Due to the large-scale, dynamic topology and multi-hop communication characteristics of Internet of Things (IoT) systems, trust management has become a critical requirement for secure and reliable network operation. However, existing trust management schemes generally rely on endpoint-centric observations or centralized evidence aggregation, making them poorly suited to realistic IoT deployments with partial observability. In particular, performance degradations caused by compromised intermediate nodes or unstable links are often misattributed to benign devices, leading to distorted trust evaluation and inefficient trust-based control. To address these challenges, this study proposes a topology-aware trust management framework (GZTrust) for multi-hop IoT networks designed in accordance with Zero Trust principles. The GZTrust framework introduces a structured separation between trust evidence generation, trust reasoning, and trust-driven control. In the data plane, a TrustTrace mechanism is employed to incrementally collect hop-level trust evidence along forwarding paths with verifiable integrity and privacy-preserving pseudonyms. In the trust plane, dynamically selected policy enforcement points (PEPs) aggregate localized evidence in a topology-aware manner to avoid flat centralized processing. To accurately evaluate trust, this study designs an attribution-aware trust computation model that decomposes hop-level anomalies into node-centric and link-centric responsibility components. Extensive simulation results demonstrate that GZTrust consistently outperforms state-of-the-art trust management schemes, improving the F1-score by approximately 6–13% across varying malicious node ratios (5%–50%). These results indicate that GZTrust provides a practical and scalable trust management framework for dynamic multi-hop IoT environments, with a lightweight overhead profile that is well aligned with resource-constrained deployment settings.

Quality of Service (QoS) routing is a critical technique for delivering differentiated services under limited network resources to meet the specific requirements of endpoint applications. Despite the development of various routing algorithms and management architectures, achieving fine-grained QoS optimization within existing networks remains challenging due to the lack of endpoint control over routing decisions. This paper introduces PanQoSR, the first application of path-aware networks (PAN) in QoS routing. PanQoSR leverages the inherent capabilities of PAN by offloading path computation and selection to the endpoint, enabling flow-level fine-grained QoS optimization. PanQoSR addresses several key challenges in applying PAN to QoS routing. First, by leveraging existing network technologies and protocols, PanQoSR remains fully compatible with legacy networks without requiring significant modifications. Second, by introducing an ε−Constraint Pathfinding (ε−CP) algorithm for intra-AS path computation and a Nonlinear Cost Pathfinding (NCP) algorithm for inter-AS path computation, PanQoSR achieves both high QoS guarantees and computational efficiency. Experimental results show that PanQoSR reduces QoS violation rates by up to 70.8% compared to baselines, while also decreasing inter-AS path computation time by 22.4% to 65.6%.

Path-aware networks have garnered significant attention as an emerging research area. It allows network senders to actively select or influence transmission paths to meet specific requirements, which necessitates the support of path validation mechanisms. Supported by the path-aware networking research group under the Internet Engineering Task Force (IETF), path validation plays a crucial role in enhancing end hosts' control over packet forwarding. However, existing methods face trade-offs among security, protocol header overhead, and computational cost, forming a ''trilemma.'' Drawing inspiration from persistent validation in zero-trust architecture, we propose the 1BIT protocol. This protocol reduces protocol header overhead by more than 57% while providing robust data flow security. The packet demand for path fault detection is reduced by more than 72%, and fault locations can be precisely identified. By employing hash algorithms and few binary operations, the 1BIT protocol achieves high throughput and supports routers capable of adapting to high-speed, multi-interface environments. On a 16-core CPU, the 1BIT protocol can handle throughput exceeding 100 Gbps. This lightweight and efficient solution introduces anomaly signal detection techniques into the field of path validation. Benefiting from in-depth research on anomaly signal detection, this technology offers a richer set of solutions for path validation and lays the foundation for future research and implementation in areas such as multi-path validation and path privacy protection.

