The rapid growth of blockchain technology and the increasing number of network nodes have heightened the risk of sophisticated attacks. Among these, Eclipse attacks present a serious threat to decentralized networks by exploiting their peer-to-peer structures. While previous research has explored artificial intelligence techniques to defend against Eclipse attacks, evolving attack patterns continue to challenge existing defenses. In this paper, we propose a novel defense framework that integrates a clustering approach based on self-attention encoders within a multi-kernel neural network clustering model. Our method utilizes parallel subnetworks to extract category-specific features from multiple perspectives, generating discriminative cluster centroids that are combined with raw transaction data to train a robust classifier for detecting Eclipse attacks in Ethereum networks. To evaluate our approach, we simulate Eclipse attacks on the Ethereum testnet and conduct extensive experiments. The results demonstrate that our method achieves a detection accuracy of 98.5% and improves classification performance by 5% compared to models trained without cluster-enhanced features, confirming the effectiveness of the proposed defense.

We study feature selection (FS) for flow-based intrusion detection and propose a deterministic hybrid-FS that fuses Mutual Information, Random-Forest, and XGBoost importances under a simplex search with a single threshold. Using CIC-IDS-2017, CSE-CIC-IDS2018, and NF-UNSW-NB15, we evaluate ten FS techniques paired with six ensembles under a leakage-safe protocol. The hybrid-FS consistently matches or exceeds the best single selectors while reducing feature count (e.g.,$78 \rightarrow 31$) and improving runtime. Throughput rises by$\sim$9–10% and per-flow latency drops from$0.44 \rightarrow 0.40$ms (p50) and$1.40 \rightarrow 1.20$ms (p99), with mean$\pm$95% CIs and paired tests. False-positive rate (FPR) decreases by 15–19% ($\approx$22 fewer false alarms per hour at 100k flows/h). Against representative PSO/GA hybrids, our fusion attains small but consistent macro-F1 gains and 15–25% FPR reductions at comparable latency. We clarify adversarial robustness with an explicit FGSM feature-space threat model and DeepPackGen configuration, and we diagnose cross-dataset shift with lightweight mitigations. A 24-hour SOC replay links FPR to analyst time savings (2.5–3.7 hours/day) without sacrificing macro-F1 or AUROC. The results position deterministic, compact FS as a practical choice for inline IDS where tail latency and alert volume matter.

Federated learning (FL) offers a decentralized, privacy-preserving framework for encrypted traffic classification (ETC), enabling network management and security. However, real-world deployment of federated ETC faces compound client specific feature, concept, and label drift, which degrades model performance. Existing ETC methods under FL settings typically address these drift types in isolation or partial combinations, overlooking their entanglement. Moreover, multiple-global model and personalized FL approaches are computational and communication expensive. To fill this gap, we propose DAIR FedMoE, a Drift-Adaptive, Imbalance-Aware, RL-Managed Federated Mixture-of-Experts framework to simultaneously handle the drift triad with single-global model while minimizing the computational and communication overhead. DAIR-FedMoE in tegrates a GShard Transformer with a hierarchical Mixture of-Experts (MoE) layer that routes encrypsted flows to either stable or drift-specialist experts based on per-client drift scores. Within each expert, entropy-guided loss reweighting empha sizes low-confidence classes to address dynamic label imbalance. Additionally, a reinforcement learning-based policy dynamically manages the expert pool by spawning, pruning, and merging experts, enabling efficient adaptation to evolving traffic patterns. Experiments on federated splits of ISCX-VPN, ISCX-Tor, VNAT, and USTC-TFC2016 show that DAIR-FedMoE achieves superior macro-F1, minority-class recall, and drift-recovery speed compared to state-of-the-art baselines, while preserving privacy and communication efficiency. The source code is available at https://github.com/dairfedmoe/DairFM.

As blockchain technology becomes prevalent, smart contracts have shown significant utility in finance and supply chain management. However, vulnerabilities in smart contracts pose serious threats to blockchain security, leading to substantial economic losses. Therefore, developing effective vulnerability detection solutions is urgent. To address this issue, we propose a method for detecting vulnerabilities in smart contracts using graph neural networks (GNNs) that can identify eight common vulnerabilities. Our method is fully automated, applicable to all Ethereum smart contracts, and does not require expert-defined rules or manually defined features. We extract the Control Flow Graph and Abstract Syntax Graph from the smart contract code, which are then processed by a GNN to generate feature vectors for classification. Experiments on a real Ethereum dataset demonstrate that our method significantly outperforms existing state-of-the-art approaches. For individual detection tasks, the combined source code and bytecode method achieves an average accuracy of 95.78%, with a peak of 99.13%, and an average F1 score of 93.80%. Compared to competitors, our method shows an average improvement of 51.92% in accuracy and 47.21% in F1 score. The bytecode-only method achieves an average accuracy of 94.68% and an F1 score of 92.36%. For multi-class tasks, both methods achieve high accuracies of 91.26% and 87.34%, with F1 scores of 97.42% and 96.43%, respectively.

