The rapid expansion of Internet of Things (IoT) devices has heightened the need for effective intrusion detection systems (IDS) that operate under strict resource constraints. Conventional IDS implementations require substantial computational resources, making them unsuitable for low-power microcontroller-based devices. This paper proposes a novel collaborative IDS architecture that separates centralised model training from distributed edge inference. The system employs an autoencoder-based labelling mechanism trained on regular traffic to identify anomalies. Each ESP32 device performs local inference and exchanges predictions via UDP multicast, whilst MD5 hashing ensures model consistency across the network. Collaborative verification enables devices to identify and isolate compromised nodes without central coordination. Experimental evaluation demonstrates 98.5% F-score with 3ms average inference latency and 12.7KB memory footprint, consuming only 2.4% of available SRAM. Our approach achieves superior detection accuracy compared to existing cloud-edge systems whilst operating on severely resource-constrained hardware, making it a practical solution for large-scale IoT security deployments.

Federated Learning (FL) enables model training across distributed clients while preserving data privacy, yet client limitations in restricted computational power, memory, storage, and bandwidth, pose significant challenges for FL training and execution efficiency. This paper introduces FedMapTCS, a novel hybrid method that enhances FL communication efficiency by integrating FedMap, a technique for gradually learning a sparse FL model, with time-correlated sparsification (TCS) and error accumulation. This approach allows clients to collaboratively train an increasingly sparse global model, reducing communication overhead from the start of the training by selectively transmitting only necessary parameters each round. Extensive evaluation in both independent and identically distributed (IID) and non-IID settings demonstrates that FedMapTCS reduces communication bits by over 60% compared to the FedMap baseline and over 85% compared to federated averaging (FedAvg), while maintaining comparable model performance in IID settings. Under non-IID settings, FedMapTCS achieves better accuracy with up to 3.25× fewer rounds than FedMap, and achieves similar accuracy with 24.7% fewer parameters, highlighting its adaptability to heterogeneous data while maintaining performance. This communication efficiency gain positions FedMapTCS as a promising and effective solution for resource-constrained FL environments.

The rapid growth of technology has increased interconnected large-scale systems, broadening the attack surface for malicious actors . Traditional security solutions often employ centralised management of components like firewalls and intrusion detection systems for consistent configuration. This centralisation introduces a ”single point of failure,” risking severe consequences if compromised. While redundancy can mitigate concerns in IT systems, it does not scale well for larger systems. Edge computing , which pushes computation closer to endpoint devices , has been explored to improve scalability. The research community has also explored distributing and decentralising cybersecurity operations, especially intrusion detection , using new machine learning methods that mix centralised and distributed approaches to scale effectively while preserving data privacy. However, challenges remain in implementing these methods in large-scale IoT systems due to resource constraints . This paper evaluates intrusion detection methods in large-scale, resource-limited IoT systems, exploring the benefits of low-powered devices for network security and discussing solutions to current implementation challenges.

There is an increasing demand for accurate indoor localisation that require minimal infrastructure and wide coverage. All radio technologies commonly used for localisation have trade-offs and there is no clear winner. Accurate systems such as ultra-wideband (UWB) radio, due to their short range of tens of meters, require dense deployment of beacons, incurring huge cost. Such systems out-match the 2.4GHz narrowband technologies with their 10cm accuracy against a few metres with the latter. However, long range technologies such as LoRa, while operating in the 2.4GHz band, can provide a few kilometers of range with fewer beacons in ideal conditions and are therefore cost effective whilst providing greater coverage. We argue in this paper that the desire of having the best of both worlds, i.e., long range, low infrastructure costs, and sub-meter accuracy, can be achieved using embedded machine learning, often referred to as TinyML. To this extent, we run an extensive data collection campaign for two radio technologies i.e., UWB and LoRa, and train machine learning models to improve their localization performance. We then deploy these models on the tiniest of devices powered by ARM Cortex M4 microcontrollers. To the best of our knowledge, we are the first to demonstrate that on-device machine learning can significantly improve localization accuracy. In our case, UWB and LoRa based systems have been shown to improve their localization accuracy by ~20% and ~70% respectively, through learning and essentially calibrating with a more accurate optical camera system without inheriting their weaknesses.

