The emergence of beyond-fifth-generation (B5G) networks and the increasing demand for Internet of Things (IoT) requires deploying a cloud-edge-terminal computing network with the Software Defined Network as the controller. However, this network is vulnerable to various threats, notably SYN flood attacks. This paper adopts queuing theory and game theory to explore Mobile Edge Computing (MEC) attack and defense interaction in different IoT businesses. Moreover, we propose a utility model of the packet flow in MEC networks featuring the delay and packet loss rate in the SYN flood attacks. For the attacker and defender’s strategy, we use game theory to model the interaction between strategy and resource allocation. A search algorithm analyzing MEC cell impact on strategy selection is developed, and we investigate the impact of the attacker’s possession of prior knowledge versus lack thereof regarding MEC cell characteristics under SYN flood attacks. The proposed game models are solved, and the results show that under the defender’s strategy, the attacker has no chance to launch SYN flood attacks under the defender’s defense cost of four times MEC computing resources; the cost of defense resources is lower than other related schemes.

Multiple base stations (multi-BS) cooperative sensing is considered a promising solution for achieving high-accuracy sensing and robust connectivity in future sixth-generation (6G) mobile communication systems. In this paper, we investigate the design of a target localization scheme for a cooperative integrated sensing and communication (ISAC) system. Specifically, our objective is to achieve high-accuracy target localization without compromising communication performance. To accomplish this, we propose a high-accuracy sensing scheme consisting of two stages. In the first stage, we develop a novel noise subspace re-projection orthogonal matching pursuit (NSR-OMP) algorithm to enable simultaneous, high-accuracy estimation of multipath parameters in a high-dimensional signal space. In the second stage, we introduce a data fusion algorithm based on the weighted average method, which effectively mitigates the impact of ill-conditioned measurements within the bistatic ranges. Finally, simulation results demonstrate that the proposed sensing scheme enhances sensing accuracy by approximately 78.9% compared to benchmark schemes, effectively validating its feasibility in practical systems.

The recent surge in large-scale Distributed Denial-of-Service (DDoS) attacks, primarily driven by Internet of Things (IoT) botnets, has drawn significant concerns. Defending against IoT botnet DDoS attacks is challenging, especially as attackers’ techniques and strategies become increasingly sophisticated. We propose a novel traffic-level differential game model from holistic and dynamic perspectives to address these challenges, integrating both the botnet formation and DDoS attack stages. Based on the actual operation mechanism of IoT botnet DDoS attacks, we extract two key attack features: 1) the incubation period of infected devices and 2) the threshold effects of DDoS attacks. Considering these, the proposed model more effectively captures the dynamic strategic behaviors of attackers and defenders. Using optimal control theory, we derive the optimal timing and frequency for attackers to activate latent devices and for defenders to restore compromised ones. Numerical simulations show the effectiveness of our defense strategy under both traditional and intelligent attack scenarios, reducing the payoff function of the attack-defense system by approximately 48% compared to static and adaptive strategies. Additionally, we examine the impact of key parameters on network security, providing valuable insights for developing effective defense strategies against botnet-driven DDoS attacks.

The proliferation of Distributed Denial-of-Service (DDoS) attacks in the Internet of Things (IoT) and the emergence of variants such as Distributed Reflection Denial-of-Service (DRDoS) attacks severely threaten the fifth-generation (5G) networks. More importantly, as attack methods continue to escalate, attackers can obtain deployed critical defense strategies through continuous probing, increasing the defense difficulty. We propose a hybrid strategy model and corresponding Software Defined Network (SDN) paradigm-based framework based on existing defense strategies to deploy it flexibly and conveniently into the 3GPP-defined 5G architecture. In addition, after quantifying the proposed hybrid strategy's defense capacity, the Stackelberg game is employed to model the hybrid strategy and solve the optimal packet sampling rate. The simulation shows that the optimal packet sampling rate is effective and robust and can force a rational attacker to give up DRDoS attacks and achieve the effect of subduing the enemy without fighting.

Network slicing is an emerging architecture that allows multiple virtual networks to be created on top of a shared physical infrastructure, each tailored to a specific type of service or application. Managing network slices using a Software Defined Network (SDN) controller makes the network more scalable and manageable but also vulnerable due to the centralized control of SDN. Low-rate denial-of-service (LDoS) is periodic and stealthy, and its attack frequency is lower than that of ordinary distributed denial-of-service attacks, making it one of the most severe threats on SDN. To cope with the above challenges, we propose a real-time Lightweight LDoS Detection and Mitigation (L2DM) framework. Moreover, an Adaptive Weight XGBoost (AW-XGBoost) algorithm is designed to extract features and obtain the detection model via adjusting adaptive weights. We also leverage the architecture of network slicing to build honeypot slices to gather information from attackers. Experimental results show that the proposed framework and corresponding algorithm can be deployed on SDN controllers to achieve LDoS attack detection and mitigation at low cost with high accuracy and effectiveness.