The Internet of Things (IoT) revolution has profoundly transformed modern industries by embedding connected digital devices across critical sectors such as energy, pharmaceuticals, and manufacturing. Such interconnected devices together form Cyber-Physical Systems (CPS), complex structures that enable computation to directly control physical processes. These systems increasingly rely on automation and real-time control to enhance efficiency, productivity, and safety. However, this growing dependence on connectivity has significantly expanded the attack surface, exposing mission-critical infrastructure to sophisticated cyber threats. Among the most dangerous are zero-day vulnerabilities, which are unknown flaws in software or firmware, and zero-day design flaws, which are deeply embedded architectural weaknesses often undetectable by conventional verification methods. Traditional defense mechanisms, largely based on static rules or known threat signatures, are ill-equipped to detect these stealthy and evolving threats - especially in real-time systems, where even minor delays in detection or response can result in catastrophic outcomes. To overcome these limitations, this work presents a transformative security framework that leverages the reasoning and generative capabilities of Large Language Models (LLMs) to construct an intelligent, redundant digital twin of the operational system. Unlike traditional replicas, the LLM-driven digital twin is logically and architecturally isolated, making it inaccessible to attackers targeting the primary system. Crucially, the twin is not a static copy: it is dynamically synthesized and continuously restructured by the LLM to ensure a heterogeneous and evolving codebase. This ensures functional alignment with the physical system while introducing deliberate software diversity, thereby increasing attacker uncertainty and resilience to shared exploits. The central hypothesis of the framework is that semantic deviations between the decisions or behaviors of the digital twin and its physical counterpart can serve as reliable indicators of anomalous activity—whether stemming from external attacks or latent design flaws. By monitoring this divergence, the system facilitates the early detection of zero-day threats and supports real-time mitigation strategies, thereby significantly strengthening the resilience of critical infrastructure. Implementation results demonstrated the effectiveness and efficiency of the proposed approach.

The proliferation of Internet of Things (IoT) devices across multiple domains has heralded an era of unprecedented connectivity and data exchange. Fog computing enhances edge-network processing, enabling real-time data analysis and prompt responses. However, ensuring secure and trustworthy communication among these devices remains a paramount concern. In fog-enabled IoT environments, securing communication among users, IoT devices, gateways, and fog nodes is of paramount importance to prevent unauthorized access and ensure data integrity and confidentiality. Additionally, users can control and deliver instructions to IoT devices remotely. Hence, we propose a blockchain-assisted authentication protocol tailored specifically for fog-enabled IoT environments to verify the user’s identity prior to accessing the IoT devices. The proposed protocol leverages cutting-edge crypto primitives like elliptic curve cryptography, hash functions, and blockchain to establish secure communication between users and IoT devices. Furthermore, we evaluate the proposed scheme through formal (Scyther) and informal analysis, demonstrating its efficacy in mitigating well-known attacks. On the other hand, the proposed protocol exhibits robustness against relevant protocols in terms of communication and computational aspects, as well as reliability for real-world fog-enabled IoT applications.

Integrating advanced communication technologies has significantly enhanced power distribution efficiency, reliability, and sustainability in the evolving landscape of smart microgrids. However, this integration introduces substantial security challenges, particularly concerning authentication and critical agreement processes, which are essential for maintaining the integrity and confidentiality of smart grid communications. This paper presents a novel authentication and key agreement protocol specifically designed for the smart grid environment by incorporating advanced cryptographic techniques such as ECC, physical unclonable functions, and blockchain. Our protocol ensures mutual authentication between devices, robust key management, and resistance to prevalent security threats. We conduct a comprehensive security analysis and performance evaluation, demonstrating that our protocol enhances security and maintains the efficiency necessary for practical deployment in smart grids. The results indicate significant improvements in security and performance metrics compared to existing solutions, establishing our protocol as a viable and effective option for securing smart grid communications. • Blockchain-based key management ensures scalable, resilient data exchange. • Novel ECC- and PUF-driven protocol enables secure smart microgrid authentication. • Protocol achieves mutual authentication, session secrecy, and forward secrecy. • Resistant to replay, man-in-the-middle, cloning, and physical attacks. • Supports lightweight operations suitable for real-time smart energy systems.

