The emerging heterogeneous Edge-IoT systems are supporting various essential and critical applications in public safety, transportation, education, and health. The reliability and resiliency of such systems are crucial given the varied demands of IoT applications and the potential for edge failure. This paper tackles two key Edge-IoT resiliency challenges: i) how to cushion the impact of sudden workload increase and allow graceful performance degradation for heterogeneous applications; ii) how to better prepare for and handle severe disruptions to avoid significant application performance loss. These are complicated challenges due to limited edge resources, heterogeneity of IoT applications, and the dynamicity of the Edge-IoT environment. Therefore, we develop a novel intelligent resource allocation framework namedREPAthat is application-centric to enable proactive resiliency and offer graceful degradation of IoT applications. The new framework: 1) proactively cushions and absorbs the disruptive impacts of edge workload increases, and provides graceful application degradation in moderate to severe edge system loads, across multiple Edge-IoT systems; 2) features a two-level optimization model that jointly optimizes the intra-zone and inter-zone edge resource allocation such that the application’s performance degradation and service disruption are minimized; 3) includes novel deep reinforcement learning (DRL) designs for resource allocation that are specialized for the complex Edge-IoT environment and provide faster and stable decision-making capabilities than the existing methods. Performance evaluation demonstrates the ability ofREPAto maintain the best performance of the IoT applications regardless of disruptive situations.

Traditional methods for identifying and mitigating cyber attacks are becoming inadequate due to ever-increasing volumes of network traffic, the complexity of modern cyber threats, and the use of encryption to protect payloads. This paper presents CyberMALT, a novel approach designed to address these challenges through machine learning-assisted analysis of traffic metadata, which provides valuable insights into network behavior without examining payloads. Our proposed solution utilizes a two-stage approach. First, we employ unsupervised machine learning techniques to study typical network behavior. This initial stage allows CyberMALT to establish a baseline understanding of typical traffic characteristics, enabling it to identify deviations indicative of potential threats. Leveraging this knowledge, CyberMALT computes an anomaly score for each observed traffic instance, thereby pinpointing suspicious activity for further investigation. In the second stage of processing, these identified anomalies undergo a comprehensive analysis to classify the types of attacks accurately and efficiently and rule out false positives. By leveraging machine learning for traffic metadata analysis, CyberMALT offers a proactive and adaptive solution for cyber threat detection and classification. Our experiments demonstrate the effectiveness of CyberMALT in identifying and classifying diverse cyber threats while minimizing false positives, thus enhancing the security posture of networked systems.

Edge computing and AI can potentially empower Unmanned Aerial Vehicle (UAV) systems with automated decision-making and resource support for monitoring in future science tasks such as emergency response, search and rescue, inspections, and wildfires. However, it is challenging to achieve autonomous and robust monitoring in such systems, given the dynamic environmental situations, the limited capabilities, and the unbalanced load of the UAVs. For instance, the monitoring activity levels at different locations might vary, which leads to an unbalanced monitoring load for the corresponding UAVs. Moreover, the UAVs require regular recharging/maintenance and can have malfunctions that will disrupt the monitoring task. In this article, we develop a novel proactive and robust Edge-UAV framework named PREUS to enable autonomous and efficient monitoring of dynamic environments when faced with dynamic environment situations and various UAV workload stresses that can jeopardize the monitoring performance. PREUS features a unique design to handle the varying UAV workload stress of the monitored area. It incorporates novel spatial, temporal, and proactive exploration vs. exploitation planning to balance the UAVs’ workloads in various locations with fluctuating activities. In addition, PREUS includes novel Deep Reinforcement Learning (DRL) design specialized to maximize coverage in the complex environments and provides faster and stabler decision-making capabilities than the existing methods. The positive impact brought by PREUS is demonstrated in terms of the achieved monitoring performance, including coverage and balanced UAV load.

