introduce a backward induction-based algorithm, which enables the system can make splitting decisions using a simple threshold-based policy. Simulation results underscore the remarkable performance of the proposed system and vehicular collaborative inference mechanism, promising to facilitate diverse content generation within vehicular networks.

Committee-based blockchain consensus is a fusion of permissionless consensus and the permissioned Byzantine Fault- Tolerant (BFT) classical protocol. However, three enduring challenges remain: the formal framework for the Proof-of-Stake (PoS)-based hybrid consensus, the dynamic adjustment of committee size and the definition of consensus time-bound. To tackle these challenges, in this paper, we present a Stackelberg game-driven fair committee-based blockchain consensus protocol, dubbed SG-FCB, which combines PoS and reputation-based blockchain hybrid BFT consensus. The SG-FCB protocol lever-ages an unbiased BLS-threshold signature and a random shuffle algorithm to achieve fair leader election and committee reconfiguration seamlessly. Specifically, the variant-BFT is designed to maintain the low communication cost of$\mathcal{O}(n)$, and a Stackelberg game-based incentive mechanism is proposed to jointly maximize the individual profit of the validators and the expected consensus committee responsiveness efficiency of blockchain user. Rigorous security analysis shows that for an adversary with a stakeholding fraction less than 1/3 and sufficient reputation value, we define the time bound for consensus, and the SG-FCB protocol achieves consistency and liveness properties by reasonably setting a corruption parameter and liveness parameter within a formal framework.

Insider threat is one of the most damaging cyber attacks that could cause the loss of intellectual property and enterprise data security breaches. Action sequence data such as host logs are used to investigate such threats and develop anomaly-based AI detectors. However, insider threat actions are similar to legitimate user activities, causing AI detectors to fail and suffer from high false alarm rates. Therefore, user cyber activity logs are inadequate to fully unfold insider threats. In this study, we adopt human psychological principles of risk-taking and impulsiveness along with host data to assess the influence and usefulness of human behavioral aspects in insider threat detection. We hypothesize that individuals' impulsive and risk-taking behavior correlates with cyberspace activities. To validate our hypothesis, we conducted an IRB-approved study recruiting 35 participants who work in a large U.S. university and collected their cyber and psychological data for 90 days. Host and human-behavioral data analysis and mapping indicate that impulsive and risk-taking users trigger more system errors causing (un)intentional insider threats and are susceptible to attackers' social engineering and cognitive hacking. Utilizing cyber-human aspects, we introduce a Cyber-Human Graph Neural Network (GNN) based frameworkGraphCHto identify abnormal user behaviors and detect insider threats.

Source code authorship attribution is an important problem in practical applications such as plagiarism detection, software forensics, and copyright disputes. Recent studies show that existing methods for source code authorship attribution can be significantly affected by time evolution, leading to a decrease in attribution accuracy year by year. To alleviate the problem of Deep Learning (DL)-based source code authorship attribution degrading in accuracy due to time evolution, we propose a new framework called Time D omain A daptation (TimeDA) by adding new feature extractors to the original DL-based code attribution framework that enhances the learning ability of the original model on source domain features without requiring new or more source data. Moreover, we employ a centroid-based pseudo-labeling strategy using neighborhood clustering entropy for adaptive learning to improve the robustness of DL-based code authorship attribution. Experimental results show that TimeDA can significantly enhance the robustness of DL-based source code authorship attribution to time evolution, with an average improvement of 8.7% on the Java dataset and 5.2% on the C++ dataset. In addition, our TimeDA benefits from employing the centroid-based pseudo-labeling strategy, which significantly reduced the model training time by 87.3% compared to traditional unsupervised domain adaptive methods.

