Industrial Control Systems (ICS) form the backbone of critical infrastructure, enabling automated monitoring, and control across essential industrial sectors. However, the convergence of legacy ICS with modern networking and computing technologies has significantly broadened their cyberattack surface. Despite this growing vulnerability, many existing anomaly detection techniques depend on centralized architectures that introduce high communication overhead, delayed threat response, and elevated false positive rates, particularly when addressing rare or stealthy attacks. Furthermore, most conventional approaches are optimized for detecting system-level anomalies, often neglecting subtle intrusions that compromise individual ICS components and pose serious security risks. To overcome these limitations, we introduce a collaborative, hierarchical observability and privacy-preserving framework based on distributed Long Short-Term Memory (LSTM) architecture. Each sensor’s latent state is captured locally using dedicated LSTM model, and these embeddings are then fused through a dual optimization strategy that supports both sensor-level and system-wide anomaly detection. In contrast to traditional federated learning, our framework enables secure and privacy-preserving exchange of sensor state information across multiple ICS nodes, enhancing the system’s ability to detect coordinated and stealthy attacks. We validate the effectiveness of the proposed approach using the HAI-21.03 dataset. Experimental results demonstrate that our approach successfully identifies both fine-grained sensor anomalies and complex stealthy system-level intrusions, while minimizing communication overhead.

The increasing connectivity of modern vehicles exposes in-vehicle communication systems such as the Controller Area Network (CAN) to a range of cyber threats. Traditional CAN lacks built-in security features, making it vulnerable to spoofing, message injection, and denial-of-service (DoS) attacks. In this paper, we present CANSecure, a lightweight security framework that integrates AES-CTR encryption, HMAC-based authentication, and a rule-based intrusion detection system (IDS) tailored for resource-constrained Electronic Control Units (ECUs). The framework was evaluated using a custom-built CAN testbed with multiple Nucleo boards under various attack scenarios. Performance results of proposed scheme demonstrate 100% decryption success rates under normal conditions and effective detection of spoofing and DoS attacks, all while maintaining sub-millisecond latency averaging ( 738 μs send, 556 μs receive), suitable for real-time automotive systems. Our findings affirm the feasibility of embedding robust security mechanisms within embedded CAN networks without compromising performance.

The utilization of Advanced Metering Infrastructure (AMI) technology is for recording and billing customers for electricity consumption. This technology is vulnerable to cyber-attacks where customers under report their electricity usage, causing financial losses for electricity providers. Machine learning (ML) can be used to detect electricity theft, but it is challenging due to the absence of malicious data. To address this challenge, most of the existing works proposed specific attacks, however, these works are only effective on the proposed attacks and fail on new attacks. Some works proposed using anomaly detectors trained only on begin dataset. However, they rely on specific attacks to set classification thresholds, leading to failure in detecting zero-day attacks. Therefore, this paper proposes a one-class classification approach for electricity theft detection depending only on benign data and without assuming any attacks. First, the paper re-evaluates an existing detector that sets a reconstruction error threshold. Then, it proposes a detector combining decisions from three one-class ML models, including a one-class support vector machine (OC-SVM) trained on benign data, an OC-SVM trained on the bottleneck outputs of an autoencoder trained only on benign data, an OC-SVM trained on the mean squared errors of the reconstructed data of the autoencoder. The evaluation results confirm the superiority of the proposed detector over its individual components and the existing detectors.

Undoubtedly, Machine Learning (ML) has revolutionized many applications in recent years. A vast amount of heterogeneous data distributed globally is being used to build efficient and robust prediction models. This has led to the need for decentralized ML paradigms. Federated Learning (FL) has emerged as a decentralized ML paradigm that creates global models from multiple privately trained local datasets. Nevertheless, FL comes with some challenges, such as using a central server, leading to a single point of failure and trust issues. Blockchain-based Federated learning (BFL) has been proposed to resolve these challenges. However, due to the openness of the Blockchain system, malicious clients can access critical information, such as the number of participating clients, and launch attacks on the BFL system. This paper presents a practicable model poisoning attack on BFL systems. Several experiments are conducted with different attack scenarios and settings explored. The evaluations and results show the efficacy and impact of the model poisoning.

