Software containerization technologies for resource-limited devices enable multi-tenant microcontrollers, which allow running multiple applications with different permission levels. However, current solutions lack run time configuration over various settings on container scheduling and container permissions to host resources. This limits the applicability of constrained containerization in dynamic and heterogeneous environments. This paper introduces TinyContainer, a lightweight software container management middleware designed for multi-tenant microcontrollers. TinyContainer provides per-container configurable scheduling and fine-grained access control to host resources through a metadata-driven approach, supporting multiple runtimes via a runtime abstraction layer. We analyze the performance of TinyContainer with a small WebAssembly runtime, CS4WAMR, and RIOT OS, a common RTOS. We report on experiments using popular IoT boards based on various Cortex-M microcontrollers. We show the endpoint system brought by TinyContainer allowing to regulate access of containers to host resources and provide host services to containers with an overhead of up to 4 ms per call. In particular, we showcase a TinyML use case, whereby containers retain data and model weights, while model inference is delegated to native host RTOS services.

The Metaverse requires intelligent QA services for applications like digital twins and avatar assistants, yet assembling high-quality domain-specific data is challenging. We introduce a novel agent-oriented augmentation pipeline using open-source LLMs (LLaMA and DeepSeek) to autonomously generate and refine synthetic QA pairs. Agents leverage chain-of-thought prompts and feedback loops to iteratively validate and improve responses. By augmenting a limited Stack Overflow R-tag dataset (2,000 examples) with 4,500 synthetic items, our method boosts BERTScore by 11.2% and F1 by 8.0% over static zero-shot baselines. This transparent, cost-effective workflow lays groundwork for scalable QA augmentation in virtual environments.

International audience

Microservices architecture has become an increasingly common approach for building complex software systems. With the distributed nature of microservices, multiple actors can contribute to a service, hence affecting the dynamics of the environment and making the management of liabilities and trust more challenging. Service-Level Agreements (SLAs) are critical in that regard and any SLA violation or breach can result in significant financial damages. One major challenge is the lack of indicators to handle the liability and trust in such architectures. To address this issue, in this paper we propose a liability and trust analysis framework, namely the LASM Analysis Service (LAS), for multi-actor dynamic microservices that employs Machine Learning (ML) techniques.

Cache Pollution Attacks (CPA) are a growing concern in Named Data Networking (NDN) due to their potential to disrupt network services and compromise data integrity. While several defence mechanisms have been developed, they often struggle to keep up with the evolving nature of such attacks. This paper introduces a cutting-edge approach for detecting and mitigating CPA in NDN, utilizing Deep Reinforcement Learning (DRL). By employing a DRL framework, we leverage the power of deep neural networks to learn complex patterns within network traffic. Our DRL algorithm is designed to analyze the intricate dynamics of NDN environments and make informed decisions about cache management to protect against CPA. The agent’s learning process involves continuous interaction with the network, allowing it to adapt to CPA attack vectors and evolving NDN network conditions. The DRL-based mitigation mechanism is evaluated using the official NDNSim simulation environment. The results show that the DRL agent effectively identifies and mitigates CPA with high accuracy, thereby improving the Cache Hit Ratio, while incurring an acceptable increase in memory usage.

Vehicular Ad-Hoc Networks (VANETs) encounter various security threats, such as greedy behaviour attacks, with most existing research focusing on the CSMA/CD protocol. This paper investigates the TDMA protocol, specifically Distributed Time Division Multiple Access (DTMAC). In this paper, we focused on identifying and addressing four novel types of greedy actions that attackers can take advantage of, revealing vulnerabilities that have not been investigated before. To detect these behaviours, we propose a watchdog model designed to analyse network traffic, extract relevant features, and generate datasets at varying levels of network density. We use Support Vector Machine (SVM) classifier with Radial Basis Function (RBF) kernel to identify attackers in the network, employing Grid Search Cross-Validation (GSCV) for optimal results. The effectiveness of our proposed solution is evaluated through in-depth simulations using the NS2 simulator and Python. The results show that the proposed detection method can achieve a high detection rate with an accuracy attaining 95% in low density scenario and 80 % in high density scenario.

Transitioning edge and cloud computing in 5G networks towards service-based architecture increases their complexity as they become even more dynamic and intertwine more actors or delegation levels. In this paper, we demonstrate the Liability-aware security manager Analysis Service (LAS), a framework that uses machine learning techniques to compute liability and trust indicators for service-based architectures such as cloud microservices. Based on the commitments of Service Providers (SPs) and real-time observations collected by a Root Cause Analysis (RCA) tool GRALAF, the LAS computes three categories of liability and trust indicators, specifically, a Commitment Trust Score, Financial Exposure, and Commitment Trends.

