Intent-Based Networking (IBN) is emerging as a powerful paradigm for managing complex, adaptive systems by translating high-level user policies into automated infrastructure behavior. To meet these intents effectively, especially in dynamic and data-driven environments, IBN increasingly depends on Artificial Intelligence (AI) for intelligent decision-making and task automation. While AI enhances the responsiveness of IBN, it introduces new challenges in data privacy and regulatory compliance—particularly in environments where sensitive personal data is continuously collected and learned. A central issue arises from the Right to Be Forgotten (RTBF) under the General Data Protection Regulation (GDPR), which requires that user data—and its learned influence—be fully removed upon request. However, conventional unlearning methods that rely on full model retraining are resource-intensive and impractical for real-time systems. To address this, this paper proposes an intent-driven machine unlearning framework that integrates meta learning, redactable blockchain, and Secure Multi-Party Computation (MPC), all coordinated through IBN. In this framework, unlearning is formulated as a targeted removal of a data point’s influence from the model without retraining, using implicit gradients. The redactable blockchain ensures compliant and auditable logging, while MPC supports secure, decentralized redaction. IBN orchestrates the process by aligning unlearning actions with privacy intents. Experimental results demonstrate that the proposed framework achieves up to 2.2% higher accuracy than baseline meta-learning approaches and 2.78 times greater unlearning efficiency compared to retraining, while maintaining strong resistance to membership inference attacks. This demonstrates its suitability for scalable, regulation-compliant AI unlearning.

Security Operations Center (SOC) analysts experience notable performance degradation under elevated cognitive stress, yet existing systems treat stress detection and decision support as separate problems. This paper presents a Cognitive–Physiological Synchronization (CPS) Framework for IoT-based Security Operations Centers (IoT-SOCs) that integrates multimodal physiological stress inference with cognitive decision-making agents to enable real-time, uncertainty-aware action selection in cybersecurity environments. Our framework employs a calibrated DNN-XGBoost ensemble to estimate stress probability from electrocardiogram (ECG), electrodermal activity (EDA), and respiration signals collected via wearable biosensors. The CPS layer converts these physiological beliefs into actionable cognitive utilities through Bayesian log-odds updates, dynamically aligning decision policies with the analyst’s momentary stress state. We further introduce a Utility-Aware Temporal Reasoner (UATR) that smooths sequential evidence over time and a Stress-Weighted Memory (SWM) mechanism that adapts experience recall within the SpeedyIBL cognitive model. Evaluated using leave-one-subject-out cross-validation on the WESAD dataset, the framework achieves 95.8% accuracy (AUC = 0.967) with sub-second latency. In zero-shot SOC simulations using CICIDS2017 tasks, unsupervised calibration enhances decision stability and reduces false escalations relative to rule-based baselines. Results confirm that synchronizing physiological stress inference with cognitive policy selection improves end-to-end action quality under uncertainty, laying a foundation for Internet of Things (IoT)-connected, human-centered adaptive cybersecurity operations across cyber–physical and edge environments.

Artificial Intelligence of Things (AIoT) systems are increasingly deployed in smart cities to enable automation, resource optimization, and real-time decision-making. How-ever, large-scale deployments face significant challenges, in-cluding device-level resource limitations, communication over-head, synchronization inefficiencies, and security threats such as data and model poisoning. To address these issues, a digi-tal twin-assisted collaborative learning framework is proposed. Resource-constrained devices are virtualized at home edge servers to offload computationally intensive training, while Multi- access Edge Computing (MEC) nodes equipped with Zero-Touch Networking (ZTN) autonomously orchestrate training policies. Snake learning is adopted to reduce synchronization delays and communication costs compared with federated and split learning, and Harris Hawks Optimization is applied to select participants based on trust, resources, and latency. Robustness against ad-versarial updates is ensured through a trust-weighted Adaptive Multi-Krum aggregation mechanism, while a permissioned blockchain provides tamper-proof auditability and accountability. Experimental results on a smart home intrusion detection dataset demonstrate a 50-65% reduction in communication, 30-45% reduction in computation and energy consumption, and Fl- scores above 95 % even under 40 % adversarial participation.