Crowdsourcing applications, such as Uber for ride-sharing, enable distributed problem-solving. A subset of these applications is intelligent crowd-forecasting applications, e.g., Virustotal, for malware detection. In crowd-forecasting applications, multiple agents respond with predictions about potential future event outcome(s). These responses are then combined to assess the events collaboratively and act accordingly. Unlike conventional crowdsourcing applications that only communicate information, crowd-forecasting applications need to additionally process information to achieve a collaborative assessment. Hence, they require knowledge-based systems instead of simple storage-based ones for crowdsourcing applications. Most existing crowd-forecasting systems are centralized, leading to the inherent single point of failure and inefficient collaborative assessment. This paper presents CrowdFAB,CrowdsourcedForecastingApplications usingBlockchains. We deploy a knowledge-based blockchain paradigm that transforms blockchains from simple storage to knowledge-based systems, thereby achieving crowd-forecasting requirements without centralization. In addition, we formulate a novel reputation scheme that assigns reputations to agents based on their performance. We then use this scheme when making assessments. We implement and analyze CrowdFAB in terms of overhead and security features. Further, we evaluate CrowdFAB for a collaborative malware detection use case, where multiple detectors are involved for crowd forecasting. Results demonstrate CrowdFAB's superior accuracy and other metrics performance compared to other works with the same settings.

The rapid proliferation of Unmanned Aircraft Systems (UAS) introduces new threats to national security. UAS technologies have dramatically revolutionized legitimate business operations while providing powerful weaponizing systems to malicious actors and criminals. Due to their inherited wireless capabilities, they are an easy target for cyber threats. In response to this challenge, the implementation of many Intrusion Detection Systems (IDS), which support anomaly detection on UAS, have been proposed in the past. However, such systems often require offline training with heavy processing, making them unsuitable for UAS deployment. This is pertinent for drone systems that support dynamic changes in mission operational tasks. This paper presents a novel system architecture that utilizes sensing systems capabilities available on existing IoT infrastructure for supporting rapid infield adaptive models’ training and parameters estimation services for UAS. We have devised a cluster-oriented distributed training algorithm based on LSTM with mini-batch gradient descent, with hundreds of IoT platforms per cluster collaboratively performing model parameters estimation tasks. The proposed architecture is based on deploying a multilayer system that facilitates secure dissemination of power consumption behavioral patterns for the flight sensing system between the UAS layer and the IoT layer. The model was implemented and deployed on a real IoT-enabled platform based on NXP-Kinetis K64–120 MHz. Furthermore, model training and validation were performed by applying various datasets contaminated with different percentages of malicious data. Our anomaly detection model achieved high prediction accuracy with an ROC-AUC score of 0.9332. The model maintains minimal power consumption overheads and low training time during the processing of a data batch.

Wearable devices have become common accessories used in tracking fitness data or augmenting daily smartphone usage. However, not all manufacturers of inexpensive wearable devices have done sufficient work to protect the privacy of their users. Some devices have shown vulnerabilities that allow attackers to obtain data stored on a locked device. In this paper, we examine using ASCON, a set of lightweight cryptographic algorithms, to enhance security of wearable devices by encrypting locally stored data.

Cloud computing is a computing facility which allows its clients to outsource their information on distant cloud based servers without having the pressure of maintaining it. Of several remote data storage issues, data integrity preservation problem has gained much attention of researchers all over the world. Numerous research work has been done by researchers all over the world in the field of data integrity audit in cloud computing. Proposed work is an efficient and stable data integrity verification scheme based on Schnorr signatures. In Schnorr signatures, the signature verification equation is linear and also batch verification of several blocks is possible. Most existing schemes are based on Boneh Lynn and Shacham (BLS) and RSA signature schemes. However, in contrast with existing schemes, the proposed scheme is highly efficient and safe and pays lower verification computation costs proven experimentally in this paper.

