The rise of the Internet of Things (IoT) has led to the integration of various devices into smart homes, significantly increasing the complexity and vulnerability of home networks. Consequent network performance issues often lead to complaints directed at Broadband Service Providers (BSPs), which may arise from either legitimate usage or malicious cyber attacks. BSPs, however, lack visibility into client-side networks, which is partly due to privacy concerns. This makes it hard to identify the true cause of performance problems. While previous research has tackled these challenges using Machine Learning (ML) techniques, few studies have approached the problem from the perspective of BSPs. They need a solution that is scalable, accurate, and privacy-preserving. Existing centralized ML models fail to generalize across these heterogeneous environments and provide low accuracy. We address this gap by introducing a novel Federated Learning (FL) framework for smart home device classification and attack detection. The proposed approach offers a privacy-preserving, scalable framework that can achieve accuracies of more than 80%. This framework can be installed inside the existing resource-constrained home gateways, making it suitable for large-scale deployment by BSPs.

Smart homes are increasingly vulnerable to cyberattacks that lead to network instability, causing homeowners to lodge complaints with their Broadband Service Providers (BSPs). Therefore, effective and timely detection of cyberattacks is crucial for both customers and BSPs. Address Resolution Protocol (ARP) spoofing is one of the most common attacks that can facilitate larger and more severe follow-up attacks. Unfortunately, there are currently no methods that can effectively detect and mitigate ARP spoofing in smart homes from a BSP’s perspective. Current Machine Learning (ML)-based methods often rely on a single dataset from a controlled lab environment designed to mimic a single home, assuming that the results will generalize to all smart homes. Our findings indicate that this assumption is flawed. They are also unsuitable for smart homes from a BSP’s perspective, as they require custom applications, introduce additional overhead, and often rely on the injection of probing traffic into the network. To address these issues, we developed an algorithm that can detect ARP spoofing in smart home networks, regardless of the network structure or connected devices. It uses a cross-protocol strategy by correlating ARP packets with Dynamic Host Configuration Protocol (DHCP) messages to validate address bindings. We evaluated our method using four public datasets and two real-world testbeds, achieving 100% detection accuracy in all scenarios. In addition, the algorithm requires only little computational overhead, confirming its suitability for use by BSPs to detect and mitigate ARP spoofing attacks in smart homes.

The Social Internet of Things (SIoT) enables cross-organisational collaboration for various industrial applications. However, evaluating trust models within such environments remains challenging due to context-dependent dynamics in SIoT environments. Existing evaluation platforms often rely on overly domain-specific or generic datasets, overlooking the inherent uncertainty and dynamicity of real-world SIoT settings. Additionally, there is a lack of practical platforms to assess the feasibility and effectiveness of trust models across diverse scenarios. In this study, we present the Realistic Trust Model Evaluation Platform for the Social Internet of Things (REACT-SIoT) to rigorously assess trust models in SIoT environments, thereby facilitating trustworthy collaboration for sustainable IoT transformations. REACT-SIoT addresses 21 identified requirements essential for simulating a realistic SIoT environment, including categories of heterogeneity, dynamicity, incompleteness, uncertainty, interdependency, and authentic real-world dynamics. We developed a configurable evaluation procedure that mitigates dataset bias and supports the assessment of both existing and newly developed trust models under various scenario-dependent settings. A real-world example demonstrates the platform’s capability to satisfy these requirements effectively. Our analysis reveals that REACT-SIoT meets all defined requirements and outperforms existing evaluation environments based on accuracy, trust convergence, and robustness criteria. The platform has been successfully applied to existing trust models, showcasing its applicability and enabling comparative assessments that were previously constrained by disparate evaluation settings and datasets. In conclusion, REACT-SIoT offers a highly- adaptable evaluation framework that ensures unbiased and comprehensive trust model assessments in SIoT environments. This platform bridges a critical gap in trust evaluation research, enabling the comparison and validation of trust models across diverse, realistic scenarios, thereby supporting the development of more resilient and trustworthy collaborative SIoT systems. • Definition of a realistic Social Internet of Things (SIoT) environment for trust evaluation. • Proposed a trust model evaluation platform that implements a realistic SIoT environment. • Proposed a Canberra Transportation Case Study as a concrete instance to evaluation trust models. • Comprehensive evaluation of trust models in the context of the Canberra Transportation Case Study.