The certification of real-time information in vehicles depends on threat detection. Intelligent vehicle sensor networks (IVSNs) have revolutionized modern transportation systems, enhancing traffic management and providing greater comfort. However, the increased use of smart sensing technologies has made connected and intelligent vehicles (CIVs) an attractive target for unauthorized access. Consequently, CIV owners are keen to ensure the security of their vehicle information, particularly the positioning, timing, and navigation of their vehicles. This article proposes a federated framework that utilizes client-level differential privacy (CLDP) to prevent privacy attacks, such as model inversion and membership inference attacks. In these attacks, an unauthorized party attempts to extract sensitive data from the model’s outputs to exploit its predictive capabilities. The CLDP-federated averaging threat detection (CLDP-FATD) approach utilizes Rényi-DP-Fed-Avg (RDP)/$(\alpha, \epsilon)$-DP, as an alternative to traditional DP algorithms to safeguard privacy and prevent data leakage within the federated learning (FL) framework. The efficacy of the proposed framework was evaluated using a GPS spoofing attack dataset. The findings demonstrate that the proposed scheme ensures collaborative privacy-utility tradeoff for CIV, achieving a minimal privacy budget$(\epsilon)$of 0.99 at 94.27% and 2.0 at 88.42% for binary and multiclass, respectively, outperforming existing approaches.

Carbon Intelligent Industrial Internet of Things (IIoT) systems are critical for achieving sustainable industrial automation but face challenges such as scalability, operational complexity, and security vulnerabilities. Zero-Touch Networks (ZTN), with their autonomous management capabilities, offer solutions to operational challenges but remain vulnerable to sophisticated cyber intrusions due to their high level of autonomy and interconnectedness. While Artificial Intelligence (AI), especially Deep Learning (DL), shows potential in intrusion detection, current approaches often encounter obstacles such as insufficient datasets, challenges in automated data preprocessing, and a lack of transparency. This paper introduces an AutoML-enabled Meta Learning-based Intrusion Prevention Scheme designed specifically for ZTN within Carbon Intelligent IIoT. The proposed framework integrates AutoML and meta-learning to streamline data preprocessing and improve model adaptability in dynamic and evolving threat environments. To ensure transparency, an Integrated Gradient-based Explainable AI (XAI) mechanism is employed, offering insights into the impact of individual features on model predictions, thereby addressing concerns related to trust and accountability in industrial applications. Experimental evaluations demonstrate the framework’s effectiveness in enhancing intrusion prevention, bolstering security, and improving transparency for ZTN in carbon intelligent IIoT, providing a comprehensive solution to prevailing challenges.

Significant advancement in Deep learning (DL) has turned it into an integral part of robust approaches for addressing cybersecurity problems in both current and aging infrastructures. Control Flow Graphs (CFGs) have demonstrated their effectiveness as leading choices that result in high-performing classifiers among various data representations used by DL-based models. Recently, Graph Neural Networks (GNNs) have made breakthroughs in the graph domain, and before long, they were jointly used with CFGs to train performant malware classifiers. However, graph-based adversarial attacks have caused suspicion about the predictions these graph-based malware classifiers make, and few studies have investigated detecting such attacks. Therefore, this paper proposes a novel GNN-based adversarial detector for identifying adversarial CFGs with higher efficacy than the previous work. This adversarial detector is placed in a data pipeline before a GNN-based malware classifier. In this paper, we solve the adversarial detection problem as an anomaly detection scenario and train the adversarial detector to learn the normal data distribution. Our GNN-based adversarial detector detects 98.96% of all adversarial CFGs, which is 1.17% higher than the previous method, with a 5.95% lower False Positive Rate (FPR). In the most hazardous category of the attack, where the attacker intends to render a malicious example as a benign input, we achieve a 4.85% boost compared to the previous competitors.

Although federated learning offers a level of privacy by aggregating user data without direct access, it remains inherently vulnerable to various attacks, including poisoning attacks where malicious actors submit gradients that reduce model accuracy. In addressing model poisoning attacks, existing defense strategies primarily concentrate on detecting suspicious local gradients over plaintext. However, detecting non-independent and identically distributed encrypted gradients poses significant challenges for existing methods. Moreover, tackling computational complexity and communication overhead becomes crucial in privacy-preserving federated learning, particularly in the context of encrypted gradients. To address these concerns, we propose a robust privacy-preserving federated learning model resilient against model poisoning attacks without sacrificing accuracy. Our approach introduces an internal auditor that evaluates encrypted gradient similarity and distribution to differentiate between benign and malicious gradients, employing a Gaussian Mixture Model and Mahalanobis Distance for byzantine-tolerant aggregation. The proposed model utilizes Additive Homomorphic Encryption to ensure confidentiality while minimizing computational and communication overhead. Our model demonstrates superior performance in accuracy and privacy compared to existing strategies and encryption techniques, such as Fully Homomorphic Encryption and Two-Trapdoor Homomorphic Encryption. The proposed model effectively addresses the challenge of detecting maliciously encrypted non-independent and identically distributed gradients with low computational and communication overhead.