Edge computing is being used to facilitate closer computing, storage, and networking resources to support various IoT applications including delay-sensitive ones. It is envisioned that the future Edge-IoT systems will incorporate heterogeneous IoT devices distributed over multiple geographical zones of certain institutions with edge resource demands that vary according to time and location. Edge servers (resource facilitators) are with limited resources and are susceptible to “outlandish” situations, such as service overloading, outage, and external attacks; they may also have to handle the roaming of IoT devices among different zones. These situations induce the need for alternative edge servers using an adaptive resource facilitation scheme to fulfill the demands of the IoT applications. In this article, we develop a novel intelligent and hierarchical resource facilitation framework named I-HARF that adapts to dynamic Edge-IoT situations, including outlandish situations, mobility, application’s sensitivity, and varying resource demand of IoT applications based on time and location. I-HARF achieves an adaptive facilitation and holistically addresses the facilitation technical barriers by: 1) adopting the hierarchical structure which efficiently migrates the resource facilitation from intrazone to interzone levels; 2) extending novel intrazone and interzone optimization models to boost the utilities of the edge servers and the IoT applications; and 3) developing a novel and unique actor dual-critic and collective actor–critic deep reinforcement learning (DRL) designs that intelligently facilitate the edge resources in both intrazone and interzone, respectively. The evaluation results demonstrate I-HARF’s capability enabling adaptive resource facilitation that adjusts according to the dynamic Edge-IoT situations.

Recent researches have applied various machine learning models to detect IoT botnet attacks. However, the heterogeneity of IoT devices’ normal and attack behaviors was not well addressed, which resulted in high false positive/negative detection rates. To solve this issue, we propose a method that builds individual behavior baselines for different types of devices with a single Conditional Variational Autoencoder model, and then detects attacks with even minor deviations from the baselines. The evaluation results on the public N-BaIoT dataset show that our method outperforms the others with accuracy higher than 99.9% while introducing limited extra computational cost.

Data-driven approaches are envisioned to build future Edge-IoT systems that satisfy IoT devices demands for edge resources. However, significant challenges and technical barriers exist which complicate resource management of such systems. IoT devices can demonstrate a wide range of behaviors in the devices resource demand that are extremely difficult to manage. In addition, the management of resources fairly and efficiently by the edge in such a setting is a challenging task. In this paper, we develop a novel data-driven resource management framework named BEHAVE that intelligently and fairly allocates edge resources to IoT devices with consideration of their behavior of resource demand (BRD). BEHAVE aims to holistically address the management technical barriers by 1) building an efficient scheme for modeling and assessment of the BRD of IoT devices based on their resource requests and resource usage; 2) expanding a new Rational, Fair, and Truthful Resource Allocation (RFTA) model that binds the devices BRD and resource allocation to achieve fair allocation and encourage truthfulness in resource demand; and 3) developing an enhanced deep reinforcement learning (EDRL) scheme to achieve the RFTA goals. The evaluation results demonstrate BEHAVE's capability to analyze the IoT devices BRD and adjust its resource management policy accordingly.

Network intrusion detection plays an important role in the Internet of Things systems for protecting devices from security breaches. Facing challenges of the rapidly increasing amount of diverse network traffic, recent research has employed end-to-end deep learning-based intrusion detectors for automatic feature extraction and high detection accuracy. However, deep learning has been proved vulnerable to adversarial attacks that may cause misclassification by imposing imperceptible perturbation on input samples. Though such vulnerability is widely discussed in the image processing domain, very few studies have investigated its perniciousness against network intrusion detection systems (NIDS) and proposed corresponding defense strategies. In this paper, we try to fill this gap by proposing Def-IDS, an ensemble defense mechanism specially designed for NIDS, against both known and unknown adversarial attacks. It is a two-module training framework that integrates multi-class generative adversarial networks and multi-source adversarial retraining to improve model robustness, while the detection accuracy on unperturbed samples is maintained. We evaluate the mechanism over CSE-CIC-IDS2018 dataset and compare its performance with the other three defense methods. The results demonstrate that Def-IDS is able to detect various adversarial attacks with better precision, recall, F1 score, and accuracy.

The current security method of Internet-of-Vehicles (IoV) systems is rare, which makes it vulnerable to various attacks. The malicious and unauthorized nodes can easily invade the IoV systems to destroy the integrity, availability, and confidentiality of information resources shared among vehicles. Indeed, access control mechanism can remedy this. However, as a static method, it cannot timely response to these attacks. To solve this problem, we propose an intelligent edge-chain-enabled access control framework with vehicle nodes and roadside units (RSUs) in this study. In our scenario, vehicle nodes act as lightweight nodes, whereas RUSs serve as full and edge nodes to provide access control services. Considering the low accuracy of risk prediction due to limited training sets, we leverage a generative adversarial networks (GANs) to convert the risk prediction to a sequence generation. Moreover, aiming at the problems of gradient disappearance and mode collapse existed in the original GANs, we devise a Wasserstein combined GANs (WCGANs). Simulation results demonstrate that WCGAN has higher prediction accuracy than the original GANs. Additionally, it can also improve the accuracy of access control of risk prediction-based access control (RPBAC) model.

