In today’s increasingly digital landscape, continuous user authentication on smartphones has become crucial for safeguarding sensitive information. Behavioral biometrics, particularly facial recognition, is emerging as a powerful tool to enhance security, leveraging advanced machine learning and deep learning models. However, traditional approaches often involve sharing personal data for training, raising significant privacy concerns. Federated Learning (FL) addresses this issue by enabling decentralized model training directly on users’ devices, thus preserving privacy. Despite its promise, FL faces unique challenges in continuous user authentication, particularly due to the non-IID (non-Independent and Identically Distributed) nature of the data where every client has access only to one label data samples. While Convolutional Neural Networks (CNNs) are commonly employed in facial recognition, they struggle with the complexities of localized features and data distribution variance. This article explores all the possible architectures in order to tackle the CNNs weaknesses, we leverage the Vision Transformers (ViTs) and MLP-Mixers as a promising alternative to CNNs in the context of facial recognition. ViTs and MLP-Mixers excel in capturing global context and hierarchical representations, making them better suited to handle the complexities of continuous user authentication in FL. Through a case study, we demonstrate how integrating ViTs and MLP-Mixers into FL frameworks for facial recognition can enhance prediction accuracy and reduce weight divergence, offering a more robust and secure solution compared to other models.

Intrusion Detection Systems (IDS) are critical for securing modern networks and systems; however, traditional IDS approaches often rely solely on network traffic or host-level data, limiting their ability to detect sophisticated threats such as AI-driven, zero-day, and polymorphic attacks. This limitation is even more pronounced in highly dynamic environments, such as cloud-based and containerized architectures, where the potential of leveraging rich contextual information remains underexplored. To address this gap, we propose a novel Multidimensional Intrusion Detection System (MIDS) approach that integrates multiple data dimensions, including network and container features, to enhance threat detection in containerized environments. By combining these dimensions, MIDS provides a holistic view of the cluster, enabling more comprehensive threat analysis and improved detection accuracy. We introduce a new data merging technique that unifies network flows with container metrics to facilitate multidimensional analysis. Due to the lack of existing datasets containing such heterogeneous data, we generated two MIDS datasets by simulating prevalent attacks on two well-known containerized applications deployed on Kubernetes (K8s): one using the Damn Vulnerable Web Application (DVWA) and the other using Google's Bank of Anthos (BoA). These simulations included Denial of Service (DoS), brute force, and SQL injection attacks. We evaluated state-of-the-art machine learning (ML) algorithms on these datasets, including SVM, XGBoost, and DNN. The experimental results demonstrate that using MIDS enables ML algorithms to achieve up to 8.69 % and 30.07 % higher F1 scores compared to using only network or container data, respectively. Feature analysis highlights the complementary contributions of network and container dimensions, showcasing the effectiveness of the proposed multidimensional approach for intrusion detection in containerized environments.

Federated learning (FL) gained importance in sensitive Internet of Things (IoT) environments by creating a privacy-preserving ecosystem where participants share machine-learning models instead of raw data. However, FL shifts data control away from the server, exposing it to non-independent and identically distributed (non-IID) problems caused by biased clients (IoT devices). This hinders the learning process by increasing execution time and cost. Current solutions alter the FL structure or compromise privacy by offloading clients’ raw data to an external server. To mitigate these limitations, this article proposes a solution to the non-IID problem by introducing an initialization phase, orchestrated by the server, that constructs high-quality initial models. These models can boost FL accuracy and convergence, regardless of whether IoT participants exhibit non-IID properties. Our proposed initialization scheme involves clients training over the same model sequentially, lessening the impact of aggregation, a primary cause of model degradation in federated approaches. Furthermore, a regulator algorithm deployed on the server maintains model integrity and mitigates catastrophic forgetting, enhanced by a client selection process that emphasizes the compatibility of IoT clients to cooperate effectively. Moreover, we devise an optimization scheme based on clustering and genetic algorithms to reduce the selection time while ensuring optimal performance in IoT networks. Experiments on MNIST, KDD, and CIFAR10 data sets show promising results in terms of initial model resiliency against catastrophic forgetting and non-IID settings. Additionally, our findings suggest that our approach can significantly enhance FL training in IoT applications by achieving 40% higher initialization accuracy and a 20% average improvement in end results compared to conventional methods, all while reducing computation time by 80% compared to similar approaches.

Conventional systems are usually constrained to store data in a centralized location. This restriction has either precluded sensitive data from being shared or put its privacy on the line. Alternatively, federated learning (FL) has emerged as a promising privacy-preserving paradigm for exchanging model parameters instead of private data of Internet of Things (IoT) devices known as clients. FL trains a global model by communicating local models generated by selected clients throughout many communication rounds until ensuring high learning performance. In these settings, the FL performance highly depends on selecting the best available clients. This process is strongly related to the quality of their models and their training data. Such selection-based schemes have not been explored yet, particularly regarding participating clients having high-quality data yet with limited resources. To address these challenges, we propose in this article FedAUR, a novel approach for an adaptive upgrade of clients resources in FL. We first introduce a method to measure how a locally generated model affects and improves the global model if selected for aggregation without revealing raw data. Next, based on the significance of each client parameters and the resources of their devices, we design a selection scheme that manages and distributes available resources on the server among the appropriate subset of clients. This client selection and resource allocation problem is thus formulated as an optimization problem, where the purpose is to discover and train in each round the maximum number of samples with the highest quality in order to target the desired performance. Moreover, we present a Kubernetes-based prototype that we implemented to evaluate the performance of the proposed approach.