Extended reality (XR) and 6G networks are set to transform mobile immersive experiences, with privacy and security being paramount in XR communications. Achieving secure and reliable XR experiences while meeting high-resolution and low-latency requirements is challenging for wireless networks. A novel security-aware cross-layer communication management framework is proposed, employing zero-trust spatiotemporal physical layer level manipulations for moving-target defense. Driven by deep reinforcement learning and real-time monitoring, the proposed framework adaptively reprograms the network configuration to maximize the user’s quality of experience (QoE), reduce the overall latency, and minimize the attacker’s intercept probability. The framework was evaluated in a simulated scenario featuring an indirect multi-hop communication setup. The results show that the proposed framework effectively and efficiently secures XR user communications while maintaining QoE, outperforming conventional Q-learning algorithms.

Digital identity management (DIM) systems have become challenging, especially, given the current progression in ubiquitous environments enclosing cooperative Internet of Things (IoT) devices, individuals, and organizations. Self-sovereign identity (SSI) has recently surfaced to manifest the notion of decentralized DIMs enlivened by users’ autonomy. This article presents a proactive, trustworthy solution for managing digital users’ data and identity information without risking its integrity, security, privacy, and confidentiality. Accordingly, we propose a decentralized SSI-enabled cloud storage model that enables secure access control and frequent data integrity checking (IC) mechanism. The presented model ensures the resiliency of SSI-enabled operations, including users’ registration, data identification, external information distribution, IC operations, identity information authentication and verification, and decentralized external and shareable operations.

The recent devastating mission Cyber–Physical System (CPS) attacks, failures, and the desperate need to scale and to dynamically adapt to changes, revolutionized traditional CPS to what we name as Software Defined CPS (SD-CPS). SD-CPS embraces the concept of Software Defined (SD) everything where CPS infrastructure is more elastic, dynamically adaptable and online-programmable. However, in SD-CPS, the threat became more immanent, as the long-been physically-protected assets are now programmatically accessible to cyber attackers. In SD-CPSs, a network failure hinders the entire functionality of the system. In this paper, we present MystifY, a spatiotemporal runtime diversification for Moving-Target Defense (MTD) to secure the SD-CPS infrastructure. In this paper, we relied on Smart Grid networks as crucial SD-CPS application to evaluate our presented solution. MystifY’s MTD relies on a set of pillars to ensure the SDN controller resiliency against failures and attacks. The 1st pillar is a grid-aware algorithm that optimally allocates the most suitable controller–deployment​ location in large-scale grids. The 2nd pillar is a special diversifier that dynamically relocates the controller between heterogeneously configured hosts to avoid host-based attacks. The 3rd pillar is a temporal diversifier that dynamically detours controller–workload between multiple controllers to enhance their reliability and to detect and avoid controller intrusions. Our experimental results showed the efficiency and effectiveness of the presented approach.

In a ubiquitous environment enclosing cooperative Internet-of-Things (IoT) devices, individuals, and entities, digital identity management (DIM) becomes critical and challenging. DIM pertains to device identities authentication and verification to enable trustworthy service exchange, data collection, and decision making. DIM is the supporting pillar for all online services and the foundation for security and authentication mechanisms. Due to the extreme heterogeneity, scale, and configuration complexity of such environments, enabling trustworthy DIM is crucial and seriously challenging. In an IoT context, devices use local digital identities stored within a tamper-proof unit and verified by a centralized authority for authentication. The recent attacks on IoT systems showed how vulnerable such a design is. It is also an inherent problem that influences humans. From that, self-sovereign identity (SSI) has emerged as a decentralized DIM approach embracing the concept of portable self-possession identity. SSI was presented to couple the digital identity from the owner to enable large-scale cooperation. However, digital identity storage and verification still occur on the device and in a centralized manner. Utilizing a local single-point-of-failure storage memory for verifiable credentials is one of the considerable drawbacks in contemporary SSI. In this regard, this article introduces decentralized trustworthy-self-sovereign identity management (DT-SSIM), a novel decentralized trustworthy SSI management framework. DT-SSIM integrates the secret share scheme with the blockchain-based smart contracts technologies to provide transparent and trustworthy SSI-based DIM services for IoT. Storing IoT identity credentials outside the devices’ local storage preserves the identity credentials from being tampered with or misused. Evaluations and discussions show the resiliency assessment of the system and the cost and estimated running times for verification processes in DT-SSIM.