Edge computing is emerging to empower the future of Internet of Things (IoT) applications. However, due to heterogeneity of applications, it is a significant challenge for the edge cloud to effectively allocate multidimensional limited resources (CPU, memory, storage, bandwidth, etc.) with constraints of applications’ Quality of Service (QoS) requirements. In this paper, we address the resource allocation problem in Edge-IoT systems through developing a novel framework namedDeepEdgethat allocates resources to the heterogeneous IoT applications with the goal of maximizing users’ Quality of Experience (QoE). To achieve this goal, we develop a novel QoE model that considers aligning the heterogeneous requirements of IoT applications to the available edge resources. The alignment is achieved through selection of QoS requirement range that can be satisfied by the available resources. In addition, we propose a novel two-stage deep reinforcement learning (DRL) scheme that effectively allocates edge resources to serve the IoT applications and maximize the users’ QoE. Unlike the typical DRL, our scheme exploits deep neural networks (DNN) to improve actions’ exploration by using DNN to map the Edge-IoT state to joint resource allocation action that consists of resource allocation and QoS class. The joint action not only maximize users’ QoE and satisfies heterogeneous applications’ requirements but also align the QoS requirements to the available resources. In addition, we develop a Q-value approximation approach to tackle the large space problem of Edge-IoT. Further evaluation shows thatDeepEdgebrings considerable improvements in terms of QoE, latency and application tasks’ success ratio in comparison to the existing resource allocation schemes.

The information sharing among vehicles provides intelligent transport applications in the Internet of Vehicles (IoV), such as self-driving and traffic awareness. However, due to the openness of the wireless communication (e.g., DSRC), the integrity, confidentiality and availability of information resources are easy to be hacked by illegal access, which threatens the security of the related IoV applications. In this paper, we propose a novel Risk Prediction-Based Access Control model, named RPBAC, which assigns the access rights to a node by predicting the risk level. Considering the impact of limited training datasets on prediction accuracy, we first introduce the Generative Adversarial Network (GAN) in our risk prediction module. The GAN increases the items of training sets to train the Neural Network, which is used to predict the risk level of vehicles. In addition, focusing on the problem of pattern collapse and gradient disappearance in the traditional GAN, we develop a combined GAN based on Wasserstein distance, named WCGAN, to improve the convergence time of the training model. The simulation results show that the WCGAN has a faster convergence speed than the traditional GAN, and the datasets generated by WCGAN have a higher similarity with real datasets. Moreover, the Neural Network (NN) trained with the datasets generated by WCGAN and real datasets (NN-WCGAN) performs a faster speed of training, a higher prediction accuracy and a lower false negative rate than the Neural Network trained with the datasets generated by GAN and real datasets (NN-GAN), and the Neural Network trained with the real datasets (NN). Additionally, the RPBAC model can improve the accuracy of access control to a great extent.

The emerging Internet of Things (IoT) is facing significant scalability and security challenges. On one hand, IoT devices are “weak” and need external assistance. Edge computing provides a promising direction addressing the deficiency of centralized cloud computing in scaling massive number of devices. On the other hand, IoT devices are also relatively “vulnerable” facing malicious hackers due to resource constraints. The emerging blockchain and smart contracts technologies bring a series of new security features for IoT and edge computing. In this paper, to address the challenges, we design and prototype an edge-IoT framework named “EdgeChain” based on blockchain and smart contracts. The core idea is to integrate a permissioned blockchain and the internal currency or “coin” system to link the edge cloud resource pool with each IoT device' account and resource usage, and hence behavior of the IoT devices. EdgeChain uses a credit-based resource management system to control how much resource IoT devices can obtain from edge servers, based on predefined rules on priority, application types, and past behaviors. Smart contracts are used to enforce the rules and policies to regulate the IoT device behavior in a nondeniable and automated manner. All the IoT activities and transactions are recorded into blockchain for secure data logging and auditing. We implement an EdgeChain prototype and conduct extensive experiments to evaluate the ideas. The results show that while gaining the security benefits of blockchain and smart contracts, the cost of integrating them into EdgeChain is within a reasonable and acceptable range.