The Internet of Vehicles (IoV) facilitates wireless communication and information exchange among vehicles, road infrastructure, and pedestrians, creating a comprehensive network for intelligent vehicle control. Within the IoV framework, numerous computing tasks typically transmitted to the cloud for centralized processing lead to significant latency and substantial cloud computing burdens. To optimize IoV efficiency while safeguarding vehicle data privacy, federated learning (FL) has shown promising potential. However, due to vehicle mobility, FL encounters challenges such as communication bandwidth limitations, varying road conditions, and data transmission delays. Additionally, traditional FL methods do not fully ensure the non-disclosure of user data during aggregation. To address these issues, we propose a lightweight encryption-based asynchronous federated learning scheme (LPAsyFL) for privacy protection in IoV. This scheme supports user participation and withdrawal, ensuring security in honest but curious environments. By utilizing lightweight cryptographic primitives and asynchronous aggregation techniques, we introduce a dynamic aggregation mechanism that reduces communication overhead and enhances model aggregation efficiency. Simulation results on various datasets demonstrate that our approach reduces communication costs and improves aggregation efficiency in the vehicular network.

Federated learning (FL) is a machine learning method that enables model training without centralizing data for integration. However, FL is vulnerable to poisoning attacks, in which an attacker manipulates the malicious clients to corrupt the global model via poisoning their local training data or model updates, resulting in compromised model accuracy and degraded performance. In addition, in FL, although the original data can be trained without leaving the local devices, some attackers can obtain the private information of training participants through model parameters, causing privacy leaks. In order to solve the above problems, we propose a privacy-preserving federated learning robust aggregation scheme based on secret sharing. This scheme is implemented based on secret sharing technology, protecting clients’ data privacy while achieving Byzantine-robust. Moreover, our scheme considers the two situations of honest majority and malicious majority of clients; that is, the model can effectively resist poisoning attacks when the proportion of malicious clients is less than 50% or more than 50%. Extensive experiments show that our scheme is secure against various common poisoning attacks and is more robust than some existing aggregation rules, even when malicious actors account for the majority.

Abstract Smart device manufacturers rely on insights from smart home (SH) data to update their devices, and similarly, service providers use it for predictive maintenance. In terms of data security and privacy, combining distributed federated learning (FL) with blockchain technology is being considered to prevent single point failure and model poising attacks. However, adding blockchain to a FL environment can worsen blockchain's scaling issues and create regular service interruptions at SH. This article presents a scalable Blockchain‐based Privacy‐preserving Federated Learning (BPFL) architecture for an SH ecosystem that integrates blockchain and FL. BPFL can automate SHs' services and distribute machine learning (ML) operations to update IoT manufacturer models and scale service provider services. The architecture uses a local peer as a gateway to connect SHs to the blockchain network and safeguard user data, transactions, and ML operations. Blockchain facilitates ecosystem access management and learning. The Stanford Cars and an IoT dataset have been used as test bed experiments, taking into account the nature of data (i.e. images and numeric). The experiments show that ledger optimisation can boost scalability by 40–60% in BCN by reducing transaction overhead by 60%. Simultaneously, it increases learning capacity by 10% compared to baseline FL techniques.

The rapid expansion of the Internet of Things (IoT) introduces critical challenges in scalability, mobility, and security, particularly in large-scale deployments. While information-centric networking (ICN) addresses these by enhancing content mobility, multipath support, and edge-embedded caching with inherent security features, it faces limitations in handling large heterogeneous environments due to its in-network caching and content-based forwarding strategies. Software-defined networking (SDN) complements ICN by employing a centralized controller to intelligently orchestrate content caching and forwarding, yet struggles with the efficient allocation and acquisition of content across expansive IoT systems. In response to these challenges, we propose CIC-SIoT, a novel information-centric SDN (IC-SDN) solution, designed to optimize the ICN-IoT framework. Our solution incorporates specialized algorithms for controllers, consumers, producers, and ICN nodes. These algorithms improve content forwarding decisions by moving beyond the traditional reliance on the forwarding information base (FIB) and instead utilizing the pending interest table (PIT) to efficiently manage and distribute content. Validated through ndnSIM and MATLAB simulations, CIC-SIoT achieves substantial performance enhancements, including an 80% increase in throughput, a 34% reduction in latency, and a 25% savings in bandwidth. Additionally, it reduces packet loss by 67% and communication overhead by 66%, compared to existing solutions. These results underscore the framework’s ability to significantly improve the efficiency and scalability of content distribution in IoT environments, highlighting its robustness and adaptability in addressing the complex dynamics of modern networked systems.

Ethereum is the second-largest blockchain platform, and the financial value of its cryptocurrency has constantly increased. Unfortunately, regulatory challenges have resulted in a surge of scams, particularly phishing, which now accounts for over 50% of fraudulent funds. Therefore, phishing scam issues have become a top priority, thus calling for dynamic early warning and accurate identification to achieve effective market regulation. However, the existing works focusing on phishing address detection do not consider early warnings for phishing scams. Furthermore, these methods depend on static graphs to extract node information and overlook the dynamic evolution process of the Ethereum network. In this article, we propose EWDPS, a novel framework to achieve dynamic early warning and effectively identify phishing scams on Ethereum. Specifically, we create a new network called the dynamic temporal transaction network (DTTN), which effectively models the dynamic temporal evolution of transactions. In DTTN, we propose the concepts of temporal evolution interaction network and account feature interaction network. Next, we design a novel feature extraction module to capture temporal sequential patterns effectively. This module takes full advantage of the dynamic interaction process of node-related transactions. Finally, we innovatively use the extracted account, network, and temporal features to enhance transaction representation in multiple dimensions. Extensive experiments show that our proposed scheme effectively achieves dynamic early warning and accurately identifies phishing scams. EWDPS achieves 92.20% accuracy, 95.90% precision, 96.77% recall, and 96.53% F1-score, and outperforms the state-of-the-art methods in phishing address identification.

