A Cyber-Physical System (CPS) consists of interconnected sensors and actuators components, specifically designed for mission critical applications. However, the susceptibility of CPS components to cyber and physical attacks can be highly detrimental. Although anomaly detection mechanisms have been proposed to address cyberattacks, existing methods often fail to detect multi-step attacks. Cyberattacks can be stealthy, necessitating the correlation of different malicious actions to detect these multi-stage threats in a timely manner for prompt mitigation. This paper proposes a novel reasoning architecture that leverages a neuro-fuzzy learning mechanism with a transformer architecture to detect individual and multi-step attack scenarios. Validation results using critical networking infrastructure demonstrate the effectiveness of our approach compared to a prominent competing scheme.

Industrial Control Systems (ICS) form the backbone of critical infrastructure, enabling automated monitoring, and control across essential industrial sectors. However, the convergence of legacy ICS with modern networking and computing technologies has significantly broadened their cyberattack surface. Despite this growing vulnerability, many existing anomaly detection techniques depend on centralized architectures that introduce high communication overhead, delayed threat response, and elevated false positive rates, particularly when addressing rare or stealthy attacks. Furthermore, most conventional approaches are optimized for detecting system-level anomalies, often neglecting subtle intrusions that compromise individual ICS components and pose serious security risks. To overcome these limitations, we introduce a collaborative, hierarchical observability and privacy-preserving framework based on distributed Long Short-Term Memory (LSTM) architecture. Each sensor’s latent state is captured locally using dedicated LSTM model, and these embeddings are then fused through a dual optimization strategy that supports both sensor-level and system-wide anomaly detection. In contrast to traditional federated learning, our framework enables secure and privacy-preserving exchange of sensor state information across multiple ICS nodes, enhancing the system’s ability to detect coordinated and stealthy attacks. We validate the effectiveness of the proposed approach using the HAI-21.03 dataset. Experimental results demonstrate that our approach successfully identifies both fine-grained sensor anomalies and complex stealthy system-level intrusions, while minimizing communication overhead.

Cooperative Intelligent Transportation Systems (C-ITS) are foundational evolution of vehicular networks, emphasizing the seamless coordination of Vehicle-to-Vehicle communication for exchanging vital information. In C-ITS, vehicles collaborate by distributing V2V messages throughout the network. However, the potential transmission of deceptive or inaccurate information by a malicious vehicle poses a significant risk to road safety. Detecting such malicious data promptly is crucial for taking appropriate actions. Current Misbehavior Detection Systems (MBS) operate with the assumption of a centralized MBS existence, but the challenge lies in empowering vehicles to make local MBS decisions as early as possible. This approach avoids the exchange of all messages with the infrastructure, reducing excessive communication overhead. In response to this challenge, we introduce an innovative distributed misbehavior detection system designed to protect vehicular networks from potential attacks. Our proposed system harnesses the scalability benefits of Federated Learning, allowing vehicles to collaboratively learn a shared model for detecting faulty and malicious messages. Recognizing the impracticality of assuming that all vehicles possess fully labeled data in real-world settings, we propose Fisher-Discriminant Analysis and model regularization to generate an effective pseudo-labeling mechanism. The model regularization proves effective when multiple models from different vehicles produce less-confidence predictions for a given sequence of Basic Safety Messages. Our approach demonstrates efficacy in identifying a broad spectrum of faults and attacks, including rare types, by learning the inherent data distribution and essential network traffic characteristics.

Intelligent transportation systems (ITS) heavily depend on advanced driver-assistance systems (ADAS) to enhance safety and efficiency. With the advent of intelligent connected vehicles and advancements in wireless technology, vehicles are no longer isolated but benefit from diverse networking functionalities to assess the external environment. While this interconnectivity offers advanced services for ITS, it also exposes vehicles to sophisticated cyber-attacks. Some intrusion detection systems can identify various types of malicious Basic Safety Messages and analyze vehicle electronic modules for anomalies. However, injecting malicious code into autonomous driver assistance systems poses significant risks. Such attacks can manipulate self-driving programs, potentially causing severe repercussions for nearby vehicles, especially in platooning scenarios. This paper examines the operational mechanisms of intelligent driving systems and promotes a memory fingerprint analysis mechanism to detect anomalies. By assessing deviations from established memory fingerprint patterns, we can uncover injected misbehaving programs. Specifically, we propose three memory fingerprint-based models using isolation forest, one-class SVM, and customized autoencoder-decoder to balance automatic detection of malicious behaviors with the complexity of real-time anomaly detection. The experimental results illustrate the performance of our approach in detecting abnormalities through a case study using a self-driving car prototype.