60 GHz millimeter-wave networks have emerged as a potential candidate for designing the next generation of multi-gigabit WLANs. Since the 60 GHz links suffer from frequent outages due to blockages caused by human mobility, deploying 60 GHz WLANs that can provide robust coverage in presence of blockages is a challenging problem. In this paper, we study blockage-aware coverage and deployment of 60 GHz WLANs. We first show that the reflection profile of an indoor environment can be sensed using a few measurements. A novel coverage metric (angular spread coverage) which captures the number of available paths and their spatial diversity is proposed. Additionally, it is shown that using relays can extend the coverage of the AP at a lower cost and provide added spatial diversity in the available paths. We propose a heuristic algorithm that determines the AP and relay locations while maximizing the angular spread coverage metric for the clients. Our testbed-based evaluation shows that for five different rooms, our proposed deployment can guarantee an average connectivity of 91.7%, 83.9%, and 74.1% of client locations in the presence of 1, 3 and 5 concurrent human blockages respectively, substantially increasing the robustness of 60 GHz links against blockages.

Conventional diagnosis using polysomnography (PSG) on breathing disorder is expensive and uncomfortable to patients. In this paper, we present a low-cost portable and wearable multi-sensor system to non-invasively acquire a subject's vital signs, and leverage various machine learning methods on features extracted from Electrocardiogram (ECG) and Blood oxygen saturation (SpO2) signals to detect breathing disorder events. Our preliminary predication accuracies on 110 clinical patients is 90.0%.

The Internet is evolving rapidly toward the future Internet of Things (IoT) which will potentially connect billions or even trillions of edge devices which could generate huge amount of data at a very high speed and some of the applications may require very low latency. The traditional cloud infrastructure will run into a series of difficulties due to centralized computation, storage, and networking in a small number of datacenters, and due to the relative long distance between the edge devices and the remote datacenters. To tackle this challenge, edge cloud and edge computing seem to be a promising possibility which provides resources closer to the resource-poor edge IoT devices and potentially can nurture a new IoT innovation ecosystem. Such prospect is enabled by a series of emerging technologies, including network function virtualization and software defined networking. In this survey paper, we investigate the key rationale, the state-of-the-art efforts, the key enabling technologies and research topics, and typical IoT applications benefiting from edge cloud. We aim to draw an overall picture of both ongoing research efforts and future possible research directions through comprehensive discussions.

Edge computing, which is a fundamental component of emerging 5G architectures, involves onloading or offloading multiple virtual network functions from mobile devices to an edge network substrate. In this paper, we present a model for the complete edge function onloading problem, which consists of three main phases: (1) Cyber foraging, which involves discovery of resources monitoring the state of edge resources, (2) edge function mapping, which involves matching requests to available resources, and (3) allocation, which involves assigning resources to mappings. Using optimization theory, we show how these three phases are tightly connected, and how the wide spectrum of existing solutions that either solve a particular phase, or jointly solve two of the phases (along with their interactions), are incomplete and may lead to inefficiencies. Moreover, with extensive simulation experiments we demonstrate that joint optimization of all three phases enables the edge network to host a larger set of constrained edge function requests.

Information Centric Networking (ICN) has been a popular research topic in the last few years, but has not attracted industry attention because of its disruptive view; this is expected considering the evolution from PSTN to IP. Towards its adoption, ICN should not only address challenges raised by current applications, but also enable a compelling service framework for next generation of networking. We envision that in the next generation networks, the network narrow waist will allow an efficient distribution of intelligence across terminals, access, edge and core network. This will enable new applications, services and future business models to be realized. Two other technologies, NFV and SDN, which in essence are frameworks that enable service-centric networking, fit well with the objective of information-centric networking, where the delivered content is a result of contextual interaction between consumers and services orchestrated to meet service objectives. Most significant benefit of this interaction will be in the network-edge considering sensitivity to service latency, customization, and contextualization. This paper provides an overview of an ICN based edge service framework, with comprehensive discussion on service composition, orchestration, and routing logic with mapping to resources in the underlying substrate. We also provide a discussion of the prototype to realize this platform and a network based conferencing system scalable to large number of participants; however the platform itself is generic to handle any service type including content distribution, video conferencing, and M2M applications.