The advent of 6G networks promises revolutionary advances in dynamism, intelligence, and decentralization. Realizing the full potential of 6G requires adaptable service level agreements (SLAs) that can optimize performance based on dynamic network conditions. In this paper, we suggested a method based on the Hyperledger Sawtooth blockchain’s smart contract with the Reptile meta-learning algorithm to solve the rigidity of static SLA and centralization problems. In order to sustain the quality of service in the radio access network and core network domain of 6G networks, this work focuses on SLA management for efficient resource allocation for the eMBB-plus slice. Our approach entails breaking down static SLAs into finer-grained components, transferring those components onto Hyperledger Sawtooth smart contracts, and using the Reptile meta-learning algorithm to forecast SLA metrics and resource requirements. A dynamic tariff model, also proposed within the smart contract, handles increased user demands. We evaluate the solution by analyzing Reptile performance, resource allocation, and SLA violations under dynamic demands. Results demonstrate the efficiency of this AI-driven, blockchain-based approach for automated, optimized 6G eMBB-plus resource management adhering to dynamic fine-grained SLAs. This work highlights the synergistic potential of AI and blockchain for trusted and intelligent 6G service delivery.

The rapid development of blockchain technology has led to a constant increase in its financial and technological value. However, this has also led to malicious attacks. Distributed denial-of-service attacks pose a considerable threat to blockchain technology out of many attacks due to its effectiveness and distributed nature. To protect the blockchain from DDoS attacks, researchers have proposed a large number of defensive schemes. However, these schemes are not well-suited for use in practical situations. In this work, we propose a DDoS attack detection scheme based on centralized federated learning, where multiple participating nodes locally train models and upload them to a central node for aggregation. Additionally, we propose a more suitable method for blockchain scenarios, using decentralized federated learning technology, where multiple nodes exchange models in a peer-to-peer manner to complete model training without a central server. We simulate DDoS attacks in blockchain and generate a large dataset by combining it with traditional network layer DDoS attack data to evaluate the effectiveness of our schemes. The experimental results show that the proposed schemes perform well in classification accuracy, demonstrating that our techniques can detect DDoS attacks effectively.

Searchable symmetric encryption (SSE) supports keyword search over outsourced symmetrically encrypted data. Dynamic searchable symmetric encryption (DSSE), a variant of SSE, further enables data updating. Most DSSE works with conjunctive keyword search primarily consider forward and backward privacy. Ideally, the server should only learn the result sets involving all keywords in the conjunction. However, existing schemes suffer from keyword pair result pattern (KPRP) leakage, revealing the partial result sets containing two of query keywords. We propose the first DSSE scheme to address aforementioned concerns that achieves strong privacy-preserving conjunctive keyword search. Specifically, our scheme can maintain forward and backward privacy and eliminate KPRP leakage, offering a higher level of security. The search complexity scales with the number of documents stored in the database in several existing schemes. However, the complexity of our scheme scales with the update frequency of the least frequent keyword in the conjunction, which is much smaller than the size of the entire database. Besides, we devise a least frequent keyword acquisition protocol to reduce frequent interactions between clients. Finally, we analyze the security of our scheme and evaluate its performance theoretically and experimentally. The results show that our scheme has strong privacy preservation and efficiency.

Deep Learning(DL) techniques have gained significant importance in the recent past due to their vast applications. However, DL is still prone to several attacks, such as the Membership Inference Attack (MIA), based on the memorability of training data. MIA aims at determining the presence of specific data in the training dataset of the model with substitute model of similar structure to the objective model. As MIA relies on the substitute model, they can be mitigated if the substitute model is not clear about the network structure of the objective model. To solve the challenge of shadow-model construction, this work presents L-Leaks, a member inference attack based on Logits. L-Leaks allow an adversary to use the substitute model's information to predict the presence of membership if the shadow and objective model are similar enough. Here, the substitute model is built by learning the logits of the objective model, hence making it similar enough. This results in the substitute model having sufficient confidence in the member samples of the objective model. The evaluation of the attack's success shows that the proposed technique can execute the attack more accurately than existing techniques. It also shows that the proposed MIA is significantly robust under different network models and datasets.

