The Mean Opinion Score (MOS) is a standard metric for assessing the Quality of Experience (QoE) in Voice over IP (VoIP) applications. Accurate prediction of how network conditions influence MOS is critical for network planning, operation, and optimization. This requires modeling traffic flows with application-level granularity, which significantly increases both the dimensionality and structural complexity of the learning task. The ability to achieve efficient, robust, and generalizable data-driven learning in the presence of such complexity depends critically on the careful design of model architectures. This paper presents NetMOS, a Graph Neural Network (GNN) architecture specifically crafted to model IP networks and predict VoIP MOS scores. NetMOS models IP networks as heterogeneous graphs and designs a two-stage Message Passing Neural Network (MPNN) to capture both permutation invariant and sequential dependencies in traffic flow and network interactions. It uses a Gated Recurrent Unit (GRU) layer to model the ordered influence of links along a traffic path and introduces a customized attention layer with Sigmoid activations to model the cumulative effects of multiple flows on the links. Simulations demonstrate that NetMOS consistently outperforms conventional GNN-based baselines across diverse network topologies in Mean Absolute Error (MAE), R² score, Pearson correlation, and Spearman correlation. NetMOS generalizes effectively beyond the training topology, maintaining high prediction accuracy on unseen network topologies and varying network activity durations without retraining. NetMOS also provides MOS predictions 44×–170× faster than packet-level simulations.

As deep learning–based AI proliferates, model theft and plagiarism pose increasing Intellectual Property (IP) risks. However, watermarking alters model weights and can degrade performance, while fingerprinting often merely verifies uniqueness or requires heavy computation. In this article, we propose a Neural Network Fingerprinting-Based Model Authentication Code (NNFMAC) scheme that verifies both model uniqueness and ownership without affecting performance. NNFMAC extracts key weights from a trained model, applies a median-based method to generate a unique binary fingerprint, and uses this fingerprint as a codebook to encode ownership information via a newly designed index-based function with expansion, producing reliable authentication codes. This non-intrusive approach integrates fingerprinting for uniqueness verification and authentication coding for ownership verification, delivering comprehensive model IP protection while preserving the model’s original performance. Extensive experiments demonstrate that NNFMAC preserves model accuracy without additional training overhead, unlike other watermarking schemes that degrade accuracy by 0.36–1.53%. It achieves bit error rates of 0.12 under weight perturbation, 0.03 under fine-tuning, 0.08 under pruning, and 0.09 under weight shifting attacks, which are substantially lower than the 0.51, 0.49, 0.46, and 0.22 reported in prior work, while consistently outperforming state-of-the-art schemes in effectiveness, efficiency, and robustness.

Model training is increasingly offered as a service for resource-constrained data owners to build customized models. Split Learning (SL) enables such services by offloading training computation under privacy constraints, and evolves towardserverlessandmulti-clientsettings where model segments are distributed across training clients. This cooperative mode assumes partial trust: data owners hide labels and data from trainer clients, while trainer clients produce verifiable training artifacts and ownership proofs. We presentCliCooper, a multi-clientcooperative SL framework tailored for cooperative model training services in heterogeneous and partially trusted environments, where one client contributes data, while others collectively act as SL trainers.CliCooperbridges the privacy and trust gaps through two new designs. First, Differential Privacy–based activation protection and secret label obfuscation safeguard data owners' privacy without degrading model performance. Second, a dynamic chained watermarking scheme cryptographically links training stages on model segments across trainers, ensuring verifiable training integrity, robust model provenance, and copyright protection. Experiments show thatCliCooperpreserves model accuracy while enhancing resilience to privacy and ownership attacks. It reduces the success rate of clustering attacks (which infer label groups from intermediate activation) to 0%, decreases inversion-reconstruction (which recovers training data) similarity from 0.50 to 0.03, and limits model-extraction–based surrogates to about 1% accuracy, comparable to random guessing.

