The rapid expansion of the Internet of Things (IoT) has led to unprecedented growth in multivariate time-series (MVTS) data, which are vital for real-world applications such as industrial monitoring, cyber-physical security, and smart city operations. These data streams are susceptible to anomalies that may indicate system malfunctions, security breaches, or environmental hazards. However, existing MVTS anomaly detection (MTAD) approaches, typically trained in centralized settings, struggle in IoT deployments due to data heterogeneity, resource constraints, and privacy concerns. We propose FEDKO, a novel federated learning (FL) framework that couples Reservoir Computing with Koopman operator theory for efficient, privacy-preserving MTAD in distributed IoT networks. At its core, ReKO, a lightweight spatio-temporal Reservoir-Koopman model, lifts nonlinear MVTS dynamics into a linear space for stable prediction and reconstruction. We formulate the FL training as a bi-level optimization procedure where the inner level learns locally stable Koopman dynamics, and the outer level refines lifted feature representations and reconstruction mappings. We further provide theoretical convergence guarantees, anomaly discriminability analysis, and a structural privacy characterization of the framework. Experiments on four IoT MVTS datasets and deployment on an NVIDIA Jetson edge device show that FEDKO achieves a balanced precision–recall profile with competitive F1-scores under heterogeneous federated settings, while substantially reducing communication and memory footprints compared with MTAD baselines.

Federated Learning (FL) is an emerging distributed machine learning (ML) technique distinguished by non-independent and identically distributed (Non-IID) data, statistical heterogeneity, and an expected large number of participating clients to collaboratively train a shared model without fusing the training data into one centralized server. State-of-the-art FL research focuses on gradient-based models, which is not suitable for ML-based intrusion detection systems that utilize tree-based learning methods such as Random Forest. Adapting a typical gradient-based FL method to a tree-based training technique is non-trivial, as ensembling trees and aggregating decision trees from different random forests across clients can be computationally, spatially, and temporally intensive. To overcome these challenges, this paper proposes FedRand, a novel adaptive Federated Random Forest Aggregation Learning Technique for Anomaly Detection in Internet of Things (IoT) networks. This paper thoroughly examines a suite of novel tree selection and aggregation strategies within a federated learning framework, ensuring robust model accuracy, accelerated aggregation, and global model convergence. We believe that this work opens up a promising solution for federated tree-based learning techniques.

The General Data Protection Regulation (GDPR), the EU/UK data protection legislation, has necessitated a critical need for compliance modelling to meet its strict and sophisticated requirements. Traditional techniques for modelling security and privacy-related threats fall short of addressing and mitigating the threats of non-compliance. This paper introduces a practical solution to modelling GDPR-compliance based on Defeasible Logic Programming (DeLP), which enhances the robustness and reasoning capabilities of compliance models in real-world scenarios. Furthermore, to overcome the challenges of UNDECIDED query outputs in logical reasoning, we incorporate explicit priorities for conflicting rules and suggest related knowledge for a query in an incomplete knowledge base. To finalize the compliance modelling system, we develop the threat mitigation mechanism that specifies the reasons in case there is a non-compliance threat, along with the suggested actions to mitigate the threats. The application of our approach is demonstrated through a case study on Fitbit , health tracking devices, focusing on non-compliance threats and resolving ”UNDECIDED” query results. Our findings show that the inference engine efficiently identifies non-compliance threats, handles UNDECIDED query results, and suggests appropriate threat mitigation measures. • Developed a knowledge base using Defeasible Logic Programming (DeLP) for GDPR compliance. • Integrated a DeLP-based reasoning mechanism to identify and mitigate non-compliance threats. • Implemented handlers for resolving contradictions in the knowledge base. • Integrated mechanisms to address incompleteness in the knowledge base. • Validated the approach with a Fitbit case study addressing non-compliance threats.

Over the last few years, several serious data breaches have raised significant public awareness of data privacy and have motivated researchers to envisage novel data sharing and management schemes. Meanwhile, personal information is becoming a valuable commodity; however, the business model used by service providers rarely involves sharing the revenue made by selling personal data, with the individuals - the data owners. This paper proposes an alternative storage and data-sharing method leveraging Blockchain technology, Smart Contracts, and Attributed-based Encryption. Blockchain’s core features such as transparency and immutability of transactions are utilised to create a decentralised system that allows individuals to maintain control over their data and directly benefit from it. Smart contracts, integrated with Attribute-based encryption schemes, are leveraged to allow users to securely share their data in an automated process, enabling them to receive a fair share of revenue for allowing service providers to use their data.