In the current Internet architecture, path validation protocols enable the source host to accurately trace the forwarding path of packets, thereby preventing degradation in the quality and security of network services. However, these protocols typically rely on Public Key Infrastructure (PKI), which can theoretically result in a storage overhead of at least 64 PB. To address this issue, we propose an Identity-Based Path Validation Protocol (IB-SC). This protocol leverages a trusted third party equipped with a public-private key pair to distribute identity keys to network nodes. The identities of these nodes, along with the public key of the third party, are used to validate packet signatures. Furthermore, we designed a Source Commitment (SC) mechanism that commits to parameters of future packets to further enhance the performance of the IB-SC protocol. Evaluation results demonstrate that the IB-SC protocol eliminates the overhead associated with PKI and session key management. Compared to the Atomos protocol, which provides similar security levels, IB-SC reduces the signature space overhead by 73.4%, the packet construction and processing delay by 8.4% and 62.1%.

Abstract In cloud-edge collaboration scenarios, attackers pose significant security risks by compromising computational nodes and using them to infiltrate other nodes and networks. Ensuring the security of cloud-edge collaboration is crucial for protecting sensitive data, preventing disruptions to critical services, and safeguarding infrastructure in increasingly interconnected and digitized societies. Traditional passive defense mechanisms are often inadequate in dealing with the complex and dynamic nature of modern network threats. In recent years, Moving Target Defense (MTD) has become an important research direction, disrupting adversaries’ reconnaissance and exploitation phases by dynamically shuffling the attack surface. However, existing MTD strategies have some shortcomings, such as single-dimensional movement strategies, poor flexibility and a lack of historical information analysis. To overcome these challenges, we propose a reinforcement learning-based approach for host address and port hopping (RLAPH). First, the approach strengthens system security through coordinated decision-making across IP address and port, leveraging both historical data and current information to make accurate and adaptive decisions. Second, a reward function is carefully designed to balance the trade-off between system overhead and security. Finally, validation experiments conducted in a simulated environment show that the proposed method effectively enhances defense performance while minimizing system overhead, highlighting its robustness and applicability.

Due to characteristics such as the openness and exposure of inter-satellite links, Low-Earth Orbit (LEO) satellite networks are subject to heightened vulnerability to malicious attacks compared to ground-based networks. Given various security risks, implementing trust management in LEO satellite networks becomes imperative. However, existing trust management schemes tailored for this scenario are vulnerable to a spectrum of attacks, resulting in low detection rates and poor network performance. To address the above issues, we propose BiTrust, a hybrid trust management scheme for secure data transmission in LEO satellite networks. BiTrust introduces two distinct types of trust: state trust and behavior trust. State trust leverages remote attestation technology to verify the authenticity of node identities and the integrity of their functions, ensuring that nodes consistently disseminate reliable behavior trust announcements to safeguard the trust plane. Behavior trust, on the other hand, utilizes a trust model to quantify the real-time data forwarding behavior characteristics of nodes, thereby maintaining the reliability of the data plane. To precisely quantify behavior trust, we design a trust model based on multi-path trust propagation. By integrating an unstable penalty term, the proposed trust model can effectively defend against dynamic dropping misbehavior. Besides, to facilitate the deployment of BiTrust in a distributed manner, we introduce a two-hop rely message mechanism and a query-answer mechanism to support the construction of behavior trust. Experimental results confirm the efficacy of BiTrust, demonstrating a significant improvement of up to 64.3% in data transmission rate under highly untrusted environments while maintaining affordable overhead.

Abstract With the continuous advancement of virtualization technology and the widespread adoption of 5G networks, the application of the Network Function Virtualization (NFV) architecture has become increasingly popular and prevalent. While the NFV architecture brings a lot of advantages, it also introduces security challenges, including the effective and efficient verification of the integrity of deployed Virtual Network Functions (VNFs) and ensuring the secure operation of VNFs. To address the challenge of efficiently conducting virtual remote attestation for VNFs and establishing trust in virtualized environments like NFV architecture, we propose TVRAVNF, which is a highly efficient and low-cost TEE-based virtual remote attestation scheme for VNFs. The scheme we proposed ensures the security and effectiveness of the virtual remote attestation process by leveraging TEE. Furthermore, we introduces a novel local attestation mechanism, which not only reduces the overall overhead of the virtual remote attestation process but also shortens the attestation interval to mitigate Time-Of-Check-Time-Of-Use attacks, thereby enhancing overall security. We conduct experiments to validate the overhead of the TVRAVNF scheme and compare its performance with that of a typical remote attestation process within a maximum unattested time interval. The experimental results demonstrate that, by employing the local attestation mechanism, our solution achieves nearly an 80% significant performance improvement with a relatively small time overhead for small to medium-sized files. This further substantiates the significant advantages of our approach in both security and efficiency.