Cloud-hosted large language models (LLMs) have become the de facto planners in agentic systems, coordinating tools and guiding execution over local environments. In many deployments, however, the environment being planned over is private, containing source code, files, credentials, and metadata that cannot be exposed to the cloud. Existing solutions address adjacent concerns, such as execution isolation, access control, or confidential inference, but they do not control what cloud planners observe during planning: within the permitted scope, raw environment state is still exposed. We introduce PLANTWIN, a schema-constrained projection based architecture for cloud-assisted planning that prevents raw local context from leaving the local boundary. The key idea is to project the real environment into a planning-oriented digital twin: a schema-constrained and de-identified abstract graph that preserves planning-relevant structure while removing reconstructable details. The cloud planner operates solely on this sanitized twin through a bounded capability interface, while a local gatekeeper enforces safety policies and cumulative disclo sure budgets. We further formalize the privacy–utility trade-off as a capability granularity problem, define architectural privacy goals using (k,δ)-anonymity and ε-unlinkability, and mitigate compositional leakage through multi-turn disclosure control. We implement PLANTWIN as middleware between local agents and cloud planners and evaluate it on 60 agentic tasks across ten domains with four cloud planners. PLANTWIN achieves SND = 1.0 against passive-observer adversaries, while maintaining planning quality close to full-context systems: three of four cloud planners achieve PQS > 0.79, within ∼4% of the no-privacy Raw Context baseline; the privacy-hardening pipeline stages add less than 2.2 percentage points of further PQS variation. Residual identifiability under stronger structural-fingerprint adversaries persists and is bounded by deployment-side controls rather than architecturally eliminated.

We introduce Split Unlearning, a novel machine unlearning technology designed for Split Learning (SL), enabling the first-ever implementation of Sharded, Isolated, Sliced, and Aggregated (SISA) unlearning in SL frameworks. Particularly, the tight coupling between clients and the server in existing SL frameworks results in frequent bidirectional data flows and iterative training across all clients, violating the ''Isolated'' principle and making them struggle to implement SISA for independent and efficient unlearning. To address this, we propose SplitWiper with a new one-way-one-off propagation scheme, which leverages the inherently ''Sharded'' structure of SL and decouples neural signal propagation between clients and the server, enabling effective SISA unlearning even in scenarios with absent clients. We further design SplitWiper+ to enhance client label privacy, which integrates differential privacy and label expansion strategy to defend the privacy of client labels against the server and other potential adversaries. Experiments across diverse data distributions and tasks demonstrate that SplitWiper achieves 0% accuracy for unlearned labels, and 8% better accuracy for retained labels than non-SISA unlearning in SL. Moreover, the one-way-one-off propagation maintains constant overhead, reducing computational and communication costs by 99%. SplitWiper+ preserves 90% of label privacy when sharing masked labels with the server.

Network Dismantling (ND) seeks to identify the smallest subset of nodes whose removal fragments a network into disconnected components. Traditional methods rely on fixed centrality heuristics or supervised models trained on synthetic data, often failing to generalize across diverse topologies. We introduce GRLND, a Graph Reinforcement Learning framework that enables fully unsupervised, structure-aware dismantling through end-to-end optimization. GRLND formulates ND as a single-step Markov Decision Process (MDP), where the action is a binary mask indicating the nodes to be removed-allowing the agent to generate a complete dismantling strategy in a single forward pass while accounting for the joint effect of multiple node removals. The framework combines a Graph Convolutional Network (GCN) for topological encoding with a stochastic policy trained via the REINFORCE algorithm. Additionally, we design a task-specific reward that balances connectivity disruption and removal sparsity, guiding the policy toward compact yet high-impact dismantling solutions. Experiments on both synthetic and real-world networks show that GRLND consistently outperforms classical heuristics and recent learning-based methods, achieving strong generalization without requiring labels or pretraining.