Vehicular networking systems rely on Internet Protocol to exchange information among vehicles. With the increasing number of vehicles, the communication overhead has increased significantly a nd h as b ecome m ore c ontent centric. To resolve this problem, the Named data networking-based communication model has been used. This communication is completely based upon the content rather than the location and provides better network coverage comparatively. The vehicles used for communication purposes in a network are moving in some specific p atterns, b ased o n h aving t he s ame destination, with the same speed parameters etc. These vehicles which have common interests form a platoon. This vehicular platoon helps in various fields such as safe driving, energy efficiency and road safety. This paper provides a scheme for the applicability of NDN to the vehicular platoon. Special design features are proposed for communication purposes in V-NDN-based vehicular platoons. The backbone platoon network is used for data dissemination between the vehicles on the highway. To check the efficiency of the proposed scheme, extensive simulations have been performed on the ndnSim simulator. More precisely, different scenarios have been used and analyzed their efficiency i n t erms o f d elay and throughput.

Vehicular Ad Hoc Networks (VANETs) have the potential to enable the next-generation Intelligent Transportation Systems (ITS). In ITS, data contributed by vehicles can build a spatio-temporal view of traffic statistics, which can improve road safety and reduce slow traffic and jams. To preserve drivers’ privacy, vehicles should use multiple pseudonyms instead of only one identity. However, vehicles may exploit this abundance of pseudonyms and launch Sybil attacks by pretending to be multiple vehicles. Then, these Sybil (or fake) vehicles report false data, e.g., to create fake congestion or pollute traffic management data. In this article, we propose a Sybil attack detection scheme using proofs of work and location. The idea is that each road side unit (RSU) issues a signed time-stamped tag as a proof for the vehicle’s anonymous location. Proofs sent from multiple consecutive RSUs are used to create a trajectory which is used as vehicle anonymous identity. Also, contributions from one RSU are not enough to create trajectories, rather the contributions of several RSUs are needed. By this way, attackers need to compromise an infeasible number of RSUs to create fake trajectories. Moreover, upon receiving the proof of location from an RSU, the vehicle should solve a computational puzzle by running proof of work (PoW) algorithm. Then, it should provide a valid solution (proof of work) to the next RSU before it can obtain a proof of location. Using the PoW can prevent the vehicles from creating multiple trajectories in case of low-dense RSUs. To report an event, the vehicle has to send the latest trajectory to an event manager. Then, the event manager uses a matching technique to identify the trajectories sent from Sybil vehicles. The scheme depends on the fact that the Sybil trajectories are bounded physically to one vehicle, and therefore, their trajectories should overlap. Extensive experiments and simulations demonstrate that our scheme achieves high detection rate of Sybil attacks with low false negative and acceptable communication and computation overhead.

Charging coordination is necessary for the successful integration of the Energy Storage Units (ESUs), including electric vehicles and home batteries, into the smart grid. To coordinate charging, the ESUs should send charging requests including time-to-complete-charging (TCC) and battery state-of-charge (SoC) to the charging controller (CC) for scheduling charging, but these data can reveal sensitive information on the ESUs’ owners such as their locations, when they return home and whether they are on travel. In this article, we propose centralized and decentralized privacy-preserving and collusion-resistant charging coordination schemes for ESUs. In the centralized scheme, ESUs authenticate their requests using anonymous tokens. To thwart linkability attacks where the CC uses TCC and SoC to link requests sent from the same ESU at consecutive time slots, an ESU needs to send multiple charging requests with different TCC and SoC values instead of only one request. In the decentralized scheme, charging is coordinated in a distributed way using a privacy-preserving data aggregation technique. The idea is that each ESU selects some ESUs to act as proxies, and shares a secret mask with each proxy. Then, each ESU adds a mask to its charging request and encrypts it so that by aggregating all requests, all masks are nullified and the total charging demand is known, and then it is used to compute the charging schedules. Due to using masking technique, the scheme is secure against collusion attacks. The results of extensive experiments and simulations confirm that our schemes are efficient and secure, and can preserve ESU owners’ privacy and thwart linkability attacks.