Abstract Video streaming from cameras to backend cloud or edge servers for neural-based analytics has gained significant popularity. However, the transmission of data from cameras to a backend raises substantial privacy concerns, particularly regarding sensitive information like facial data. To offer privacy protection, visual processing techniques, such as Generative Adversarial Networks (GANs), have been employed on cameras to blur and safeguard such data intelligently. However, these techniques frequently face memory challenges, particularly when dealing with high-resolution videos. In this paper, we propose PIMO, a memory-efficient visual privacy protection scheme designed to effectively blur video content leveraging adaptive slicing of frames and resolution degradation. Our extensive experimental evaluations validate that PIMO’s adaptive mechanism proficiently navigates fluctuating memory constraints. Furthermore, utilizing a content-based blur scheme, our approach can maintain an impressive mean precision of 95.2%, as compared to the original, non-blurred images.

Communication is supposed to improve multi-agent collaboration and overall performance in cooperative Multi-agent reinforcement learning (MARL). However, such improvements are prevalently limited in practice since most existing communication schemes ignore communication overheads (e.g., communication delays). In this paper, we demonstrate that ignoring communication delays has detrimental effects on collaborations, especially in delay-sensitive tasks such as autonomous driving. To mitigate this impact, we design a delay-aware multi-agent communication model (DACOM) to adapt communication to delays. Specifically, DACOM introduces a component, TimeNet, that is responsible for adjusting the waiting time of an agent to receive messages from other agents such that the uncertainty associated with delay can be addressed. Our experiments reveal that DACOM has a non-negligible performance improvement over other mechanisms by making a better trade-off between the benefits of communication and the costs of waiting for messages.

Abstract Federated Learning (FL) suffers from the Non-IID problem in practice, which poses a challenge for efficient and accurate model training. To address this challenge, prior research has introduced clustered FL (CFL), which involves clustering clients and training them separately. Despite its potential benefits, CFL can be computationally and communicationally expensive when the data distribution is unknown beforehand. This is because CFL involves the entire neural networks of involved clients in computing the clusters during training, which can become increasingly time-consuming with large-sized models. To tackle this issue, this paper proposes an efficient CFL approach called LayerCFL that employs a Layer-wised clustering technique. In LayerCFL, clients are clustered based on a limited number of layers of neural networks that are pre-selected using statistical and experimental methods. Our experimental results demonstrate the effectiveness of LayerCFL in mitigating the impact of Non-IID data, improving the accuracy of clustering, and enhancing computational efficiency.

Insider threat is destructive and concealable, making addressing it a challenging task in cybersecurity. Most existing methods transform user behavior into sequential information and analyze user behavior while neglecting structural information among users, resulting in high false positives. To solve this problem, in this paper, we propose Dual-Domain Graph Convolutional Network (referred to as DD-GCN), a graph-based modularized method for high accuracy and adaptive insider threat detection. The central idea is to convert user features and structural information into heterogeneous graphs in the light of various relationships and take user behavior and relationship into account together. To this end, a weighted feature similarity mechanism is applied to balance the feature similarity of users and original linkages among them so as to generate the fused structure. Next, specific graph embeddings are extracted from the original topology structure and fused structure simultaneously, which convert behavior information into high-level representations. Furthermore, an attention mechanism is applied to learn the adaptive importance weights of the user’s features in the corresponding embedding. The combination and difference constraints are proposed to enhance the learned embeddings’ commonality and the ability to capture different information. Extensive experiments on two real-world datasets clearly show that our proposed DD-GCN extracts the most correlated information from structural topology and feature information substantially, and achieves improved accuracy with a clear margin.