Reinforcement Learning (RL) optimizes Traffic Signal Control (TSC) to reduce congestion and emissions, but real-world TSC systems face challenges like adversarial attacks and missing data, leading to incorrect signal decisions and increased congestion. Existing methods, limited to offline data predictions, address only one issue and fail to meet TSC's dynamic, real-time needs. We propose RobustLight, a novel framework with an enhanced, plug-and-play diffusion model to improve TSC robustness against noise, missing data, and complex patterns by restoring attacked data. RobustLight integrates two algorithms to recover original data states without altering existing TSC platforms. Using a dynamic state infilling algorithm, it trains the diffusion model online. Experiments on real-world datasets show RobustLight improves recovery performance by up to 50.43\% compared to baseline scenarios. It effectively counters diverse adversarial attacks and missing data. The relevant datasets and code are available at Github.

To secure Intra-Vehicular Networks (IVN) from cyberattacks, we introduce Fed-CMA, a hierarchical federated learning framework that delivers robust personalized Intrusion Detection System (IDS) resilient to data heterogeneity and poisoning attacks. Standard Federated Learning (FL) methods fail in realistic vehicular settings due to non-IID data from diverse Electronic Control Units (ECUs) and driving conditions. Fed-CMA overcomes this by integrating dynamic, context-aware clustering with intra-cluster matched averaging. By grouping clients based on a multi-faceted similarity metric, it isolates anomalous data and potential threats. It then builds specialized models for each cluster using a sophisticated neuron-matching aggregation technique. This synergistic design not only mitigates the negative impacts of data skew but also enhances personalization, leading to a more secure and effective FL deployment in safety-critical automotive systems. Empirically, Fed-CMA proves its robustness, outperforming all baselines with a personalized accuracy of 96.87% under severe data skew.

Trust management systems (TMS) are crucial for managing trust in distributed environments. The rise of decentralized systems and blockchain has sparked interest in credential-based decentralized trust management systems (DTMS). This paper bridges the gap between theory and practice through a systematic review of credential-based DTMS. We analyze existing DTMS solutions through multiple dimensions, including their architectural designs, credential mechanisms, and trust evaluation models. Our survey provides a detailed taxonomy of credential-based DTMS approaches and establishes comprehensive evaluation criteria for assessing DTMS implementations. Through extensive analysis of current systems and implementations, we identify critical challenges and promising research directions in the field. Our examination offers valuable insights for researchers and practitioners working on DTMS, particularly in areas such as access control, reputation systems, and blockchain-based trust frameworks.

Unlearning in Federated Learning (FL) presents significant challenges, as models grow and evolve with complex inheritance relationships. This complexity is amplified when blockchain is employed to ensure the integrity and traceability of FL, where the need to edit multiple interlinked blockchain records and update all inherited models complicates the process. In this paper, we introduce Blockchained Federated Unlearning (BlockFUL), a novel framework with a dual-chain structure— comprising a live chain and an archive chain—for enabling unlearning capabilities within Blockchained FL. BlockFUL introduces two new unlearning paradigms, i.e., parallel and sequential paradigms, which can be effectively implemented through gradient-ascent-based and re-training-based unlearning methods. These methods enhance the unlearning process across multiple inherited models by enabling efficient consensus operations and reducing computational costs. Our extensive experiments validate that these methods effectively reduce data dependency and operational overhead, thereby boosting the overall performance of unlearning inherited models within BlockFUL on CIFAR-10 and Fashion-MNIST datasets using AlexNet, ResNet18, and MobileNetV2 models.

Driving trajectory data remains vulnerable to privacy breaches despite existing mitigation measures. Traditional methods for detecting driving trajectories typically rely on map-matching the path using Global Positioning System (GPS) data, which is susceptible to GPS data outage. This paper introduces CAN-Trace, a novel privacy attack mechanism that leverages Controller Area Network (CAN) messages to uncover driving trajectories, posing a significant risk to drivers’ long-term privacy. A new trajectory reconstruction algorithm is proposed to transform the CAN messages, specifically vehicle speed and accelerator pedal position, into weighted graphs accommodating various driving statuses. CAN-Trace identifies driving trajectories using graph-matching algorithms applied to the created graphs in comparison to road networks. We also design a new metric to evaluate matched candidates, which allows for potential data gaps and matching inaccuracies. Empirical validation under various real-world conditions, encompassing different vehicles and driving regions, demonstrates the efficacy of CAN-Trace: it achieves an attack success rate of up to 90.59% in the urban region, and 99.41% in the suburban region.