To address the growing amount of data generated by the Internet of Things (IoT), Network Functions Virtualization (NFV), 5G, Fog and Edge computing converge to form a Cloud-to-IoT continuum. This complex multi-layer architecture involves several actors among which responsibilities may be blurred. Existing profiles mostly describe deployment aspects and elude responsibility, accountability or liability characteristics. Moreover, the multiplicity of component profiles prevents uniform service management. This paper proposes TRAILS (sTakeholder Responsibility, AccountabIity and Liability deScriptor), an extension of the TOSCA NFV profile that merges the existing profiles and adds a description of the responsibilities and accountabilities of supply chain actors. This allows a uniform and liability-aware management of services involving IoT devices, fog, edge and cloud nodes. To show the usability of our model, we discuss the ecosystem around the generation of the proposed extension as well as its application in an ontology-based referencing module of a liability-aware service manager that we designed.

Outlier detection has been widely explored and applied to different real-world problems. However, outlier characterization that consists in finding and understanding the outlying aspects of the anomalous observations is still challenging. In this paper, we present a new approach to simultaneously detect subspace outliers and characterize them. We introduce the Dimension-wise Local Outlier Factor (DLOF) function to quantify the degree of outlierness of the data points in each feature dimension. The obtained DLOFs are used in an outlier ensemble so as to detect and rank the anomalous points. Subsequently, the same DLOFs are analyzed in order to characterize the detected outliers with their relevant subspace and their same-type anomalies. Experiments on various datasets show the efficacy of our method. Indeed, we demonstrate through an experimental evaluation that the proposed approach is competitive compared to the existing solutions in terms of both detection and characterization accuracy.

Advances in internet of things (IoT) and cloud computing technologies have led to the emergence of new applications such as in e-health domain bringing convenience for both physicians and patients. However, the development of these new technologies makes users' privacy vulnerable. The threats on private data may arise from service providers themselves voluntarily or by inadvertence. As a result, the data owner would like to ensure that the collected data are securely stored and accessed only by authorised users. In this paper, we propose a novel data-owner centric privacy model in IoT/cloud environment. Our model combines two promising paradigms for data privacy, which are attribute-based encryption (ABE) and blockchain, to strengthen the data-owner privacy protection. We propose a new scheme of ABE that is, in one hand, suitable to resource-constrained devices by externalising the computing capabilities, thanks to fog computing paradigm and, in the other hand, combined with a blockchain-based protocol to overcome a single point of trust and to enhance data-owner access control.

The widespread decentralized applications and Blockchain components significantly boost the security frameworks in many vertical applications and use-cases including different secured payment methods and smart contracts. The integral part of any smart contract is the validation of the stake-holder identity, in general, while ideally being achieved without the third-party involvement. Recent industrial research works introduce the sovereign-identity system, where Blockchain becomes a decentralized component to establish a self-certified identity and to avoid a centralized trust third party. Hence, the classification of distributed transactions with respect to identity validation across several users becomes more challenging, especially because of the massive and sensitive identities that are issued through many users and IoT devices and that are used to validate transactions. In this context, it is important to identify and classify the malicious and non-malicious types of transactions. Our proposed method achieves the target of identity classifications from variety of transaction data. Since different users may have different device usage patterns, the data samples and labels located on any individual device may follow a different distribution, which cannot represent the global data distribution. Therefore, the solution could be bi-focal to compensate the gap. This paper coins the approach of hybridizing the consensus where as to initiate a machine learning mechanism to collect the local data globally through a permission driven and a federated approach. We introduce here a Federated Reinforcement learning to be improvised for distributed independent data as a policy of consortium while binding the proof of consensus more centrally authenticated.

Vehicular Ad hoc Networks (VANETs), while promising new approaches to improving road safety, must be protected from a variety of threats. Greedy behavior attacks at the level of the Medium Access (MAC) Layer can have devastating effects on the performance of a VANET. This kind of attack has been extensively studied in contention-based MAC protocols. Hence, in this work, we focus on studying the impact of such an attack on a contention-free MAC protocol called Distributed TDMA-based MAC Protocol DTMAC. We identify new vulnerabilities related to the MAC slot scheduling process that can affect the slot reservation process on the DTMAC protocol and we use simulations to evaluate their impact on network performance. Exploitation of these vulnerabilities would result in a severe waste of channel capacity where up to a third of the free slots could not be reserved in the presence of an attacker. Moreover, multiple attackers could cripple the channel and none could acquire a time slot.