Software-defined wireless networking (SDWN) offers new methods for managing wireless and heterogeneous systems, but equally poses new security challenges. Here, we investigate how the emerging paradigm of trust may be able to address security challenges in the SDWN data plane through trust management and trust-based routing. This paper presents a Proof-of-Concept (PoC) trust management system for securely managing heterogeneous software-defined networks, with a supporting threat model and trust framework. Evaluation demonstrates that the essential capabilities of a trust-based routing model are functional in our PoC, and also points to opportunities for future research.

Until today, Physical Layer Security (PLS) has been a concept from information theory without practical implementations. We here describe a demonstration of how PLS can be achieved with common off-the-shelf WiFi equipment and open-source software. The key principle is that we make intelligent use of the architecture of a wireless network instead of trying to control every link individually on the physical layer.

We investigated if independent wireless operators can effectively collaborate using Software-Defined Wireless Networking (SDWN) to achieve secret wireless communications and optimize useful throughput under the condition of Physical-Layer Security enabled secrecy in heavily contended spectrum. We studied this on the level of useful throughput, in addition to Signal-to-Interference-plus-Noise Ratio. The investigation was carried out by means of a series of discrete event simulations of a realistic Wi-Fi network deployment. We found that the difference between the user throughputs of the legitimate station and the eavesdropper could be a reasonably good proxy for secrecy capacity and conclude that SDWN controllers should ideally optimize the network based on empirical feedback from the system and active learning mechanisms, rather than on hard-programmed pre-calculated network models.

IEEE Time-Sensitive Networking (TSN) Task Group has standardized enhancements for Ethernet networks to ensure high reliability, deterministic latency and minimal jitter for time-critical traffic. However, TSN capabilities have not yet been extended to wireless standards. We discuss the inherent characteristics of wireless communications that currently limit TSN performance. We argue for the development of a framework for an integrated wired and wireless TSN using Software-Defined Wireless Networking (SDWN) to address this gap. Our approach focuses on addressing the mobility of wireless stations by dynamically adjusting the wireless channel bandwidth through SDWN. This adaptive approach takes into account the proximity of wireless stations to the access point and configures the wireless channel bandwidth to meet the stringent latency requirements of time-sensitive wireless applications. In this paper, we sketch a general architecture for the framework. Furthermore, we present the development of a TSN-enabled network emulator testbed, leveraging a suite of open-source tools including Mininet, Mininet-WiFi, a modified version of Open Virtual Switch (OVS), Linux TAPRIO, RYU SDN controller, and SDWN controller. Our experimental evaluation demonstrates an average one-way latency of approximately 14 μs, achieved through the utilization of a modified version of the OVS software switch.

Physical Layer Security (PLS) is widely recognized as a promising approach to secure wireless communications through the exploitation of the physical properties of the wireless channel. However, until today, PLS has mostly been a concept from information theory without practical implementations. In this paper, we present an actual implementation of PLS in a wireless network. We achieved this by leveraging the flexibility and control granularity offered by the relatively new concept of spectrum programming, by which we were able to control and degrade the quality of the eavesdropper’s channel by virtually manipulating the connectivity of the legitimate station. The key feature of our design is that we make intelligent use of the architecture of a wireless network instead of trying to control every link individually on the physical layer. The PLS implementation is built using off-the-shelf hardware and open-source software which makes it cost-effective and easy to replicate.