Federated learning (FL) offers an effective learning architecture to protect data privacy in a distributed manner. However, the inevitable network asynchrony, overdependence on a central coordinator, and lack of an open and fair incentive mechanism collectively hinder FL's further development. We propose IronForge, a new generation of FL framework, that features a directed acyclic graph (DAG)-based structure, where nodes represent uploaded models, and referencing relationships between models form the DAG that guides the aggregation process. This design eliminates the need for central coordinators to achieve fully decentralized operations. IronForge runs in a public and open network and launches a fair incentive mechanism by enabling state consistency in the DAG. Hence, the system fits in networks where training resources are unevenly distributed. In addition, dedicated defense strategies against prevalent FL attacks on incentive fairness and data privacy are presented to ensure the security of IronForge. Experimental results based on a newly developed test bed FLSim highlight the superiority of IronForge to the existing prevalent FL frameworks under various specifications in performance, fairness, and security. To the best of our knowledge, IronForge is the first secure and fully decentralized FL (DFL) framework that can be applied in open networks with realistic network and training settings.

Radio Frequency Identification (RFID) is a crucial technology in the Internet of Things (IoT), enabling seamless wireless communication and data exchange. However, these technologies can pose significant security chal-lenges if not implemented with proper attention to security protocols-especially in communication, where pre-shared keys are not used between active tags and readers for device authentication. Some recent authentication protocols rely solely on a hash function, nonce, and single public kay agreement, which can lead to failure to implement robust security and proper authentication or ineffective for high security application environments. To effectively address these challenges this paper proposes a secure Elliptic Curve Cryptography (ECC) based lightweight mutual authentication protocol utilizing a hybrid key agreement protocol between active tag and reader for secure communication in RFID-enabled devices in the IoT environments. The informal analysis demonstrates a secure communication environment for data privacy and flexibility through effective key management. This protocol is adaptable to various applications by addressing specific requirements and limitations.

During the deployment and utilization of federated models, they are susceptible to unauthorized theft or misuse. To address this issue, researchers have proposed the use of watermarking techniques to protect the Intellectual Property (IP) of the federated models. Nevertheless, traditional watermarking methods in federated learning have certain limitations. It is highly likely that different clients may embed watermarks in the same region of the model. During the aggregation of the watermarked weights, the watermarks from various clients may overlap, resulting in conflicts between the embedded watermarks. To overcome these challenges, we propose a novel method called Non-Interfering Fragmented Watermarking for Federated Models (FedNIFW). In the proposed scheme, each client node is assigned a specific segment of the neural network layer where watermarking can be applied. During training, each client is allowed to embed watermarks only within their designated segments, while other segments intended for watermarking by different clients are frozen. Experimental results demonstrate that this segmented watermarking scheme effectively prevents conflicts between client watermarks and does not significantly impact the accuracy of the federated models. These findings underscore the feasibility of the proposed watermarking scheme.

Integrating sharded blockchain with IoT presents a solution for trust issues and optimized data flow. Sharding boosts blockchain scalability by dividing its nodes into parallel shards, yet it is vulnerable to the 1% attacks where dishonest nodes target a shard to corrupt the entire blockchain. Balancing security with scalability is pivotal for such systems. Deep Reinforcement Learning (DRL) adeptly handles dynamic, complex systems and multi-dimensional optimization. This paper introduces a Trust-based and DRL-driven (TbDd) framework, crafted to counter collusion attack risks and dynamically adjust node allocation, enhancing throughput while maintaining network security. With a comprehensive trust evaluation mechanism, TbDd discerns node types and performs targeted resharding against potential threats. The TbDd framework maximizes the tolerance for dishonest nodes, optimizes node movement frequency, ensures even node distribution in shards, and balances sharding risks. Extensive evaluations validate TbDd’s superiority over conventional random-, community-, and trust-based sharding methods in shard risk equilibrium and reducing cross-shard transactions.