An energy-trading system is essential for the successful integration of Electric vehicles (EVs) into the smart grid. Existing systems merely focus on making optimal decisions while others depend on anonymization to achieve EVs drivers' privacy which is not enough because they can be identified from visited locations. In this paper, leveraging blockchain technology, we propose a privacy-preserving charging-station-to-vehicle (CS2V) energy trading scheme. To preserve privacy, EVs are anonymous, however, a malicious EV may abuse the anonymity to launch Sybil attacks by pretending as multiple non-exiting EVs to launch powerful attacks such as Denial of Service (DoS) by submitting multiple reservations/offers without committing to them, to prevent other EVs from charging and make the trading system unreliable. To thwart the Sybil attacks, we use a common prefix linkable anonymous authentication scheme, so that if an EV submits multiple reservations/offers at the same timeslot, the blockchain can identify such submissions. To further protect the privacy of EV drivers, we introduce an anonymous and efficient blockchain-based payment system that cannot link individual drivers to specific charging locations. Our experimental results indicate that our schemes are secure and privacy-preserving with low communication and computation overheads.

To outsource medical data to the cloud, several schemes have been recently proposed to enable search over encrypted data to preserve data owners’ privacy. However, most of the existing schemes are either inefficient as they suffer from high computation/communication overheads or they are designed only to support single-data-owner and they unfortunately do not take in consideration the multi-data-owner setting of the e-health applications. In medical applications, a user, e.g., a doctor or a Primary Care Provider (PCP), should be able to search over data of many patients. Also, the existing searchable encryption schemes do not allow the user to customize his search scope to a subset of documents related to his focus based on some search conditions. So, the user receives unrelated documents to his search focus and spends too much computation overhead to decrypt them which makes the search process inefficient. In this paper, we propose a customized searchable encryption scheme with efficient key management over medical cloud data. Each data owner, e.g, a patient, sends to the cloud server an encrypted index with each document and it contains the keywords of this document. Each doctor sends to the cloud server an encrypted trapdoor contains the keyword of the search. In a nutshell, the cloud server can compute the similarity score of the encrypted indices and the encrypted trapdoor without learning the keywords of the document and the query, and then it returns to the doctors the documents of his interest. By using customized search, doctor can limit his search scope to a subset of documents related to his interest based on some search conditions. Our formal analysis of the privacy preservation and performance evaluation indicate that our scheme is secure, expressive, and efficient compared to the literature’s existing approaches.

Ride-sharing is a service that enables drivers to share trips with riders, which leads to several benefits such as sharing the travel cost and reducing traffic congestion. However, most of the existing ride-sharing systems rely on a central trusted unit to organize the service, which makes them subject to a single point of failure and attack, and lack of transparency. A few works have investigated decentralized ride-sharing systems, but they either do not consider privacy preservation or suffer from a tradeoff between privacy protection and accuracy due to using location cloaking technique. This paper proposes a Blockchain-based ride sharing organization system with accurate matching and privacy preservation. To achieve the accurate matching, instead of representing the ride-sharing area by a single grid, it is represented by several overlapping grids so that only near drivers/riders share rides. To preserve privacy, drivers/riders encrypt their offers/requests using a lightweight cryptosystem, and the Blockchain matches the encrypted offers and requests without being able to decrypt them. Our security and privacy analysis demonstrate that our system can organize the ride-sharing service in a secure and transparent way, and also preserve the privacy of drivers and riders. To evaluate the performance of our system, we have implemented it, and our measurements indicate that our system requires low communication and computation overheads.

There are different metering systems adopted in the advanced metering infrastructure (AMI) of the smart grid. Among these systems, the net-metering is a promising system that motivates customers to install renewable resources at their premises to generate electricity and sell it to the utility. In this system, the customer’s home is equipped with one smart meter to report the net readings representing the difference between the power consumed from the power grid and the power injected into the grid. However, malicious customers may compromise their meters to report false readings to the utility to illegally achieve financial gains. This not only causes huge losses to the utility, but also deteriorates the grid performance. To the best of our knowledge, this problem has not been investigated. Therefore, in this paper, we investigate the detection of false-reading attacks in the net-metering system for the first time. Specifically, we propose four sophisticated attacks customized for the net-metering system and use them to create a dataset containing both benign and malicious samples. We have analyzed the dataset and detected time correlations between the readings within the benign samples. Based on the data analysis, we propose a general deep-learning-based detector with hybrid architecture involving convolutional neural network (CNN) and gated recurrent unit neural network (GRU). We have evaluated our detector, and the results demonstrate that the detector can detect the false-reading attacks with high precision and recall, and low false alarm.

