The rapid proliferation of Internet of Things (IoT) devices has led to a significant increase in the number of network users, prompting advancements in security mechanisms. Consequently, traditional attacks targeting specific vulnerabilities have become less effective due to these enhanced defense systems, leading attackers to increasingly adopt phishing strategies as a primary means of bypassing security measures. Among these, phishing websites have been increasing rapidly, exploiting the carelessness of countless users. In response, numerous phishing website detection methods have been investigated, with machine learning-based approaches emerging as a leading strategy. However, these machine learning-based classification methods require substantial computational resources, posing challenges for their direct application in the already widespread IoT environment. To address these challenges, we propose an efficient phishing website detection method based on HTML tag sequences, the core structural elements of websites, by leveraging encoder models known for their effectiveness in classifying sequential data. Our approach also incorporates a customized tokenizer and dictionary specifically tailored for HTML tags. Experiments conducted on publicly available datasets demonstrate that the proposed method achieves over 95% accuracy across key performance metrics. Furthermore, comparative analyses highlight several advantages of our method, including reduced model size and faster detection times compared to existing approaches.

One significant security challenge in vehicular networks is defending against malicious members’ attacks, including insiders and compromised authorities. Insiders are legitimate vehicles who have passed the registration process. Since they can exploit all the information related to the network and other members’ communication, it is easier to perform various attacks with a high impact. In addition, an authority takes charge of registering and managing legitimate vehicles. Thus, if the authority is compromised, it will cause significant damage to the system, including the leaking of private information, such as identity, location, and membership. Many authentication schemes have been proposed to protect vehicular communication from these security issues. However, most existing schemes still face the vulnerability of malicious members. Furthermore, most conventional schemes require additional interactions between the vehicles and infrastructure for authentication, which can cause communication overheads. To overcome these issues, we propose a novel blockchain-based one-time authentication scheme to protect vehicular communication against malicious members. One-time authentication provides higher security and efficiency as every message is authenticated with different proof at a time. We use publicly verifiable secret sharing with blockchain for this property, which brings two benefits. First, it prevents even an authority from obtaining members’ identities by distributing encrypted shares instead of their real identities. Second, it enables robust vehicular communication against insiders’ attacks by allowing a vehicle to send unique proof generated from its private information with messages. Receivers can authenticate the messages by comparing attached values to the information through the blockchain in a noninteractive manner. Security analysis shows that our scheme assures secure vehicle-to-everything communication against insider attacks, and efficiency analysis shows how both authentication and consensus delay change.

Group Key Exchange (GKE) is an important tool to develop secure multi-user applications such as group text messages, ad-hoc networks, and so on. Most of the currently deployed GKE schemes are synchronous, i.e., they require all the participants to be online during their execution. However, with more battery-powered devices being used in such applications, the synchronicity requirement is challenging to fulfill. To fill the gaps, asynchronous GKE schemes have been introduced in the literature. Nevertheless, the currently available asynchronous and synchronous GKE schemes rely on Trusted Third Parties (TTPs) for key establishment and management. To this end, reliance on TTPs is a serious shortcoming since TTPs are well known to be the single point of failure. Furthermore, the existing GKE schemes require participants to perform all computations, which can degrade the performance of resource-constrained devices such as Internet of Things (IoT) devices. To solve these problems, in this paper, we propose an asynchronous GKE scheme that uses blockchain and smart contracts to store the security keys-related material and reduce the computational load of the participants. Furthermore, our proposed scheme provides Perfect Forward Secrecy (PFS) and Post-Compromised Security (PCS). Our implementation on Ethereum shows that the proposed scheme can scale to more than 100 participants when combined with a distributed storage system.

Electrocardiogram (ECG) based user identification has received considerable attention with the advent of wearable devices. It provides emerging applications including personal healthcare a convenient way to authenticate users as the process can be performed at the moment the user makes contact with the device. However, a recent study discovered that injecting noise into the signal transmitted from the user to an application can effectively hinder the classification process. Many efforts have been made to deal with this noise injection attack, but most approaches have focused on noise removal. In contrast, this paper proposes Defensive Adversarial Training (DAT), which involves training a model with various noisy data to enhance the robustness of deep learning-based identification algorithms. We used two types of noise, Gaussian and Laplacian, to create noisy data. In addition, a sliding-window technique was used to effectively extract useful features and to achieve better accuracy. Our simulation results demonstrate that the proposed approach is highly robust to noise injection attacks and even against random noise. A comparative analysis with noise removal schemes also shows that the proposed DAT significantly enhances the robustness of ECG-based user identification.