The distributed nature of Federated Learning (FL) introduces security vulnerabilities and issues related to the heterogeneous distribution of data. Traditional FL aggregation algorithms often mitigate security risks by excluding outliers, which compromises the diversity of shared information. In this paper, we introduce a novel filtering-and-voting framework that adeptly navigates the challenges posed by non-iid training data and malicious attacks on FL. The proposed framework integrates a filtering layer for defensive measures against the intrusion of malicious models and a voting layer to harness valuable contributions from diverse participants. Moreover, by employing Deep Reinforcement Learning (DRL) for dynamic aggregation weight adjustment, we ensure the optimized aggregation of participant data, enhancing the diversity of information used for aggregation and improving the performance of the global model. Experimental results demonstrate that the proposed framework presents superior accuracy over traditional and contemporary FL aggregation methods as diverse models are utilized. It also shows robust resistance against malicious poisoning attacks.

As the primary standard protocol for modern cars, the controller area network (CAN) is a critical research target for automotive cybersecurity threats and autonomous applications. As the decoding specification of CAN is a proprietary black-box maintained by original equipment manufacturers (OEMs), conducting related research and industry developments can be challenging without a comprehensive understanding of the meaning of CAN messages. In this article, we propose a fully automated reverse-engineering system, named ByCAN, to reverse engineer CAN messages. ByCAN outperforms the existing research by introducing byte-level clusters and integrating multiple features at both the byte and bit levels. ByCAN employs the clustering and template matching algorithms to automatically decode the specifications of CAN frames without the need for prior knowledge. Experimental results demonstrate that ByCAN achieves high accuracy in slicing and labeling performance, i.e., the identification of CAN signal boundaries and labels. In the experiments, ByCAN achieves slicing accuracy of 80.21%, slicing coverage of 95.21%, and labeling accuracy of 68.72% for the general labels when analysing the real-world CAN frames.

Web3 is leading a wave of the next generation of web services that even many Web2 applications are keen to ride. However, the lack of Web3 background for Web2 developers hinders easy and effective access and transition. On the other hand, Web3 applications desire encouragement and advertisement from conventional Web2 companies and projects due to their low market shares. In this article, we propose a seamless transition framework that transits Web2 to Web3, named WEBTTCOM [WEBTTCOM stands for Web2 (two)–Web3 (three) Communicator], after exploring the connotation of Web3 and the key differences betweenWeb2 andWeb3 applications.We also provide a full-stack implementation as a use case to support the proposed framework, followed by performance evaluation and surveys with ~1000 participants that show ~80% positive and ~20% neutral responses. We confirm that the proposed framework WEBTTCOM addresses the defined research question, and the implementation well satisfies the framework WEBTTCOM in terms of strong necessity,usability, andcompletenessbased on the survey results.

The development of effective recommender systems for Web3 assets, such as the Non-Fungible Token (NFT), requires concentration along with the growth of popularity and heterogeneity in many potential applications such as Web3 gaming and NFT rental markets, the requirements of predicting rNFT classification desire a practical solution. In this paper, we make use of the referable NFT (rNFT11In this work, rNFT mainly refers to the EIP-5521 protocol and corresponding formed network/topology [1], while NFT is used in the context of a single node, node sets, or products that align with the EIP-5521 protocol.) standard [2], indexed EIP-5521, to construct an rNFT classification framework leveraging Graph Neural Network (GNN), an emerging branch of Deep Learning (DL), which learns on the inherent topology of graph-based data. In particular, we first transform the rNFT backward and onward reference relationship to a Direct Acyclic Graph (DAG) and model appropriate node and edge features from rNFT metadata and associated token transactions. Next, a multi-layer GraphSage model is designed to include the collected features for the learning process. In this way, the model takes into account graph topology together with features to classify both the existing and incoming NFT nodes in a supervised way. We also give comprehensive elaboration on the architecture of the new GNN-based recommender system with discussions in regard to its characteristics and challenges. Furthermore, we expect to conduct extensive experiments, by presenting an initial plan, to show the feasibility and efficacy of our system.