Internet of Vehicles (IoV) is a distributed network supporting communication in real time between vehicles, pedestrians, and roadside infrastructure. An utmost challenge in such an integrated network is how to ensure the authenticity of the communicating vehicles and protect the network against impersonation, message replay and Sybil attacks. Compared to traditional authentication mechanisms, a major concern in IoV authentication is how to achieve real time verification of vehicle identities without violating the user's location privacy. The approach should also be lizhtweight to cope with the constrained computational resources of the vehicle. This paper proposes a privacy-preserving protocol that not only provides the vehicle user's anonymous authentication but also resists Sybil attacks through multiple registrations. Our protocol leverages the usage of lightweight hardware flngerprinting primitives and the properties of elliptic curves. Particularly we employ physically unclonable functions (PUFs). An elliptic curve serves as an implicit dynamic one-way transformation of the hardware fingerprint to ensure the anonymity of the sources and provide further forward secrecy. The robustness of the proposed approach is validated using data collected from an FPGA-based PUF implementation.

UAV swarms are gaining popularity due to the reduced cost of deployment and their ability to perform complex tasks such as environmental monitoring, surveillance, and search and rescue operations. UAV swarms are characterized by a highly dynamic environment and continuous interaction with no guarantee of persistent connectivity to a trusted network infrastructure. Traditional cryptographic techniques can be inefficient in ensuring secure swarm communications due to the UAV resource constraints, the broadcast nature of wireless communication, and the vulnerability of UAVs to physical capture and cloning attacks. This paper aims to address these security issues by developing a novel lightweight secure and authenticated intra swarm communication. The approach incorporates Physically Unclonable Functions (PUFs) and the Chinese Remainder Theorem, which enables the seamless establishment and maintenance of group keys on the fly. Additionally, our mechanism supports implicit keys management using the pseudo-randomness proprieties of the chaotic map. We demonstrate the resiliency of our method against active and passive attacks, using formal analysis framework. We also validate the resiliency of our schema against key modeling attacks using FPGA-based PUF implementation. The results confirm a significant reduction in computational complexity compared to competing schemes.

Pervasive sensing is shaping up modern societies and opening the door for many unconventional applications. Instead of the contemporary access model where sensor data is disseminated to a single user, multi-access scenarios are becoming more prevalent, which raises the issue of how to authenticate users, how to ensure access authorization, and how to prevent information leakage. To address these issues, this paper presents a novel lightweight protocol that promotes a data-driven methodology. The idea is to employ hardware primitives to support authentication of legit data recipients and to factor in the previously shared data samples in generating encryption keys. Our protocol in essence generates encryption keys that vary per packet and in an implicitly synchronized manner between the data source and each recipient. The generated key is also a function of the hardware primitive and thus effectively prevents data access to unauthorized recipients. We analyze the resilience of our protocol to impersonation and message replay, and hardware primitive modeling attacks. The security properties of our solution is validated using the AVISPA toolset and its performance is compared to the asymmetric cryptography approaches.

The scale, unattended-operation and ad-hoc nature of an Internet-of-Things (IoT) make the network vulnerable to device impersonation, message replay, and Sybil attacks by either external actors or compromised nodes. This paper opts to tackle such vulnerability and presents a novel and effective solution for mutual authentication of IoT nodes. The proposed solution calls for embedding a Physically Unclonable Function (PUF) on each device, and employs a lightweight protocol for validating the identity of the individual devices based on querying the PUF. To authenticate a “prover” node, a verifier node will send a challenge bit-stream to the prover, where the latter provides the response of its PUF to such a challenge to be matched by what the verifier expects. To prevent the PUF of a prover from being modeled by an eavesdropper or a collusive set of compromised verifiers, the proposed protocol makes the response to a challenge dependent on the verifier. In addition, our protocol combines such an identity-based response generation with a simple Elliptic curve to thwart any attempts by a compromised verifier to reverse engineer the response generation process. The robustness of our PUF-based IoT Device Authentication (PIDA) protocol, is validated using data collected from an FPGA-based implementation.