Summary The surge of the presence of personal mobile devices in multi‐environment makes a significant attention to the mobile cloud computing (MCC). Along with this concern, security issues also appear as a barrier to prevent the propagation of this trend. This paper focuses on an important feature in many security protocols and application, which is the device attestation in the MCC. The existing remote attestation mechanisms are currently used in trusted computing environment such as binary attestation and property‐based attestation. In this paper, by taking advantage of the combination of technologies and trends, such as trusted platform module, cloud computing, and bring your own device, we introduce property‐based token attestation to secure the mobile user in the enterprise cloud environment. In order to accomplish a secure MCC environment, security threats need to be studied and acted accordingly, and therefore, we first represent the common threats and then explain a novel attestation schema for addressing these threats by providing security proofs. In addition, Scyther is in use to verify the correctness of our protocol.

Nowadays, computers, as well as smart devices, are connected through communication networks making them more vulnerable to attacks. Honeypots are proposed as deception tools but usually used as part of a proactive defense strategy. Hence, this article demonstrates how honeypots data can be analyzed in an active defense strategy. Furthermore, anomaly detection based on unsupervised machine learning techniques allows to build autonomous systems and to detect unknown anomalies without the need for prior knowledge. However, the unsupervised techniques applied for honeypots data analysis do not value the advantages of these tools’ data, particularly the high probability that they include a large number of previously unseen anomalies with unexpected and diverse patterns. Therefore, in the present work, the aim is to improve the unsupervised anomaly detection in honeypots data by varying the data feature subset and the parameterization of the anomaly detection algorithm. To this purpose, an outlier ensemble with LOF (Local Outlier Factor) as a base algorithm is proposed. The ensemble outperforms existing solutions as depicted in the experiments where a detection rate higher than 92% is achieved.

Enabling Named Data Networking (NDN) in realworld Internet of Things (IoT) deployments becomes essential to benefit from Information Centric Networking (ICN) features in current IoT systems. To design realistic NDN-based communication solutions for IoT, revisiting mainstream technologies such as low-power wireless standards may be the key. In this paper, we explore the NDN forwarding over IEEE 802.15.4 by modeling a broadcast-based forwarding strategy. Based on the observations, we adapt the Carrier-Sense Multiple Access (CSMA) algorithm of 802.15.4 to improve NDN wireless forwarding while reducing broadcast effects in terms of packet redundancy, round-trip time and energy consumption.

Soil degradation and hot climate explain the poor yield of olive groves in North Algeria. Edaphic and climatic data were collected from olive groves and analyzed by Self-Organizing Maps (SOMs). SOM is a non-supervised neural network that projects high-dimensional data onto a low-dimension topological map, while preserving the neighborhood. In this paper, we show how SOMs enable farmers to determine clusters of olive groves, to characterize them, to study their evolution and to decide what to do to improve the nutritional quality of oil. SOM can be integrated in the Intelligent Farming System to boost conservation agriculture.

E-health applications are one of the most promising applications in the context of internet of things (IoT). Nevertheless, resource constraints and security issues in IoT are the main barriers for their deployment. Among security issues, authentication and data confidentiality are required to secure e-health applications. In this paper, we propose a new authentication and key agreement scheme for e-health applications in the context of IoT. This scheme allows a sensor node, a gateway node, and a remote user to authenticate each other and secure the collection of health-related data. The proposed scheme is based on lightweight symmetric cryptography since it uses nonces, exclusive-or operations, and simple hash functions. Besides, it takes into consideration the sensors location to provide an efficient authentication. To assess the proposed scheme, we conduct a theoretical and an automated security analysis using AVISPA tool. The results show that our scheme preserves the security properties, and ensures resilience against different types of attacks. In addition, we evaluate and compare both communication and computational costs with some existing authentication schemes. The obtained results prove that it provides authentication with low energy cost.