In medical cloud computing, more medical data owners are preferred to outsource their sensitive data to the cloud after encryption. Meanwhile, dynamic searchable symmetric encryption (DSSE) provides the capability for data users to query over the dynamically-updated encrypted database. To reduce update leakage, a secure DSSE scheme usually requires forward and backward privacy. However, existing multi-client DSSE schemes with forward and backward privacy require the data owner to keep online to respond to per-query interaction from data users. To address this issue, we propose a multi-client non-interactive DSSE scheme with forward and backward privacy, namely MCNI. The core design of MCNI is leveraging time range queries to achieve non-interactive forward privacy since the past queries cannot be used to search the newly-added timestamps. To enable efficient time range queries, we convert the timestamp and time range into the boolean wildcard form and develop Boolean Wildcard Matching (BWM) algorithm that formulates the match as a dot product calculation problem. Finally, we combine the polynomial fitting technique, time range query, and random matrix multiplication technique to achieve efficient keyword searches without revealing sensitive information. Theoretical analysis and extensive experiments demonstrate the security and effectiveness of our proposed scheme, respectively.

Nowadays, Internet usage has become prevalent, primarily because of high-quality heterogeneous multimedia content expectations from the subscriber (consumer), which puts tremendous pressure on the publisher (producer) in the networks. Information-Centric Networking (ICN) is a future internet architecture that optimizes data resources through content-based forwarding and caching, making it well-suited for multimedia content and video streaming (VS) scenarios. However, real-time data delivery is challenging in the current ICN-based publish–subscribe (pub-sub) mechanism, which pushes the existing pub-sub studies to prioritize more on the forwarding information base (FIB) rather than the pending interest table (PIT). This leads to issues such as inefficient caching and forwarding mechanisms, high overhead, and communication costs. To address these challenges, in this paper, we present a novel forwarding and caching solution named VS-ICSDN, integrating the combined principles of ICN-based pub-sub scheme and software-defined networking (SDN) in order to utilize the network resources more efficiently. We design a clean-slate caching strategy and name-based forwarding method to support both on-path and off-path caching on ICN nodes to coordinate flow entries among the SDN controller and clean-slate ICN nodes to maximize PIT utilization. In addition, the framework allows the content to be stored and searched in chunks with a single request to access the desired content, reducing the communication overhead and significantly improving overall performance. A simulation-based testbed and experimental result analysis validate our proposed work’s effectiveness in ensuring efficient network resource usage with low communication overhead and computational cost compared to other baseline methods.

Time-series data aggregation in Internet of Things applications is a useful operation, where the time-series data is sensed by a group of users, and gathered by the aggregator for real-time analysis. However, some security and privacy challenges still affect the collection and aggregation process. Although existing privacy-preserving solutions achieve strong privacy guarantees, they introduce a fully trusted TA that is difficult to realize in the real world. Besides, they cannot be directly applied in time-series data aggregation scenarios due to unacceptable efficiency. In this article, we propose a privacy-preserving time-series data aggregation scheme with a semi-trusted authority. Moreover, our scheme also supports arbitrary aggregate functions and fault tolerance to enhance the reliability and scalability of data aggregation. Security analysis demonstrates that our proposed scheme achieves$(n-k)$-source anonymity even if$k(k\leq (n-2))$data providers collude with the cloud server. We also conduct thorough experiments based on a simulated data aggregation scenario to show the high computation and communication efficiency of our scheme.

The integration of body sensors, cloud computing, and mobile communication technologies has significantly improved the development and availability of e-healthcare systems. In an e-healthcare system, health service providers upload real patients’ clinical data and diagnostic treatments to the cloud server. Afterward, the users can submit queries with specific body sensor parameters, to obtaining pertinent${k}$diagnostic files. The results are ranked based on ranking algorithms that match the query parameters to the ones in diagnostic files. However, privacy concerns arise while matching disease, since the clinical data and diagnostic files contain sensitive information. In this work, we propose two reliable and privacy-preserving Top-${k}$disease matching schemes. The first scheme is constructed based on our proposed weighted Euclidean distance comparison algorithm under secure${k}$-nearest neighbor technique to get${k}$diagnostic files. It allows users to set different weights for each body indicator as per their needs. The second scheme is designed by comparing Euclidean distances under the modified Paillier homomorphic encryption algorithm where a superlinear sequence is used to reduce the computational and communication overhead. The user side incurs slightly higher computational costs, but the trusted party does not need to execute encryption operations. Hence, the proposed two schemes can be applied in different application scenarios. Simulations on synthetic and real data prove the efficiency of the schemes, and security analysis establishes the privacy-preservation properties.

The use of the Internet of Things and modern technologies has boosted the expansion of e-health solutions significantly and allowed access to better health services and remote monitoring of patients. Every service provider usually implements its information system to manage and access patient data for its unique purpose. Hence, the interoperability among independent e-health service providers is still a major challenge. From the structure of stored data to its large volume, the design of each such big data system varies, hence the cooperation among different e-health systems is almost impossible. In addition to this, the security and privacy of patient information is a challenging task. Building a unified solution for all creates significant business and economic issues. In this article, we present a solution to migrate existing e-health systems to a unified Blockchain-based model, where access to large scale medical data of patients can be achieved seamlessly by any service provider. A core blockchain network connects individual & independent e-health systems without requiring them to modify their internal processes. Access to patient data in the form of digital assets stored in off-chain storage is controlled through patient-centric channels and policy transactions. Through emulation, we show that the proposed solution can interconnect different e-health systems efficiently.

