The Internet of Maritime Things (IoMT) enables large-scale coordination and sensing across vessels and coastal infrastructures, but the openness of Automatic Identification System (AIS) data and limited trust among participants expose learning pipelines to inference, leakage, and replay attacks. To address these challenges, this paper presents HHB-FL, a privacy-preserving federated learning framework designed for maritime environments. HHB-FL achieves end-to-end confidentiality through hierarchical homomorphic encryption and verifiable on-chain aggregation. Specifically, model updates are separated into weights and biases: weight updates are first perturbed with calibrated Laplace noise to ensure differential privacy and then encrypted using the Paillier scheme to maintain lightweight client computation, while bias updates are encrypted with CKKS to support precise homomorphic aggregation of floating-point parameters. A blockchain-based smart contract performs identity verification, deduplication, and freshness validation, ensuring transparent and tamper-evident aggregation without relying on a trusted server. A momentum-aware optimization strategy further stabilizes convergence under non-IID data and bandwidth-limited maritime links. Experimental results on AIS-driven tasks demonstrate that HHB-FL reduces the inference attack success rate from 92.59% to 41.61%, achieves 87.9% accuracy after 100 rounds, and maintains practical decryption and communication overheads. These results confirm that HHB-FL provides a secure and efficient foundation for privacy-preserving analytics in maritime IoT deployments.

As a core sixth-generation (6G) architecture, the Space-Air-Ground-Sea Integrated Network (SAGSIN) features multi-layer heterogeneity and large-scale deployment, with broad application potential in critical fields (e.g., ocean shipping, national defense, emergency rescues). However, its cross-domain integration and expanded scale introduce severe cybersecurity risks, making Network Security Situation Prediction (NSSP)—a key component of Network Security Situation Awareness (NSSA)—essential for proactive defense. Existing NSSP methods have limitations: gray modeling is incompatible with SAGSIN’s non-linear multi-source data, while most time-series models focus on single network domain tasks, lacking multi-layer fusion and long-term forecasting for cross-domain scenarios. To address these gaps, this paper proposes the Multi-level Gated Kolmogorov-Arnold Network (MGKAN) for SAGSIN’s cross-domain multi-layer NSSP. MGKAN integrates two key innovations: 1) a multi-layer channel fusion method (modified self-attention with channel independence and patch strategies) to extract inter-layer situational dependencies; 2) GKAN, a Temporal Kolmogorov-Arnold Network (TKAN)-inspired module enhanced with gating units for capturing long-range temporal dynamics.Experimental results confirm MGKAN’s superiority: it achieves top performance in 7/8 metrics on the TON IoT dataset, on three classic multivariate time-series datasets, secures 12 best and 9 second-best results across 24 task indicators. MGKAN enables cross-domain feature learning and efficient long-term prediction, addressing SAGSIN’s architectural complexity and early-warning needs. This work fills the cross-domain multi-layer NSSP research gap, providing a practical framework for safeguarding large-scale integrated communication networks like SAGSIN.

This paper investigates the formation-surrounding control problem of multiagent pursuit-evasion (MPE) games with denial-of-service (DoS) attacks and disturbance. First, a novel prescribed-time observer is developed to estimate the disturbance suffered by the multiagent, which eliminates the assumption of disturbance upper bound. Second, the resilient formation-surrounding control methods are designed for the MPE games under DoS attacks via the reinforcement learning (RL) and improved dynamic event-triggering mechanism (IDETM). In the RL framework, a novel weight updating law without finite/persistent excitation conditions is proposed such that the estimation error of weight can be uniformly ultimately bounded (UUB). In the IDETM, the arc-cotangent function is introduced to improve the inter-event interval into the event-triggering condition. Finally, the effectiveness and advantages of the developed policy are validated by the theoretical analysis and numerical simulations.

Due to the exstence of common and rare diseases, the complex clinical scenario often poses the challenging class imbalanced open set recognition problem. Unfortunately, most existing approaches are ill-suited for such situations with limited and imbalanced data during training and the possibility of encountering unseen classes during test. In this work, we propose a novel Multi-level mixup-based Evidential Open Set Recognition (ME-OSR) approach to more explicitly and effectively address the open set recognition for class-imbalanced medical images. Briefly, we first extract disentangled discriminative and background image features. Then, based on the original images and extracted features, we propose to sample and conduct Multi-level Open Mixup (MOM) for a more balanced open set data augmentation. It includes extensive intra- and interclass mixup operations in both image and feature spaces, which can augment rare classes with different feature combinations and generate potential pseudo-unknown class examples in the open set to boost the model training. Based on the augmented data and their extracted discriminative features, we propose a Regularized Evidential Deep Learning (REDL) classifier to work with the augmented data to achieve open set recognition with prediction uncertainty estimation and unknown example rejection. Through comparative experiments and ablation studies on several representative medical datasets, we showed that our proposed method outperforms other state-of-the-arts on four popular medical OSR datasets.

Internet of Things (IoT) security is a guarantee for the rapid development of IoT. Traditional supervised deep learning-based intrusion detection systems (IDSs) need to label all the traffic data, but the number of labeled records is always insufficient. The current intrusion detection algorithms are relatively inefficient in detecting new attacks as well as a small number of attacks. In this article, we proposed a self-supervised deep learning method combining supervised learning which is improved residual temporal convolution neural network adversarial autoencoder with efficient channel attention (IResTAE2A), our proposed model is trained without any labeled attack information, in which we proposed an improved residual temporal convolution neural network (TCN) module to enhance the spatiotemporal characterization of neural network learning traffic data. An Improved adversarial autoencoder (AAE) was introduced to enhance the encoder’s representation learning ability to better extract the hidden information of normal traffic. In addition, an efficient channel attention (ECA) mechanism was introduced, which performs feature extraction on the useful part of the data before training to improve the efficiency of training afterward. We utilized the NSL-KDD data set, the CIC-IDS2017 data set, and the CIC-IDS2018 data set to simulate and evaluate the model, and the experimental results show that the proposed method is able to more effectively improve the accuracy of IoT’s detection of new samples or even small samples of attacks under the condition of no-sample-labeling. IResTAE2A maintains the monitoring accuracy while significantly reduces the training time i.e., it is able to process the intrusion detection dynamically and in real time.