The broadcasting nature of the wireless medium makes exposure to eavesdroppers a potential threat. Physical Layer Security (PLS) has been widely recognized as a promising security measure complementary to encryption. It has recently been demonstrated that PLS can be implemented using off-the-shelf equipment by spectrum-programming enhanced Software-Defined Networking (SDN), where a network controller is able to execute intelligent access point (AP) selection algorithms such that PLS can be achieved and secrecy capacity optimized. In this paper we provide a basic system model for such implementations. We also introduce a novel secrecy capacity optimization algorithm, in which we combine intelligent AP selection with the addition of Friendly Jamming (FJ) by the not-selected AP.

The Internet of Things (IoT) is reshaping our connected world as the number of lightweight devices connected to the Internet is rapidly growing. Therefore, high-quality research on intrusion detection in the IoT domain is essential. To this end, network intrusion data sets are fundamental, as many attack detection strategies have to be trained and evaluated using such data sets. In this article, we introduce the description, statistical analysis, and machine learning evaluation of the novel ToN_IoT data set. A comparison to other recent IoT data sets shows the importance of heterogeneity within these data sets, and how differences between data sets may have a huge impact on detection performance. In a cross-training experiment, we show that the inclusion of different data collection methods and a large diversity of the monitored features are of crucial importance for IoT network intrusion data sets to be useful for the industry. We also explain that the practical application of IoT data sets in operational environments requires the standardization of feature descriptions and cyberattack classes. This can only be achieved with a joint effort from the research community.

Packet injection attacks are a primary threat to software-defined enterprise networks, for which continuous connectivity and real-time network functioning are two essential requirements. They are a form of denial-of-service attacks, and their main effect is network performance degradation up to total breakdown. In this paper, we show how such an attack can effectively be detected and mitigated at the entrance gateway switch of the software-defined enterprise network without sacrificing the basic functionality and performance of the networks control mechanisms. We describe an effective protection of the network’s core controller as well as a significant reduction of rule-space overhead compared to a state-of-the-art technique.

Cyber-physical systems rely more and more on wireless technologies that operate in unmanaged, unlicensed frequency bands. Already today, this leads to security issues and a significant degradation of network performance due to interference and traffic congestion. Only collaboration between stakeholders leads to a sustainable solution. To facilitate collaboration, we designed a platform that heavily relies on the concept of Software-Defined Networking, introducing a central controller for programmable radio parameters. Part of this solution is a Brokering Platform that automates negotiation for spectral resources between access point (AP) operators. In this article we present a novel architecture for a Brokering Platform. We also propose secure distribution of Brokering Platform functionality over the APs using blockchain.

Much value in a brownfield Industrial Internet of Things (IIoT) implementation resides at its edge tier, where new types of devices and technologies are deployed to interoperate the legacy industrial control systems with servers and systems in the cloud, and leverage the benefits of the Internet of Things technologies. One of these novel devices is the IIoT edge gateway, which is used to connect critical physical systems with the cyber world, and to provide consistent storage, processing, and analytical and controlling capabilities. However, these devices also come with new and advanced threats such as targeted ransomware. In this paper, we investigate this threat in detail. We studied the threat actors' motivations, the anatomy of ransomware for edge gateways, and the likelihood of such ransomware attack to happen in the future. We found that threat actors find IIoT edge gateways attractive ransomware targets due to their vital roles and functionalities in working with critical infrastructure and that the likelihood of such attack to occur is high. We built the first version of a ransomware security testbed for IIoT, and for test purposes, we developed a first version of ransomware target at IIoT edge gateway in a brownfield system. From our measurements we conclude that kernel-related activity parameters are significant indicators of the abnormal behavior caused by crypto-ransomware attacks in IIoT edge gateways, much more so even than for similar attacks in information technology server workstation. Thereby, some potential countermeasures for addressing targeted ransomware in IIoT systems are recommended as proactive strategies for dealing with attackers' new techniques and tactics.

About two thirds of the energy consumed in buildings originates household appliances. Nowadays, appliances are often intelligent and networked devices that form complete energy consuming, producing, and managing systems. Reducing energy is therefore a matter of managing and optimizing the energy utilization on a system level. These systems need standardized interfaces on a sensor and device level to enable further extensions. Many of the required standards already exist, but a common architecture does not, resulting in a market which is too fragmented and powerless. We are therefore designing a reference ontology for these appliances, and in this paper we present our initial results. We have identified 48 different semantic assets that describe various properties of smart appliances in residential environments. After translating 19 of these assets into Web Ontology Language (OWL), we identified 20 recurring concepts that will be the initial building blocks of the reference ontology.