As one of the highly used components in the power system, digital relays are employed to use the phasor measurement units', voltage, and current signals, to decide whether a fault has occurred in the system or not. The major difference between digital relays and traditional ones is that the former receives the mentioned signals mostly by wireless communication paths, instead of using measurement transformers. While the wireless signals used as the input of digital relays are vulnerable to cyber-attacks, a proper cybersecurity solution for digital relays is demanding. Due to the pervasive use of AI-based techniques in cybersecurity, one of the most vital features of a cybersecurity method is its training data volume. Hence, we employed a modified generative adversarial network that is able to generate attacked data by itself, meaning that there is no need to train the neural network with the cyber-attacked data. Additionally, a feature selection method called extra tree classifier is used to reduce the dimension of our input data. The discriminator sector of the generative adversarial network is then used as the classifier to detect false data injection, civil attacks, and faults which is preventing the digital relay from tripping falsely. The two mentioned cyber-attacks, false data injection and civil-attack, are used to evaluate the performance of our proposed method in 29 different scenarios. The IEEE 39-bus transmission network is employed as our test system. The proposed cyber-attack detection method was able to classify the faults and mentioned cyber-attacks in most scenarios with more than 97 percent of accuracy, f1 score, and more than 96 percent of sensitivity. We also examined the proposed modified GAN-based method by giving it only the voltage signal as input for training, and the method scored at least 90 percent of accuracy, 87 percent of sensitivity, and 88 percent of f1 score in harsh scenarios which is almost as accurately as before when both voltage and current signals were used for the relay as inputs, making the proposed technique universal and suitable for other types of relays.

The integration of the communications network and the Internet of Things in today’s critical infrastructures facilitates intelligent and online monitoring of these systems. However, although critical infrastructure’s digitalization brings tremendous advantages and opportunities for remote access and control, it significantly increases cyber-attack’s vulnerability. Therefore, efficient and proper detection and localization of cyber-attack are paramount for the critical infrastructure’s reliable and secure operation. This article proposes a deep learning-based cyber-attack detection and location identification system for critical infrastructures by constructing new representations and model the system behavior using multilayer autoencoders. The results show that the new representations capture the physical relationships among the measurements and have more discriminant power in distinguishing the location of the attack. Furthermore, the proposed method has outperformed conventional machine learning models under various cyber-attack scenarios using real-world data from the gas pipeline and water distribution supervisory control and data acquisition systems.

Protecting widely used deep classifiers against black-box adversarial attacks is a recent research challenge in many security-related areas, including malware classification. This class of attacks relies on optimizing a sequence of highly similar queries to bypass given classifiers. In this article, we leverage this property and propose a history-based method named,stateful query analysis (SQA), which analyzes sequences of queries received by a malware classifier to detect black-box adversarial attacks on an industrial Internet of Things (IIoT). In the SQA pipeline, there are two components, namely the similarity encoder and the classifier, both based on convolutional neural networks. Unlike the state-of-the-art methods, which aim to identify individual adversarial examples, tracking the history of queries allows our method to identify adversarial scenarios and abort attacks before their completion. We optimize SQA using different combinations of hyperparameters on an advanced risc machine (ARM)-based IIoT malware dataset, widely adopted for malware threat hunting in industry 4.0. The use of a novel distance metric in calculating the loss function of the similarity encoder results in more disentangled representations and improves the performance of our method. Our evaluations demonstrate the validity of SQA via a detection rate of 93.1% over a wide range of adversarial examples.

Nowadays, blockchain-based technologies are being developed in various industries to improve data security. In the context of the Industrial Internet of Things (IIoT), a chain-based network is one of the most notable applications of blockchain technology. IIoT devices have become increasingly prevalent in our digital world, especially in support of developing smart factories. Although blockchain is a powerful tool, it is vulnerable to cyberattacks. Detecting anomalies in blockchain-based IIoT networks in smart factories is crucial in protecting networks and systems from unexpected attacks. In this article, we use federated learning to build a threat hunting framework called block hunter to automatically hunt for attacks in blockchain-based IIoT networks. Block hunter utilizes a cluster-based architecture for anomaly detection combined with several machine learning models in a federated environment. To the best of our knowledge, block hunter is the first federated threat hunting model in IIoT networks that identifies anomalous behavior while preserving privacy. Our results prove the efficiency of the block hunter in detecting anomalous activities with high accuracy and minimum required bandwidth.

