The integration of Unmanned Aerial Vehicles (UAVs) and Low-Earth Orbit (LEO) satellites as aerial nodes in non-terrestrial networks (NTNs) presents both opportunities and challenges for on-demand 6G interconnectivity. This paper presents a new Composite Cost Metric (CCM) which improves energy-efficient routing performance in combined UAV-satellite constellations. We consider incorporating cumulative Free Space Path Loss (FSPL) and residual energy into the route selection process for both proactive and reactive protocols, our approach refines the routing decisions of classical protocols. The proposed CCM-driven modifications and protocol-specific integration typologies can improve overall route stability, reduce energy consumption per delivered packet, and optimize network reliability by dynamically selecting relays with lower attenuation and higher energy availability. We develop an NS-3-based simulation framework that integrates realistic satellite orbital mechanics, UAV mobility models, and a hybrid energy model that includes solar energy harvesting for satellites. Simulation results demonstrate that our enhancements can indeed outperform baseline implementations in packet delivery ratio, energy efficiency, and end-to-end delay which makes them viable for next-generation NTN-supported 6G networks, at the expense of some additional control overhead. With this set of developments we aim to pave the way for global-optimum and energy-aware emergency and disaster relief communications.

Modern Healthcare cyberphysical systems have begun to rely more and more on distributed AI leveraging the power of Federated Learning (FL). Its ability to train Machine Learning (ML) and Deep Learning (DL) models for the wide variety of medical fields, while at the same time fortifying the privacy of the sensitive information that are present in the medical sector, makes the FL technology a necessary tool in modern health and medical systems. Unfortunately, due to the polymorphy of distributed data and the shortcomings of distributed learning, the local training of Federated models sometimes proves inadequate and thus negatively imposes the federated learning optimization process and in extend in the subsequent performance of the rest Federated models. Badly trained models can cause dire implications in the healthcare field due to their critical nature. This work strives to solve this problem by applying a post-processing pipeline to models used by FL. In particular, the proposed work ranks the model by finding how fair they are by discovering and inspecting micro-Manifolds that cluster each neural model's latent knowledge. The produced work applies a completely unsupervised both model and data agnostic methodology that can be leveraged for general model fairness discovery. The proposed methodology is tested against a variety of benchmark DL architectures and in the FL environment, showing an average 8.75% increase in Federated model accuracy in comparison with similar work.

The digitisation of the typical electrical grid introduces valuable services, such as pervasive control, remote monitoring and self-healing. However, despite the benefits, cybersecurity and privacy issues can result in devastating effects or even fatal accidents, given the interdependence between the energy sector and other critical infrastructures. Large-scale cyber attacks, such as Indostroyer and DragonFly have already demonstrated the weaknesses of the current electrical grid with disastrous consequences. Based on the aforementioned remarks, both academia and industry have already designed various cybersecurity standards, such as IEC 62351. However, dynamic risk assessment and certification remain crucial aspects, given the sensitive nature of the electrical grid. On the one hand, dynamic risk assessment intends to re-compute the risk value of the affected assets and their relationships in a dynamic manner based on the relevant security events and alarms. On the other hand, based on the certification process, new approach for the dynamic management of the security need to be defined in order to provide adaptive reaction to new threats. This paper presents a combined approach, showing how both aspects can be applied in a collaborative manner in the smart electrical grid.

The rise of the Internet of Medical Things introduces the healthcare ecosystem in a new digital era with multiple benefits, such as remote medical assistance, realtime monitoring, and pervasive control.However, despite the valuable healthcare services, this progression raises significant cybersecurity and privacy concerns.In this article, we focus our attention on the IEC 60 870-5-104 protocol, which is widely adopted in industrial healthcare systems.First, we investigate and assess the severity of the IEC 60 870-5-104 cyberattacks by providing a quantitative threat model, which relies on Attack Defence Trees and Common Vulnerability Scoring System v3.1.Next, we introduce an intrusion detection and prevention system (IDPS), which is capable of discriminating and mitigating automatically the IEC 60 870-5-104 cyberattacks.The proposed IDPS takes full advantage of the machine learning (ML) and software defined networking (SDN) technologies.ML is used to detect the IEC 60 870-5-104 cyberattacks, utilizing 1) Transmission Control Protocol/Internet Protocol network flow statistics and 2) IEC 60 870-5-104 payload flow statistics.

The rapid evolution of the Internet of Medical Things (IoMT) introduces the healthcare ecosystem into a new reality consisting of smart medical devices and applications that provide multiple benefits, such as remote medical assistance, timely administration of medication and real-time monitoring. However, despite the valuable advantages, this new reality increases the cybersecurity and privacy concerns since vulnerable IoMT devices can access and handle autonomously patients’ data. Furthermore, the continuous evolution of cyberattacks, malware and zero-day vulnerabilities require the development of the appropriate countermeasures. In the light of the aforementioned remarks, in this paper, we present an Intrusion Detection and Prevention System (IDPS), which can protect the healthcare communications that rely on the Hypertext Transfer Protocol (HTTP) and the Modbus/Transmission Control Protocol (TCP). HTTP is commonly adopted by conventional healthcare-related services, such as web-based Electronic Health Record (EHR) applications, while Modbus/TCP is an industrial protocol adopted by IoMT. Although the Machine Learning (ML) and Deep Learning (DL) methods have already demonstrated their efficacy in detecting intrusions, the rarely available intrusion detection datasets (especially in the healthcare sector) complicate their global application. The main contribution of this work lies in the fact that an active learning approach is modelled and adopted in order to re-train dynamically the supervised classifiers behind the proposed IDPS. The evaluation analysis demonstrates the efficiency of this work against HTTP and Modbus/TCP cyberattacks, showing also how the entire accuracy is increased in the various re-training phases.