Federated learning (FL) is a distributed learning process that uses a trusted aggregation server to allow multiple parties (or clients) to collaboratively train a machine learning model without having them share their private data. Recent research, however, has demonstrated the effectiveness of inference and poisoning attacks on FL. Mitigating both attacks simultaneously is very challenging. State-of-the-art solutions have proposed the use of poisoning defenses with Secure Multi-Party Computation (SMPC) and/or Differential Privacy (DP). However, these techniques are not efficient and fail to address the malicious intent behind the attacks, i.e., adversaries (curious servers and/or compromised clients) seek to exploit a system for monetization purposes. To overcome these limitations, we present a ledger-based FL framework known as FLEDGE that allows making parties accountable for their behavior and achieve reasonable efficiency for mitigating inference and poisoning attacks. Our solution leverages crypto-currency to increase party accountability by penalizing malicious behavior and rewarding benign conduct. We conduct an extensive evaluation on four public datasets: Reddit, MNIST, Fashion-MNIST, and CIFAR-10. Our experimental results demonstrate that (1) FLEDGE provides strong privacy guarantees for model updates without sacrificing model utility; (2) FLEDGE can successfully mitigate different poisoning attacks without degrading the performance of the global model; and (3) FLEDGE offers unique reward mechanisms to promote benign behavior during model training and/or model aggregation.

Most existing multi-unmanned aerial vehicle (multi-UAV) systems focus on fly path or energy consumption for task assignment, while little attention has been paid to the dynamic feature of the task, resulting in poor task completion ratio. The machine learning (ML) paradigm provides new methodologies for task assignment. However, ML methods are usually of heavy resource-consumption that cannot be directly applied in the UAV. In this paper, a digital twin (DT) assisted task assignment approach is proposed to improve the resource-intensive utilization and the efficiency of deep reinforcement learning (DRL) in multi-UAV system. The approach has a three-layer network structure which can dynamically assign tasks based on the task time constraints. Moreover, the approach is divided into two stages of initial task-assignment and task-reassignment. In the first stage, airship divides a task into multiple subtasks according to the shortest distance based on genetic algorithm and assigns them to UAVs. In the second stage, the DT can be leveraged to enable the airships to learn from the features of tasks and to generate the Q-value of the estimated value network of DRL for UAVs via pre-train of DT. The Q-value can be directly applied for deep Q-learning network (DQN) in the UAVs to reduce the training episode. Furthermore, the DQN is adopted to train task-reassignment strategy. Simulation results indicate that the DQN with DT can significantly reduce the training episode, improving 30% of the task completion ratio and 19% of the system energy efficiency compared with that of the baseline methods.

Source code authorship attribution is an important problem often encountered in applications such as software forensics, bug fixing, and software quality analysis. Recent studies show that current source code authorship attribution methods can be compromised by attackers exploiting adversarial examples and coding style manipulation. This calls for robust solutions to the problem of code authorship attribution. In this paper, we initiate the study on making Deep Learning (DL)-based code authorship attribution robust. We propose an innovative framework called Robust coding style Patterns Generation (RoPGen), which essentially learns authors' unique coding style patterns that are hard for attackers to manipulate or imitate. The key idea is to combine data augmentation and gradient augmentation at the adversarial training phase. This effectively increases the diversity of training examples, generates meaningful perturbations to gradients of deep neural networks, and learns diversified representations of coding styles. We evaluate the effectiveness of RoPGen using four datasets of programs written in C, C++, and Java. Experimental results show that RoPGen can significantly improve the robustness of DL-based code authorship attribution, by respectively reducing 22.8% and 41.0% of the success rate of targeted and untargeted attacks on average.