Fog computing extends the concept of cloud computing by allowing services, embedded into virtual machines or containers, to be placed at the edge of the network in the proximity of the end devices. However, due to the huge increase in the number of user requests, placing containers onto fog devices becomes a challenging task. In this work, we address the problem of large-scale container placement in fog computing environments. We propose a machine learning-based K-means clustering solution, which we integrate into the Genetic Algorithm (GA) to improve the selection of the initial population. We first formulate the container placement problem as a multi-objective optimization model with several (conflicting) objectives and then propose a cluster-based GA approach to solve the problem in an efficient manner. Simulation results suggest that our solution outperforms one state-of-the-art approach in terms of effectiveness and efficiency.

Information technology (IT) service providers are nowadays moving toward cloud computing. Software-as-a-service (SaaS) refers to cloud service-oriented web applications. As a result of computation outsourcing, a customer (tenant) can subscribe to a self-service SaaS and use it on a pay-per-use basis. To reduce resource costs, a single instance of SaaS serves multiple tenants (multi-tenancy). However, outsourcing and multi-tenancy bring about new security issues. Indeed, tenants lose control over the source code, databases and infrastructure and cannot deploy their own intrusion detection system (IDS). In this context, the provider must not only integrate their preferred IDS into a public cloud, but also protect the tenants according to their individual security requirements. We put forth a multi-tenant intrusion detection framework as a service for SaaS (MTIDaaS) to allow the provider to undertake such integration. Our MTIDaaS has been integrated and tested in a real public cloud environment. It provides security-as-a-service (SecaaS) for both provider and tenant with high levels of portability, flexibility and cost-effectiveness. The experimental results demonstrate that our MTIDaaS offers easy integration of IDS with little virtualization overhead and insignificant impact on HTTP response time.

Driven by privacy concerns and the visions of deep learning, the last four years have witnessed a paradigm shift in the applicability mechanism of machine learning (ML). An emerging model, called federated learning (FL), is rising above both centralized systems and on-site analysis, to be a new fashioned design for ML implementation. It is a privacy-preserving decentralized approach, which keeps raw data on devices and involves local ML training while eliminating data communication overhead. A federation of the learned and shared models is then performed on a central server to aggregate and share the built knowledge among participants. This article starts by examining and comparing different ML-based deployment architectures, followed by in-depth and in-breadth investigation on FL. Compared to the existing reviews in the field, we provide in this survey a new classification of FL topics and research fields based on thorough analysis of the main technical challenges and current related work. In this context, we elaborate comprehensive taxonomies covering various challenging aspects, contributions, and trends in the literature, including core system models and designs, application areas, privacy and security, and resource management. Furthermore, we discuss important challenges and open research directions toward more robust FL systems.

In the age of cloud-native implementation both monitoring and automated orchestration plays an important role for managing these applications' life cycle. There are lot of available monitoring tools which are able to monitor these implementations but they lack the application related metrics and also the automated orchestration is still at a premature stage. In this article we are proposing a framework that takes application related metrics along with the absolute and relative metrics and pro-actively performs automated orchestration using machine learning for scalability.

The evolving of context-aware applications are becoming more readily available as a major driver of the growth of future connected smart, autonomous environments. However, with the increasing of security risks in critical shared massive data capabilities and the increasing regulation requirements on privacy, there is a significant need for new paradigms to manage security and privacy compliances. These challenges call for context-aware and fine-grained security policies to be enforced in such dynamic environments in order to achieve efficient real-time authorization between applications and connected devices. We propose in this work a novel solution that aims to provide context-aware security model for Android applications. Specifically, our proposition provides automated context-aware access control model and leverages Attribute-Based Encryption (ABE) to secure data communications. Thorough experiments have been performed and the evaluation results demonstrate that the proposed solution provides an effective lightweight adaptable context-aware encryption model.

Recently, we are attending to the proliferation of Cloud Computing (CC) as the new trending internet-based-Platform. Thanks to the outsourcing paradigm, CC is enabling many services. Software as a Service (SaaS) is one of those cloud-based-services. Indeed, SaaS model allows providers to reduce the cost of maintenance and management by transferring traditional on premise deployment to public Cloud. Clients can subscribe, in self-service, to SaaS services based on a pay-per-use model. However, since user data are outsourced to the Cloud, serious security breaches are rising and could harm the reputation of providers and slow down the subscription of clients. SQL injection attack (SQLIA) is one of the most critical SaaS vulnerabilities that allows attackers to violate the availability, confidentiality and integrity of user data. In this paper, we propose SQL injection intrusion detection framework as a service for SaaS providers, SQLIIDaaS, which allows a SaaS provider to detect SQLIAs targeting several SaaS applications without reading, analyzing or modifying the source code. To achieve SQL query/HTTP request mapping, we propose an event correlation based on the similarity between literals in SQL queries and parameters in HTTP requests. SQLIIDaaS is integrated and validated in Amazon Web Services (AWS). A SaaS provider can subscribe to this framework and launch its own set of virtual machines, which holds on-demand self-service, resource pooling, rapid elasticity, and measured service properties.

The main problem of firewall configuration is to ensure the filtering rules consistency w.r.t. a global security policy. However, the overall firewalls configuration on a network, which requires a human intervention, is often an error-prone process. Therefore, automated solutions are needed in order to detect firewall configuration inconsistencies and to check the inter-firewalls consistency. In this paper, we propose a formal modeling and verification framework based on model checking. It allows to verify automatically the end-to-end security behavior of a set of firewalls w.r.t. a global security policy. To deal with state explosion problem, two abstractions are proposed and evaluated in term of space and time complexity, according to the network size and connectivity rate.

In this paper, we propose an attribute based access control (ABAC) approach for safely sharing knowledge in a collaborative environment. Indeed, existing similar systems facilitate collaboration at the risk to convey doubtful information and sometimes serve as a gate to vandalism. Our system called