Federated learning (FL) is a promising collaborative and privacy-preserving machine learning approach in data-rich smart cities. Nevertheless, the inherent heterogeneity of these urban environments presents a significant challenge in selecting trustworthy clients for collaborative model training. The usage of traditional approaches, such as the random client selection technique, poses several threats to the system’s integrity due to the possibility of malicious client selection. Primarily, the existing literature focuses on assessing the trustworthiness of clients, neglecting the crucial aspect of trust in federated servers. To bridge this gap, in this work, we propose a novel framework that addresses the mutual trustworthiness in FL by considering the trust needs of both the client and the server. Our approach entails: 1) creating preference functions for servers and clients, allowing them to rank each other based on trust scores; 2) establishing a reputation-based recommendation system leveraging multiple clients to assess newly connected servers; 3) assigning credibility scores to recommending devices for better server trustworthiness measurement; 4) developing a trust assessment mechanism for smart devices using a statistical interquartile range (IQR) method; and 5) designing intelligent matching algorithms considering the preferences of both parties. Based on simulation and experimental results, our approach outperforms baseline methods by increasing trust levels, global model accuracy, and reducing nontrustworthy clients in the system.

We address in this paper the challenge of data poisoning attacks on Federated Learning. We consider a particularly challenging attack scenario in which a single poisoning attack is coordinated over a set of clients to complicate its detection. In response, the federated learning server assigns a weight to each client’s model update with the aim of mitigating the effects of the poisoning on the global model. To address this challenge, we first design a trust mechanism that enables the federated learning server to assess the trustworthiness of each client on the basis of the client’s adherence to the federated learning protocol and the quality of data contributed by the client. Capitalizing on the trust mechanism, we model the interactions between the attacker and federated learning server as a security max-min game. The outcome of the game guides the server on the optimal weight assignment strategy over the set of clients’ model updates, so as to minimize the effects of the data poisoning on the global model. Simulations conducted on the MNIST and CIFAR-10 datasets suggest that our proposed solution decreases the coordinated attack success rate, as well as the false positive and false negative percentages compared to two baseline solutions.

Autonomous driving has been gaining a lot of attention in the field of transportation technology in recent years. The use of autonomous vehicles has the potential to reduce the number of road accidents caused by human error, improve traffic flow, increase fuel efficiency and save time for travelers. In federated learning systems, selecting trustworthy autonomous vehicles (AVs) to participate in training is critical for ensuring system performance and reliability. In this work, we propose a trust-aware approach to AV selection that incorporates the performance of each AV using the Local Interpretable Model-Agnostic Explanations (LIME) method and One-Shot Federated Learning. We modify the XAI LIME Deep Q-learning-based AV selection model to include the trust metric, resulting in the Trust-Aware XAI LIME Deep Q-learning-based AV selection model. Our experiments show that the trust-aware approach outperforms the standard approach in terms of both accuracy and reliability, demonstrating the effectiveness of incorporating trust metrics in AV selection.

Federated Learning (FL) is a revolutionary privacy-preserving distributed learning framework that allows a small group of users to cooperatively build a machine-learning model using their own data locally. Smart cities are areas that can generate high volume and critical data, which has the potential to revolutionize federated learning. Nevertheless, it is highly challenging to select a trustworthy group of clients to collaborate in model training. The utilization of a random selection technique would pose many threats due to malicious clients’ targeted and untargeted attacks. Such vulnerability may cause attacks and poisoning in the produced model. To address this problem, we present a mutual trust client-server selection approach based on matching game theory and bootstrapping mechanisms for federated learning in smart cities. Our solution entails the creation of: (1) preference functions for federated servers and smart devices (i.e., IoT/IoV) that enables them to sort each other based on trust score, (2) light feedback-base technique that leverages the cooperation of multiple client devices to assign trust value to the newly connected federated server, and (3) intelligent matching algorithms consider trust preferences of both parties in their design. According to our simulation results, our technique outperforms the baseline selection approach VanillaFL in terms of increasing the trust level and hence the global accuracy of the federated learning model and optimizing the number of untrusted selected clients.