Over the last few years, finding vacant parking spaces has become a hassle for drivers especially in crowded cities. This problem leads to wasting drivers' time, traffic congestion, and air pollution. Recently, smart parking systems aim to address this problem by enabling drivers to have real-time parking information about vacant parking spaces. However, the existing parking systems rely on a central third party to organize the service, which makes them subject to a single point of failure and privacy breach concerns by both internal and external attackers. In this paper, we propose a secure smart parking system using blockchain technology. Specifically, a consortium blockchain is made of parking lots to ensure security, transparency, and availability of the parking system. Then, to protect the drivers' location privacy, we use cloaking technique to hide the drivers' locations. The blockchain validators return available parking offers with in the cloaked area. Finally, the driver selects the best offer and makes reservation directly with the parking lot. Evaluations are conducted to evaluate the proposed scheme, and results indicate practicality of our scheme.

Purveyors of malicious network attacks continue to increase the complexity and the sophistication of their techniques, and their ability to evade detection continues to improve as well. Hence, intrusion detection systems must also evolve to meet these increasingly challenging threats. Machine learning is often used to support this needed improvement. However, training a good prediction model can require a large set of labeled training data. Such datasets are difficult to obtain because privacy concerns prevent the majority of intrusion detection agencies from sharing their sensitive data. In this paper, we propose the use of mimic learning to enable the transfer of intrusion detection knowledge through a teacher model trained on private data to a student model. This student model provides a mean of publicly sharing knowledge extracted from private data without sharing the data itself. Our results confirm that the proposed scheme can produce a student intrusion detection model that mimics the teacher model without requiring access to the original dataset.

Ride-sharing is a service that enables drivers to share their trips with other riders, contributing to improving traffic congestion as well as assist in reducing Carbon Dioxide (CO2) emission and fuel consumption. It has come to the forefront in recent years as a Green service in large cities. However, the majority of existing ride-sharing services rely on a central third party, which makes them subject to a single point of failure and privacy disclosure concerns by both internal and external attackers. Moreover, they are vulnerable to distributed denial of service (DDoS) and Sybil attacks due to malicious users. There is also high service fees paid to the ride-sharing service provider. In this paper, we propose to decentralize ride-sharing services based on a public Blockchain. Our scheme enables drivers to propose ride-sharing services without relying on a trusted third party. To preserve location privacy, riders send cloaked ride requests to hide their exact pick-up/drop-off locations, and departure/arrival dates. Then, by using an off-line matching technique, drivers sends their offers encrypted to ensure data confidentiality. Upon receiving the ride-offers, the rider can find a ride match using some heuristics as well as the bid price included in the offer. To preserve anonymity, riders/drivers use pseudonyms that change per trip to ensure unlinkabilty. We envision the application of this technology in Green Internet of Things connected smart cities, where ride sharing services are common. Finally, we implement our scheme and deploy it in a test net of Ethereum. The experimental results show the applicability of our protocol.

Recently, Autonomous Vehicles (AVs) have gained extensive attention from both academia and industry. AVs are a complex system composed of many subsystems, making them a typical target for attackers. Therefore, the firmware of the different subsystems needs to be updated to the latest version by the manufacturer to fix bugs and introduce new features, e.g., using security patches. In this paper, we propose a distributed firmware update scheme for the AVs' subsystems, leveraging blockchain and smart contract technology. A consortium blockchain made of different AVs manufacturers is used to ensure the authenticity and integrity of firmware updates. Instead of depending on centralized third parties to distribute the new updates, we enable AVs, namely distributors, to participate in the distribution process and we take advantage of their mobility to guarantee high availability and fast delivery of the updates. To incentivize AVs to distribute the updates, a reward system is established that maintains a credit reputation for each distributor account in the blockchain. A zero-knowledge proof protocol is used to exchange the update in return for a proof of distribution in a trustless environment. Moreover, we use attribute-based encryption (ABE) scheme to ensure that only authorized AVs will be able to download and use a new update. Our analysis indicates that the additional cryptography primitives and exchanged transactions do not affect the operation of the AVs network. Also, our security analysis demonstrates that our scheme is efficient and secure against different attacks.