The General Data Protection Regulation (GDPR), an EU data protection law, requires compliance modeling techniques to help service providers meet its stringent requirements. Traditional privacy modeling techniques often fail to address and mitigate threats of non-compliance. This paper introduces an efficient threat modeling technique based on Defeasible Logic Programming (DeLP) to identify and mitigate non-compliance threats. To achieve this, we construct a DeLP-based knowledge base that integrates facts and rules derived from GDPR requirements. We then implement an inference engine to reason about GDPR non-compliance threats upon this knowledge base. Two novel concepts, namely the horizontal complexity and vertical complexity of a DeLP knowledge base, have been defined to further analyze and evaluate the complexity of the proposed DeLP-based modeling mechanism. An empirical demonstration validates the system’s feasibility and confirms the time complexity of the proposed reasoner. The findings demonstrate that the proposed DeLP-based technique provides an effective approach to GDPR compliance modeling and improves legal reasoning.

Blockchain technology has emerged as a transformative force in various sectors, including finance, healthcare, supply chains, and intellectual property management. Beyond Bitcoin’s role as a decentralized payment system, Ethereum represents a notable application of blockchain, featuring Smart Contract functionality that enables the development and execution of decentralized applications (DApps). A key feature of Ethereum , and public blockchains in general, is pseudonymity, typically achieved by using public keys as pseudonyms for users. Despite implementing several privacy-preserving techniques, the public recording of user activities on the blockchain allows various deanonymization methods that can profile users, reveal sensitive information , and potentially re-identify them. Most blockchains, such as Bitcoin , Litecoin , and Cardano, employ the Unspent Transaction Output (UTXO) model for accounting, which focuses on individual transactions and is susceptible to various deanonymization techniques. In contrast, Ethereum uses an account-based transaction model, integrating the concepts of accounts and wallets at the protocol level. This makes most UTXO-based deanonymization techniques ineffective for Ethereum. However, alternative methods with the potential to deanonymize Ethereum users have been proposed and developed. Privacy preservation techniques have been used to counteract deanonymization attempts; however, the challenges related to these techniques, their effectiveness and efficiency, and the trade-off between usability and protection levels remain areas for further exploration. This survey presents a comprehensive analysis of state-of-the-art privacy preservation along with deanonymization techniques in the blockchain and Ethereum ecosystems. This survey examines the intrinsic mechanisms supporting pseudonymity in Ethereum, providing a detailed assessment of the advantages and disadvantages of privacy preservation techniques, and suggests potential countermeasures against those deanonymization methods. It also discusses the implications arising from the intersection of DApps and data protection legislation , which is vital for ensuring the coexistence and advancement of groundbreaking blockchain capabilities and protecting user data.

Data-driven applications and services have been increasingly deployed in all aspects of life including healthcare and medical services in which a huge amount of personal data is collected, aggregated, and processed in a centralised server from various sources. As a consequence, preserving the data privacy and security of these applications is of paramount importance. Since May 2018, the new data protection legislation in the EU/UK, namely the General Data Protection Regulation (GDPR), has come into force and this has called for a critical need for modelling compliance with the GDPR's sophisticated requirements. Existing threat modelling techniques are not designed to model GDPR compliance, particularly in a complex system where personal data is collected, processed, manipulated, and shared with third parties. In this paper, we present a novel comprehensive solution for developing a threat modelling technique to address threats of non-compliance and mitigate them by taking GDPR requirements as the baseline and combining them with the existing security and privacy modelling techniques (i.e., STRIDE and LINDDUN, respectively). For this purpose, we propose a new data flow diagram integrated with the GDPR principles, develop a knowledge base for the non-compliance threats, and leverage an inference engine for reasoning the GDPR non-compliance threats over the knowledge base. Finally, we demonstrate our solution for threats of non-compliance with legal basis and accountability in a telehealth system to show the feasibility and effectiveness of the proposed solution.