In the past several years, the world has witnessed an acute surge in the production and usage of smart devices which are referred to as the Internet of Things (IoT). These devices interact with each other as well as with their surrounding environments to sense, gather and process data of various kinds. Such devices are now part of our everyday’s life and are being actively used in several verticals, such as transportation, healthcare, and smart homes. IoT devices, which usually are resource-constrained, often need to communicate with other devices, such as fog nodes and/or cloud computing servers to accomplish certain tasks that demand large resource requirements. These communications entail unprecedented security vulnerabilities, where malicious parties find in this heterogeneous and multiparty architecture a compelling platform to launch their attacks. In this work, we conduct an in-depth survey on the existing intrusion detection solutions proposed for the IoT ecosystem which includes the IoT devices as well as the communications between the IoT, fog computing, and cloud computing layers. Although some survey articles already exist, the originality of this work stems from the three following points: 1) discuss the security issues of the IoT ecosystem not only from the perspective of IoT devices but also taking into account the communications between the IoT, fog, and cloud computing layers; 2) propose a novel two-level classification scheme that first categorizes the literature based on the approach used to detect attacks and then classify each approach into a set of subtechniques; and 3) propose a comprehensive cybersecurity framework that combines the concepts of explainable artificial intelligence (XAI), federated learning, game theory, and social psychology to offer future IoT systems a strong protection against cyberattacks.

Federated learning (FL) is a novel distributed privacy-preserving learning paradigm, which enables the collaboration among several participants (e.g., Internet of Things (IoT) devices) for the training of machine learning models. However, selecting the participants that would contribute to this collaborative training is highly challenging. Adopting a random selection strategy would entail substantial problems due to the heterogeneity in terms of data quality, and computational and communication resources across the participants. Although several approaches have been proposed in the literature to overcome the problem of random selection, most of these approaches follow a unilateral selection strategy. In fact, they base their selection strategy on only the federated server’s side, while overlooking the interests of the client devices in the process. To overcome this problem, we present in this articleFedMint, an intelligent client selection approach for FL on IoT devices using game theory and bootstrapping mechanism. Our solution involves the design of: 1) preference functions for the client IoT devices and federated servers to allow them to rank each other according to several factors, such as accuracy and price; 2) intelligent matching algorithms that take into account the preferences of both parties in their design; and 3) bootstrapping technique that capitalizes on the collaboration of multiple federated servers in order to assign initial accuracy value for the newly connected IoT devices. We compare our approach against theVanillaFLselection process as well as other state-of-the-art approach and showcase the superiority of our proposal.

The “black-box” nature of artificial intelligence (AI) models has been the source of many concerns in their use for critical applications. Explainable Artificial Intelligence (XAI) is a rapidly growing research field that aims to create machine learning models that can provide clear and interpretable explanations for their decisions and actions. In the field of cybersecurity, XAI has the potential to revolutionize the way we approach network and system security by enabling us to better understand the behavior of cyber threats and to design more effective defenses. In this survey, we review the state of the art in XAI for cybersecurity and explore the various approaches that have been proposed to address this important problem. The review follows a systematic classification of cybersecurity threats and issues in networks and digital systems. We discuss the challenges and limitations of current XAI methods in the context of cybersecurity and outline promising directions for future research.

In this article, we propose a new paradigm of Federated Learning (FL) for Internet of Things (IoT) devices calledCoalitional Federated Learning. The proposed paradigm aims to address the challenges of (1) non-independent and identically distributed (non-IID) data across clients; (2) communication overhead due to the large number of messages exchanged between the server and clients; and (3) selfish clients that seek to obtain the latest global models without efficiently contributing to the training of the FL model. Our novel paradigm consists of three main components, i.e., (1) client-to-client trust establishment mechanism that relies on subjective and objective sources to enable clients to establish credible trust relationships toward one another; (2) trust-enabled coalitional game to enable clients to autonomously form harmonious coalitions of FL trainers; and (3) coalitional federated learning in which multiple local aggregations take place at the level of each coalition to mitigate the problems of non-IID data and communication bottleneck. Extensive experiments suggest that our solution outperforms both the standard vanilla FL approach and one state-of-the-art trust-based FL approach in terms of increasing the accuracy of the global FL model and decreasing the presence of selfish devices participating in the training.

Federated Learning (FL) is a novel distributed privacy-preserving learning paradigm, which enables the collaboration among several devices. However, selecting the participants that would contribute to this collaborative training is highly challenging. Adopting a random selection strategy would entail substantial problems due to the heterogeneity in terms of data quality and resources across the participants. To overcome this problem, we propose an intelligent client selection approach for federated learning on IoT devices using matching game theory. Our solution involves the design of: (1) preference functions for the client IoT devices and federated servers to allow them to rank each other according to several criteria such as accuracy and price, and (2) intelligent matching algorithms that take into account the preferences of both parties in their design. Based on our simulation findings, our strategy surpasses the VanillaFL selection approach in terms of maximizing both the revenues of the client devices and accuracy of the global federated learning model.