Federated learning (FL) enables data owners to train a joint global model without sharing private data. However, it is vulnerable to Byzantine attackers that can launch poisoning attacks to destroy model training. Existing defense strategies rely on the additional datasets to train trustable server models or trusted execution environments to mitigate attacks. Besides, these strategies can only tolerate a small number of malicious users or resist a few types of poisoning attacks. To address these challenges, we design a novel federated learning methodTDFL,TruthDiscovery basedFederatedLearning, which can defend against multiple poisoning attacks without additional datasets even when the Byzantine users are$\geq 50\%$. Specifically, the TDFL considers different scenarios with different malicious proportions. For Honest-majority setting (Byzantine$< 50\%$), we design a special robust truth discovery aggregation scheme to remove malicious model updates, which can assign weights according to users’ contribution; for Byzantine-majority setting (Byzantine$\geq 50\%$), we use maximum clique-based filter to guarantee global model quality. To the best of our knowledge, this is the first study that uses truth discovery to defend against poisoning attacks. It is also the first scheme which can achieve strong robustness under multiple kinds of attacks launched by high proportion attackers without root datasets. Extensive comparative experiments are designed with five state-of-the-art aggregation rules under five types of classical poisoning attacks on different datasets. The experimental results demonstrate that TDFL is practical and achieves reasonable Byzantine-robustness.

Vehicle platoon, a novel vehicle driving paradigm that organizes a group of vehicles in the nose-to-tail structure, has been considered as a potential solution to reduce traffic congestion and increase travel comfort. In such a platoon system, head vehicles’ performances are usually evaluated by user vehicles’ feedbacks. Selection of an appropriate and reliable head vehicle while not disclosing user vehicles’ privacy has become an interesting problem. In this article, we present a trust-based and privacy-preserving platoon recommendation scheme, called TPPR, to enable potential user vehicles to avoid selecting the malicious head vehicles. The basic concept of TPPR is that each user vehicle holds a trust value, and the reputation score of the head vehicle is calculated via a truth discovery process. To preserve vehicles’ privacy, pseudonyms and Paillier cryptosystem are applied. In addition, novel authentication protocols are designed to ensure that only the valid vehicles (i.e., the vehicles holding the truthful trust values and joining the vehicle platoon) can pass the authentication. A comprehensive security analysis is conducted to prove that the proposed TPPR scheme is secure against several sophisticated attacks in vehicular ad hoc networks. Moreover, extensive simulations are conducted to demonstrate the correctness and effectiveness of the proposed scheme.

Crowdsensing gradually forms a big data market where workers are willing to trade reusable data with different data collectors. It is challenging for the data collector to choose the transaction party due to the changeable value of the data, while determining the transaction price is also a tough issue. In this paper, we research the dynamic data transaction in crowdsensing. The contribution of the new data to the collector is modeled as the Shapley value, with each worker as a player in the cooperative game. The data collector then judges the contribution of the worker and determines the transaction object. To maximum the profit in the transaction, the collector will dynamically adjust the offering price to workers. The contextual bandit model is utilized in the price decision, with each candidate price as an arm and the time-variant data value as the context. Based on the classic LinUCB learning policy, we learn the mapping of the observed data value and the reward, and estimate the optimal reward in current transaction. The simulation on the data demonstrates that the actual reward got by the collector is close to the maximum reward he can get, which verifies the effectiveness of our scheme.

This paper integrates Software-Defined Networking (SDN) and Information -Centric Networking (ICN) framework to enable low latency-based stateful routing and caching management by leveraging a novel forwarding and caching strategy. The framework is implemented in a clean- slate environment that does not rely on the TCP/IP principle. It utilizes Pending Interest Tables (PIT) instead of Forwarding Information Base (FIB) to perform data dissemination among peers in the proposed IC-SDN framework. As a result, all data exchanged and cached in the system are organized in chunks with the same interest resulting in reduced packet overhead costs. Additionally, we propose an efficient caching strategy that leverages in- network caching and naming of contents through an IC-SDN controller to support off- path caching. The testbed evaluation shows that the proposed IC-SDN implementation achieves an increased throughput and reduced latency compared to the traditional information-centric environment, especially in the high load scenarios.

Biometrics identification has been used in a growing number of fields in recent years, since it is more secure, classified and convenient. With the development of cloud computing, database systems are able to upload large amounts of biometric data to cloud server for storage and identification to save local memory and improve computational efficiency. However, this involves potential privacy concerns because of the introduction of third-party platforms. In this paper, we achieve computational and communication efficiency in biometric identification, while preserving the privacy of data. Specifically, the database system firstly encrypts all biometric data and query data. Then, it sends the ciphertext to a cloud server to carry out matching tasks. Finally, the cloud server returns the index of final matches to the system so that it can check whether the biometric vector is legal or not. Detailed security analysis indicates that the proposed scheme can resist powerful attacks. Beyond that, Experiments show that the scheme is more efficient in computation and communication than stat of art biometric identification schemes.