Classification of fashion item attributes, such as neckline types, graphic patterns, sleeve lengths, hem types/length, etc., plays an essential role in the fashion item recommender systems by means of providing precise categorization and recommendations. With recent advances in Artificial Intelligence, many online retailers have adopted deep learning models to detect and classify the attributes of their product images effectively. However, these deep learning models require large and diverse datasets with labels to achieve an acceptable accuracy, which takes time and effort to collect and annotate. Another challenge of deep learning is its limited generalization capability to a new type of sample data. We hypothesize that imbuing a neural classification model with a human’s cognitive capability, such as recognizing complex patterns by simple geometric shapes, can improve fashion attribute classification performance. This paper proposes a transfer learning-based image classification model that exploits synthetic examples of canonical shapes (e.g., circles, triangles, rectangles, etc.) from publicly available datasets and our examples created using simple graphic tools. We use these datasets of geometric shapes as a source domain to pre-train a model and fine-tune it with labeled images to solve the target problem (i.e., fashion attribute classification). Our proposed framework increases the accuracy of the neckline type and graphical pattern classifications of Resnet50 by 40.7% and 19.8%, from 49.4% and 54.8% to 90.1% and 74.6%, respectively.

During the past few years, serverless computing has changed the paradigm of application development and deployment in the cloud and edge due to its unique advantages, including easy administration, automatic scaling, built-in fault tolerance, etc. Nevertheless, serverless computing is also facing challenges such as long latency due to the cold start. In this paper, we present an in-depth performance analysis of cold start in the serverless framework and propose HotC, a container-based runtime management framework that leverages the lightweight containers to mitigate the cold start and improve the network performance of serverless applications. HotC maintains a live container runtime pool, analyzes the user input or configuration file, and provides available runtime for immediate reuse. To precisely predict the request and efficiently manage the hot containers, we design an adaptive live container control algorithm combining the exponential smoothing model and Markov chain method. Our evaluation results show that HotC introduces negligible overhead and can efficiently improve the performance of various applications with different network traffic patterns in both cloud servers and edge devices.

Federated Learning (FL) is a promising technique for edge computing environments as it provides better data privacy protection. It enables each edge node in the system to send a central server a computed value, named gradient, rather than sending raw data. However, recent research results show that the FL is still vulnerable to an inference attack, which is an adversarial algorithm that is capable of identifying the data used to compute the gradient. One prevalent mitigation strategy is differential privacy which computes a gradient with noised data, but this causes another problem that is accuracy degradation. To effectively deal with this problem, this paper proposes a new digestive neural network (DNN) and integrates it into FL. The proposed scheme distorts raw data by DNN to make it unrecognizable then computes a gradient by a classification network. The gradients generated by edge nodes will be sent to the server to complete a trained model. The simulation results show that the proposed scheme has 9.31% higher classification accuracy and 19.25% lower attack accuracy on average than the differential private schemes.

Federated Learning (FL) is an efficient and secure machine learning technique designed for decentralized computing systems such as fog and edge computing. Its learning process employs frequent communications as the participating local devices send updates, either gradients or parameters of their models, to a central server that aggregates them and redistributes new weights to the devices. In FL, private data does not leave the individual local devices, and thus, rendered as a robust solution in terms of privacy preservation. However, the recently introduced membership inference attacks pose a critical threat to the impeccability of FL mechanisms. By eavesdropping only on the updates transferring to the center server, these attacks can recover the private data of a local device. A prevalent solution against such attacks is the differential privacy scheme that augments a sufficient amount of noise to each update to hinder the recovering process. However, it suffers from a significant sacrifice in the classification accuracy of the FL. To effectively alleviate the problem, this paper proposes a Digestive Neural Network (DNN), an independent neural network attached to the FL. The private data owned by each device will pass through the DNN and then train the FL. The DNN modifies the input data, which results in distorting updates, in a way to maximize the classification accuracy of FL while the accuracy of inference attacks is minimized. Our simulation result shows that the proposed DNN shows significant performance on both gradient sharing- and weight sharing-based FL mechanisms. For the gradient sharing, the DNN achieved higher classification accuracy by 16.17% while 9% lower attack accuracy than the existing differential privacy schemes. For the weight sharing FL scheme, the DNN achieved at most 46.68% lower attack success rate with 3% higher classification accuracy.