Current efforts in extending the Internet are focused on achieving full support of services and user-centric content from sectors such as energy management, education, and e-health. Until recently, these sectors typically developed their own communication infrastructure and systems, leading to point solutions, often built on non-IP technologies. We describe a demonstrator that shows how a non-IP supporting Continua-certified health device, such as a weighing scale, can be unlocked for use by other devices and services in the home by applying Universal Plug and Play (UPnP), and how this enables new use cases and business models.

Service providers are demanding the development of novel diagnostic tools with which they can remotely troubleshoot the home network. One of the tools should be able to gather information about the topology of the home network. In this paper we propose a set of key performance indicators for home network topology discovery architectures, and how they should be measured. We apply them to the Link-Layer Topology Discovery (LLTD) protocol and the Link-Layer Discovery Protocol (LLDP), and show that these protocols do not fulfill all the requirements as formulated by the service providers.

Prioritization of flows in a home network based on traffic classification is still no guarantee that enough bandwidth will be available between a server and a client. Besides, such QoS technologies need to be supported by every device in the end-to-end path to be effective, which is relatively expensive for the owners of home networks. In any small-scale IP network (best-effort or QoS-enabled) it is therefore preferable to diagnose the network in real time, before admitting a new flow. In this paper we demonstrate a new method to probe the available bandwidth between a server and a client in an IP-based home network. The tool works with existing end-user devices, is non-intrusive, has a short measurement time, does not require pre-knowledge of the link layer network topology, and is accurate enough to make decisions about the admission of high-throughput high-quality streams such as for IPTV services.

Current QoS solutions for home networks are inspired by Internet technologies and typically based on traffic classification and prioritization. They are not well adopted because they need to be supported by every device in the end-to-end path to be effective. Besides, their use still does not guarantee that enough bandwidth will be available between a server and a client. It is therefore preferable to diagnose a home network in real time before admitting a new flow. We demonstrate a new method which probes the end-to-end path capacity as well as the available bandwidth in a small-scale IP network. Its distinguishing features are the applicability to networks consisting of legacy devices and any mixture of wired, wireless, and no-new-wires links, in combination with fast convergence, high accuracy, and non-intrusiveness.

We develop a performance model for the availability of a MobileTV service in a caching hierarchy network. The probability that bandwidth for the service is available is calculated as a function of channel popularity, the number of available channels, cache sizes, network configuration, and content viewing behavior. The system performance and the key factors that affect the performance are analyzed.

Current QoS solutions for IP networks are usually based on traffic classification and need to be supported by every device in the end-to-end path to be effective. This is relatively expensive for home networks. Alternative techniques have been proposed that require end-user services to pragmatically adapt their properties to the actual condition of the network. For this, the condition of the network needs to be known in real time. In this article we demonstrate a new method to probe the path capacity between a server and a client in a home network or any other best-effort small-scale IP network. The tool requires adaptation of the server side only, is non-intrusive, has a short measurement time, does not require pre-knowledge of the link-layer network topology, and is accurate enough to make educated predictions about the admission of IPTV services and the like.

End-to-end broadband service delivery requires remote management of devices in the home network, beyond the home gateway (HG). The service provider can only put limited requirements to these of-the-shelf devices, and therefore has to make intelligent use of their given control and management protocols. The authors propose architectures for the unique remote discovery and management of such devices in a highly heterogeneous home network. We suggest to have the HG discovering these devices and to proxy management and control actions to the provider's remote servers. This approach has been recently adopted by the Home Gateway Initiative. A proof-of- concept is described for the remote management of UPnP devices in the home with a simple TR-069/UPnP proxy on the HG, but the architecture is basically generic for any combination of Web-services like protocols.