Obfuscating a dataset by adding random noises to protect the privacy of sensitive samples in the training dataset is crucial to prevent data leakage to untrusted parties when dataset sharing is essential. We conduct comprehensive experiments to investigate how the dataset obfuscation can affect the resultant model weights —in terms of the model accuracy, ℓ 2 -distance-based model distance, and level of data privacy—and discuss the potential applications with the proposed Privacy, Utility, and Distinguishability (PUD)-triangle diagram to visualize the requirement preferences. Our experiments are based on the popular MNIST and CIFAR-10 datasets under both independent and identically distributed (IID) and non-IID settings. Significant results include a tradeoff between the model accuracy and privacy level and a tradeoff between the model difference and privacy level. The results indicate broad application prospects for training outsourcing and guarding against attacks in federated learning both of which have been increasingly attractive in many areas, particularly learning in edge computing.

Existing permissionless sharded-Blockchains come on the scene. However, there is a lack of systematic formulations and experiments regarding the behaviors of individual miners. In this article, we interpret block mining in a permissionless sharded-Blockchain as a repeated$M$-player noncooperative game with finite actions, and propose a new multiagent deep reinforcement learning (MADRL) framework to allow the miners to maximize their profits in a decentralized fashion by scheduling their resources across the shards without centralized coordination. We formulate the rewards, and design a two-scale action space for each miner to reduce the action space and expedite convergence. We also propose a new MADRL model, named Rainbow-WoLF-PHC, which allows each miner to learn its resource allocation online and converge fast to a mixed strategy Nash equilibrium. Extensive experiments show the superiority of the Rainbow-WoLF-PHC to its alternatives in terms of convergence, stability, and profitable actions. This work provides a prosperous design of an end-user-friendly permissionless sharded-Blockchain.

The undisclosed Controller Area Network (CAN) decoding specification is important to the in-vehicle network (IVN) research for both industry and academia. Researchers have developed several CAN reverse engineering systems to predict signal boundaries and labels in order to map out CAN signal decoding specifications. Existing works mainly use one parameter (i.e., bit flip rate) to determine CAN signals boundary, which results in biased slicing and labelling of CAN signals. In this paper, we propose a multi-layer CAN reverse engineering system to cluster signal boundary at byte-level and label sliced CAN signal blocks at bit-level. The proposed system avoids biased signal slicing and labelling by introducing multiple parameters in signal classification, while existing works only use the bit flip rate and the number of unique value. The feasibility and adaptability of the proposed system is assessed by deploying it into a web application as a functionality module. We evaluate the proposed system with CAN messages from real cars. Compared with existing reverse engineering models, the proposed system introduces multi-layer signal processing to avoid over-slicing and over-labelling problem.

The legacy design of the Controller Area Network (CAN) weakens the encryption and authentication of the In-Vehicle Networks (IVN). Anomaly detection systems, e.g. the Long-Short Term Memory (LSTM) based Intrusion Detection System (IDS), are employed to remedy the defection of CAN. Existing works feed the LSTM-based IDS with the byte values of the data payload of CAN to train and test the LSTM model. In this paper, we propose an LSTM-based IDS leveraging byte-level features, i.e., byte flip rate, byte-level change rage, and byte-level distinct value rate, to augment the sensitivity of proposed LSTM-based IDS when distinguishing malicious CAN messages. By using the byte-level signal features, the proposed system achieves high accuracy with a small size of the training dataset. The experiment results show that the model with the byte-level features can achieve a performance gain of the$F$1Score up to 20% over the model without the byte-level features.

The development of location-based services (LBS) leads to the rapid growth of location data, potentially increasing the threat to location privacy. Existing location obfuscation techniques focus on two-dimensional (2D) planar areas and overlook the features of road networks. In this paper, we leverage differential privacy and propose a new notion of Road Network-Indistinguishability (RN-Indistinguishability) to measure the indistinguishability of locations in road networks. With the RN-Indistinguishability, we design a Cloaking Region Obfuscation (CRO) mechanism to protect the location privacy of vehicles on roads. With the CRO mechanism, vehicle locations in a cloaking region are obfuscated following the same obfuscation distribution. The proposed CRO mechanism is proved to achieve RN-Indistinguishability and can be generalized with road network features holding the triangle inequality. Comprehensive experiments show that the CRO mechanism outperforms existing 2D obfuscation mechanisms in real-world road networks.