Fog computing extends the concept of cloud computing by allowing services, embedded into virtual machines or containers, to be placed at the edge of the network in the proximity of the end devices. However, due to the huge increase in the number of user requests, placing containers onto fog devices becomes a challenging task. In this work, we address the problem of large-scale container placement in fog computing environments. We propose a machine learning-based K-means clustering solution, which we integrate into the Genetic Algorithm (GA) to improve the selection of the initial population. We first formulate the container placement problem as a multi-objective optimization model with several (conflicting) objectives and then propose a cluster-based GA approach to solve the problem in an efficient manner. Simulation results suggest that our solution outperforms one state-of-the-art approach in terms of effectiveness and efficiency.

Recently, the concept of autonomous driving became prevalent in the domain of intelligent transportation due to the promises of increased safety, traffic efficiency, fuel economy and reduced travel time. Numerous studies have been conducted in this area to help newcomer vehicles plan their trajectory and velocity. However, most of these proposals only consider trajectory planning using conjunction with a limited data set (i.e., metropolis areas, highways, and residential areas) or assume fully connected and automated vehicle environment. Moreover, these approaches are not explainable and lack trust regarding the contributions of the participating vehicles. To tackle these problems, we design an Explainable Artificial Intelligence (XAI) Federated Deep Reinforcement Learning model to improve the effectiveness and trustworthiness of the trajectory decisions for newcomer Autonomous Vehicles (AVs). When a newcomer AV seeks help for trajectory planning, the edge server launches a federated learning process to train the trajectory and velocity prediction model in a distributed collaborative fashion among participating AVs. One essential challenge in this approach is AVs selection, i.e., how to select the appropriate AVs that should participate in the federated learning process. For this purpose, XAI is first used to compute the contribution of each feature contributed by each vehicle to the overall solution. This helps us compute the trust value for each AV in the model. Then, a trust-based deep reinforcement learning model is put forward to make the selection decisions. Experiments using a real-life dataset show that our solution achieves better performance than benchmark solutions (i.e., Deep Q-Network (DQN), and Random Selection (RS)).

Although the existing machine learning-based intrusion detection systems in the Internet of Things (IoT) usually perform well in static environments, they struggle to preserve their performance over time, in dynamic environments. Yet, the IoT is a highly dynamic and heterogeneous environment, leading to what is known as data drift and concept drift. Data drift is a phenomenon which embodies the change that happens in the relationships among the independent features, which is mainly due to changes in the data quality over time. Concept drift is a phenomenon which depicts the change in the relationships between input and output data in the machine learning model over time. To detect data and concept drifts, we first propose a drift detection technique that capitalizes on the principal component analysis (PCA) method to study the change in the variance of the features across the intrusion detection data streams. We also discuss an online outlier detection technique that identifies the outliers that diverge both from historical and temporally close data points. To counter these drifts, we discuss an online deep neural network (DNN) that dynamically adjusts the sizes of the hidden layers based on the Hedge weighting mechanism, thus enabling the model to steadily learn and adapt as new intrusion data come. Experiments conducted on an IoT-based intrusion detection data set suggest that our solution stabilizes the performance of the intrusion detection on both the training and testing data compared to the static DNN model, which is widely used for intrusion detection.

We argue in this paper that the role of the cloud should be reshaped from being a passive virtual market to become an active platform for monetizing data. The objective is to enable the cloud to be an active platform that can help data providers reach a wider set of data consumers. This will allow these consumers to be exposed to a larger variety of data that benefits data analytic applications. To achieve this vision, we propose a novel game theoretical model, which consists of a mix of cooperative and competitive strategies. The players of the game are the data providers, cloud platform, and cloud users. The strategies of the players are modeled using the two-sided market theory that takes into consideration the network effects (externalities) among the players. Simulations conducted using Amazon and google clustered data show that the proposed model improves the total surplus of involved parties in terms of cloud resources provision and monetary profits compared to the current merchant model.