As increasingly more vehicles are connected to the Internet, cyber attacks against vehicles are becoming a real threat with devastating consequences. This highlights the importance of detecting vehicle cyber attacks before fatal accidents occur. One natural method for tackling this problem is to adapt existing approaches for detecting attacks in enterprize networks, but which has achieved limited success. In this article, we propose a new approach to treat vehicles as cyber-physical-human systems, leading to a novel framework called exploiting human, physical and driving behaviors to detect vehicle cyber attacks (ExHPD). The framework has four detectors: 1) a human detector; 2) a physical behavior-based detector; 3) a driving behavior-based detector (DBD); and 4) an integrated physical and DBD. As the proof of concept, we recruited 50 drivers to conduct institutional review board-approved simulation-based driving tests. The experimental results show that ExHPD is effective to detect vehicle cyber attacks and avoid deadly crashes by offering drivers adequate time to safely pull over their compromised vehicle. The impact of driver's impulsiveness (one aspect of human factors) on the detectors' effectiveness and limitations of the present study are discussed. Future research directions toward an ultimately usable solution are outlined.

Unlike conventional servers housed in a centralized and secured indoor environment (e.g., data centers), Internet-of-Things (IoT) devices such as sensor/actuator are geographically distributed and may be closely located to the physical systems where IoT devices are utilized. However, the resource-constrained nature of IoT devices limits their capacity to deploy sophisticated security solutions. The proposed approach assumes that a device can be compromised and hence, the need to be able to automatically isolate the compromised device(s). In order to enforce security policies even when devices are compromised, we propose using blockchain in the monitoring framework. Unlike existing centralized or distributed security solutions (which do not consider the possibility that the solutions themselves can be compromised), the proposed blockchain-based framework can enforce the security policies as long as a majority of the devices are not compromised. By employing the permissioned blockchain (Hyperledger Fabric) and add-on hardware modules, the proposed framework offers significantly lower latency and overhead compared to permissionless blockchain frameworks (e.g., Ethereum) and allows existing IoT devices to join the framework without modification.

The Internet of Things (IoT) technology is transforming the world into Smart Cities, which have a huge impact on future societal lifestyle, economy and business. Intelligent Transportation Systems (ITS), especially IoT-enabled Electric Vehicles (EVs), are anticipated to be an integral part of future Smart Cities. Assuring ITS safety and security is critical to the success of Smart Cities because human lives are at stake. The state-of-the-art understanding of this matter is very superficial because there are many new problems that have yet to be investigated. For example, the cyber-physical nature of ITS requires considering human-in-the-loop (i.e., drivers and pedestrians) and imposes many new challenges. In this paper, we systematically explore the threat model against ITS safety and security (e.g., malfunctions of connected EVs/transportation infrastructures, driver misbehavior and unexpected medical conditions, and cyber attacks). Then, we present a novel and systematic ITS safety and security architecture, which aims to reduce accidents caused or amplified by a range of threats. The architecture has appealing features: (i) it is centered at proactive cyber-physical-human defense; (ii) it facilitates the detection of early-warning signals of accidents; (iii) it automates effective defense against a range of threats.

Internet-of-Things (IoT) is increasingly becoming the norm in both civilian and military settings. In this paper, we present a comprehensive security abstraction layer for IoT systems based on blockchain, which provides us a logical view of a system that comprises trusted devices. The goal of the proposed layer is to detect and isolate untrusted devices. The proposed abstraction layer provides three services, namely: authorization, authentication, and auditing by using blockchain and smart contract-based approaches. We adopt a hardware based approach, where dedicated hardware modules are used to monitor the behavior of the firmware without incurring excessive performance overhead.

The Internet of Things (IoT) has been applied to home/office, healthcare, intelligent transportation and agriculture systems. The new IoT technology are growing rapidly and will play an essential role in our future societal lifestyle, economy and business. Currently, power hungry and radio wave interference are two big challenges hindering the IoT development. In this study, we propose a Markov localization algorithm to estimate positions of IoT devices considering various gateway allocation scenarios in a widespread and boundaryless field. We adopt the model-checking technique to validate the convergence of positions of the IoT devices. Our approach can accurately identify positions of IoT devices and connect each IoT node to its nearest gateways for sending sensing data and receiving commands from the cloud computing resources. We use a cattle-breeding IoT network as a case study to validate the proposed approach,which reduces IoT power consumption while enhancing the connectivity of the network. Additionally, we also discuss how to apply this simple approach to real-world IoT networks such as smart home and vehicular ad-hoc networks.