Smart energy in buildings is an important research area of Internet of Things (IoT). As important parts of the smart grids, the energy efficiency of buildings is vital for the environment and global sustainability. Using a LEED-gold-certificated green office building, we built a unique IoT experimental testbed for our energy efficiency and building intelligence research. We first monitor and collect 1-year-long building energy usage data and then systematically evaluate and analyze them. The results show that due to the centralized and static building controls, the actual running of green buildings may not be energy efficient even though they may be “green” by design. Inspired by “energy proportional computing” in modern computers, we propose an IoT framework with smart location-based automated and networked energy control, which uses smartphone platform and cloud-computing technologies to enable multiscale energy proportionality including building-, user-, and organizational-level energy proportionality. We further build a proof-of-concept IoT network and control system prototype and carried out real-world experiments, which demonstrate the effectiveness of the proposed solution. We envision that the broad application of the proposed solution has not only led to significant economic benefits in term of energy saving, improving home/office network intelligence, but also bought in a huge social implication in terms of global sustainability.

There are two key issues that prevent Application Service Providers (ASPs) from fully leveraging the cloud "advantage." First, in modern enterprise and Internet-based application environments, a separate middlebox infrastructure for providing application delivery services such as security (e.g., firewalls, intrusion detection), performance (e.g., SSL off loaders), and scaling (e.g., load balancers) is deployed. In a cloud datacenter, the ASP does not have any control over the network infrastructure, thus making it hard for them to deploy middleboxes for their cloud-based application deployments. Second, modern services virtualize the application endpoint. A service can no longer be statically mapped to a single end host. Instead, the service is partitioned and replicated across multiple end hosts for better performance and scaling. In enterprise datacenters, service requests are intercepted by an application-level routing service (APR) in the data plane and dynamically mapped to the correct service partition and the best (e.g. least loaded) instance of that partition. However, although multi-cloud (or Inter-cloud) environments allow ASPs to globally distributed their applications over multiple cloud datacenters leased from multiple cloud providers, ASPs need support of a globally distributed APR infrastructure to intelligently route application traffic to the right service instance. But, since such an infrastructure would be extremely hard to own and mange, it is best to design a shared solution where APR could be provided as a service by a third party provider having a globally distributed presence, such as an ISP. Although these requirements seem separate, they can be converged into a single abstraction for supporting application delivery in the cloud context. A sample design of this abstraction is OpenADN, presented here.

Multihoming practice in the current Internet is limited to hosts and autonomous systems (ASs). It is “connectivity-oriented” without support for user or data multihoming. However, the swift migration of Internet from “connectivity-oriented” to “content-oriented” pattern urges to incorporate user and data level multihoming support in architecture designs instead of just through ad-hoc patches. In this paper, based on our previous research experience, we expand the multihoming concepts to both user and data levels based on the “multiple points of attachment” in a way similar to host multihoming. We propose a new incrementally-deployable multihoming framework by introducing a “realm” concept. The high-level user and data multihoming support can be built on top of the host and AS level multihoming in an incrementally-deployable and flexibly-assembled manner. Realms form a hierarchy of functionally dependable blocks. We define a new dimension of building block-slice which is an incrementally implementable functional unit for multihoming. Besides the long-term support for user and data multihoming, the first step deployment of the new framework is also able to address the short-term routing scalability challenge by reducing the total inter-domain routing table size gradually.

Cellular networking standards organizations such as the 3rdGeneration Partnership Project (3GPP) are currently developing System Architecture Evolution (SAE) as their core network architecture. SAE is all-IP based. However, IP-based networks face several known issues, such as mobility, multi-homing, location privacy, path preference, etc. Mobile IP (MIP) and its variants, such as Mobile IPv6 (MIPv6), Hierarchical MIP, and Proxy MIP, have been developed primarily to alleviate the mobility problem. These variation and extensions, however, still do not provide many of the features required in Next Generation Wireless Networks (NGWN). The limitations are especially due to the overloading of IP addresses as both node identity and locator. In this paper, we propose an extension to MIPv6 called Virtual ID. This concept applies the ID/Locator split idea into a Mobile IPv6 environment. Virtual ID and its extensions provide many features that would be desired in the NGWN. Since our proposed scheme is based on the standard MIPv6 and Proxy MIPv6, the scheme is fully compatible with the legacy MIPv6.