This paper introduces a new framework for reducing mode collapse in Generative adversarial networks (GANs). The problem occurs when the generator learns to map several various input values (z) to the same output value, which makes the generator fail to capture all modes of the true data distribution. As a result, the diversity of synthetically produced data is lower than that of the real data. To address this problem, we propose a new and simple framework for training GANs based on the concept of virtual mapping. Our framework integrates two processes into GANs: merge and split. The merge process merges multiple data points (samples) into one before training the discriminator. In this way, the generator would be trained to capture the merged-data distribution rather than the (unmerged) data distribution. After the training, the split process is applied to the generator's output in order to split its contents and produce diverse modes. The proposed framework increases the chance of capturing diverse modes through enabling an indirect or virtual mapping between an input z value and multiple data points. This, in turn, enhances the chance of generating more diverse modes. Our results show the effectiveness of our framework compared to the existing approaches in terms of reducing the mode collapse problem.

Summary Cloud computing is undeniably becoming the main computing and storage platform for today's major workloads. From Internet of things and Industry 4.0 workloads to big data analytics and decision‐making jobs, cloud systems daily receive a massive number of tasks that need to be simultaneously and efficiently mapped onto the cloud resources. Therefore, deriving an appropriate task scheduling mechanism that can both minimize tasks' execution delay and cloud resources utilization is of prime importance. Recently, the concept of cloud automation has emerged to reduce the manual intervention and improve the resource management in large‐scale cloud computing workloads. In this article, we capitalize on this concept and propose four deep and reinforcement learning‐based scheduling approaches to automate the process of scheduling large‐scale workloads onto cloud computing resources, while reducing both the resource consumption and task waiting time. These approaches are: reinforcement learning (RL), deep Q networks, recurrent neural network long short‐term memory (RNN‐LSTM), and deep reinforcement learning combined with LSTM (DRL‐LSTM). Experiments conducted using real‐world datasets from Google Cloud Platform revealed that DRL‐LSTM outperforms the other three approaches. The experiments also showed that DRL‐LSTM minimizes the CPU usage cost up to 67% compared with the shortest job first (SJF), and up to 35% compared with both the round robin (RR) and improved particle swarm optimization (PSO) approaches. Moreover, our DRL‐LSTM solution decreases the RAM memory usage cost up to 72% compared with the SJF, up to 65% compared with the RR, and up to 31.25% compared with the improved PSO.

Internet of Vehicles and vehicular networks have been compelling targets for malicious security attacks where several intrusion detection solutions have been proposed for protecting them. Nonetheless, their main problem lies in their heavy computation, which makes them unsuitable for next-generation artificial intelligence-powered self-driving vehicles whose computational power needs to be primarily reserved for real-time driving decisions. To address this challenge, several approaches have been lately presented to take advantage of the cloud computing for offloading intrusion detection tasks to central cloud servers, thus reducing storage and processing costs on vehicles. However, centralized cloud computing entails high latency on intrusion detection related data transmission and plays against its adoption in delay-critical intelligent applications. In this context, this article proposes a vehicular-edge computing (VEC) fog-enabled scheme allowing offloading intrusion detection tasks to federated vehicle nodes located within nearby formed ad hoc vehicular fog to be cooperatively executed with minimal latency. The problem has been formulated as a multiobjective optimization model and solved using a genetic algorithm maximizing offloading survivability in the presence of high mobility and minimizing computation execution time and energy consumption. Experiments performed on resource-constrained devices within actual ad hoc fog environment illustrate that our solution significantly reduces the execution time of the detection process while maximizing the offloading survivability under different real-life scenarios.

Cloud-based systems are subject to various attack types launched by Virtual Machines (VMs) manipulated by attackers having different goals and skills. The existing detection and defense mechanisms might be suitable for simple attack environments but become ineffective when the system faces advanced attack scenarios wherein simultaneous attacks of different types are involved. This is because these mechanisms overlook the attackers' strategies in the detection system's design, ignore the system's resource constraints, and lack sufficient knowledge about the attackers' types and abilities. To address these shortcomings, we propose a repeated Bayesian Stackelberg game consisting of the following phases: risk assessment framework that identifies the VMs' risk levels, live-migration-based defense mechanism that protects services from being successful targets for attackers, machine-learning-based technique that collects malicious data from VMs using honeypots and employs one-class Support Vector Machine to learn the attackers' types distributions, and resource-aware Bayesian Stackelberg game that provides the hypervisor with the detection load's optimal distribution over VMs that maximizes the detection of multi-type attacks. Experiments conducted using Amazon's datacenter and Amazon Web Services honeypot data reveal that our solution maximizes the detection, minimizes the number of attacked services, and runs efficiently compared to the state-of-the-art detection and defense strategies, namely Collabra, probabilistic migration, Stackelberg, maxmin, and fair allocation.