This paper presents LE3D; a novel data drift detection framework for preserving data integrity and confidentiality. LE3D is a generalisable platform for evaluating novel drift detection mechanisms within the Internet of Things (IoT) sensor deployments. Our framework operates in a distributed manner, preserving data privacy while still being adaptable to new sensors with minimal online reconfiguration. Our framework currently supports multiple drift estimators for time-series IoT data and can easily be extended to accommodate new data types and drift detection mechanisms. This demo will illustrate the functionality of LE3D under a real-world-like scenario.

Data integrity becomes paramount as the number of Internet of Things (ioT) sensor deployments increases. Sensor data can be altered by benign causes or malicious actions. Mechanisms that detect drifts and irregularities can prevent disruptions and data bias in the state of an IoT application. This paper presents LE3D, an ensemble framework of data drift estimators capable of detecting abnormal sensor behaviours. Working collaboratively with surrounding ioT devices, the type of drift (natural/abnormal) can also be identified and reported to the end-user. The proposed framework is a lightweight and unsupervised implementation able to run on resource-constrained IoT devices. Our framework is also generalisable, adapting to new sensor streams and environments with minimal online reconfiguration. We compare our method against state-of-the-art ensemble data drift detection frameworks, evaluating both the real-world detection accuracy as well as the resource utilisation of the implementation. Experimenting with real-world data and emulated drifts, we show the effectiveness of our method, which achieves up to 97% of detection accuracy while requiring minimal resources to run.

We apply Federated Learning (FL) to the problem of indoor localisation in a real-world multiple residential house scenario. Fingerprinting of the Received Signal Strength Indicator (RSSI) was used as the localisation method. We show that, given the minimal amount of fine-tuning allowed by constraint on the size of the gradient step in the fit round of FL, a shared model learned this way has strong performance on all houses and is stable with respect to randomness in weight initialisation. Not unexpectedly, the performance is inferior to an individual learning approach. We developed a tuned FL approach - a finetuning step in every round of FL that only affects a subset of the clients' parameters while leaving a common ‘backbone’ unchanged. The FL clients were able to accept the model weights post-tuning or revert to the weights in the previous evaluation round based on their local validation set. Through our extensive evaluation, our results indicate a significant reduction in the performance gap between a completely individual ML and a benchmark traditional FL approach.

The vast increase of Internet of Things (IoT) technologies and the ever-evolving attack vectors have increased cyber-security risks dramatically. A common approach to implementing AI-based Intrusion Detection Systems (IDSs) in distributed IoT systems is in a centralised manner. However, this approach may violate data privacy and prohibit IDS scalability. Therefore, intrusion detection solutions in IoT ecosystems need to move towards a decentralised direction. Federated Learning (FL) has attracted significant interest in recent years due to its ability to perform collaborative learning while preserving data confidentiality and locality. Nevertheless, most FL-based IDS for IoT systems are designed under unrealistic data distribution conditions. To that end, we design an experiment representative of the real-world and evaluate the performance of an FL-based IDS. For our experiments, we rely on TON-IoT, a realistic IoT network traffic dataset, associating each IP address with a single FL client. Additionally, we explore pre-training and investigate various aggregation methods to mitigate the impact of data heterogeneity. Lastly, we benchmark our approach against a centralised solution. The comparison shows that the heterogeneous nature of the data has a considerable negative impact on the model's performance when trained in a distributed manner. However, in the case of a pre-trained initial global FL model, we demonstrate a performance improvement of over 20% (F1-score) compared to a randomly initiated global model.

Although desirable, achieving a high-fidelity digital twin of buildings often requires a substantial influx of real-time data, demanding a dense network of environmental sensors. Regrettably, factors such as high hardware expenses, deployment constraints, and sensor malfunctions can impede the realization of such digital twins. In this demonstration, we introduce a pioneering approach that harnesses data-driven virtual sensing within a real-time, high-fidelity 3D digital twin of a building environment. Our innovative method provides accurate machine learning-based inference of real-time sensor variables across both two-dimensional (varying rooms) and three-dimensional (diverse elevations) domains, with limited reliance on physical sensor inputs. Thus, by extending the sensing coverage through the use of ML-driven virtual sensing, we are able to create a more accurate digital twin. Our initial results indicate a mean absolute percentage error of2, when compared against the ground truth physical sensors.

