Abstract Formal verification is paramount for neural networks in safety-critical domains yet remains constrained by the trade-off between precision and scalability, especially with modern high frequency activation functions. However, the inherent NP-hardness of the problem forces a fundamental trade-off between scalability and precision in existing methods, which fail to adequately capture the high-frequency nonlinearities of modern activations. To address this, Quadratic Approximation based Verification via Fourier series and Taylor truncation (QAV-FT) is proposed as a framework unifying Fourier-enhanced quadratic approximation and Taylor remainder-aware error control. Specifically: (i) A Fourier-based quadratic abstraction is formulated for arbitrary activations, with a rigorous error bound established via Jackson’s theorem and Lebesgue constant analysis; (ii) A second-order propagation scheme utilizing Lagrange remainder theory is devised to analytically derive sound, tight bounds with reduced symbolic complexity; and (iii) These mechanisms are integrated into a scalable full-network verification algorithm. Empirical results on MNIST-FC and other benchmarks demonstrate that QAV-FT achieves an average certification accuracy of 96.8% across complex activations like Swish, GELU, and Mish, with favorable accuracy and efficiency over comparable methods on partial models.

Intrusion detection systems (IDS) can effectively monitor network traffic and accurately detect malicious behaviors. In Internet of Things (IoT) environments, the massive influx of heterogeneous, resource-constrained devices introduces more complex security challenges, making IDS even more crucial for maintaining network security. However, the presence of redundant or irrelevant features in network traffic can significantly degrade the detection performance of IDS. To address this issue, this paper proposes a Feature distribution and Gini Impurity Filter-based intrusion feature selection method (FGIF). It combines the cardinality and Gini impurity distributions of features within a dataset to construct a multi-parameter evaluation framework, which is used to define efficient feature filtering rules that eliminate redundant and irrelevant features. Theoretical analysis demonstrates that, compared to entropy-based methods, FGIF mitigates selection bias during the feature selection process and significantly reduces computational overhead. Experiments conducted on six widely used IDS benchmark datasets and five commonly adopted classification models further confirm its effectiveness. FGIF significantly reduces feature dimensionality while maintaining detection performance comparable to that of the full feature set. Moreover, compared to existing state-of-the-art methods, FGIF achieves a superior balance between dimensionality reduction and model performance.

With the rapid development of Internet of Things (IoT) in recent years, the security of IoT becomes more and more prominent. To protect data privacy and device availability, identity authentication technology has been applied to the IoT environment. However, although scholars have designed a variety of authentication protocols for the IoT environment, the resource costs of these protocols are still expensive for resource-constrained devices. In particular, when the frequent upgrade of computer hardware has led to a gradual increase in the key length of the cryptosystem, IoT devices are hard to keep up with the upgrade speed because of the balance between cost and tasks. Although the storage space has increased in recent years, the computational and communication capabilities are still limited by some physical factors, such as energy, power, and communication link bandwidth. To improve the situation, this article proposes an anonymous authentication protocol suitable for IoT devices with current hardware performance, which is based on elliptic curve and signcryption techniques. Compared to other protocols, our protocol further reduces the communication and computing cost of the client devices while ensuring security requirements. Thus, we formally prove its theoretical security under the random oracle model and use simulation experiments to verify that the protocol can effectively reduce the resource requirements.

Deep neural networks (DNNs) can be utilized maliciously for compromising the privacy stored in electronic devices, e.g., identifying the images stored in a mobile phone connected to the Internet of Things (IoT). However, recent studies demonstrated that DNNs are vulnerable to adversarial examples, which are artificially designed perturbations in the original samples for misleading DNNs. Adversarial examples can be used to protect the DNN-based privacy leakage in mobile phones by replacing the photos with adversarial examples. To avoid affecting the normal use of photos, the adversarial examples need to be highly similar to original images. To handle a large number of photos stored in the devices at a proper time, the time efficiency of a method needs to be high enough. Previous methods cannot do well on both sides. In this article, we propose a broad class of selective gradient sign iterative algorithms to make adversarial examples useful in protecting the privacy of photos in IoT devices. By neglecting the unimportant image pixels in the iterative process of attacks according to the sort of first-order partial derivative, we control the optimization direction meticulously to reduce image distortions of adversarial examples without leveraging high time-consuming tricks. Extensive experimental results show that the proposed methods successfully fool the neural network classifiers for the image classification task with a small change in the visual effects and consume little calculating time simultaneously.

The DDoS attack is a serious threat to Internet of Things (IoT). As a new class of DDoS attack, Link-flooding attack (LFA) disrupts connectivity between legitimate IoT devices and target servers by flooding only a small number of links. In this paper, we propose an active LFA mitigation mechanism, called Linkbait, that is a proactive and preventive defense to throttle LFA for IoT. We propose a link obfuscation algorithm in Linkbait that selectively reroutes probing flows to hide target links from adversaries and mislead them to identify bait links as target links. To block attack traffic and further reduce the impact in IoT, we propose a compromised IoT devices detection algorithm that extracts unique traffic patterns of LFA for IoT and leverages support vector machine (SVM) to identify attack traffic. We evaluate the performance of Linkbait by using both real-world experiments and large-scale simulations. The experimental results demonstrate the effectiveness of Linkbait.

The explosive growth of the Internet of Things (IoT) is posing a high pressure on the spectrum resources. Dynamic spectrum allocation is an effective solution for supporting massive IoT devices with limited spectrum resources, often implemented in the form of spectrum auction. Among diverse auction formats, double auctions feature multiple buyers and multiple sellers, which is applicable to a wide range of IoT scenarios. Nevertheless, the existing double auction mechanisms mostly focus on the design of truthfulness and ignore the importance of privacy preservation. Hence, in this article, we propose PP-SPEC, a truthful and privacy-preserving double auction mechanism that takes spatial reuse, spectrum heterogeneity, and multiminded bidders into account, and provides full privacy in terms of asking prices, bidding values, and locations. To tackle the challenge of privacy-preserving comparison over ciphertext field, we carefully designed a set of generic privacy-preserving ciphertext comparison protocols (PIC), including basic PIC (B-PIC) and extended PIC (E-PIC), by integrating additive homomorphic encryption and garbled circuits. Furthermore, we have theoretically proved the truthfulness and security of PP-SPEC. We have implemented and evaluated PP-SPEC, whose experimental results show high performance and practicability of PP-SPEC for real-life applications.

The selection of routes is an important issue in wireless networks when network coding is used. Existing research formulate network-coding-aware routing as a linear optimization program. However, deploying such method in real wireless networks is impractical. To solve this issue, in this paper, a practical network-coding aware routing protocol is proposed for unicast sessions in wireless networks. The protocol is based on a novel routing metric design that captures the characteristics of network coding and unicast sessions. To ensure the novel routing metric can operate with practical and widely available path calculation mechanisms, a unique mapping process is used to map a real wireless network to a virtual network. The mapping process ensures that the paths with the biggest coding opportunities will be selected by commonly used path calculation mechanisms. Simulation results show that the proposed routing protocol is effective.