The rapid expansion of Internet of Things (IoT) devices has heightened the need for effective intrusion detection systems (IDS) that operate under strict resource constraints. Conventional IDS implementations require substantial computational resources, making them unsuitable for low-power microcontroller-based devices. This paper proposes a novel collaborative IDS architecture that separates centralised model training from distributed edge inference. The system employs an autoencoder-based labelling mechanism trained on regular traffic to identify anomalies. Each ESP32 device performs local inference and exchanges predictions via UDP multicast, whilst MD5 hashing ensures model consistency across the network. Collaborative verification enables devices to identify and isolate compromised nodes without central coordination. Experimental evaluation demonstrates 98.5% F-score with 3ms average inference latency and 12.7KB memory footprint, consuming only 2.4% of available SRAM. Our approach achieves superior detection accuracy compared to existing cloud-edge systems whilst operating on severely resource-constrained hardware, making it a practical solution for large-scale IoT security deployments.

The rapid growth of technology has increased interconnected large-scale systems, broadening the attack surface for malicious actors . Traditional security solutions often employ centralised management of components like firewalls and intrusion detection systems for consistent configuration. This centralisation introduces a ”single point of failure,” risking severe consequences if compromised. While redundancy can mitigate concerns in IT systems, it does not scale well for larger systems. Edge computing , which pushes computation closer to endpoint devices , has been explored to improve scalability. The research community has also explored distributing and decentralising cybersecurity operations, especially intrusion detection , using new machine learning methods that mix centralised and distributed approaches to scale effectively while preserving data privacy. However, challenges remain in implementing these methods in large-scale IoT systems due to resource constraints . This paper evaluates intrusion detection methods in large-scale, resource-limited IoT systems, exploring the benefits of low-powered devices for network security and discussing solutions to current implementation challenges.

Data integrity becomes paramount as the number of Internet of Things (ioT) sensor deployments increases. Sensor data can be altered by benign causes or malicious actions. Mechanisms that detect drifts and irregularities can prevent disruptions and data bias in the state of an IoT application. This paper presents LE3D, an ensemble framework of data drift estimators capable of detecting abnormal sensor behaviours. Working collaboratively with surrounding ioT devices, the type of drift (natural/abnormal) can also be identified and reported to the end-user. The proposed framework is a lightweight and unsupervised implementation able to run on resource-constrained IoT devices. Our framework is also generalisable, adapting to new sensor streams and environments with minimal online reconfiguration. We compare our method against state-of-the-art ensemble data drift detection frameworks, evaluating both the real-world detection accuracy as well as the resource utilisation of the implementation. Experimenting with real-world data and emulated drifts, we show the effectiveness of our method, which achieves up to 97% of detection accuracy while requiring minimal resources to run.

We apply Federated Learning (FL) to the problem of indoor localisation in a real-world multiple residential house scenario. Fingerprinting of the Received Signal Strength Indicator (RSSI) was used as the localisation method. We show that, given the minimal amount of fine-tuning allowed by constraint on the size of the gradient step in the fit round of FL, a shared model learned this way has strong performance on all houses and is stable with respect to randomness in weight initialisation. Not unexpectedly, the performance is inferior to an individual learning approach. We developed a tuned FL approach - a finetuning step in every round of FL that only affects a subset of the clients' parameters while leaving a common ‘backbone’ unchanged. The FL clients were able to accept the model weights post-tuning or revert to the weights in the previous evaluation round based on their local validation set. Through our extensive evaluation, our results indicate a significant reduction in the performance gap between a completely individual ML and a benchmark traditional FL approach.

The vast increase of Internet of Things (IoT) technologies and the ever-evolving attack vectors have increased cyber-security risks dramatically. A common approach to implementing AI-based Intrusion Detection Systems (IDSs) in distributed IoT systems is in a centralised manner. However, this approach may violate data privacy and prohibit IDS scalability. Therefore, intrusion detection solutions in IoT ecosystems need to move towards a decentralised direction. Federated Learning (FL) has attracted significant interest in recent years due to its ability to perform collaborative learning while preserving data confidentiality and locality. Nevertheless, most FL-based IDS for IoT systems are designed under unrealistic data distribution conditions. To that end, we design an experiment representative of the real-world and evaluate the performance of an FL-based IDS. For our experiments, we rely on TON-IoT, a realistic IoT network traffic dataset, associating each IP address with a single FL client. Additionally, we explore pre-training and investigate various aggregation methods to mitigate the impact of data heterogeneity. Lastly, we benchmark our approach against a centralised solution. The comparison shows that the heterogeneous nature of the data has a considerable negative impact on the model's performance when trained in a distributed manner. However, in the case of a pre-trained initial global FL model, we demonstrate a performance improvement of over 20% (F1-score) compared to a randomly initiated global model.

With the ever-increasing reliance on digital networks for various aspects of modern life, ensuring their security has become a critical challenge. Intrusion Detection Systems play a crucial role in ensuring network security, actively identifying and mitigating malicious behaviours. However, the relentless advancement of cyber-threats has rendered traditional/classical approaches insufficient in addressing the sophistication and complexity of attacks. This paper proposes a novel 3-stage intrusion detection system inspired by a simplified version of the Lockheed Martin cyber kill chain to detect advanced multi-step attacks. The proposed approach consists of three models, each responsible for detecting a group of attacks with common characteristics. The detection outcome of the first two stages is used to conduct a feasibility study on the possibility of predicting attacks in the third stage. Using the ToN IoT dataset, we achieved an average of 94% F1-Score among different stages, outperforming the benchmark approaches based on Random-forest model. Finally, we comment on the feasibility of this approach to be integrated in a real-world system and propose various possible future work.

Edge computing is rapidly changing the IoT-Cloud landscape. Various testbeds are now able to run multiple Docker-like containers developed and deployed by end-users on edge devices. However, this capability may allow an attacker to deploy a malicious container on the host and compromise it. This paper presents a dataset based on the Linux Auditing System, which contains malicious and benign container activity. We developed two malicious scenarios, a denial of service and a privilege escalation attack, where an adversary uses a container to compromise the edge device. Furthermore, we deployed benign user containers to run in parallel with the malicious containers. Container activity can be captured through the host system via system calls. Our time series auditd dataset contains partial labels for the benign and malicious related system calls. Generating the dataset is largely automated using a provided AutoCES framework. We also present a semi-supervised machine learning use case with the collected data to demonstrate its utility. The dataset and framework code are open-source and publicly available.

Recent studies show that a key contributor to congestion and increased CO2 emissions within cities are drivers searching (or cruising) to find a vacant on-street parking space. It has been shown that approximately (depending on the city) 20-30% of vehicles in congested urban areas were cruising to find a parking space with a parking search time varying in the order of several minutes. In the city of Bristol alone, we have shown, using our collected trip and publicly available census data that over 790 metric tons of CO2 is generated every year due to cruising. At a total cost of £368, 000 (US$467, 000) in terms of fuel wasted. The solution, described in this paper, aims to reduce parking search times using our automated real-time parking system called ParkUs 2.0. Our proposed method leverages sensor and location data collected from smartphones (carried by drivers), uses machine learning (classification) to detect cruising behaviour, automatically annotates parking availability on road segments based on the classified data and displays this information as a heatmap of parking availability information on the user's smartphone. This is the first such attempt to automatically detect cruising to the best of our knowledge. Evaluation through controlled trials with volunteer participants highlights the potential of our novel approach as we are able to detect cruising with an accuracy of 81%.