MPEG-DASH is a video streaming standard that outlines protocols for sending audio and video content from a server to a client over HTTP. However, it creates an opportunity for an adversary to invade users’ privacy. While a user is watching a video, information is leaked in the form of meta-data, the size of data and the time the server sent the data to the user. After a fingerprint of this data is created, the adversary can use this to identify whether a target user is watching the corresponding video. Only one defense strategy has been proposed to deal with this problem: differential privacy that adds sufficient noise in order to muddle the attacks. However, that strategy still suffers from the trade-off between privacy and efficiency. This paper proposes a novel defense strategy against the attacks with rigorous privacy and performance goals creating a private, scalable solution. Our algorithm, “No Data are Alone” (NDA), is highly efficient. The experimental results show that our scheme is more than two times efficient in terms of excess downloaded video (represented as waste) compared to the most efficient differential privacy-based scheme. Additionally, no classifier can achieve an accuracy above 7.07% against videos obfuscated with our scheme.

Vehicle to everything (V2X) in heterogeneous networks concurrently retains multiple communication links within a channel: such as vehicle to vehicle (V2V), Vehicle to macro base station (V2C), and cellular user equipment to femtocell base station (U2F). To provide high spectral efficiency, there were many efforts such as non-orthogonal multiple access (NOMA) and channel aggregation. However, combining these schemes on the top of NOMA-V2X-femtocell is extremely challenging as it increases the number of dimensions to be considered. To address this issue, this paper proposes a new genetic deep learning algorithm. It employs a genetic algorithm (GA) to find a pair of communication links per channel in a way to maximize the throughput and a neural network to reduce the dimension gradually. The neural network is trained to predicts which pair can be part of the final result. The suitable pairs are marked by deep learning, then they are not shuffled in the subsequent generations. The simulation results show that the proposed scheme achieved higher throughput greater than 20%, compared to the existing GA.

Network anomalies are correlated to activities that deviate from regular behavior patterns in a network, and they are undetectable until their actions are defined as malicious. Current work in network anomaly detection includes network-based and host-based intrusion detection systems. However, most of them suffer from high false detection rates due to the base rate fallacy. To overcome such a drawback, this paper proposes a superior behavior-based anomaly detection system (SuperB) that defines legitimate network behaviors of authorized users in order to identify unauthorized accesses. We define the network behaviors of the authorized users by training the proposed deep learning model with time-series data extracted from network packets of each of the users. Then, the trained model is used to classify all other behaviors (we define these as anomalies) from the defined legitimate behaviors. As a result, SuperB effectively detects all anomalies of network behaviors. Our simulation results show that the proposed algorithm needs at least five end-to-end conversations to achieve over 95% accuracy and over 93% recall rate. Some simulations show 100% accuracy and recall rate. Our simulations use live network data combined with the CICIDS2017 data set. The performance has an average of less than 1.1% false-positive rate with some simulations showing 0%. The execution time to process each conversation is 85.20±0.60 milliseconds (ms), and thus it takes about only 426 ms to process five conversations to identify anomaly.

Group Key Agreement (GKA) mechanisms play a crucial role in realizing various applications in different networks, such as sensor networks and the Internet of Things (IoT). To be suitable for IoT, a GKA must satisfy several critical requirements. First, a GKA must be robust against a compromised device attack and satisfy essential secrecy definitions without the existence of a Trusted Third Party (TTP). TTP is often used by IoT devices to establish ad hoc networks securely, and usually, these devices are resource-constrained. Second, the GKA must be able to distribute session keys successfully, even with offline devices. Third, a GKA must reduce the burden of heavy cryptographic computations for IoT devices. Based on these observations, we propose a new GKA scheme that satisfies all the requirements above. The proposed scheme leverages smart contracts to alleviate the computational and storage overheads on IoT devices induced by cryptographic functions. It also brings the advantage of asynchronism such that offline devices will be able to compute the group key once they are online.