Truth discovery has received considerable attention in mobile crowdsensing systems. In real practice, it is vital to resolve conflicts among a large amount of sensory data and estimate the truthful information. Although truth discovery has been widely explored to improve aggregation accuracy, numerous security and privacy issues still need to be addressed. Existing schemes either do not guarantee the privacy of each participating user, or fail to consider practical needs in crowdsensing systems. In this paper, we present two reliable and privacy-preserving truth discovery schemes for different scenarios. Our first design is fit for applications where users are relatively stable. By employing the homomorphic Paillier encryption, one-way hash chain, and super-increasing sequence techniques, this approach not only guarantees strong privacy, but also is highly efficient and practical. Our second design suits applications where users are frequently moving. In such an application, we explore data perturbation and homomorphic Paillier encryption to shift all user workloads to the server side, without compromising users' privacy. Through detailed security analysis, we demonstrate that both schemes are secure, practical, and privacy-preserving. Moreover, extensive experiments based on real world and simulated mobile crowdsensing systems, we demonstrate the efficiency of our proposed schemes.

Software-Defined Networking has become an integral technology for large scale networks that require dynamic flow management. It separates the control function from data plane devices and centralizes it in a domain controller. However, only a limited number of switches can be managed by a single and centralized controller which introduces challenges such as scalability, reliability, and availability. Distributed controller architecture resolves these issues but also introduces new challenges of uneven load and traffic management across domains. As real-world networks have redundant links, hence a significant challenge is to distribute traffic flows on multiple paths, within a domain, and across multiple independent domains. The selection of ingress and egress switches becomes even more problematic if the intermediate domain is non-cooperative. In this work, we propose a Dynamically Optimized and Load-balanced Path for Inter-domain (DOLPHIN) communication system, a customized solution for different SDN controllers. It provides control beyond the virtual switch elements in intra and inter-domain communication and extends the range of programmability to wireless devices, such as the Internet of Things or vehicular networks. Extensive simulation results show that the traffic load is distributed evenly on multiple links connecting different domains. We model data center communication and 5G vehicular network communication to show that, by load balancing the flow completion times of the different types of network traffic can be significantly improved.

Mobile Crowd Sensing (MCS) enables the platform to offer data-based service by incentivizing mobile users to perform sensing task and collecting sensing data from them. Most of the existing works on MCS only consider designing incentive mechanisms for a single MCS platform. In this paper, we study the incentive mechanism in MCS with multiple platforms under two scenarios: competitive platform and cooperative platform. We correspondingly propose new competitive and cooperative mechanisms for each scenario. In the competitive platform scenario, platforms decide their prices on rewards to attract more participants, while the users choose which platform to work for. We model such a competitive platform scenario as a two-stage Stackelberg game. In the cooperative platform scenario, platforms cooperate to share sensing data with each other. We model it as many-to-many bargaining. Moreover, we first prove the NP-hardness of exact bargaining and then propose heuristic bargaining. Finally, numerical results show that (1) platforms in the competitive platform scenario can guarantee their payoff by optimally pricing on rewards and participants can select the best platform to contribute; (2) platforms in the cooperative platform scenario can further improve their payoff by bargaining with other platforms for cooperatively sharing collected sensing data.

Collecting driving routes is effective in predicting traffic patterns and alleviating traffic jams. However, due to the sensitivity of the location information, drivers are usually reluctant to share their route information. Although some efforts have been made to address this challenge, most of them either do not consider traffic order issues or fall short of achieving practical efficiency. In this paper, we propose an efficient and privacy-preserving route collection scheme, named EPRC, to solve the above-mentioned problems. The main idea of EPRC is to perform location-aware and traffic order-based route aggregation on drivers' encrypted data using super-increasing sequences and a homomorphic encryption cryptosystem. The proposed scheme achieves better computation and communication efficiency by reducing computational complexity and communication overhead from O(M) to O(1), where M denotes the number of road segments. Security analysis demonstrates the privacy of an individual driver's route is preserved under standard cryptographic assumptions. Performance evaluations via implementing EPRC on mobile devices and systems show EPRC's efficiency in terms of computation and communication costs.

Efficient and smart business processes are heavily dependent on the Internet of Things (IoT) networks, where end-to-end optimization is critical to the success of the whole ecosystem. These systems, including industrial, healthcare, and others, are large scale complex networks of heterogeneous devices. This introduces many security and access control challenges. Blockchain has emerged as an effective solution for addressing several such challenges. However, the basic algorithms used in the business blockchain are not feasible for large scale IoT systems. To make them scalable for IoT, the complex consensus-based security has to be downgraded. In this article, we propose a novel lightweight proof of block and trade (PoBT) consensus algorithm for IoT blockchain and its integration framework. This solution allows the validation of trades as well as blocks with reduced computation time. Also, we present a ledger distribution mechanism to decrease the memory requirements of IoT nodes. The analysis and evaluation of security aspects, computation time, memory, and bandwidth requirements show significant improvement in the performance of the overall system.

