Traditional Intrusion Detection Systems (IDS) are increasingly challenged by the distributed, heterogeneous, and rapidly evolving threat landscape in Internet of Things (IoT) and Industrial IoT (IIoT) environments. Blockchain has been explored as a promising foundation for decentralized and trustworthy security mechanisms; however, the existing literature remains fragmented and lacks a clear organizing lens for comparing design choices and evaluation practices. To address this, this paper presents a problem-driven survey of blockchain-enabled IDS for IoT and IIoT. We organize prior work into four integration paradigms, Trusted Rule, ML, DL, and FL—and relate each paradigm to the recurring design tensions it primarily targets. We further distill three fundamental tensions that frequently shape system design, including distributed architectures vs. centralized security management, collaborative information sharing vs. privacy preservation, and real-time detection requirements vs. resource-constrained devices. In addition, we summarize representative frameworks by consolidating datasets, threat models, and reported performance-related metrics, and we discuss common limitations that hinder cross-paper comparability. Finally, we outline a roadmap toward more standardized benchmarking, suggesting candidate evaluation criteria and blockchain-specific KPIs to encourage more transparent and comparable reporting. Overall, this survey aims to provide a structured lens for navigating the design space of blockchain-enabled IDS and to highlight open challenges for future research.

The digital transformation of educational systems has significantly optimized administrative workflows and enhanced the user experience for educators and learners. However, the accumulation of sensitive personal data on educational websites has made them prime targets for cyber threats. Despite growing awareness of these security challenges, the technical roots of vulnerabilities within such platforms remain insufficiently explored. To address this gap, we introduce LLM-EduAttackGraph, a specialized tool designed to assist in vulnerability detection by leveraging large language models (LLMs). Rather than serving as a fully automated monitoring system, LLM-EduAttackGraph operates as a human-in-the-loop assistant, combining expert knowledge with the analytical capabilities of LLMs to help identify potential penetration paths based on network fingerprint information. Using LLM-EduAttackGraph, we have so far identified 961 penetration vulnerabilities across educational websites in mainland China—a number that continues to grow as analysis progresses. These findings demonstrate the tool’s practical value in augmenting cybersecurity research and efforts. Our in-depth analysis of the discovered vulnerabilities reveals that limited developer experience and a heavy dependence on outsourced website development are key contributing factors. By shedding light on these root causes, our research offers actionable strategies and insights aimed at improving the cybersecurity posture of educational platforms and ensuring the sustainable development of online education. Furthermore, we have compared LLM-EduAttackGraph with several existing large model penetration tools to demonstrate the performance of LLM-EduAttackGraph. Such strengths include its low demand for hardware resources and having undergone empirical verification.

The diversity of the Internet of Things (IoT) poses challenges to privacy protection, especially in the field of digital forensics. How to ensure that only the private information of the suspect is provided, and not the irrelevant information of other users is disclosed is crucial, especially when obtaining evidence in the complex IoT environment. To the best of our knowledge, there are few studies on protecting the privacy of irrelevant users in the IoT forensics. However, it is very important to ensure that the evidence does not violate the privacy of other users when collecting evidence, because it directly determines whether the evidence is legal and whether it can be admissible in court. In this paper, a new method based on data provenance graph is designed to solve the privacy protection problem of IoT forensics. The key idea of this method is to protect privacy by dividing multi-user information and protecting it from an encryption perspective. The method consists of three main phrases: distinguishing different users' data provenance graphs using traversal search, node abstraction, and hiding techniques, utilizing pseudo-random dual-key negotiation methods tailored for the scenario to enhance privacy protection for unrelated users, and employing identity authentication technology to facilitate better investigation and extraction of data provenance graph information of criminal accomplices in specific scenarios. Example proves that this method has practical significance and promising application prospects in protecting the privacy of unrelated users in IoT forensics while ensuring evidence accessibility in special criminal scenarios.

The advent of the Internet of Things (IoT) has brought forth an era of unprecedented connectivity, with an estimated 80 billion smart devices expected to be in operation by the end of 2025. These devices facilitate a multitude of smart applications, enhancing the quality of life and efficiency across various domains. Machine Learning (ML) serves as a crucial technology, not only for analyzing IoT-generated data but also for diverse applications within the IoT ecosystem. For instance, ML finds utility in IoT device recognition, anomaly detection, and even in uncovering malicious activities. This paper embarks on a comprehensive exploration of the security threats arising from ML’s integration into various facets of IoT, spanning various attack types including membership inference, adversarial evasion, reconstruction, property inference, model extraction, and poisoning attacks. Unlike previous studies, our work offers a holistic perspective, categorizing threats based on criteria such as adversary models, attack targets, and key security attributes (confidentiality, availability, and integrity). We delve into the underlying techniques of ML attacks in IoT environment, providing a critical evaluation of their mechanisms and impacts. Furthermore, our research thoroughly assesses 65 libraries, both author-contributed and third-party, evaluating their role in safeguarding model and data privacy. We emphasize the availability and usability of these libraries, aiming to arm the community with the necessary tools to bolster their defenses against the evolving threat landscape. Through our comprehensive review and analysis, this paper seeks to contribute to the ongoing discourse on ML-based IoT security, offering valuable insights and practical solutions to secure ML models and data in the rapidly expanding field of artificial intelligence in IoT.