We present a new Internet architecture based on de-conflated identities (ADI) that explicitly establishes the separation of ownership of hosts from the underlying infrastructure connectivity. A direct impact of this de-conflated Internet architecture is the ability to express organizational policies separately and thus more naturally, from the underlying infrastructure routing policies. Host or organizational accountability is separated from the infrastructure accountability, laying the foundations of a cleaner security and policy enforcement framework. Also, it addresses the present Internet routing problems of mobility, multihoming, and traffic engineering more naturally by making a clear distinction of host and infrastructure responsibilities and thus defining these functions as a set of primitives governed by individual policies. In this paper, we instantiate the primitive mechanisms related to the issues of end-to-end policy enforcements, mobility, multihoming, traffic engineering, etc., within the context of our architecture to emphasize the relevance of a de-conflated Internet architecture on these functions.

In this paper, we take a fresh look at stub-site multihoming within the paradigms of an identifier/locator split architecture. More specifically, we investigate the possibility of enabling multi-homed stub network sites to improve the performance of their end-to-end TCP flows by leveraging the path diversity of the underlying network. We design a host-network co-operative mechanism for end-to-end flow path switching based on reliable transport layer protocol "hints" indicating probable path problems. Our evaluations of actual Internet routing/topology data strongly suggest significant degree of path diversity across path switches available to multihomed stub networks, even within the restricted precincts of inter-domain policy routing. Additionally, we also address the problems of global routing scalability and inbound traffic engineering control as pertaining to stub-site multi-homing.

Many challenges to the Internet including global routing scalability have drawn significant attention from both industry and academia, and have generated several new ideas for the next generation. MILSA (Mobility and Multihoming supporting Identifier Locator Split Architecture) and related enhancements are designed to address the naming, addressing, and routing scalability challenges, provide mobility and multihoming support, and easy transition from the current Internet. In this paper, we synthesize our research into a multiple-tier realm-based framework and present the fundamental principles behind the architecture. Through detailed presentation of these principles and different aspects of our architecture, the underlying design rationale is justified. We also discuss how our proposal can meet the IRTF RRG design goals. As an evolutionary architecture, MILSA balances the high-level long-run architecture design with ease of transition considerations. Additionally, detailed evaluation of the current inter-domain routing system and the achievable improvements deploying our architecture is presented that reveals the roots of the current difficulties and helps to shape our deployment strategy.

MILSA (Mobility and Multihoming supporting Identifier Locator Split Architecture) has been proposed to address the naming and addressing challenges for NGI (next generation Internet), we present several design enhancements for MILSA which include a hybrid architectural design that combines "core-edge separation approach" and "split approach", a security-enabled and logically oriented hierarchical identifier system, a three-level identifier resolution system, a new hierarchical code based design for locator structure, cooperative mechanisms among the three planes in MILSA model to assist mapping and routing, and an integrated MILSA service model. The underlying design rationale is also discussed along with the design descriptions. Further analysis addressing the IRTF (Internet Research Task Force) RRG (Routing Research Group) design goals shows that the enhanced MILSA provides comprehensive benefits in routing scalability, traffic engineering, mobility and multihoming, renumbering, security, and deployability.

Naming and addressing are important issues for next generation Internet (NGI). In this paper, we discuss a new mobility and multihoming supporting identifier locator split architecture (MILSA). There are three main contributions of our solution. First, we separate trust relationships (realms) from connectivity (zones). A hierarchical identifier system for the realms and a Realm Zone Bridging Server (RZBS) infrastructure that performs the bridging function is introduced. Second, we separate the signaling and data plane functions to improve the performance and support mobility. Third, to provide transparency to the upper layer applications, identifier locator split happens in network layer. A Hierarchical URI-like Identifier (HUI) is used by the upper layers and is mapped to a locators set by HUI Mapping Sublayer (HMS) through interaction with RZBS infrastructure. Further scenarios description and analysis show the benefits of this scheme for routing scalability, mobility and multihoming.