Intelligent, large-scale IoT ecosystems have become possible due to recent advancements in sensing technologies, distributed learning, and low-power inference in embedded devices. In traditional cloud-centric approaches, raw data is transmitted to a central server for training and inference purposes. On the other hand, Federated Learning migrates both tasks closer to the edge nodes and endpoints. This allows for a significant reduction in data exchange while preserving the privacy of users. Trained models, though, may under-perform in dynamic environments due to changes in the data distribution, affecting the model’s ability to infer accurately; this is referred to as concept drift. Such drift may also be adversarial in nature. Therefore, it is of paramount importance to detect such behaviours promptly. In order to simultaneously reduce communication traffic and maintain the integrity of inference models, we introduce FLARE, a novel lightweight dual-scheduler FL framework that conditionally transfers training data, and deploys models between edge and sensor endpoints based on observing the model’s training behaviour and inference statistics, respectively. We show that FLARE can significantly reduce the amount of data exchanged between edge and sensor nodes compared to fixed-interval scheduling methods (over 5x reduction), is easily scalable to larger systems, and can successfully detect concept drift reactively with at least a 16x reduction in latency.

With the ever-increasing reliance on digital networks for various aspects of modern life, ensuring their security has become a critical challenge. Intrusion Detection Systems play a crucial role in ensuring network security, actively identifying and mitigating malicious behaviours. However, the relentless advancement of cyber-threats has rendered traditional/classical approaches insufficient in addressing the sophistication and complexity of attacks. This paper proposes a novel 3-stage intrusion detection system inspired by a simplified version of the Lockheed Martin cyber kill chain to detect advanced multi-step attacks. The proposed approach consists of three models, each responsible for detecting a group of attacks with common characteristics. The detection outcome of the first two stages is used to conduct a feasibility study on the possibility of predicting attacks in the third stage. Using the ToN IoT dataset, we achieved an average of 94% F1-Score among different stages, outperforming the benchmark approaches based on Random-forest model. Finally, we comment on the feasibility of this approach to be integrated in a real-world system and propose various possible future work.

The processing and analysis of large-scale journey trajectory data is becoming increasingly important as vehicles become ever more prevalent and interconnected. Mapping these trajectories onto a road network is a complex task, largely due to the inevitable measurement error generated by GPS sensors. Past approaches have had varying degrees of success, but achieving high accuracy has come at the expense of performance, memory usage, or both.In this paper, we solve these issues by proposing a map matching algorithm based on Hidden Markov Models (HMM). The proposed method is shown to be more efficient when compared against a traditional HMM based map matching method, whilst maintaining high accuracy and eschewing any requirements for CPU-intensive and memory-expensive pre-processing. The proposed algorithm offers a method for significantly accelerating transition-probability calculations using instances of high data-availability, which have previously been a large bottleneck in map matching algorithm performance. It is shown that this can be accomplished with the application of road-network segmentation combined with a spatially-aware heuristic. Experiments are performed using two different datasets, with over 9 hours of GPS samples. We show that the proposed framework is able to offer a reduction in run-time of over 90% with no significant effect on the algorithm’s accuracy when compared against the traditional HMM approach.

In recent years, there has been considerable interest in computational offloading algorithms. The interest is mainly driven by the potential savings that offloading offers in task completion time and mobile device energy consumption. This paper builds on authors' previous work on computational offloading and describes a multi-objective optimization model that optimizes time and energy in a network with multiple Multi-Access Edge Computing servers (MECs) and Mobile Devices (MDs). Each MD has multiple computational jobs to process, and each task can be processed locally or offloaded to one of the MEC servers. Several heuristic offloading policies are proposed and tested with an objective function with a range of weightings for optimizing time and energy. The approaches are illustrated with the help of three test cases of varying complexity. The objective function shows a continuous variation as the emphasis is placed on either time or energy saving by the weighting factors. The numerical tests demonstrate that the proposed heuristic algorithms produce near-optimal computational offloading solutions while considering a combined weighted score for schedule task completion time and energy.