Accurate assessment of fish quality is difficult in practice due to the lack of trusted fish provenance and quality tracking information. Working with Sydney Fish Market (SFM), we develop a Blockchain-enabled fish provenance and quality tracking (BeFAQT) system. A multilayer Blockchain architecture based on attribute-based encryption (ABE) is proposed to tackle the privacy issue caused by applying Blockchain to secure supply chain data and achieve trusted and confidential data sharing among parties in fish supply chains. An Internet-of-Things (IoT) chain saves encrypted fish provenance and quality tracking data, and an ABE chain is specifically designed for the access control to the data in the IoT chain. Latest IoT and artificial intelligence (AI) technologies, including NarrowBand-IoT, image processing, and biosensing, are developed for fish origin proof, supply chain tracking, and objective fish quality assessment. As proven by field trials with SFM and a local fish supply chain, the BeFAQT is able to provide trusted and comprehensive fish provenance and quality tracking information in real time.

The proliferation of location-based services (LBS) leads to increasing concern about location privacy. Location obfuscation is a promising privacy-preserving technique but yet to be adequately tailored for vehicles in road networks. Existing obfuscation schemes are based primarily on the Euclidean distances and can lead to infeasible results, e.g., off-road locations. In this paper, we define Road Network-Indistinguishability (RN-I) to evaluate obfuscation-based location privacy-preserving schemes in road networks. To protect drivers’ location privacy in road networks, we propose a Personalized Location Privacy-Preserving (PLPP) scheme and prove it achieves RN-I. The PLPP scheme employs a dual-obfuscation algorithm, consisting of a connection perturbation and an interval perturbation, to obfuscate on-road locations. An efficient personalization algorithm is designed for the PLPP scheme to fine-tune location privacy budgets for capturing drivers’ sensitive locations and privacy requirements. Experiments upon two real-world datasets confirm the location privacy-preserving capability, data utility, and efficiency of the proposed PLPP scheme.

Online social networks (OSNs) suffer from forged messages. Current studies have typically been focused on the detection of forged messages and do not provide the analysis of the behaviors of message publishers and network strategies to suppress forged messages. This paper carries out the analysis by taking a game theoretic approach, where infinitely repeated games are constructed to capture the interactions between a publisher and a network administrator and suppress forged messages in OSNs. Critical conditions, under which the publisher is disincentivized to publish any forged messages, are identified in the absence and presence of misclassification on genuine messages. Closed-form expressions are established for the maximum number of forged messages that a malicious publisher could publish. Confirmed by the numerical results, the proposed infinitely repeated games reveal that forged messages can be suppressed by improving the payoffs for genuine messages, increasing the cost of bots, and/or reducing the payoffs for forged messages. The increasing detection probability of forged messages or decreasing misclassification probability of genuine messages also has a strong impact on the suppression of forged messages.

Disconnecting impaired or suspicious nodes and rewiring to those reliable, adaptive networks have the potential to inhibit cascading failures, such as DDoS attack and computer virus. The weights of disconnected links, indicating the workload of the links, can be transferred or redistributed to newly connected links to maintain network operations. Distinctively different from existing studies focused on adaptive unweighted networks, this paper presents a new mean-field model to analyze the reliability of adaptive weighted networks against cascading failures. By taking mean-field approximation, we develop a new continuous-time Markov model to capture the propagations of cascading failures and the rewiring actions that individual nodes can take to bypass failed neighbors. We analyze the stability of the model to identify the critical conditions, under which the cascading failures can be eventually inhibited or would proliferate. The conditions are evaluated under different link weight distributions and rewiring strategies. Our model reveals that preferentially disconnecting suspicious peers with high weights can effectively inhibit virus and failures.