Considering the highly dynamic nature of the vehicular environment and the delay-sensitive wireless medium, enabling secure and reliable vehicle-to-vehicle communication becomes a very challenging task. In this paper, we propose a novel system design that uses blockchain technology to establish a high-level trust-management successful trustworthy cooperative vehicular wireless communication. The proposed system is a cross-layer approach that optimizes the best-relay selection process allowing only trustworthy relays to participate in data transmission. In this work, blockchain stores real-time information about relaying, transmitting, and receiving vehicles. The information includes channel characteristics and participation quality. The information is vetted and verified by mining vehicles. The result guides the relay selection process to block untrustworthy vehicles from participation. The entire system is comprehensively modeled and mathematically analyzed. Simulations using throughput and Bit Error Rate (BER) as evaluation metrics demonstrated the effectiveness and efficacy of the presented approach in enabling reliable wireless communication in presence of maliciously behaving vehicles. On average, the overall system throughput rate increased by$3bps$, the BER was reduced by almost by$2dB$, and the percentage of false messages decreased by 90% considering high Signal to Noise Ratio (SNR).

Cloud federation is the evolution of modern cloud computing. It provides better resource-sharing, perfect resource-utilization, and load-balancing. However, the heterogeneity of security policies and configurations between cloud service providers makes it hard for users to totally trust them. Further, the severe impact of modern cloud attacks such as cross-side channels on federated environments is a major roadblock against such evolution. Securing users' capsules (Virtual Machines and containers) against cross-side channel attacks is considered as a big challenge to cloud service providers. Moving-target Defense (MtD) by live capsule migration was introduced as an effective mechanism to overcome such challenge. However, researchers noted that even with MtD, migrated capsules can still be tracked via routing information. In this paper, we propose a novel Blockchain-based routing mechanism to enable trace-resistant Moving-target Defence (BMtD) to enable anonymous live cross-cloud migrations of running capsules in federated cloud environments. Exploiting the Vulnerable, Exposed, Attacked, Recovered (VEAR) model, simulation results demonstrated the effectiveness of BMtD in minimizing viral attack dispersion.

This paper proposes a novel approach to enhance wireless vehicle‐to‐vehicle channel‐secrecy capacity by imposing signal transmission diversity. This work exploits cooperative vehicular relaying to extract the associated underlying multipath and Doppler diversity using precoding techniques. We evaluated the capacity and diversity gain for the presented approach to ensure its effectiveness and efficiency. The abundance of moving vehicles, operating in an ad hoc fashion, can eliminate the need to establish a dedicated relaying infrastructure. A relay selection scheme is deployed, taking advantage of the potentially large number of available relaying vehicles. Further, we derivate a closed‐form mathematical expression for the channel‐secrecy capacity, diversity order gain, and the intercept probability. We used the direct transmission scenario as a reference to assess our analysis. Our analytical and simulation results for the presented model showed that channel‐secrecy capacity and performance‐indicators improved significantly.

This paper presents ESCAPE, an informed moving target defense mechanism for cloud containers. ESCAPE models the interaction between attackers and their target containers as a "predator searching for a prey" search game. Live migration of Linux-containers (prey) is used to avoid attacks (predator) and failures. The entire process is guided by a novel host-based behavior-monitoring system that seamlessly monitors containers for indications of intrusions and attacks. To evaluate ESCAPE effectiveness, we simulated the attack avoidance process based on a mathematical model mimicking the prey-vs-predator search game. Simulation results show high container survival probabilities with minimal added overhead.

The emergence of Mobile Ad-hoc Clouds (MACs) promises more effective and collaborative elastic resource-infinite computing.However, the highly dynamic, mobile, heterogeneous, fractionized, and scattered nature of computing resources coupled with the isolated non-cooperative nature of current re

Today numerous infrastructure assets remain alarmingly susceptible to advanced, targeted cyber attacks. There is a need to construct trustworthy high-quality protection and defense solutions capable of securing such valuable assets. In our work, we realize such cyber trust through trace-resistant mo

Modernizing our critical infrastructure often involves upgrades with Cyber-Physical Systems (CPS) to enhance efficiency, safety and reliability. New security and resilience challenges arise given the mission- and time-critical nature of CPS applications. Herby, we present CyPhyCARD (Cooperative Auto

Ubiquitous cyber systems and their supporting infrastructure impact productivity and quality of life immensely. Their penetration in our daily life increases the need for their enhanced resilience and for means to secure and protect them. One major threat is the software monoculture. Latest research