As a primitive function of location-based services (LBSs), the location sharing aims to provide a user's current location information to other designated users. In recent years, LBSs have become one of the most popular services provided by mobile online social networks (mOSNs). As LBSs actively exploit the users' identity and current location information, appropriate approaches have to be utilized to protect the location privacy of the users. Several recent reports have discussed the significance of friendship privacy protection with the goal of hiding the friendship relation of users from unintended entities. However, to the best of our knowledge, there hasn't been an approach for protecting the location sharing with complete privacy of location and friendship connections. To address this issue, we propose a new cryptographic primitive, functional pseudonym, for location sharing in mOSNs that ensures both of them. Unlike many of the existing solutions, our approach does not require a fully trusted server and does not assume pre-established secrets among friends, and therefore is highly practical. Also, the proposed approach significantly reduces computational overhead of users by delegating part of the computations for location sharing to a server, therefore it is highly sustainable. Our primitive can be widely used in many mOSNs to enable LBSs with improved privacy and sustainability. Consequently, it will contribute to proliferate LBSs by eliminating users privacy concerns.

Recently, the concept of fog-cloud storage is attracting lots of attentions to overcome the limit of the central cloud storage. A storage audit scheme aims to ensure user that his/her data on the storage is sound. So far, various audit schemes have been introduced for cloud storages. However, compared to a central cloud storage, a distributed fog-cloud storage consists of multiple local fog storages in addition to a global cloud storage and therefore it is not straightforward to directly apply an existing audit scheme for a cloud storage to a fog-cloud storage. To address this issue, this paper introduces a new fog-cloud storage architecture which can achieve much higher throughput compared to the traditional central cloud storage architecture by reducing the traffics at the routers nearby the cloud storage. The proposed architecture provides transparency such that an end user device does not know the existence of fog storages, and only needs to upload its request toward the central cloud. This means that there is no need to make a modification on the existing end user devices. Our system provides a stronger audit scheme which is naturally coupled with the initial data upload process and does not suffer from the replay attack using old proof of data soundness.

This paper introduces the concept of a new service for social Internet of Vehicles (IoV)-based clouds called incentives-based vehicle witnesses as a service (IVWaaS), which employs vehicles moving on the road as the witnesses to designated events. Specifically, we focus on two key enablers, a new secure and privacy preserving service framework as well as a new incentive mechanism to promote the wide adoption of the aforementioned social service. In IVWaaS, when confronted any events, the vehicles in the vicinity with mounted cameras collaborate with other roadside cameras to take pictures of the site of interest around them, and send the pictures to the cloud infrastructure anonymously so that the privacy of the vehicles can be preserved. To stimulate active participation from the users, we also introduce a new privacy-aware incentives mechanism called privacy-aware proportionate receipt collection, in which the contributors are credited according to their contribution to the service and can claim their incentives in a privacy-aware fashion. Service providers can also use the stored pictures as “on-demand picture service.” Other law enforcement agencies can obtain the stored pictorial information and use it as forensics in the investigations.

Summary The mobile cloud is a highly heterogenous and constantly evolving network of numerous portable devices utilizing the powerful back‐end cloud infrastructure to overcome their severe deficiency in computing resource and offer various services such as data sharing. Inherently, in mobile cloud, the risk of user privacy invasion by the cloud operator is high. The conditional proxy re‐encryption (CPRE) is a useful concept for secure group data sharing via cloud while preserving the privacy of the shared data from any unintended third parties including the cloud operator. Unfortunately, the state‐of‐art CPRE is not particularly designed for mobile cloud environment and therefore imposes heavy burdens to the weak mobile cloud clients. This paper introduces a new CPRE scheme, namely the CPRE for mobile cloud, which utilizes the back‐end cloud to the extreme extent so that the overhead of terminals is drastically reduced. Specifically, our scheme outsources a significant amount of computation overhead caused by the following functions at terminals: (a) re‐encryption key generation, (b) condition value change, and (c) decryption, to the cloud. The proposed scheme also allows users to verify the correctness of outsourced computation under refereed delegation of computation model. Our simulation results show CPRE for mobile cloud that outperforms its existing alternatives. Copyright © 2016 John Wiley & Sons, Ltd.

Recently, the concept of barrier-coverage of wireless sensor network has been introduced for various civilian and military defense applications. This paper studies the problem of how to organize hybrid sensor network, which consists of a number of energy-scarce ground sensors with homogenous initial battery level and energy-plentiful mobile sensors, to maximum the lifetime of barrier-coverage. Two key observations are (a) as the lifetime of each mobile sensor is much longer than that of the static ground sensors, each mobile sensor is capable of contributing multiple sensor barrier formations, and (b) no mobile sensor node can join two hybrid barriers which will be successively used to continuously protect the area of interest due to the moving delay. Based on these, we introduce a new maximum lifetime barrier-coverage problem in hybrid sensor network. We first propose a simple heuristic algorithm by combining existing ideas along with our own. Then, we design another efficient algorithm for the problem and prove that the lifetime of hybrid barrier constructed by this algorithm is at least three times greater than the existing one on average. Our simulation result shows that the second algorithm outperforms the first algorithm at least 33 percent and up to 100 percent.