Edge computing is rapidly changing the IoT-Cloud landscape. Various testbeds are now able to run multiple Docker-like containers developed and deployed by end-users on edge devices. However, this capability may allow an attacker to deploy a malicious container on the host and compromise it. This paper presents a dataset based on the Linux Auditing System, which contains malicious and benign container activity. We developed two malicious scenarios, a denial of service and a privilege escalation attack, where an adversary uses a container to compromise the edge device. Furthermore, we deployed benign user containers to run in parallel with the malicious containers. Container activity can be captured through the host system via system calls. Our time series auditd dataset contains partial labels for the benign and malicious related system calls. Generating the dataset is largely automated using a provided AutoCES framework. We also present a semi-supervised machine learning use case with the collected data to demonstrate its utility. The dataset and framework code are open-source and publicly available.

Human activity recognition is progressing from automatically determining what a person is doing and when, to additionally analyzing the quality of these activities—typically referred to as skill assessment. In this chapter, we propose a new framework for skill assessment that generalizes across application domains and can be deployed for near-real-time applications. It is based on the notion of repeatability of activities defining skill. The analysis is based on two subsequent classification steps that analyze (1) movements or activities and (2) their qualities, that is, the actual skills of a human performing them. The first classifier is trained in either a supervised or unsupervised manner and provides confidence scores, which are then used for assessing skills. We evaluate the proposed method in two scenarios: gymnastics and surgical skill training of medical students. We demonstrate both the overall effectiveness and efficiency of the generalized assessment method, especially compared to previous work.

Automated mood recognition has been studied in recent times with great emphasis on stress in particular. Other affective states are also of great importance, as studying them can help in understanding human behaviours in more detail. Most of the studies conducted in the realisation of an automated system that is capable of recognising human moods have established that mood is personal—that is, mood perception differs amongst individuals. Previous machine learning--based frameworks confirm this hypothesis, with personalised models almost always outperforming the generalised methods. In this article, we propose a novel system for grouping individuals in what we refer to as “perception clusters” based on their physiological signals. We evaluate perception clusters with a trial of nine users in a work environment, recording physiological and activity data for at least 10 days. Our results reveal no significant difference in performance with respect to a personalised approach and that our method performs equally better against traditional generalised methods. Such an approach significantly reduces computational requirements that are otherwise necessary for personalised approaches requiring individual models developed separately for each user. Further, perception clusters manifest a direction towards semi-supervised affective modelling in which individual perceptions are inferred from the data.

This paper studies the indoor localisation of WiFi devices based on a commodity chipset and standard channel sounding. First, we present a novel shallow neural network (SNN) in which features are extracted from the channel state information (CSI) corresponding to WiFi subcarriers received on different antennas and used to train the model. The single-layer architecture of this localisation neural network makes it lightweight and easy-to-deploy on devices with stringent constraints on computational resources. We further investigate for localisation the use of deep learning models and design novel architectures for convolutional neural network (CNN) and long-short term memory (LSTM). We extensively evaluate these localisation algorithms for continuous tracking in indoor environments. Experimental results prove that even an SNN model, after a careful handcrafted feature extraction, can achieve accurate localisation. Meanwhile, using a well-organised architecture, the neural network models can be trained directly with raw data from the CSI and localisation features can be automatically extracted to achieve accurate position estimates. We also found that the performance of neural network-based methods are directly affected by the number of anchor access points (APs) regardless of their structure. With three APs, all neural network models proposed in this paper can obtain localisation accuracy of around 0.5 metres. In addition the proposed deep NN architecture reduces the data pre-processing time by 6.5 hours compared with a shallow NN using the data collected in our testbed. In the deployment phase, the inference time is also significantly reduced to 0.1 ms per sample. We also demonstrate the generalisation capability of the proposed method by evaluating models using different target movement characteristics to the ones in which they were trained.