Connected vehicles are essential for the deployment of intelligent transportation services. However, the high level of connectivity in today's Internet of vehicles (IoV) and the extreme reliance on the data collected from the smart transportation infrastructure widen the space of security vulnerabilities, making the IoV a potential target for cyberattacks. This article investigates novel sophisticated ways to exploit the IoV and launch intelligent attacks on road traffic services by creating persistent impact and reducing detection chances. This article models the processes of attack and defense as a cybersecurity Stackelberg game leading to optimal mixed strategies for both the attackers and the IoV defense system, where the latter optimally deploys the available security resources within the transportation infrastructure to minimize the impact of attacks and improve their detection. The game is of Bayesian type and considers several types of data corruption attacks that occur according to a probability distribution that we determine based on a rigorous risk assessment approach. The results show that our game model and solution allow us to reduce the impact of advanced persistent threats compared to a uniform defense design that is indifferent to attackers' strategies and types. The solution could be integrated into the design of IoV intrusion detection systems to increase their robustness.

In this paper, we propose a new framework for mitigating biases in machine learning systems. The problem of the existing mitigation approaches is that they are model-oriented in the sense that they focus on tuning the training algorithms to produce fair results, while overlooking the fact that the training data can itself be the main reason for biased outcomes. Technically speaking, two essential limitations can be found in such model-based approaches: 1) the mitigation cannot be achieved without degrading the accuracy of the machine learning models, and 2) when the data used for training are largely biased, the training time automatically increases so as to find suitable learning parameters that help produce fair results. To address these shortcomings, we propose in this work a new framework that can largely mitigate the biases and discriminations in machine learning systems while at the same time enhancing the prediction accuracy of these systems. The proposed framework is based on conditional Generative Adversarial Networks (cGANs), which are used to generate new synthetic fair data with selective properties from the original data. We also propose a framework for analyzing data biases, which is important for understanding the amount and type of data that need to be synthetically sampled and labeled for each population group. Experimental results show that the proposed solution can efficiently mitigate different types of biases, while at the same time enhancing the prediction accuracy of the underlying machine learning model.

Intelligent Transportation Systems (ITS) play a vital role in the development of smart cities. They enable various road safety and efficiency applications such as optimized traffic management, collision avoidance, and pollution control through the collection and evaluation of traffic data from Road Side Units (RSUs) and connected vehicles in real time. However, these systems are highly vulnerable to data corruption attacks which can seriously influence their decision-making abilities. Traditional attack detection schemes do not account for attackers’ sophisticated and evolving strategies and ignore the ITS’s constraints on security resources. In this paper, we devise a security game model that allows the defense mechanism deployed in the ITS to optimize the distribution of available resources for attack detection while considering mixed attack strategies, according to which the attacker targets multiple RSUs in a distributed fashion. In our security game, the utility of the ITS is quantified in terms of detection rate, attack damage, and the relevance of the information transmitted by the RSUs. The proposed approach will enable the ITS to mitigate the impact of attacks and increase its resiliency. The results show that our approach reduces the attack impact by at least 20% compared to the one that fairly allocates security resources to RSUs indifferently to attackers’ strategies.

Cloud computing has long been the main backbone that Internet of Things (IoT) devices rely on to accommodate their storage and analytical needs. However, the fact that cloud systems are often located quite far from the IoT devices and the emergence of delay-critical IoT applications urged the need for extending the cloud architecture to support delay-critical services. Given that fog nodes possess low resource capabilities compared to the cloud, matching the IoT services to appropriate fog nodes while guaranteeing minimal delay for IoT services and efficient resource utilization on fog nodes becomes quite challenging. In this context, the main limitation of existing approaches is addressing the scheduling problem from one side perspective, i.e., either fog nodes or IoT devices. To address this problem, we propose in this paper a multi-criteria intelligent IoT-Fog scheduling approach using game theory. Our solution consists of designing (1) preference functions for the IoT and fog layers to enable them to rank each other based on several criteria latency and resource utilization and (2) centralized and distributed intelligent scheduling algorithms that capitalize on matching theory and consider the preferences of both parties. Simulation results reveal that our solution outperforms the two common Min-Min and Max-Min scheduling approaches in terms of IoT services execution makespan and fog nodes resource consolidation efficiency.