Internet of Things (IoT) and blockchain (BC) technologies have been dominating their respective research domains for some time. IoT offers automation at the finest level in different fields, while BC provides secure transaction processing for asset exchanges. The capability of IoT devices to generate transactions prompts their integration with BC as the next logical step. The biggest challenges in this integration are the scalability of ledger and rate of transaction execution in BC. On one hand, due to their large numbers, IoT devices will generate transactions at a rate which current block chain solutions cannot handle. On the other hand, implementing BC peers onto IoT devices is impossible due to resource constraints. This prohibits direct integration of both technologies in their current state. In this paper, we propose a solution to address these challenges by using a local peer network to bridge the gap. It restricts the number of transactions which enters the global BC by implementing a scalable local ledger, without compromising on the peer validation of transactions at local and global level. The testbed evaluations show significant reduction in the block weight and ledger size on global peers. The solution also indirectly improves the transaction processing rate of all peers due to load distribution.

Mobile crowdsensing (MCS) is widely applied in large-scale distributed networks for collecting sensing data from workers. In an MCS system, workers are recruited to complete tasks for data requesters, and they will get profits. Accordingly, how to establish an effective incentive mechanism has become an important issue to consider. Since workers are naturally selfish, they try to maximize individual benefits while minimize costs. In this article, we propose a truthful incentive mechanism which pays for the workers by the workers' performance in the task just completed and the reputation. For each worker, through the future prediction function, we get the reputation of the worker by utilizing the previous performances. In the proposed scheme, partial payment for the workers is distributed depending on workers' reputation. The final payment is based on punishments and rewards according to the performances. Moreover, data accuracy and response time are introduced to evaluate the worker performance in the task. It can be demonstrated that the mechanism provides continuous incentives to workers compared to the single ex-ante and ex-post pricing schemes. The experimental results show that our mechanism is effective.

The integration of wearable wireless devices and cloud computing in e-health systems has significantly improved their effectiveness and availability. Patients can upload their personal health information (PHI) files to the cloud, from where the health service providers (HSPs) can obtain appropriate information to determine the health state. This system not only reduces the costs associated to healthcare but also provides timely diagnosis to save lives. However, a number of privacy concerns arise while sharing sensitive information. In this paper, we propose a novel privacy-preserving patient health information sharing scheme, which allows HSPs to access and search PHI files in a secure yet efficient manner. We make use of the searchable encryption technique with keyword range search and multikeyword search. The proposed privacy-preserving equality test protocol allows different types of numeric comparison searches on encrypted data. We also use a variant of bloom filter and message authentication code to classify PHI files, filter false data, and check integrity of search results. The simulations on real-world and synthetic data show the feasibility and efficiency of the system, and security analysis proves the privacy-preservation properties.

With the continuous development of eHealthcare systems, medical service recommendation has received great attention. However, although it can recommend doctors to users, there are still challenges in ensuring the accuracy and privacy of recommendation. In this paper, to ensure the accuracy of the recommendation, we consider doctors' reputation scores and similarities between users' demands and doctors' information as the basis of the medical service recommendation. The doctors' reputation scores are measured by multiple feedbacks from users. We propose two concrete algorithms to compute the similarity and the reputation scores in a privacy-preserving way based on the modified Paillier cryptosystem, truth discovery technology, and the Dirichlet distribution. Detailed security analysis is given to show its security prosperities. In addition, extensive experiments demonstrate the efficiency in terms of computational time for truth discovery and recommendation process.

Information-Centric Networking is considered as one of the most promising architecture for IoT. The use of content-centric approach may improve the content access & dissemination, reduce the content retrieval latency, and enhance the network performance. The use of in-network caching in ICN enhances the data availability in the network, overcomes the issue of single-point failure, and improves IoT devices power efficiency. In this paper, we present a Near-ICN Cache Placement (NCP) scheme for IoT taking traffic class into consideration. NCP is designed to select the optimal replica cache by minimizing: the cost of moving the data from content producer to replica nodes, the cost of caching the content in the replica and the cost of delivery the content to consumers. Hence, we presented a multi-objective optimization problem, with a heuristic caching selection algorithm. We evaluated NCP with various performance metrics against different caching schemes. The obtained results show improvement in the cache utilization, with fast data retrieval, and enhancement in the network cache distribution & diversity.

Recent advances in socially aware networks (SANs) have allowed its use in many domains, out of which the Social Internet of Vehicles (SIOV) is of prime importance. SANs can provide a promising routing and forwarding paradigm for SIOV by using interest-based communication. Though able to improve the forwarding performance, existing interest-based schemes fail to consider the important issue of protecting users' interest information. In this paper, we propose a privacy-preserving interest-based forwarding scheme (PRIF) for SIOV, which not only protects the interest information but also improves the forwarding performance. We propose a privacy-preserving authentication protocol to recognize communities among mobile nodes. During data routing and forwarding, a node can know others' interests only if they are affiliated with the same community. Moreover, to improve forwarding performance, a new metric community energy is introduced to indicate vehicular social proximity. Community energy is generated when two nodes encounter one another and information is shared among them. PRIF considers this energy metric to select forwarders toward the destination node or the destination community. Security analysis indicates PRIF can protect nodes' interest information. In addition, extensive simulations have been conducted to demonstrate that PRIF outperforms the existing algorithms, including the BEEINFO, Epidemic, and PRoPHET.