In the era of Internet of Things (IoT), millions of heterogeneous IoT devices generate an explosion of data and services waiting to be discovered. The convergence of IoT with social networks (SIoT) interconnects multiple IoT applications and alleviates the common data sparsity and cold start problems in traditional recommendation systems. However, the social trust relationships may also be very sparse, which affects the accuracy of trust-based recommendation systems. Meanwhile, mobile devices have limited resources and are more vulnerable to malicious attacks in the IoT environment. In order to complete the trust relationship and further improve the trust-based recommendation performance, we propose a reliable and lightweight trust inference model for service recommendation in SIoT, calledTIRec. First, we obtain a comprehensive weighted centrality metric (LGWC) considering both local and global contexts. Based on this, we propose a corresponding lightweight trust path selection algorithm. Then, we present a reliable trust inference calculation algorithm consist of trust propagation and aggregation strategy, which can efficiently resist two common malicious attacks. Finally, we incorporate the rating, direct trust, and indirect trust together into the matrix factorization model, and integrate the influence of truster and trustee to obtain the synthetic model for rating predication. To the best of our knowledge, this article is the first to integrate trust inference algorithm into the trust-based recommendation systems. The extensive experiments are conducted on three real-world data sets, and the results show that ourTIRecmodel performs better than other advanced recommendation models in both “all users” view and “cold start users” view.

Facing multidemand tasks and massive heterogeneous resources in an IoT edge computing environment, it is a challenge to obtain reliable and quick response service and allocate application tasks to resource nodes that meet task requirements and user preference. Since IoT edge computing is facing different types of severe attacks, such as message attacks, swing attacks, collusion attack, node attacks, etc., providing a reliable service environment, trust evaluation between edge nodes is necessary. Existing trust computing schemes, however, suffer from a long response period and low malicious detection rate in a dynamic environment. To alleviate these issues, we propose a reliable and efficient task offloading strategy based on the multifeedback trust mechanism (TOSMFTM). First, a reliable and efficient architecture of TOSMFTM is established, which can effectively improve the ability of trust computing and task offloading. Second, according to the broker’s dynamic monitoring of data, a multifeedback trust aggregation model based on time attenuation and interaction frequency is proposed to provide a trusted running environment. Third, a trust weight$k$-means (TWK-means) clustering algorithm is designed based on resource attributes to enhance the reliability of service, and quickly and accurately cluster out resource nodes required by the task. Finally, we construct a task offloading model based on trust clustering to ensure user experience quality and promote system efficiency. Different from existing task processing models, which only focus on task offloading, our method also carries out resource preprocessing, trust evaluation, and resource clustering before task processing. The experiment verifies the effectiveness and feasibility of our TOSMFTM scheme.

As a complementary technology to traditional network security, trust computing scheme has been playing an increasingly important role in providing cloud service. However, many organizations constantly face trust computing challenges; moreover, establishing a highly trustworthy cloud ecosystem can be costly and time-consuming. In this article, we originally propose the conceptual model and formal definitions for a trustworthy collaboration service ecosystem, and construct a Bi-trustworthy cloud collaboration service (Bi-TCCS), which is a scheme based on an innovative bilateral social feedback (referred to as “bi-feedback”) scheme. First, a trust-aware collaboration service model is proposed based on cloud service brokerages (CSBs), which can provide intermediation and aggregation capabilities to enable organizations to deploy their services across a collaborative cloud environment. Then, we propose a bi-feedback scheme based on the inherent social relationship among three network communities, which are composed of three types of network entities: cloud users, CSBs, and cloud service providers. The proposed scheme is effective and reliable against garnished and bad-mouthing attacks resulting from the traditional social feedback scheme. Moreover, we innovatively adopt an aggregating method for overall trust based on deviation analysis. This method can minimize errors and overcome the limitations of traditional schemes, where trust attributes are weighted manually. Theoretical analysis and experiments verify the effectiveness ofBi-TCCS. Compared with existing approaches, the service successful ratio ofBi-TCCSincreased by 12 percent under highly dishonest cloud environment. These results also indicate thatBi-TCCSis more adaptable both in the random walk and cheating profiles, which represents a substantial improvement in tracking the dynamic behavior of cloud services.

The interaction between mobile Internet of Things (IoT) devices is based on a hybrid communication architecture. To improve packet delivery ratio, reduce end-to-end delay, and protect data privacy, designing an efficient data forwarding scheme is crucial in guaranteeing the quality of data transmission. Fog computing, a novel distributed computing framework, can decrease the amount of data transmission on the Internet and improve quality of services. In this paper, we propose a fog computing-assisted trustworthy forwarding (FCTF) scheme. To the best of our knowledge, this paper is the first study that investigates the role of fog infrastructure nodes (FINs) in forwarding scheme design. FCTF first selects the contact probability and the service degree as the basic trustworthy metrics between node pairs, and combines high-performance optimization algorithms to design a dynamic detection model of overlapping trustworthy communities (DOTCs). Then, we construct logical joint edge community structures on the basis of the results of DOTC and the distribution of FINs at each timestamp. Finally, based on the logical joint edge community, we define the forwarding utilities for FINs and mobile devices, respectively, and design self-adaptive forwarding rules. The experimental results prove that our FCTF scheme can enhance the delivery ratio, and decrease the latency and average hop-count more effectively, and has better routing quality compared with some popular forwarding models in mobile IoT applications.