Distributed Denial of Service (DDoS) constitutes a major threat against cloud systems owing to the large financial losses it incurs. This motivated the security research community to investigate numerous detection techniques to limit such attack's effects. Yet, the existing solutions are still not mature enough to satisfy a cloud-dedicated detection system's requirements since they overlook the attacker's wily strategies that exploit the cloud's elastic and multi-tenant properties, and ignore the cloud system's resources constraints. Motivated by this fact, we propose a two-fold solution that allows, first, the hypervisor to establish credible trust relationships toward guest Virtual Machines (VMs) by considering objective and subjective trust sources and employing Bayesian inference to aggregate them. On top of the trust model, we design a trust-based maximin game between DDoS attackers trying to minimize the cloud system's detection and hypervisor trying to maximize this minimization under limited budget of resources. The game solution guides the hypervisor to determine the optimal detection load distribution among VMs in real-time that maximizes DDoS attacks' detection. Experimental results reveal that our solution maximizes attacks' detection, decreases false positives and negatives, and minimizes CPU, memory and bandwidth consumption during DDoS attacks compared to the existing detection load distribution techniques.

The prominence of cloud computing led to unprecedented proliferation in the number of web services deployed in cloud data centers. In parallel, service communities have gained recently increasing interest due to their ability to facilitate discovery, composition, and resource scaling in large-scale services' markets. The problem is that traditional community formation models may work well when all services reside in a single cloud but cannot support a multi-cloud environment. Particularly, these models overlook having malicious services that misbehave to illegally maximize their benefits and that arises from grouping together services owned by different providers. Besides, they rely on a centralized architecture whereby a central entity regulates the community formation; which contradicts with the distributed nature of cloud-based services. In this paper, we propose a three-fold solution that includes: trust establishment framework that is resilient to collusion attacks that occur to mislead trust results; bootstrapping mechanism that capitalizes on the endorsement concept in online social networks to assign initial trust values; and trust-based hedonic coalitional game that enables services to distributively form trustworthy multi-cloud communities. Experiments conducted on a real-life dataset demonstrate that our model minimizes the number of malicious services compared to three state-of-the-art cloud federations and service communities models.

In todays cloud market, providers are taking advantage of consumer reviews and ratings as a new marketing tool to establish their credibility. However, to achieve higher ratings, they need to enhance their service quality which comes with an additional cost. In this paper, we model this conflicting situation as a Stackelberg game between a typical service provider and multiple service users in a cloud environment. The strategy of the service provider is to adjust the price and IT capacity by predicting the users ratings as well as their demands variation in response to his given price, quality and rating. The game is solved through a backward induction procedure using Lagrange function and Kuhn-Tucker conditions. To evaluate the proposed model, we performed experiments on three real world service providers who have low, medium and high average of users' ratings, obtained from the Trust Feedback Dataset in the Cloud Armor project. The results show that improvement in ratings is mostly profitable for highly rated providers. The surprising point is that providers having low ratings do not get much benefit from increasing their average ratings, meanwhile, they can perform well when they lower the service price.

Insider attacks in which misbehaving Virtual Machines (VMs) take part of the cloud system and learn about its internal vulnerabilities constitute a major threat against cloud resources and infrastructure. This demands setting up continuous and comprehensive security arrangements to restrict the effects of such attacks. However, limited security resources prohibit full detection coverage on all VMs at all times, which can be exploited by attackers to examine the selective detection strategies and adjust their own attack plans accordingly. Motivated by the absence of any approach that accounts for such a challenge in the domain of cloud computing, we propose in this work an adaptive detection strategy that formulates a Stackelberg security game to enable the cloud system to optimally exploit its available amount of security resources to maximize the detection of distributed attacks, knowing that attackers have the ability to monitor the cloud system's strategies and adjust their own attack plans. Experiments carried out on the CloudSim framework reveal that the proposed solution maximizes the detection of distributed attacks and minimizes false negatives and positives compared to a maximin-based detection strategy, while being scalable to the increase in both the number of co-hosted VMs and percentage of co-resident attackers.

Extracting association rules helps data owners to unveil hidden patterns from their data for the purpose of analyzing and predicting the behavior of their clients. However, mining association rules in a distributed environment is not a trivial task due to privacy concerns. Data owners are interested in collaborating with each other to mine association rules on a global level; however, they are concerned that sensitive information related to the individuals involved in their database might get compromised during the mining process. In this paper, we formulate and address the problem of answering association rules queries in a distributed environment such that the mining process is confidential and the results are differentially private. We propose a privacy-preserving distributed association rules mining approach, named DARM, where global strong association rules are determined in a confidential way, and the results returned satisfy ε-differential privacy. We conduct our experiments on real-life data, and show that our approach can efficiently answer association rules queries and is scalable with increasing data records.