Due to the differences between Information Technology (IT) and Industrial Control System (ICS) networks, current IT security solutions are not working effectively on ICS networks. Moreover, due to security and privacy issues, ICS owners usually do not share their network data with third parties to train specific machine learning-based ICS security solutions. To rectify the mentioned issues, a scalable deep federated learning-based method is presented in this paper. In the proposed method, each client trains an unsupervised deep neural network model using local data and shares its parameters with a server. The server aggregates the clients’ parameters, makes a generalized public model, and shares it with all clients. The proposed model is evaluated using a real-world ICS dataset in a water treatment system and compared with two non-federated learning-based methods. Findings show that the proposed method outperformed the other two methods with the same computational complexity as other deep neural network-based methods in the literature.

Internet-of-Things (IoT) devices are increasingly targeted, partly due to their presence in a broad range of applications (including home and corporate environments). In this article, we propose a multikernel support vector machine (SVM) for IoT cloud-edge gateway malware hunting, using the gray wolves optimization (GWO) technique. This metaheuristic approach is used for optimum selection of features distinguishing between malicious and benign applications at the IoT cloud-edge gateway. The model is trained with the Opcode and Bytecode of IoT malware samples (i.e., the training data set comprises 271 benign and 281 malicious Cortex A9 samples) and evaluated using the K-fold cross-validation technique. We validate the robustness of the proposed model, in terms of its ability to detect previously unseen IoT malware samples. We achieve an accuracy of 99.72% on the combination of the radial basis function (RBF) and polynomial kernels. Moreover, our proposed model only requires 20 s for training in comparison to the previous deep neural network (DNN) model that requires over 80 s to be trained on the same data. Overall, the proposed multikernel SVM approach outperforms DNNs and fuzzy-based IoT malware hunting techniques, in terms of accuracy, while significantly reducing the computational cost and the training time.

Securing Internet-of-Things (IoT)-enabled cyber-physical systems (CPS) can be challenging, as security solutions developed for general information/operational technology (IT/OT) systems may not be as effective in a CPS setting. Thus, this article presents a two-level ensemble attack detection and attribution framework designed for CPS, and more specifically in an industrial control system (ICS). At the first level, a decision tree combined with a novel ensemble deep representation-learning model is developed for detecting attacks imbalanced ICS environments. At the second level, an ensemble deep neural network is designed to facilitate attack attribution. The proposed model is evaluated using real-world data sets in gas pipeline and water treatment system. Findings demonstrate that the proposed model outperforms other competing approaches with similar computational complexity.

There is currently widespread use of drones and drone technology due to their rising applications that have come into fruition in the military, safety surveillance, agriculture, smart transportation, shipping, and delivery of packages in our Internet-of-Things global landscape. However, there are security-specific challenges with the authentication of drones while airborne. The current authentication approaches, in most drone-based applications, are subject to latency issues in real time with security vulnerabilities for attacks. To address such issues, we introduce a secure authentication model with low latency for drones in smart cities that looks to leverage blockchain technology. We apply a zone-based architecture in a network of drones, and use a customized decentralized consensus, known as drone-based delegated proof of stake (DDPOS), for drones among zones in a smart city that does not require reauthentication. The proposed architecture aims for positive impacts on increased security and reduced latency on the Internet of Drones (IoD). Moreover, we provide an empirical analysis of the proposed architecture compared to other peer models previously proposed for IoD to demonstrate its performance and security authentication capability. The experimental results clearly show that not only does the proposed architecture have low packet loss rate, high throughput, and low end-to-end delay in comparison to peer models but also can detect 97.5% of attacks by malicious drones while airborne.