Ransomware, a class of self-propagating malware that uses encryption to hold the victims' data ransom, has emerged in recent years as one of the most dangerous cyber threats, with widespread damage; e.g., zero-day ransomware WannaCry has caused world-wide catastrophe, from knocking U.K. National Health Service hospitals offline to shutting down a Honda Motor Company in Japan [1]. Our close collaboration with security operations of large enterprises reveals that defense against ransomware relies on tedious analysis from high-volume systems logs of the first few infections. Sandbox analysis of freshly captured malware is also commonplace in operation. We introduce a method to identify and rank the most discriminating ransomware features from a set of ambient (non-attack) system logs and at least one log stream containing both ambient and ransomware behavior. These ranked features reveal a set of malware actions that are produced automatically from system logs, and can help automate tedious manual analysis. We test our approach using WannaCry and two polymorphic samples by producing logs with Cuckoo Sandbox during both ambient, and ambient plus ransomware executions. Our goal is to extract the features of the malware from the logs with only knowledge that malware was present. We compare outputs with a detailed analysis of WannaCry allowing validation of the algorithm's feature extraction and provide analysis of the method's robustness to variations of input data-changing quality/quantity of ambient data and testing polymorphic ransomware. Most notably, our patterns are accurate and unwavering when generated from polymorphic WannaCry copies, on which 63 (of 63 tested) antivirus (AV) products fail.

Information and communication technologies are widely used in health care. With the development of cloud computing, Healthcare Information Systems (HIS) are adopting mature cloud-based services for Electronic Health Record (EHR) sharing and remote diagnosis while reducing the facility, data and applications maintenance expense. Due to the high value of healthcare data and the limitation of current security solutions, HISs are highly vulnerable and have become new targets of cyber crimes.This paper discusses the current security challenges of HISs, and designs an Autonomic Security Management (ASM) approach, which proactively self-protects a HIS from internal and external attacks. The performance of a HIS is monitored in real time, and potential attacks that may disrupt HIS services are predicted by the intrusion estimation module. We also discuss the functionality and feasibility of intrusion detection systems for detecting known and unknown cyber attacks threatening the confidentiality and integrity of EHRs. The intrusion response system of the ASM approach selects the most appropriate protection mechanisms to recover the compromised HIS back to normal with little or no human intervention.

The quantity and sophistication of cyber attacks have increased year by year, thus it is infeasible to manually process Intrusion Detection Systems (IDSs) alerts. Intrusion Response Systems (IRSs) extend IDSs by providing automatic protection mechanisms. The core of an IRS is its planning algorithm, in charge of selecting the best response action to counter the detected attacks. However, the planning algorithm has to be carefully designed and implemented in order to exhibit a low overhead and not to compromise the scalability of the protected system. In this paper we present the performance evaluation of an IRS based on Markov Decision Process (MDP), which leverages many-core co-processors. Such an IRS produces optimal long-term response policies evaluated according to a multi-criteria objective function. We show that, despite the complexity of the MDP modeling, the proposed IRS is able to protect large systems while introducing little to no overhead on the protected hosts.

This paper introduces an autonomic model-based cyber security management approach for the Internet of Things (IoT) ecosystems. The approach aims at realizing a self-protecting system, which has the ability to autonomously estimate, detect, and react to cyber attacks at an early stage. Our approach integrates various model-based techniques including: 1) real-time estimation and baseline security controls to predict and eliminate potential cyber attacks; 2) data analysis to identify and classify attacks; and 3) a multicriteria optimization method to select the optimal active response for deploying countermeasures while maintaining system functions. The prototype framework has been developed with a master controller virtual machine, which can be configured for various platforms. Experimental results demonstrated the effectiveness of this proposed approach in protecting a Web-based application against known and unknown attacks with little or no human intervention.