In this article we study the use of the Support Vector Machine technique to estimate the probability of the reception of a given transmission in a Vehicular Ad hoc NETwork (VANET). The transmission takes place between a vehicle and a RoadSide Unit (RSU) at a given distance and with a given transmission rate. The RSU computes the statistics of the receptions and is able to compute the percentage of successful transmissions versus the distance between the vehicle and the RSU and the transmission rate. Starting from this statistic, a Support Vector Machine (SVM) scheme can produce a model. Then, given a transmission rate and a distance between the vehicle and the RSU, the SVM technique can estimate the probability of a successful reception. This probability can be used to build an adaptive technique which optimizes the expected throughput between the vehicle and the RSU. Instead of using transmission values of a real experiment, we use the results of an analytical model of CSMA that is customized for 1D VANETs. The model we adopt to perform this task uses a Matern selection process to mimic the transmission in a CSMA IEEE 802.11p VANET. With this model we obtain a closed formula for the probability of successful transmissions. Thus with these results we can train an SVM model and predict other values for other couples : distance, transmission rate. The numerical results we obtain show that SVM seems very suitable to predict the reception probability in a VANET.

International audience

Offloading is one major type of collaborations between mobile devices and clouds to achieve less execution time and less energy consumption. Offloading decisions for mobile cloud collaboration involve many decision factors. One of important decision factors is the network unavailability that has not

In this article, a new mobile Cloud service model is presented. It offers a dynamic and efficient remote access to information services and resources for mobile devices. Mobile Cloud computing has been evolved as a distributed service model, where individual mobile users are Cloud service providers. Compared to traditional Internet-centric Cloud service models, the complexity of mobile service management in a dynamic and distributed service environment is increased dramatically. To address this challenge, we propose to establish an OSGi-based mobile Cloud service model — MCC-OSGi — that uses OSGi Bundles as the basic mobile Cloud service building components. The proposed solution supports OSGi bundles running on both mobile devices and Cloud-side virtual machine OS platforms, and the bundles can be transferred and run on different platforms without compatibility issues. The presented solution is achieved: 1) by incorporating OSGi into Android software development platform, 2) by setting up a Remote-OSGi on the Cloud and on mobile devices, and 3) by defining three service architecture models. The presented solution is validated through a demonstrative application with relevant performance measurements.

With rapid growth of mobile devices and the emergency of mobile cloud services, it is a trend to use mobile devices for mobile-centric applications, and expand the mobile capabilities and provide needed security by mobile cloud services. However, due to the mobility of the device and the semitrust of the mobile cloud, how to build trust in the mobile applications is a big concern. In this paper, we propose a dual-root trust online transaction model that provides a dualroot trust model including both the user's mobile device and a delegation mobile cloud. We design a dual-root trust protocol by leveraging a modified CP-ABE cryptography and the trust execution environment embedded in a mobile device to provide device-specific transaction confirmations for online transactions initiated by the mobile user. The performance evaluation of the protocol demonstrates that it is a lightweight scheme for mobile devices since most cryptographic functions are delegated from users to the mobile cloud.

Current applications are distributed in nature and manipulate time-critical databases with firm-deadline transactions. A transaction submitted to a master site is splitted into sub transactions executed on participant sites which manage each a local database. In this paper, we propose a Java platform based on a protocol that manages real-time distributed transactions with firm-deadline, in the context of possible overload situations and imprecise data acceptable utilization

Over the last decade (approx. 1991), mobile computing technologies have led to increasing demand for processing real time transactions by many current applications. These applications are composed of large distributed databases located on fixed sites and small parts of the database located on mobile hosts (MHs). The MHs and the fixed sites communicate via wireless networks. Mobile users often require timely access to information. We study how to ensure the continuity of soft real time transaction computing despite the disconnection problems that often occur between MHs and fixed sites. We propose a soft real time transaction scheduling protocol, called disconnection tolerance protocol (DT protocol), that efficiently manages the frequent network disconnections. We focus particularly on query transactions. DT protocol is based on an extended transaction scheme where controlled transactions deadline overruns and controlled data imprecision are used.

Real-time database applications are distributed in nature. Incorporating distributed data into a real-time database framework incurs complexity associated with transaction concurrency control and database recovery in a distributed context. This article presents an algorithm that manages soft real-time transactions in a distributed database. It uses a specific causal-ordering protocol to ensure the precedence relationships between transactions. Our algorithm is based on a technique which subdivides transactions into sets. Then the protocol virtually serializes the executions on distributed servers by using causal phase ordering properties. Causal phases are created according to transaction conflicts that may occur between transaction sets. Transactions of the same phase are scheduled according to their criticality and transactions of two successive phases are ensured to commit in a causal partial order This strategy permits us to reduce the execution time, allowing more transactions to meet their deadlines.