Motivated by the quest for decreased healthcare costs and further fueled by the COVID pandemic, wearable devices have gained major attention in recent years. Yet, their secure usage and patients’ privacy continue to be concerning. To address these issues, the paper presents SWeeT, a novel lightweight protocol for allowing flexible and secure access to the collected data by multiple caregivers while sustaining the patient’s privacy. Particularly, SWeeT deploys Physically Unclonabale Functions (PUFs) to generate encryption keys to safeguard the patients’ data during transmission. The computation overhead is significantly reduced by applying very simple encryption operations while enabling frequent change of the keys to sustain robustness. SWeeT is shown to counter impersonation, Sybil, man-in-the-middle, and forgery attacks. SweeT is validated through experiments using implementation on an Artix7 FPGA and through formal security analysis.

Federated learning (FL) is a collaborative framework that aggregates multiple machine learning (ML) models and thus enables efficient handling of data collected from numerous and diverse IoT devices. However, traditional FL frameworks often do not consider the connectivity and the heterogeneity of the data sources and hence suffer accuracy imbalance among the individual (local) ML models and in turn, negatively impact the aggregated model. To mitigate such a shortcoming, this paper promotes a two-step optimization process. The first focuses on data offloading from devices to fog nodes with the objective of improving the accuracy of local ML models under resource and connectivity constraints. The second provides statistical distribution aware data offloading that trades off the communication cost and the accuracy of local ML models. We validate the advantages of our approach using a benchmark dataset.

The popular means for safeguarding against cyberattacks is to employ an intrusion detection system (IDS). Contemporary IDS designs apply machine learning (ML)-based approaches to recognize attack signatures. Yet, the dynamic nature of an Edge-of-Things (EoT) requires continual IDS adaptation by incorporating new intelligence and gained knowledge from security logs in order to detect unknown malicious behaviors. The scale of the system makes the collection of voluminous logs to be impractical. Moreover, sharing security logs by the involved devices would raise privacy concerns. This paper overcomes these challenges by proposing a novel IDS for EoT. The proposed IDS employs federated learning to enable edge nodes to share a model rather than raw data and aggregate the provided models in a hierarchical manner. In addition, our approach recognizes the presence of any individual or colluding attempts to degrade the IDS by providing erroneous (poisonous) data. We apply an iterative voting algorithm to associate trust to participating devices and a Louvain method for uncovering collusive communities. The validation results using a public dataset confirm the effectiveness of our approach.

Hardware fingerprinting has emerged as a viable option for safeguarding IoT devices from cyberattacks. Such a fingerprint is used to not only authenticate the interconnected devices but also to derive cryptographic keys for ensuring data integrity and confidentiality. A Physically Unclonable Function (PUF) is deemed as an effective fingerprinting mechanism for resource-constrained IoT devices since it is simple to implement and imposes little overhead. A PUF design is realized based on the unintentional variations of microelectronics manufacturing processes. When queried with input bits (challenge), a PUF outputs a response that depends on such variations and this uniquely identifies the device. However, machine learning techniques constitute a threat where intercepted challenge-response pairs (CRPs) could be used to model the PUF and predict its output. This paper proposes an adversarial machine learning based methodology to counter such a threat. An effective label flipping approach is proposed where the attacker's model is poisoned by providing wrong CRPs. We employ an adaptive poisoning strategy that factors in potentially leaked information, i.e., the intercepted CRPs, and introduces randomness in the poisoning pattern to prevent exclusion of these wrong CRPs as outliers. The server and client use a lightweight procedure to coordinate and predict poisoned CRP exchanges. Specifically, we employ the same pseudo random number generator at communicating parties to ensure synchronization and consensus between them, and to vary the poisoning pattern over time. Our approach has been validated using datasets generated via a PUF implementation on an FPGA. The results have confirmed the effectiveness of our approach in defeating prominent PUF modeling attack techniques in the literature.

The edge computing paradigm has been adopted in many Internet-of-Things (IoT) applications to improve responsiveness and conserve communication resources. However, such high agility and efficiency come with increased cyber threats. Intrusion detection systems (IDS) have been the primary means for guarding networked computing assets against hacking attempts. The popular design methodology for IDS relies on the application of machine learning (ML) techniques that use intelligence data to classify malicious activities. However, in the realm of IoT, insufficient data is available to build IDS; hence a distributed intrusion system with continual data collection is primordial to refine the detection model. Such IDS is also subject to privacy constraints and should sustain robustness against data manipulation from internal attackers that degrade the ML model. This paper opts to fulfill these requirements by proposing a novel distributed IDS for IoT. The proposed system employs federated learning to enable privacy preservation and diminish the communication overhead. Our system promotes a reinforcement mechanism to ensure resiliency to data manipulation attacks by single or colluding internal actors. The validation results using recently released datasets demonstrate the effectiveness of our approach.