Recently an online electric vehicle (OLEV) concept has been introduced, where vehicles are propelled by the wirelessly transmitted electrical power from the infrastructure installed under the road while moving. The absence of secure-and-fair billing is one of the main hurdles to widely adopt this promising technology. This paper introduces a new secure and privacy-aware fair billing framework for OLEV on the move through the charging plates installed under the road. We first propose two extreme lightweight mutual authentication mechanisms, a direct authentication and a hash chain-based authentication between vehicles and the charging plates that can be used for different vehicular speeds on the road. Second, we propose a secure and privacy-aware wireless power transfer on move for the vehicles with bidirectional auditability guarantee by leveraging game theoretic approach. Each charging plate transfers a fixed amount of energy to the vehicle and bills the vehicle in a privacy-aware way accordingly. Our protocol guarantees secure, privacy-aware, and fair billing mechanism for the OLEVs while receiving electric power from the infrastructure installed under the road. Moreover, our proposed framework can play a vital role in eliminating the security and privacy challenges in the deployment of power transfer technology to the OLEVs.

Location based services (LBSs), which are useful applications of mobile online social network (mOSN), exploit various geographic properties. Location sharing helps people to share their current locations with designated friends and is one important primitive to construct the LBSs. The recent reports showed that a poorly designed location sharing scheme could easily allow the privacy of users to be violated. Over years, lots of efforts are made to provide a privacy-preserving location sharing, but none of them is satisfactory. To address this issue, we introduce a new location sharing scheme in mOSNs with a strong user privacy protection mechanism such that (a) the user's current location as well as (b) the list of friends who will learn the user's current location will be protected from any unintended entity, while the designated friends in the list will learn the exact location of the user. For this purpose, we introduce a new cryptography primitive called the functional pseudonym scheme based on Lagrange polynomial with the public social network IDs of the designated friends. Then, the pseudonym of a user is posted on the server along with the current location of the user. While each user can see every posted messages (pseudonym and location pairs), the actual identify of the originator of each pair can be verified only by designated friends, whose identities are used to compute the pseudonym. Most importantly, unlike any of the existing counterparts, our scheme does not assume neither a trusted server nor pre-established secret among the friends.

Recently a new concept of online electric vehicle (OLEV) has been introduced in South Korea, where vehicles are propelled through the transmitted energy from the infrastructure installed underneath the road. However, for billing and audit reasons only authentic vehicles with necessary credentials are allowed to charge their batteries and pay the designated amount to the service provider. Moreover, due to the massive budget requirements for such infrastructure, only designated road segments will offer the charging service. As a result, a tradeoff solution to the charging of electric vehicles is needed to both fulfill the charging requirements of the electric vehicles and reduce the upfront costs for the service providers. To obtain electric charge from the charging plates beneath the road, vehicles need to authenticate themselves beforehand for twofold purposes: to bill the vehicles accordingly and to let the revocation authorities revoke the vehicle in case of a dispute. In this paper, we use the core concept of the OLEV and introduce extreme lightweight privacy-aware authentication schemes for charging-on-the-move through the charging plates installed under the road. More precisely we propose two mutual authentication mechanisms between charging plates and the vehicles, a direct authentication and a hash chain-based authentication. In the direct authentication scheme, we leverage multiple pseudonyms for conditional privacy. Vehicles use different pseudonyms every time they use the charging-on-the-move service. Whereas in case of hash chain-based authentication mechanism, the vehicles mutually authenticate with charging plates through service provider. Our proposed authentication mechanisms preserve conditional privacy throughout the protocol and is computationally lightweight than the existing mechanisms.