Smart Cyber Physical Grids are the new wave of power system technology that integrates networks of sensors with power stations for more efficient power generation and distribution. While utilizing communication networks is accompanied with tremendous advantages, it also increases the vulnerability of power systems to cyber attacks. Many methods for security and attack detection have been proposed in literature; however, most papers do not consider the imbalance of data in real power systems. In this paper, we propose a deep learning based method, referred to as Ensemble Stacked AutoEncoder (ESAE), aimed at tackling the problem of data imbalance. This method achieves superior performance on imbalanced data by developing a deep representation learning model to construct new balanced representations. The detection accuracy and model performance is improved by utilizing an ensemble architecture based on Stacked Autoencoders and Random Forest classifiers to detect attacks from the new representations. The proposed method is tested on all degrees of data imbalance using test cases of IEEE 14-bus, 30-bus, and 57-bus systems. Comparisons are made to several classifiers to demonstrate the effectiveness of the proposed algorithm.

Smart power grids are one of the most complex cyberphysical systems, delivering electricity from power generation stations to consumers. It is critically important to know exactly the current state of the system as well as its state variation tendency; consequently, state estimation and state forecasting are widely used in smart power grids. Given that state forecasting predicts the system state ahead of time, it can enhance state estimation because state estimation is highly sensitive to measurement corruption due to the bad data or communication failures. In this paper, a hybrid deep learning-based method is proposed for power system state forecasting. The proposed method leverages Convolutional Neural Network (CNN) for predicting voltage magnitudes and a deep Recurrent Neural Network (RNN) for predicting phase angels. The proposed CNN-RNN model is evaluated on the IEEE 118-bus benchmark. The results demonstrate that the proposed CNN-RNN model achieves better results than the existing techniques in the literature by reducing the normalized Root Mean Squared Error (RMSE) of predicted voltages by 10%. The results also show a 65% and 35% decrease in the average and maximum absolute error of voltage magnitude forecasting.

Electricity theft can be considered as a Nontechnical Loss (NTL) in smart grids, which is very harmful to the power system. Electricity Theft Detection (ETD) is a procedure to detect atypical behaviours in smart grids, which can be achieved via the massive amount of data that is generated by these networks due to using smart meter tools and Information and Communications Technology (ICT). Since the existing methods are not exceptionally robust to detect this type of attack, also considering the strength of the convolutional neural network (CNN), an Ensemble Deep Convolutional Neural Network (EDCNN) algorithm for ETD in smart grids has been proposed. As the first layer of the model, a random under bagging technique is applied to deal with the imbalance data, then deep CNNs are utilized on each subset, and finally, a voting system is embedded as the last part. This study has been conducted on a dataset which contains consumption information of more than 42,000 customers over 24 months. Various performance parameters containing AUC, precision, recall, f1-score and accuracy have been reported as the results.

Traditional Internet of Things (IoT) system architectures are centralized. Data from the devices are stored on the back-end, where they are processed and analyzed, and then reconnected to IoT devices. The scalability of centralized systems is very limited especially when an abundance of devices exist on an IoT network. Network security in IoT networks is another aspect at stake that could be compromised easily due to the unavailability of security in design mechanisms in most IoT networks. Blockchain technology is a distributed ledger without any intensive management that can store all transactions which leads to large amounts of data that increases over time. Large data amounts will be more pronounced with the increasing IoT devices and blockchain use cases involving IoT. IoT devices are for the most part constrained in both energy, storage, and computation, unlikely to be able to store all blockchain data. The current implementation of blockchain is not IoT friendly. Moreover, consensus on the blockchain using Proof of Work (PoW) is infeasible due to computational constraints. In this paper, we propose a Secure and Low latency Proof of Work (SLPoW) protocol. We also bring the computation of miners onto a Field-programmable gate array (FPGA) to improve the processing speeds of computation. We consider our resulting blockchain technology using SLPoW suitable for the evolving Green IoT setting.

The surging pace of Internet of Things (IoT) development and its applications has resulted in significantly large amounts of data (commonly known as big data) being communicated and processed across IoT networks. While cloud computing has led to several possibilities in regard to this computational challenge, there are several security risks and concerns associated with it. Edge computing is a state-of-the-art subject in IoT that attempts to decentralize, distribute and transfer computation to IoT nodes. Furthermore, IoT nodes that perform applications are the primary target vectors which allow cybercriminals to threaten an IoT network. Hence, providing applied and robust methods to detect malicious activities by nodes is a big step to protect all of the network. In this study, we transmute the programs’ OpCodes into a vector space and employ fuzzy and fast fuzzy pattern tree methods for malware detection and categorization. We obtained a high degree of accuracy during reasonable run-times especially for the fast fuzzy pattern tree. Both utilized feature extraction and fuzzy classification, which were robust, led to more powerful edge computing malware detection and categorization method.