Manufacturing variations introduce features that distinguish radio transceivers even those of the same vendor. Such distinction is often referred to as radiometric signature and is found to be useful in conducting device authentication and crime forensics. Yet, radiometric signatures could constitute a privacy threat. Particularly, in the realm of wireless networks, an adversary may exploit RF fingerprinting to identify devices and conduct traffic analysis in order to uncover the topology and categorize the role of various nodes. In this paper, we show that RF fingerprinting could be a major tool for the adversary to distinguish among nodes and bypass the provisioned anonymity protection in the network. We analyze the accuracy of RF fingerprinting and highlight how the accuracy affects the success of adversary attacks. We further develop a novel countermeasure to degrade the adversary's ability in exploiting RF fingerprinting. The proposed countermeasure is based on switching among preset communication protocols and employs adversarial machine learning to select the protocol for a transmission so that the accuracy of the RF fingerprinting diminishes. We demonstrate the effectiveness of our scheme through simulation and prototype experiments.

In a smart power grid, phasor measurement devices provide critical status updates in order to enable stabilization of the grid against fluctuations in power demands and component failures. Particularly the trend is to employ a large number of phasor measurement units (PMUs) that are inter-networked through wireless links. We tackle the vulnerability of such a wireless PMU network to message replay and false data injection (FDI) attacks. We propose a novel approach for avoiding explicit data transmission through PMU measurements prediction. Our methodology is based on applying advanced machine learning techniques to forecast what values will be reported and associate a level of confidence in such prediction. Instead of sending the actual measurements, the PMU sends the difference between actual and predicted values along with the confidence level. By applying the same technique at the grid control or data aggregation unit, our approach implicitly makes such a unit aware of the actual measurements and enables authentication of the source of the transmission. Our approach is data-driven and varies over time; thus it increases the PMU network resilience against message replay and FDI attempts since the adversary's messages will violate the data prediction protocol. The effectiveness of approach is validated using datasets for the IEEE 14 and IEEE 39 bus systems and through security analysis.

We consider networks where mobile sensor/actor nodes move to specific locations in order to conduct data collection or deliver a response to an event. The challenge is to find the best tour for the mobile nodes in order to visit the given set of locations. In this paper, the objective of the optimization is to extend the node lifetime by emphasizing both path efficiency and balanced energy consumption when identifying and assigning tours to mobile nodes. Compared to existing schemes in the literature, we consider the initial position of mobile sensors when determining the tours. We formulate the optimization as a balanced multi-salesman travel problem and propose a solution based on a two-step approach. First, we determine the shortest tour that includes all event locations by forming the Hamiltonian cycle. Then, we formulate the optimal partitioning of such a cycle as a linear program (LP) where the objective is to reduce the tour length while minimizing the maximum tour a node has to be make. For scalability and to expedite convergence, we propose a method for solving the LP formulation based on Branch & Price algorithm. The simulation results confirm the effectiveness of our optimization formulation and the advantage of our solution compared to competing schemes.

Wireless sensors and actors networks (WSANs) have the capacity for not only monitoring some phenomena through sensor nodes but also performing appropriate actions. Most of the contemporary WSAN management solutions focus on defining communication path among sensors and actors and on tasking appropriate actors to handle the detected events. In this paper we classify events based on how they evolve over time into continuous and discrete and categorize the WSAN management strategies accordingly. Unlike discrete events, a continuous event spreads quickly and becomes more serious as time passes. Such a characteristic introduces more challenges and motivates a non-conventional management strategies. This paper presents an approach for Sensor-Actuator Coordination for Handling Spreading events (SACHS). SACHS opts to enable the network to respond quickly in order to avoid the event from growing in scope, e.g., prevent a fire from spreading, while reducing the energy overhead due to the coordination messages and due to actor's relocation to the event region. SACHS limits sensor-actor and actor-actor interactions and exploits local sensor-sensor communication to determine the scope of the event, define spots for actors to position at, and schedule the actors' response. The simulation results confirm the performance advantage of SACHS compared to competing schemes.