End-to-end broadband service delivery requires remote management of devices in the home network, beyond the home gateway (HG). The service provider can only put limited requirements to these of-the-shelf devices, and therefore has to make intelligent use of their given control and management protocols. We developed a demonstrator for the remote management of Universal Plug and Play (UPnP) devices in the home with a simple TR-069/UPnP proxy on the HG. It shows how UPnP devices can be discovered, configured, controlled and monitored with a legacy TR-069 auto-configuration server.

Near Field Communication (NFC) enables fast interactive mobile services as it allows two mobile devices to quickly and securely exchange information when they are within touching range. However, NFC-enabled phones are virtually absent on the market today, which impedes the break-through of these useful services. This paper presents the Mobile Touch Technology, which utilizes the mobile phone's microphone plus its connectivity capabilities to effectively emulate NFC with mobile phones that are already widely available on the market.

Current service discovery protocols (SDP) hardly provide information on the actual availability of resources in the network or a mechanism for (device) resource reservation. When the resources cannot serve all multiple client requests at the same time, conflicts happen, often involving heavy and frequent reconfiguration traffic. This paper presents a generic resource reservation scheme. Its properties are derived from common SDP operations. We built a prototype, measured the extra overhead such a reservation manager introduces and simulated the gain in network scalability. The main conclusion is that our solution improves the scalability and the sustainability of the service access significantly, and at a minor cost.

The current service- and device discovery protocols are not platform- and network independent Therefore, proxy servers will be needed to extend the range of IP-based discovery protocols to non-IP domains. We developed an architecture of a proxy that enables UPnP devices and services to be discovered on the Bluetooth network and vice versa, and allows Bluetooth devices and UPnP control points to access and utilize services located on devices in the other network. We managed to keep all functionality needed for effective proxying running on a single device, e.g. the mobile phone or the Residential Gateway. © 2007 IEEE.

By developing demonstrators and performing small-scale user trials, we found various opportunities and pitfalls for deploying personal networks (PNs) on a commercial basis. The demonstrators were created using as many as possible legacy devices and proven technologies. They deal with applications in the health sector, home services, tourism, and the transportation sector. This paper describes the various architectures and our experiences with the end users and the technology. We conclude that context awareness, service discovery, and content management are very important in PNs and that a personal network provider role is necessary to realize these functions under the assumptions we made. The PNPay Travel demonstrator suggests that PN service platforms provide an opportunity to develop true trans-sector services.

A Personal Network (PN) is created when the various private networks of a single user are always seamlessly interconnected, despite the mobility of the user. To realize this vision we have designed an architecture of a simple, concrete example of such a PN. It consists of just a home network and a Personal Area Network (PAN), which are interconnected directly or via an intermediate public network. From a set of requirements deduced from a typical usage scenario we conclude that Bluetooth as a PAN technology is not sufficient to extend the PAN to a PN. HiperLAN/2 can add the desired extra functionality. Furthermore, UPnP and MobileIP should be used as middleware for autoconfiguration, service discovery and mobility management. Proper functioning of UPnP can only be guaranteed if tunnels are used between the PAN and the home network. User-friendly operation then requires an Automatic Tunnel Setup Protocol to be developed. © 2006 IEEE.

Personal networks (PNs) enable users to be connected with their devices and services at any time and any place. Context-awareness will further enrich PNs. This paper shows some examples, presents definitions of context and context-awareness for PNs, and introduces a high-level architecture for context-awareness that is tailored to PNs

A new OSI (Open Systems Interconnection)-based model is described that can be used for the classification of residential gateways (RG). It is applied to analyze current gateway solutions and to draw evolutionary paths for the mid-to-long term. It is concluded that set-top boxes and broadband modems especially, in contrast to game consoles and PCs, have a strong potential to evolve towards gateways that deliver network services to the home on all OSI layers, though they will probably not converge. In the context of our model, we have not found any compelling reasons for the residential gateway industry to support concurrent multiple broadband access network connections on a single RG in the near future.