The security of emerging 6G small-cell networks increasingly depends on intelligent deception mechanisms, where honeypots serve as proactive defence components. However, conventional honeypots lack semantic and behavioural realism and often risk leaking sensitive data when emulating complex network states. Existing systems remain limited by static personas, weak sanitisation, and unexplainable reactions, making them ineffective against adaptive attackers. To address this challenge, we propose TwinPot-Gen, a digital-twin-assisted honeypot framework that integrates semantic communication , graph-based knowledge modelling, and generative AI to achieve realistic and privacy-preserving deception. The framework establishes two isolated domains-the Digital-Twin Network and the Honeypot Network-connected through two secure gateways: the Generative Knowledge Gateway (GKG) and the Defence-Orchestration Gateway (DOG). GKG performs semantic sanitisation and persona generation using a large language model, while DOG enforces adaptive, policy-driven responses. Experimental results on a Kubernetes-based 6G testbed show that TwinPot-Gen improves persona realism by 35-50%, achieves a 0.94 F1-score in attack detection, and maintains sub-100 ms orchestration latency, confirming its efficiency and trustworthiness in dynamic 6G environments.

Digital twin (DT) technology is rapidly becoming essential for smart city ecosystems, enabling real-time synchronisation and autonomous decision-making across physical and digital domains. However, as DTs take active roles in control loops, securely binding them to their physical counterparts in dynamic and adversarial environments remains a significant challenge. Existing authentication solutions either rely on static trust models, require centralised authorities, or fail to provide live and verifiable physical-digital binding, making them unsuitable for latency-sensitive and distributed deployments. To address this gap, we introduce PRZK-Bind, a lightweight and decentralised authentication protocol that combines Schnorr-based zero-knowledge proofs with elliptic curve cryptography to establish secure, real-time correspondence between physical entities and DTs without relying on pre-shared secrets. Simulation results show that PRZK-Bind significantly improves performance, offering up to 4.5 times lower latency and 4 times reduced energy consumption compared to cryptography-heavy baselines, while maintaining false acceptance rates more than 10 times lower. These findings highlight its suitability for future smart city deployments requiring efficient, resilient, and trustworthy DT authentication.

Wireless networks are vulnerable to jamming attacks due to the shared communication medium, which can severely degrade performance and disrupt services. Despite extensive research, current jamming detection methods often rely on simulated data or proprietary over-the-air datasets with limited cross-layer features, failing to accurately represent the real state of a network and thus limiting their effectiveness in real-world scenarios. To address these challenges, we introduce JamShield, a dynamic jamming detection system trained on our own collected over-the-air and publicly available dataset. It utilizes hybrid feature selection to prioritize relevant features for accurate and efficient detection. Additionally, it includes an autoclassification module that dynamically adjusts the classification algorithm in real-time based on current network conditions. Our experimental results demonstrate significant improvements in detection rate, precision, and recall, along with reduced false alarms and misdetections compared to state-of-the-art detection algorithms, making JamShield a robust and reliable solution for detecting jamming attacks in real-world wireless networks.

With the development of software-defined edge networks, network management has become more flexible and realtime. However, this advancement has also led to critical security concerns, especially when detecting attacks efficiently in resourceconstraint environments. Existing solutions often suffer from high computational load, making them unsuitable for the fast, dynamic environments of resource-constrained edge environments. To tackle this issue, we introduce a lightweight attack detection system that combines digital twins with advanced machine learning techniques. Our approach uses a stacked sparse autoencoder (ssAE) for feature extraction and reduction and a hybrid CNNGRU model for accurate attack classification. The simulation results show that our solution significantly outperforms existing models, which are ANOVA-DNN, AE-MLP and CNN-LSTM. It achieves the highest detection accuracy at$\mathbf{9 9. 7 2 \%}$and a suitable low time-cost at 0.215 ms, providing a good balance between accuracy and speed. Moreover, it delivers the lowest computational load compared to others, which makes it ideal for deployment in real-time resource-limited environments.

This paper delves into enhancing cybersecurity training efficacy through an in-depth examination of gamified learning, behavioural strategies, and the deployment of digital twins. It identifies the critical role of behavioural strategies in bolstering cybersecurity defences by influencing human behaviour. The study explores the benefits of gamified learning in engaging participants and improving knowledge acquisition, alongside applying digital twins and cyber ranges in offering practical, hands-on experience. By analysing these methodologies, the paper aims to bridge the gap between theoretical knowledge and real-world application, encouraging the researchers to work on a forward-looking approach to cybersecurity training using these innovative methodologies that are both effective and engaging. Our findings suggest that by creating an immersive, interactive learning environment, it is possible to enhance the cybersecurity competencies of individuals, making them better prepared to navigate the complexities of the digital age. This paper contributes to cybersecurity training by offering insights using innovative approaches for effective training programs that are both engaging and informative, ultimately aiming to bolster organisations’ cybersecurity posture.