Artificial Intelligence-based applications have been increasingly deployed in every field of life including smart homes, smart cities, healthcare services, and autonomous systems where personal data is collected across heterogeneous sources and processed using ”black-box” algorithms in opaque centralised servers. As a consequence, preserving the data privacy and security of these applications is of utmost importance. In this respect, a modelling technique for identifying potential data privacy threats and specifying countermeasures to mitigate the related vulnerabilities in such AI-based systems plays a significant role in preserving and securing personal data. Various threat modelling techniques have been proposed such as STRIDE, LINDDUN, and PASTA but none of them is sufficient to model the data privacy threats in autonomous systems. Furthermore, they are not designed to model compliance with data protection legislation like the EU/UK General Data Protection Regulation (GDPR), which is fundamental to protecting data owners’ privacy as well as to preventing personal data from potential privacy-related attacks. In this article, we survey the existing threat modelling techniques for data privacy threats in autonomous systems and then analyse such techniques from the viewpoint of GDPR compliance. Following the analysis, We employ STRIDE and LINDDUN in autonomous cars, a specific use-case of autonomous systems, to scrutinise the challenges and gaps of the existing techniques when modelling data privacy threats. Prospective research directions for refining data privacy threats & GDPR-compliance modelling techniques for autonomous systems are also presented.

In recent years, along with the blooming of Machine Learning (ML)-based applications and services, ensuring data privacy and security have become a critical obligation. ML-based service providers not only confront with difficulties in collecting and managing data across heterogeneous sources but also challenges of complying with rigorous data protection regulations such as EU/UK General Data Protection Regulation (GDPR). Furthermore, conventional centralised ML approaches have always come with long-standing privacy risks to personal data leakage, misuse, and abuse. Federated learning (FL) has emerged as a prospective solution that facilitates distributed collaborative learning without disclosing original training data. Unfortunately, retaining data and computation on-device as in FL are not sufficient for privacy-guarantee because model parameters exchanged among participants conceal sensitive information that can be exploited in privacy attacks. Consequently, FL-based systems are not naturally compliant with the GDPR. This article is dedicated to surveying of state-of-the-art privacy-preservation techniques in FL in relations with GDPR requirements. Furthermore, insights into the existing challenges are examined along with the prospective approaches following the GDPR regulatory guidelines that FL-based systems shall implement to fully comply with the GDPR. © 2021

Blockchain technology has been envisaged to commence an era of decentralised applications and services (DApps) without the need for a trusted intermediary. Such DApps open a marketplace in which services are delivered to end-users by contributors which are then incentivised by cryptocurrencies in an automated, peer-to-peer, and trustless fashion. However, blockchain, consolidated by smart contracts, only ensures on-chain data security, autonomy and integrity of the business logic execution defined in smart contracts. It cannot guarantee the quality of service of DApps, which entirely depends on the services’ performance. Thus, there is a critical need for a trust system to reduce the risk of dealing with fraudulent counterparts in a blockchain network. These reasons motivate us to develop a fully decentralised trust framework deployed on top of a blockchain platform, operating along with DApps in the marketplace to demoralise deceptive entities while encouraging trustworthy ones. The trust system works as an underlying decentralised service providing a feedback mechanism for end-users and maintaining trust relationships among them in the ecosystem accordingly. We believe this research fortifies the DApps ecosystem by introducing an universal trust middleware for DApps as well as shedding light on the implementation of a decentralised trust system.

The General Data Protection Regulation (GDPR) gives control of personal data back to the owners by appointing higher requirements and obligations on service providers who manage and process personal data. As the verification of GDPR-compliance, handled by a supervisory authority, is irregularly conducted; it is challenging to be certified that a service provider has been continuously adhering to the GDPR. Furthermore, it is beyond the data owner's capability to perceive whether a service provider complies with the GDPR and effectively protects her personal data. This motivates us to envision a design concept for developing a GDPR-compliant personal data management platform leveraging the emerging blockchain and smart contract technologies. The goals of the platform are to provide decentralised mechanisms to both service providers and data owners for processing personal data; meanwhile, empower data provenance and transparency by leveraging advanced features of the blockchain technology. The platform enables data owners to impose data usage consent, ensures only designated parties can process personal data, and logs all data activities in an immutable distributed ledger using smart contract and cryptography techniques. By honestly participating in the platform, a service provider can be endorsed by the blockchain network that it is fully GDPR-compliant; otherwise, any violation is immutably recorded and is easily figured out by associated parties. We then demonstrate the feasibility and efficiency of the proposed design concept by developing a profile management platform implemented on top of the Hyperledger Fabric permissioned blockchain framework, following by valuable analysis and discussion.