Computational offloading is a strategy by which mobile device (MD) users can access the superior processing power of a Multi-Access Edge Computing (MEC) server network. In this paper, we contribute a model of a system that consists of multiple MEC servers and multiple MD users. Each MD has multiple computational tasks to perform, and each task can either be computed locally on the MD, or it can be offloaded to one of the MEC servers. For this system and having global knowledge, we compute the theoretical optimal allocation that minimises the time required to complete the computation of all tasks. Subsequently, we contribute a distributed heuristic algorithm that allows each MD to independently, and using local knowledge only, decide how to handle each individual job. Furthermore, we propose three approaches to decide whether to offload each individual job, and three mechanisms to determine which MEC server each task should be offloaded to. We use simulations to evaluate those approaches in terms of how well they can approximate the theoretical optimum. The proposed heuristic algorithm is tested on a range of experiments, and the results demonstrate that the heuristic algorithm can produce reasonable quality solutions.

High accuracy localisation technologies exist but are prohibitively expensive to deploy for large indoor spaces such as warehouses, factories, and supermarkets to track assets and people. However, these technologies can be used to lend their highly accurate localisation capabilities to low-cost, commodity, and less-accurate technologies. In this paper, we bridge this link by proposing a technology-agnostic calibration framework based on artificial intelligence to assist such low-cost technologies through highly accurate localisation systems. A single-layer neural network is used to calibrate a less accurate technology using a more accurate one such as Bluetooth Low Energy (BLE) using Ultra-Wideband (UWB) and UWB using a professional motion tracking system. On a real indoor testbed, we demonstrate an improvement in accuracy of approximately 70% for BLE and 50% for UWB. Not only does the proposed approach require a very short measurement campaign, the low complexity of a single-layer neural network makes it ideal for deployment on constrained devices typically used for localisation purposes.

When a person is performing daily activities (e.g. walking) in the context of a WBAN application, the channel quality between the worn sensor devices and the hub can vary due to the switching of Line-Of-Sight (LOS) and None-Line-Of-Sight (NLOS) statuses among the sender and the receiver. Therefore, motion aware wireless MAC protocols are designed in order to enhance communication reliability and to avoid wasting energy on unnecessary wireless re-transmissions during most of the NLOS communications. Despite its importance, the prerequisite step of accurate and energy efficient motion detection remains as an assumption in most of the existing motion aware WBAN protocols. Hence in this paper, we propose an optimized real-time gesture detection method and implement it in a motion aware WBAN communication protocol. Wireless communications only take place when the channel condition is good, while data is buffered otherwise. It is lightweight and tailored to perform fast with accurate detection that suits embedded devices with limited memory size and relatively low MCU processing speeds. Experiments are conducted using both simulation and real-life hardware devices with 6 volunteers. The proposed motion detection method showed 99.28% off-line accuracy and 92.5% online accuracy, respectively. Thanks to which, the communication results yielded a promising 82% improvement in packet drop reduction and 32.8% improvement in energy efficiency compared to conventional methods.

The LoRaWAN based Low Power Wide Area networks aim to provide long-range connectivity to a large number of devices by exploiting limited radio resources. The Adaptive Data Rate (ADR) mechanism controls the assignment of these resources to individual end-devices by a runtime adaptation of their communication parameters when the quality of links inevitably changes over time. This paper provides a detailed performance analysis of the ADR technique presented in the recently released LoRaWan Specifications (v1.1). We show that the ADR technique lacks the agility to adapt to the changing link conditions, requiring a number of hours to days to converge to a reliable and energy-efficient communication state. As a vital step towards improving this situation, we then change different control knobs or parameters in the ADR technique to observe their effects on the convergence time.