In data-intensive cloud collaboration services with tens of thousands of users and million-level resources, means of providing personalized and trust-aware services quickly and simultaneously is a challenging issue. In this paper, we propose Per-trust, a trust-aware and fast resource matchmaking scheme for personalized QoS guaranteeing in collaboration cloud service. First, an integrated and trust-aware service broking architecture is proposed across the collaborative cloud computing environment; this architecture can provide trust computing and personalized resource matchmaking capacities. Then, a resource clustering method is proposed based on the multidimensional properties of cloud resources; this method can accurately, quickly meet the personalized requirements of users. Finally, an innovative algorithm is proposed for the trust computing of service resources based on real-time and dynamic monitoring of data, thereby quickly and effectively providing trust-aware resource matchmaking. Different from existing methods, which focus only on QoS and trust issues, our approach adds a resource clustering step before QoS and trust evaluation. Three key components are organically combined, namely, service broking architecture, resource clustering, and security and QoS-related trust computing. To the best of our knowledge, this paper is the first to construct an integrated solving scheme for cloud resource matchmaking that can simultaneously satisfy the trustworthiness and personalization required by users. Theoretical and experimental results verify the effectiveness of the proposed scheme.

Given a software defined wide-area network (WAN), how to choose location of controllers and how to assign the controllers to forwarding devices are two significant issues. Previously, most of solutions to these two problems focus on the propagation delay but ignore the balance of controllers, because it's difficult to solve them with consideration of balance of controllers. In this paper, a novel approach which can efficiently and accurately solve SDN controller placement problem and assignment problem for WAN is proposed. The SDN controller assignment problem is formulated as a minimum weight matching of bipartite graph, and it also considers the balance of controllers. The Kuhn- Munkres algorithm based solution is used to find optimal matching between switches and controllers. Then, a genetic algorithm is proposed to solve the controller placement problem based on the controller assignment scheme. The performance shows that our approach has good performance in reducing the average propagation delay between SDN forwarding devices and controllers, and it also achieves better balance of controllers.

In Device-to-Device (D2D)communications, the communication environments are multifarious and it is difficult for devices to distinguish undependable services and get successful cooperation. In this paper, we originally propose a broker-guided trust calculation model based on feedback from brokers of BSs which provide mobile network services. And we adopt lightweight trust evaluating mechanism which facilitates low-overhead trust computing algorithms to reduce networking risk and improve system efficiency. Compared with existing models, the experimental results show that our model have great advantage in both reliability and efficiency.

Providing high trustworthy service is the most fundamental task for any cloud computing platform. Users are willing to deliver their computing tasks and the most sensitive data to cloud data centers, which is based on the trust relationship established between users and cloud service providers. However, with the development of collaboration cloud computing, how to provider fast response for a large number of users' service requests becomes a challenging problem. In order to quickly provide highly trustworthy services, the service platform must efficiently and quickly reply tens of millions of service requests, and automatically match-make tens of thousands of service resources. In this context, lightweight and fast (high-speed, low-overhead) trust computing schemes become the fundamental demand for implementing a trustworthy and collaborative cloud service. In this paper, we propose an innovative and parallel trust computing scheme based on big data analysis for the trustworthy cloud service environment. First, a distributed and modular perceiving architecture for large-scale virtual machines' service behavior is proposed relying on distributed monitoring agents. Then, an adaptive, lightweight, and parallel trust computing scheme is proposed for big monitored data. To the best of our knowledge, this paper is the first to use a blocked and parallel computing mechanism, the speed of trust calculation is greatly accelerated, which makes this trust computing scheme very suitable for a large-scale cloud computing environment. Performance analysis and experimental results verify feasibility and effectiveness of the proposed scheme.