The emerging Blockchain (BC) and Distributed Ledger technologies have come to impact a variety of domains, from capital market sectors to digital asset management in the Internet of Things (IoT). As a result, more and more BC-based decentralized applications for numerous cross-domain services have been developed. These applications implement specialized decentralized computer programs called Smart Contracts (SCs) which are deployed into BC frameworks. Although these SCs are open ato public, it is challenging to discover and utilize such SCs for a wide range of usages from both systems and end-users because such SCs are already compiled in form of byte-codes without any associated meta-data. This motivates us to propose a solution called Semantic SC (SSC) which integrates RESTful semantic web technologies in SCs, deployed on the Ethereum Blockchain platform, for indexing, browsing and annotating such SCs. The solution also exposes the relevant distributed ledgers as Linked Data for enhancing the discovery capability. To achieve this goal, the OWL-S service ontology is extended by incorporating some domain specific terminologies, which are used in the development of the proposed SSCs. As a result, SSC can be utilized to enrich queries for a domain-specific terms across multiple distributed ledgers, which greatly increases the discovery capability of decentralized IoT applications and services. Contribution in standardization is also discussed. We believe that our research work takes the first steps towards connecting BC-based decentralized services with semantic web services in order to provide better IoT ecosystems.

The emerging blockchain technology has enabled various decentralised applications in a trustless environment without relying on a trusted intermediary. It is expected as a promising solution to tackle sophisticated challenges on personal data management, thanks to its advanced features such as immutability, decentralisation and transparency. Although certain approaches have been proposed to address technical difficulties in personal data management; most of them only provided preliminary methodological exploration. Alarmingly, when utilising Blockchain for developing a personal data management system, fictions have occurred in existing approaches and been promulgated in the literature. Such fictions are theoretically doable; however, by thoroughly breaking down consensus protocols and transaction validation processes, we clarify that such existing approaches are either impractical or highly inefficient due to the natural limitations of the blockchain and Smart Contracts technologies. This encourages us to propose a feasible solution in which such fictions are reduced by designing a novel system architecture with a blockchain-based “proof of permission” protocol. We demonstrate the feasibility and efficiency of the proposed models by implementing a clinical data sharing service built on top of a public blockchain platform. We believe that our research resolves existing ambiguity and take a step further on providing a practically feasible solution for decentralised personal data management.

Mobile crowd-sensing (MCS) has appeared as a prospective solution for large-scale data collection, leveraging built-in sensors and social applications in mobile devices that enables a variety of Internet of Things (IoT) services. However, the human involvement in MCS results in a high possibility for unintentionally contributing corrupted and falsified data or intentionally spreading disinformation for malevolent purposes, consequently undermining IoT services. Therefore, recruiting trustworthy contributors plays a crucial role in collecting high-quality data and providing a better quality of services while minimizing the vulnerabilities and risks to MCS systems. In this paper, a novel trust model called experience-reputation (E-R) is proposed for evaluating trust relationships between any two mobile device users in an MCS platform. To enable the E-R model, virtual interactions among the users are manipulated by considering an assessment of the quality of contributed data from such users. Based on these interactions, two indicators of trust called experience and reputation are calculated accordingly. By incorporating the experience and reputation trust indicators (TIs), trust relationships between the users are established, evaluated, and maintained. Based on these trust relationships, a novel trust-based recruitment scheme is carried out for selecting the most trustworthy MCS users to contribute to data sensing tasks. In order to evaluate the performance and effectiveness of the proposed trust-based mechanism as well as the E-R trust model, we deploy several recruitment schemes in an MCS testbed, which consists of both normal and malicious users. The results highlight the strength of the trust-based scheme as it delivers a better quality for MCS services while being able to detect malicious users. We believe that the trust-based user recruitment offers an effective capability for selecting trustworthy users for various MCS systems and, importantly, the proposed mechanism is practical to deploy in the real world.