We propose a new approach towards RSS (Received Signal Strength) based wireless localisation for scenarios where, instead of absolute positioning of an object, only the information whether an object is inside or outside of a specific area is required. This is motivated through a number of applications including, but not limited to, a) security: detecting whether an object is removed from a secure location, b) wireless sensor networks: detecting sensor movements outside of a network area, and c) computational behaviour analytics: detecting customers leaving a retail store. The result of such detection systems can naturally be utilised in building a higher level contextual understanding of a system or user behaviours. We use a supervised learning method to overcome issues related to RSS based localisation systems including multipath fading, shadowing, and incorrect model parameters (as in unsupervised methods). Moreover, to reduce the cost of collecting training data, we employ a detection method called One- Class SVM (OC-SVM) which requires only one class of data (positive data, or target class data) for training. We derive a mathematical approximation of accuracy which utilises the characteristics of wireless signals as well as OC-SVM. Based on this we then propose a novel mathematical formula to find optimal placement of devices. This enables us to optimize the placement without performing any costly experiments or simulations. We validate our proposed mathematical framework based on simulated and real experiments.

Recent studies show that a key contributor to congestion and increased CO2 emissions within cities are drivers searching (or cruising) to find a vacant on-street parking space. It has been shown that approximately (depending on the city) 20-30% of vehicles in congested urban areas were cruising to find a parking space with a parking search time varying in the order of several minutes. In the city of Bristol alone, we have shown, using our collected trip and publicly available census data that over 790 metric tons of CO2 is generated every year due to cruising. At a total cost of £368, 000 (US$467, 000) in terms of fuel wasted. The solution, described in this paper, aims to reduce parking search times using our automated real-time parking system called ParkUs 2.0. Our proposed method leverages sensor and location data collected from smartphones (carried by drivers), uses machine learning (classification) to detect cruising behaviour, automatically annotates parking availability on road segments based on the classified data and displays this information as a heatmap of parking availability information on the user's smartphone. This is the first such attempt to automatically detect cruising to the best of our knowledge. Evaluation through controlled trials with volunteer participants highlights the potential of our novel approach as we are able to detect cruising with an accuracy of 81%.

The next generation of human activity recognition applications in ubiquitous computing scenarios focuses on assessing the quality of activities, which goes beyond mere identification of activities of interest. Objective quality assessments are often difficult to achieve, hard to quantify, and typically require domain specific background information that bias the overall judgement and limit generalisation. In this paper we propose a framework for skill assessment in activity recognition that enables automatic quality analysis of human activities. Our approach is based on a hierarchical rule induction technique that effectively abstracts from noise-prone activity data and assesses activity data at different temporal contexts. Our approach requires minimal domain specific knowledge about the activities of interest, which makes it largely generalisable. By means of an extensive case study we demonstrate the effectiveness of the proposed framework in the context of dexterity training of 15 medical students engaging in 50 attempts of surgical activities.

We propose four variants of a novel hierarchical hidden Markov models strategy for rule induction in the context of automated sports video annotation including a multilevel Chinese takeaway process (MLCTP) based on the Chinese restaurant process and a novel Cartesian product label-based hierarchical bottom-up clustering (CLHBC) method that employs prior information contained within label structures. Our results show significant improvement by comparison against the flat Markov model: optimal performance is obtained using a hybrid method, which combines the MLCTP generated hierarchical topological structures with CLHBC generated event labels. We also show that the methods proposed are generalizable to other rule-based environments including human driving behavior and human actions.

A key prerequisite of automatic video indexing and summarisation is the description of events and actions. In the context of many sports, the motion of the ball and agents plays an essential role in describing events. However, the only existing solution for the tennis event recognition problem in the literature is the work in which relies on a set of heuristic rules such as proximity between ball and players or court lines to classify ball event candidates. We present hidden Markov models (HMMs) paradigm to automatically learn to identify events from ball trajectories and demonstrate that its ability to capture the dynamics of the ball movement lead to a much higher performance.

Anomaly detection has received much attention within the literature as a means of determining, in an unsupervised manner, whether a learning domain has changed in a fundamental way. This may require continuous adaptive learning to be abandoned and a new learning process initiated in the new domain. A related problem is that of anomaly rectification; the adaptation of the existing learning mechanism to the change of domain. As a concrete instantiation of this notion, the current paper investigates a novel lattice-based HMM induction strategy for arbitrary court-game environments. We test (in real and simulated domains) the ability of the method to adapt to a change of rule structures going from tennis singles to tennis doubles. Our long term aim is to build a generic system for transferring game-rule inferences.