The evolution of authentication mechanisms in ensuring secure access to systems has been crucial for mitigating vulnerabilities and enhancing system security. However, despite advancements in two-factor authentication (2FA) and multi-factor authentication (MFA), authentication mechanisms remain weak in system security, particularly when individuals accessing critical systems are involved. In response to this challenge, we propose a novel blockchain-based multi-factor dynamic authentication mechanism (BMFA) that integrates honeytoken technology to enhance security. Our proposed mechanism leverages Ethereum blockchain technology and smart contracts to provide a decentralized and robust authentication framework. By incorporating honeytokens into smart contracts, we introduce a dynamic layer of security that continuously adapts to prevent potential attacks. Our evaluation demonstrates that our BMFA mechanism effectively addresses various security challenges, including brute force attacks, man-in-the-middle attacks, and smart contract vulnerabilities, while providing robust protection against unauthorized access. Our findings emphasise the efficacy of the BMFA mechanism in enhancing system security and mitigating evolving threats in authentication processes for next-generation critical industrial control systems.

The rapid evolution of Vehicular Ad-hoc NETworks (VANETs) has ushered in a transformative era for intelligent transportation systems (ITS), significantly enhancing road safety and vehicular communication. However, the intricate and dynamic nature of VANETs presents formidable challenges, particularly in vehicle-to-infrastructure (V2I) communications. Roadside Units (RSUs), integral components of VANETs, are increasingly susceptible to cyberattacks, such as jamming and distributed denial of service (DDoS) attacks. These vulnerabilities pose grave risks to road safety, potentially leading to traffic congestion and vehicle malfunctions. Existing methods face difficulties in detecting dynamic attacks and integrating digital twin technology and artificial intelligence (AI) models to enhance VANET cybersecurity. Our study proposes a novel framework that combines digital twin technology with AI to enhance the security of RSUs in VANETs and address this gap. This framework enables real-time monitoring and efficient threat detection while also improving computational efficiency and reducing data transmission delay for increased energy efficiency and hardware durability. Our framework outperforms existing solutions in resource management and attack detection. It reduces RSU load and data transmission delay while achieving an optimal balance between resource consumption and high attack detection effectiveness. This highlights our commitment to secure and sustainable vehicular communication systems for smart cities.

Digital twin technology is crucial to the development of the sixth-generation (6G) Internet of Vehicles (IoV) as it allows the monitoring and assessment of the dynamic and complicated vehicular environment. However, 6G IoV networks have critical challenges in network security and computational efficiency, which need to be addressed. Existing digital twin technologies in 6G IoV networks often suffer from limitations, such as reliance on static models and high computational demands, leading to unstable attack detection and inefficiencies. Their results for attack detection performance metrics, precision, detection rate, and F1-Score are insufficient for 6G IoV. Moreover, these systems concentrate all computational processes within the digital twin’s service layer, leading to inefficiencies. To address these challenges, we introduce a novel artificial intelligence (AI) enhanced digital twin framework designed to significantly improve 6G IoV network security and computational efficiency under dynamic conditions. Our framework employs an advanced feature engineering module that uses feature selection methods and stacked sparse autoencoders (ssAE) to reduce feature dimensions within the cyber twin layer, effectively distributing the overall computational load. It also utilizes an online learning module which enables a network-aware attack detection mechanism for precise attack detection. The proposed solution exhibits a stable performance of around 98% success rate regarding attack detection metrics against two data sets. Specifically, our solution reduces system latency by 12%, energy consumption by 15%, RAM usage by 20%, and improves packet delivery rates by 6.1%. These findings underscore the potential of our framework to enhance the robustness and responsiveness of 6G IoV systems, offering a significant contribution to vehicular network security and management.

As the current detection solutions of distributed denial of service attacks (DDoS) need additional infrastructures to handle high aggregate data rates, they are not suitable for sensor networks or the internet of things. Besides, the security architecture of software-defined sensor networks needs to pay attention to the vulnerabilities of both software-defined networks and sensor networks. In this paper, we propose a network-aware automated machine learning (AutoML) framework, which detects DDoS attacks in software-defined sensor networks. Our framework selects an ideal machine learning algorithm to detect DDoS attacks in network-constrained environments, using the metrics such as variable traffic load, heterogeneous traffic rate, and detection time while preventing over-fitting. Our contributions are two-fold: (i) we first investigate the trade-off between the efficiency of ML algorithms and network/traffic state in the scope of DDoS detection. (ii) we design and implement a software architecture containing open-source network tools, with the deployment of multiple ML algorithms. Lastly, we show that under the denial of service attacks, our framework ensures the traffic packets are still delivered within the network with additional delays.