The distributed Information-Centric Networking architecture has shown enormous potential to replace the host centric Internet architecture. A number of solutions such as Named Data Networking have become available. Building application services and integrating other technological design on top of ICNs is a challenging task, and has many open issues, hence an efficient distributed architecture needs to be developed. In this paper, we address the case of using IoT architecture targeted for ambient assisted living applications, on top of named data networking. We have proposed a complete architecture and implementation details for device & service networking, communication model, management, and naming. Within each model we have proposed mechanisms which support node mobility, hand-off, packet design, and push & pull data services without changing NDN data exchange model. This architecture is flexible, scalable, and can be adapted to other application specific IoT networks. We also have implemented the proposal on NDN simulator, and evaluated different services. The communication overhead and mobility implications have been studied to show effectiveness of new services with negligible cost to the network.

Mobile crowd sensing has become a promising paradigm for mobile users to collect information. Considering that the task information push is not free and there are many users who are not interested in the current task or provide noisy sensing data, one of the imminent problems is how to recommend high-quality and interested users in real time and steer participators to collect data with adequate budgets. However, it is difficult to predict the data quality and users' interest without the validity of real data. In this paper, we propose a user recommender system where the users' data qualities for sensing tasks are derived from historical statistical data to filter out the non-interested and malicious users in current task. The aim is to recruit a sub-group of participators for efficient crowd sensing, in order to maximize the platform utility. We show that our problem is NP-hard, and model the recruitment process as a sub-modular problem. Finally, an approximation algorithm is designed to guarantee the platform utility and participators' profits. We evaluate our algorithm on simulated data set and the results indicate that the platform utility and data quality improves significantly.

Sleep monitoring system helps to diagnose various health problems. Traditional solutions for sleep monitoring are usually invasive or limited to medical facilities. Radio Frequency (RF) based methods require specialized devices or dedicated wireless sensors. Recently, Wi-Fi based methods without any wearable or dedicated devices obtain more attention, however, they all assume that all the users are in a relatively quiet environment without moving targets. In this paper, we develop a system called Mo-Sleep, which adopts off-the-shelf Wi-Fi devices to continuously collect fine-grained wireless Channel State Information (CSI) in a room. We introduce a motion detection module in our system to identify whether the CSI information has been interfered by a moving target. We then use Principal Component Analysis (PCA) to obtain accurate breath signal. Our prototypic system demonstrates that the proposed scheme can not only remove interfered CSI, but also obtain real time breath rate every five seconds.

Applications for wireless sensor networks have grown enormously over the past few years. Routing and sink discovery protocols designed for ad hoc networks do not adapt to sensor networks, and generic sensor network routing techniques are not optimal for all scenarios. We propose a light weight routing protocol to discover mobile sinks in battle-field operations or large terrains. Initial experimentation shows promising results in reduction of control over head, good data delivery with support of multi-metric path selection.

The wireless multihop to an access point model appears to be a promising component of future network architectures, including multihop cellular networks and wireless access networks at the edges of mesh networks. Sophisticated software radios and core network protocols are being developed to support the integration of heterogeneous air interfaces within these access networks. A key challenge is managing diverse resources at access points (e.g., 3G, WiFi or WiMax) while discovering efficient multi-hop paths from a source to an access point based on selection criteria specified by various applications or necessitated by network resource constraints. We propose a new routing protocol that integrates multiple metrics to calculate path cost based on diverse selection criteria. In addition, a hybrid proactive/reactive anycast routing paradigm is applied to guide the discovery of an access point among multiple available access points. The result is an integrated, flexible protocol for route discovery and access point discovery. Simulation analysis shows that our approach outperforms single-metric routing protocols while supporting flexible service criteria, including load balancing at access points.

The calculation of path cost is a critical component of route discovery for network routing. The criteria used to represent path cost guides resource consumption in the network. In this paper, we describe our approach, a set of protocols based on our Multiple Metrics Routing Protocol (MMRP) for integrating hop count, energy consumption, and traffic load into the path cost calculation for ad hoc or multihop-cellular networks. Our initial aim is to select among multiple disjoint routes in order to maintain a low path cost, in terms of energy consumption and delay, without depleting resources at popular intermediate nodes. One extension of MMRP removes the constraint that only disjoint paths are considered and enables discovery of more optimal routes. A second extension includes adaptive adjustment of cost metrics to support device classification (e.g., energy capacity, bandwidth) in heterogeneous networks. We illustrate our approach with a simple example, followed by extensive simulation analysis. Results indicate that proper combination of multiple metrics for calculating path costs results in improved performance and lower overall system resource consumption as compared to AODV or energy efficient routing protocols.

The wireless multihop to an access point model appears to be a promising component of future network architectures, including multihop cellular networks and wireless access networks at the edges of mesh networks. Sophisticated software radios and core network protocols are being developed to support the integration of heterogeneous access networks. A challenge is managing diverse resources at access points (e.g., 3G, WiFi or WiMax), as well as the distributed interference among the mobiles within a heterogeneous access network. We propose the use of a new anycasting protocol to guide access point discovery and path selection for balancing access point resource and routing packets to access points (APs). In addition, a hybrid proactive/reactive approach is used to reduce overhead of AP discovery. We use theoretical analysis and extensive simulations, to study the tradeoff of our hybrid anycasting protocol. The simulation study indicates that the use of the hybrid anycasting protocol for AP discovery, load balancing and routing, results in consistent performance improvements.