The term "smart grid" refers to the next generation power supply system. A smart meter, an essential component of the grid system, is installed at each housing unit and acts as an agent for the unit. While the smart meter is a key enabler of great opportunities and conveniences in smart grid, it is susceptible to various cyber-security attacks, especially privacy invasion from electricity providers. Trusted third party (TTP) and homomorphic encryption are two favorite tools to deal with this issue in the literature. Unfortunately, the use of TTP does not completely eliminate the privacy risk. On the other hand, the use of homomorphic encryption makes it harder for the providers to support various services whose demand can be highly diversified. In this paper, we introduce a drastically new approach to deal with the consumer privacy issue in smart grid. Our key idea is let each consumer to determine the frequency of the measurement report. In this way, each consumer can responsibly make a trade-off between the level of privacy preservation with the quality of the services it will receive.

In the recent past, a new concept termed as VANET-based clouds evolved from traditional VANET incorporating both VANET and cloud computing technologies in order to provide vehicle drivers, passengers, and consumers with safe, reliable, and infotainment-rich services while driving on the roads. In this paper, we use a framework of VANET-based clouds proposed by Hussain et al. namely VuC (VANET using Clouds) and define another layer TIaaS (Traffic Information as a Service) atop the cloud computing stack. TIaaS layer provides vehicular nodes (more precisely subscribers) with fine-grained traffic information in a secure way. Additionally our proposed scheme provides security, privacy, and conditional anonymity which are of prime concern in VANET clouds.

Technological advancements in mobile technology and cloud computing open the door for another paradigm known as Mobile Cloud Computing (MCC). This integration of cloud computing and mobile technology gives numerous facilities to a mobile user, such as the ubiquitous availability of Location Based Services (LBS). The utilization of these LBS services require the knowledge of a user's location, hence threatens the privacy of a user. In this paper we take advantages of ultra-fast processing and reliability of cloud computing and aim to solve the privacy threat issue faced by a mobile user while getting LBS services. We propose a model that utilizes a cloud based server which helps in making of a cloaking region. We highlight that how our model utilizes an untrusted cloud based server and eliminates the use of a trusted anonymizer while providing LBS services to a user securely and anonymously.

Inspired by the dramatic evolution of VANE clouds, this paper proposes a new VANET-cloud service called VWaaS (Vehicle Witnesses as a Service) in which vehicles moving on the road serve as anonymous witnesses of designated events such as a terrorist attack or a deadly accident. When confronted the events, a group of vehicles with mounted cameras collaborate with roadside stationary cameras to take pictures of the site of interest (SoI) around them, and send the pictures to the cloud infrastructure anonymously. The pictures are sent to the cloud in a way that the privacy of the senders can be protected, and kept by the cloud for future investigation. However, for the case that the pictures are used as an evidence of court trial, we made the privacy protection to be conditional and thus can be revoked by authorized entity(s) if necessary.

The foreseen dream of reliable, safe, and comfortable driving experience is yet to become reality since automobile industries are testing their waters for VANET (Vehicular Ad Hoc NETwork) deployment. But nevertheless, security and privacy issues have been the root cause of hindrance in VANET deployment. Recently, VANET evolved to VANET-based clouds as a result of resources-rich high-end cars. Soon after, Hussain et al. defined different architectural frameworks for VANET-based clouds. In this paper, we aim at a specific framework namely VuC (VANET using Clouds) where VANET and CC (Cloud Computing) cooperate with each other in order to provide VANET users (more precisely subscribers) with services. We propose a lightweight privacy-aware revocation and route tracing mechanism for VuC. Beacons broadcasted by vehicles are stored in cloud infrastructure as cooperation from VANET and after processing, cloud provides VANET subscribers with services. Revocation authorities can revoke and trace the path taken by the target node for a specified timespan by exploiting the beacons stored in the cloud. Our proposed scheme is secure, preserves conditional privacy, and is computationally less expensive than the previously proposed schemes.

Despite the surge in Vehicular Ad Hoc NETwork (VANET) research, future high-end vehicles are expected to under-utilize the on-board computation, communication, and storage resources. Olariu et al. envisioned the next paradigm shift from conventional VANET to Vehicular Cloud Computing (VCC) by merging VANET with cloud computing. But to date, in the literature, there is no solid architecture for cloud computing from VANET standpoint. In this paper, we put forth the taxonomy of VANET based cloud computing. It is, to the best of our knowledge, the first effort to define VANET Cloud architecture. Additionally we divide VANET clouds into three architectural frameworks named Vehicular Clouds (VC), Vehicles using Clouds (VuC), and Hybrid Vehicular Clouds (HVC). We also outline the unique security and privacy issues and research challenges in VANET clouds.