Epidemic models trade the modeling accuracy for complexity reduction. This paper proposes to group vertices in directed graphs based on connectivity and carries out epidemic spread analysis on the group basis, thereby substantially reducing the modeling complexity while preserving the modeling accuracy. A group-based continuous-time Markov SIS model is developed. The adjacency matrix of the network is also collapsed according to the grouping, to evaluate the Jacobian matrix of the group-based continuous-time Markov model. By adopting the mean-field approximation on the groups of nodes and links, the model complexity is significantly reduced as compared with previous topological epidemic models. An epidemic threshold is deduced based on the spectral radius of the collapsed adjacency matrix. The epidemic threshold is proved to be dependent on network structure and interdependent of the network scale. Simulation results validate the analytical epidemic threshold and confirm the asymptotical accuracy of the proposed epidemic model.

A major challenge in distributed mobile networks is network integrity, resulting from short link duration and severe transmission collisions. This paper analyzes the impact of link duration and transmission collisions on a range of on-the-fly authentication protocols, which operate based on predistributed keys and can instantly verify and forward messages. All unexpired messages within a link duration can be verified retrospectively, once the keys are matched on-the-air. We develop a new general 4D Markov model which, apart from the first three dimensions modeling a cycle of the protocols, is able to unprecedentedly capture unexpired messages between cycles in the fourth dimension. Validated by simulation, our analysis reveals that the on-the-fly authentication is efficient under short link duration, but is susceptible to transmission collisions. The authentication requires holistic cross-layer designs of retransmission and rekeying. The proposed model is able to facilitate the design of the protocol parameters, which allows the protocols to significantly outperform the state of the art.

Android malware detection is a complex and crucial issue. In this paper, we propose a malware detection model using a support vector machine (SVM) method based on feature weights that are computed by information gain (IG) and particle swarm optimization (PSO) algorithms. The IG weights are evaluated based on the relevance between features and class labels, and the PSO weights are adaptively calculated to result in the best fitness (the performance of the SVM classification model). Moreover, to overcome the defects of basic PSO, we propose a new adaptive inertia weight method called fitness-based and chaotic adaptive inertia weight-PSO (FCAIW-PSO) that improves on basic PSO and is based on the fitness and a chaotic term. The goal is to assign suitable weights to the features to ensure the best Android malware detection performance. The results of experiments indicate that the IG weights and PSO weights both improve the performance of SVM and that the performance of the PSO weights is better than that of the IG weights.

Advanced Persistent Threat (APT) imposes increasing threats on cyber security with the developing network attack technologies. APT is a highly interactive, specifically targeted and extremely harmful network-centric attack, which employs various technologies to evade detection during attacks leading to the result that victims will not be aware of attacks until they suffer from tremendous losses. Since command and control (C&C) is an essential component during the lifetime of APT, the detection of it is a practical measure to defend against the APT. In this paper, we analyze the features of C&C in APT and find that the HTTP-based C&C is widely used. Based on the analysis results, we propose a new feature of C&C, i.e., independent access, to characterize the difference between C&C communications and normal HTTP requests. Applying the independent access feature into DNS records, we implement a novel C&C detection method and validate it on public dataset. As a new feature of C&C, its advantages and drawbacks are also analyzed.

Biological epidemic models, widely used to model computer virus propagations, suffer from either limited scalability to large networks, or accuracy loss resulting from simplifying approximations. In this paper, a discrete-time absorbing Markov process is constructed to precisely characterize virus propagations. Conducting eigenvalue analysis and Jordan decomposition to the process, we prove that the virus extinction rate, i.e., the rate at which the Markov process converges to a virus-free absorbing state, is bounded. The bounds, depending on the infection and curing probabilities, and the minimum degree of the network topology, have closed forms. We also reveal that the minimum curing probability for a given extinction rate requirement, specified through the upper bound, is independent of the explicit size of the network. As a result, we can interpret the extinction rate requirement of a large network with that of a much smaller one, evaluate its minimum curing requirement, and achieve simplifications with negligible loss of accuracy. Simulation results corroborate the effectiveness of the interpretation, as well as its analytical accuracy in large networks.