Publisher Copyright: © 2021

In this paper, an Intrusion Detection and Prevention System (IDPS) for the Distributed Network Protocol 3 (DNP3) Supervisory Control and Data Acquisition (SCADA) systems is presented. The proposed IDPS is called DIDEROT (Dnp3 Intrusion DetEction pReventiOn sysTem) and relies on both supervised Machine Learning (ML) and unsupervised/outlier ML detection models capable of discriminating whether a DNP3 network flow is related to a particular DNP3 cyberattack or anomaly. First, the supervised ML detection model is applied, trying to identify whether a DNP3 network flow is related to a specific DNP3 cyberattack. If the corresponding network flow is detected as normal, then the unsupervised/outlier ML anomaly detection model is activated, seeking to recognise the presence of a possible anomaly. Based on the DIDEROT detection results, the Software Defined Networking (SDN) technology is adopted in order to mitigate timely the corresponding DNP3 cyberattacks and anomalies. The performance of DIDEROT is demonstrated using real data originating from a substation environment.

Honeypots are powerful security tools, developed to shield commercial and industrial networks from malicious activity. Honeypots act as passive and interactive decoys in a network attracting malicious activity and securing the rest of the network entities. Since an increase in intrusions has been observed lately, more advanced security systems are necessary. In this paper a new method of adapting a honeypot system in a modern industrial network, employing the Modbus protocol, is introduced. In the presented NeuralPot honeypot, two distinct deep neural network implementations are utilized to adapt to network Modbus entities and clone them, actively confusing the intruders. The proposed deep neural networks and their generated data are then compared.

Information and Communication Technology (ICT) is an integral part of Critical Infrastructures (CIs), bringing both significant pros and cons. Focusing our attention on the energy sector, ICT converts the conventional electrical grid into a new paradigm called Smart Grid (SG), providing crucial benefits such as pervasive control, better utilisation of the existing resources, self-healing, etc. However, in parallel, ICT increases the attack surface of this domain, generating new potential cyberthreats. In this paper, we present the Secure and PrivatE smArt gRid (SPEAR) architecture which constitutes an overall solution aiming at protecting SG, by enhancing situational awareness, detecting timely cyberattacks, collecting appropriate forensic evidence and providing an anonymous cybersecurity information-sharing mechanism. Operational characteristics and technical specifications details are analysed for each component, while also the communication interfaces among them are described in detail.

Power grid is a major part of modern Critical Infrastructure (CIN). The rapid evolution of Information and Communication Technologies (ICT) enables traditional power grids to encompass advanced technologies that allow them to monitor their state, increase their reliability, save costs and provide ICT services to end customers, thus converting them into smart grids. However, smart grid is exposed to several security threats, as hackers might try to exploit vulnerabilities of the industrial infrastructure and cause disruption to national electricity system with severe consequences to citizens and commerce. This paper investigates and compares honey-x technologies that could be applied to smart grid in order to distract intruders, obtain attack strategies, protect the real infrastructure and form forensic evidence to be used in court.

Machine-type communication (MTC) provides a potential playground for deploying machine-to-machine (M2M), IP-enabled `things' and wireless sensor networks (WSNs) that support modern, added-value services and applications. 4G/5G technology can facilitate the connectivity and the coverage of the MTC entities and elements by providing M2M-enabled gateways and base stations for carrying traffic streams to/from the backbone network. For example, the latest releases of long-term evolution (LTE) such as LTE-Advanced (LTE-A) are being transformed to support the migration of M2M devices. MTC-oriented technical definitions and requirements are defined to support the emerging M2M proliferation. ETSI describes three types of MTC access methods, namely a) the direct access, b) the gateway access and c) the coordinator access. This work is focused on studying coverage aspects when a gateway access takes place. A deployment planar field is considered where a number of M2M devices are randomly deployed, e.g., a hospital where body sensor networks form a M2M infrastructure. An analytical framework is devised that computes the average number of connected M2M devices when a M2C gateway is randomly placed for supporting connectivity access to the M2M devices. The introduced analytical framework is verified by simulation and numerical results.

IEEE 802.16e allows for flexibly defining the relation of the downlink and uplink sub-frames' width from 3:1 to 1:1, respectively. However, the determination of the most suitable ratio is left open to the network designers and the research community. Existing scheduling and mapping schemes are inflexibly designed. In this paper, a novel adaptive mapping scheme is proposed aiming to dynamically adjust the downlink-to-uplink ratio, following adequately the modification of the load requests with respect to both downlink and uplink directions. A learning automaton is exploited in order to sense the performance of the downlink and uplink mapping processes and to determine the most appropriate length ratio of both sub-frames in order to maximize the network performance. The suggested ratio determination scheme is evaluated through realistic scenarios and it is compared with static schemes that maintain a fixed ratio. The results show that our proposed scheme introduces considerable improvement, increasing the network's service ratio and reducing the bandwidth waste.