In recent years, Blockchain has been expected to create a secure mechanism for exchanging not only for cryptocurrency but also for other types of assets without the need for a powerful and trusted third-party. This could enable a new era of the Internet usage called the Internet of Value (IoV) in which any types of assets such as intellectual and digital properties, equity and wealth can be digitized and transferred in an automated, secure, and convenient manner. In the IoV, Blockchain is used to guarantee security of transactions that the transactions are nearly impossible to be altered; thus it is impractical to retract once a transaction is confirmed. Therefore, to strengthen the IoV, before making any transactions it is crucial to evaluate trust between participants for reducing the risk of dealing with malicious peers. In this article, we clarify the concept of IoV and propose a trust-based IoV model including a system architecture, components and features. Then, we present a trust platform in the IoV considering two concepts, Experience and Reputation, originated from Social Networks for evaluating trust between two any peers in the IoV. The Experience and Reputation are characterized and calculated using mathematical models with analysis and simulation in the IoV environment. We believe this paper consolidates the understandings about IoV technologies and demonstrates how trust is evaluated and used to strengthen the IoV. It also opens important research directions on both IoV and trust in the future.

Trust has been exploring in the era of Internet of Things (IoT) as an extension of the traditional triad of security, privacy and reliability for offering secure, reliable and seamless communications and services. It plays a crucial role in supporting IoT entities to reduce possible risks before making decisions. However, despite a large amount of trust-related research in IoT, a prevailing trust evaluation model has been still debatable and under development. In this article, we clarify the concept of trust in the Social Internet of Things (SIoT) ecosystems and propose a comprehensive trust model called REK that incorporates third-party opinions, experience and direct observation as the three Trust Indicators. As the convergence of the IoT and social network, the SIoT enables any types of entities (physical devices, smart agents and services) to establish their own social networks based on their owners' relationships. We leverage this characteristic for inaugurating Experience and Reputation, which are originally two concepts from social networks, as the two paramount indicators for trust. The Experience and Reputation are characterized and modeled using mathematical analysis along with simulation experiments and analytical results. We believe our contributions offer better understandings of trust models and evaluation mechanisms in the SIoT environment, particularly the two Experience and Reputation models. This paper also opens important trust-related research directions in near future.

In the Internet of Thing, data is almost collected, aggregated and analyzed without human intervention by machine-to-machine communications resulting in raising serious challenges on access control. Particularly in Smart City ecosystems in which multi-modal data comes from heterogeneous sources, data owners cannot imagine how their data is used to extract sensitive information. Thus, there is a critical need for novel access control methods that minimize privacy risks while increase ability of personalized access control. Our solution is to build a trust-based usage control mechanism called TUCON that enables stakeholders to set access control policies based on their trust relationships with data consumers. In this study, we introduce two novel paradigms integrated in the Smart City shared platform: a Trust Service Platform and a Data Usage Control, then bring them together to establish the new mechanism. The conceptual model, the architecture, the formalization, and the practical development of TUCON is described in detail. We also show the roles and the interactions of TUCON components in the Smart City platform. Our contributions lie in a new trust model with a trust computation procedure based on semantic web technologies, a novel trust-based usage control conceptual model including a formalization, a practical expression and an architecture for Smart City systems. We believe this study provides better understanding on both trust and usage control in the Internet of Things and opens several important research directions in the future.

Vehicular Adhoc Networks (VANETs) have been attracted a lot of research recent years. Although VANETs are deployed in reality offering several services, the current architecture has been facing many difficulties in deployment and management because of poor connectivity, less scalability, less flexibility and less intelligence. We propose a new VANET architecture called FSDN which combines two emergent computing and network paradigm Software Defined Networking (SDN) and Fog Computing as a prospective solution. SDN-based architecture provides flexibility, scalability, programmability and global knowledge while Fog Computing offers delay-sensitive and location-awareness services which could be satisfy the demands of future VANETs scenarios. We figure out all the SDN-based VANET components as well as their functionality in the system. We also consider the system basic operations in which Fog Computing are leveraged to support surveillance services by taking into account resource manager and Fog orchestration models. The proposed architecture could resolve the main challenges in VANETs by augmenting Vehicle-to-Vehicle (V2V), Vehicle-to-Infrastructure (V2I), Vehicle-to-Base Station communications and SDN centralized control while optimizing resources utility and reducing latency by integrating Fog Computing. Two use-cases for non-safety service (data streaming) and safety service (Lane-change assistance) are also presented to illustrate the benefits of our proposed architecture.