ABSTRACT The rapid proliferation of Internet of Things (IoT) systems has underscored the critical need for robust security measures to safeguard interconnected devices and data. This study presents an extensive bibliometric analysis of research advancements in anomaly detection in an IoT environment, leveraging data from the Web of Science repository to comprehend key trends, influential contributors, and evolving research themes. The analysis identifies the most prolific organizations, authors, and countries contributing to IoT anomaly detection literature, highlighting global scientific production and collaboration networks. The study traces publication trends, revealing the temporal distribution of article production and the impact of locally and globally cited sources. It also examines the most relevant authors in the field, their scholarly influence, and the dynamics of their research output over time. The co‐occurrence of authors' keywords provides insights into emerging themes and the evolution of research focus areas. At the same time, a detailed review of the most globally cited articles elucidates foundational contributions to the field. Additionally, the study analyzes the frequency and evolution of key terms, identifying trending topics that shape current and future research. The authors' and countries' collaboration networks illustrate the extent of international cooperation, highlighting key partnerships driving innovation. The application areas, challenges, and future research directions are also discussed, offering valuable guidance for further research. This bibliometric analysis offers a valuable resource for researchers and practitioners seeking to understand this domain's development, current state, and future research trajectory.

Summary Software‐defined networking (SDN) is an advanced networking paradigm that decouples forwarding control logic from the data plane. Therefore, it provides a loosely‐coupled architecture between the control and data plane. This separation provides flexibility in the SDN environment for addressing any transformations. Further, it delivers a centralized way of managing networks due to control logic embedded in the SDN controller. However, this advanced networking paradigm has been facing several security issues, such as topology spoofing, exhausting bandwidth, flow table updating, and distributed denial of service (DDoS) attacks. A DDoS attack is one of the most powerful menaces to the SDN environment. Further, the central data controller of SDN becomes the primary target of DDoS attacks. In this article, we propose a Kafka‐based distributed DDoS attacks detection approach for protecting the SDN environment named K‐DDoS‐SDN. The K‐DDoS‐SDN consists of two modules: (i) Network traffic classification (NTClassification) module and (ii) Network traffic storage (NTStorage) module. The NTClassification module is the detection approach designed using scalable H2O ML techniques in a distributed manner and deployed an efficient model on the two‐nodes Kafka Streams cluster to classify incoming network traces in real‐time. The NTStorage module collects raw packets, network flows, and 21 essential attributes and then systematically stores them in the HDFS to re‐train existing models. The proposed K‐DDoS‐SDN designed and evaluated using the recent and publically available CICDDoS2019 dataset. The average classification accuracy of the proposed distributed K‐DDoS‐SDN for classifying network traces into legitimate and one of the most popular attacks, such as DDoS_UDP is 99.22%. Further, the outcomes demonstrate that proposed distributed K‐DDoS‐SDN classifies traffic traces into five categories with at least 81% classification accuracy.

Summary Body area networks (BANs) play a pivotal role in modern healthcare, enabling real‐time data collection and monitoring of vital patient parameters, thereby empowering healthcare providers to respond swiftly to any serious health conditions. These networks depend on strategically placed sensors on the patient's body to collect important health data. The integrity of this data is really important, as problems with a component can cause doctors to make mistakes that could be life‐threatening. Consequently, developing and evaluating robust anomaly detection methods for BANs is paramount. To address this concern, an anomaly detection system for body area networks (ADSBAN) has been proposed in this article. Different machine learning methods have been tested and implemented to improve the proposed system's performance. These include decision tree, K‐nearest neighbor, logistic regression (LR), random forest, AdaBoost (Adaptive Boosting), and XGBoost (Extreme Gradient Boosting). Further, this framework has been tested with emulated and standard datasets and compared with existing methodologies. The research employs an IoT Flock emulator to replicate BAN conditions and simulate two distinct attack scenarios. Wireshark aids in thoroughly analyzing network traffic, while Python, in conjunction with tools like Keras and Pandas, is instrumental in implementing the ML models. Further, a CIC flowmeter has been utilized to convert the .pcap file format into .CSV file format. Comprehensive evaluation metrics such as precision, recall, accuracy, F1 score, and the Mathew correlation coefficient (MCC) demonstrate the consistent superiority of LR on emulated (i.e., traffic generated through a simulator IoT Flock) and standard datasets (BoT‐IoT). LR shows the highest accuracy of 99.92% on emulated and standard datasets, while XGBoost has the highest average accuracy of 99.92% on standard dataset. This research significantly bolsters the reliability of healthcare data, instilling confidence among healthcare professionals in their decision‐making processes. By safeguarding the integrity of vital health data in BANs, it advances the quality of patient care. It underscores the indispensable role of ML techniques in fortifying the resilience of healthcare systems.

Abstract A distributed denial of service (DDoS) attack is a significant threat to web‐based applications and hindering legitimate traffic (denies access to benign users) by overwhelming the victim system or its infrastructure (service, bandwidth, networking devices, etc.) with a large volume of attack traffic. It leads to a delay in responses or sometimes a crash victim system. Even a few moments of pause in web‐based applications lead to a huge monetary loss and a bad reputation in the market. Several approaches available in the literature to protect websites from different types of DDoS attacks. However, incidents and volume sizes of DDoS attacks are growing quarter by quarter. Further, various challenges in the traditional framework based defense mechanisms: itself becoming a victim of attacks while analyzing a massive amount of traffic, require more time for detection process, no coordination among the modules, etc. This paper presents a comprehensive DDoS defense deployment taxonomy and critically reviewed existing distributed frameworks based DDoS attack detection systems. Further, characterized several existing distributed processing frameworks to select an appropriate one for deploying DDoS attack detection mechanisms. Finally, several evaluation metrics, open issues, discussion on available datasets including their limitations, and future directions are presented.

Abstract Smart‐phones have become a necessity for users due to their abundance of services such as global positioning system, Wi‐Fi, voice/video calls, SMS, camera, and so forth. It contains personal information of users including photos, documents, messages, and videos. Android‐based smart‐phones enriched with many applications (commonly known as apps) fascinates users to use this ubiquitous technology up to a full extent. With open architecture and 73% of market share, Android is the most popular mobile operating system (OS) among developers. At the same time, the increasing popularity of Android OS woos attackers or cyber‐criminals to exploit its vulnerabilities. The attackers write malicious code to harm the device and grab users' sensitive information. For example, ransomware (a form of malware) demands ransom from victims to liberate the ceased material for illegal financial gain. The existing survey papers cover the analysis and detection of generic Android malware. The focus of this survey paper is to present an in‐depth threat scenario of Android ransomware. This article not only provides a comprehensive survey on analysis and detection methods for Android ransomware since its beginning (2015) till date (2020); but also presents observations and suggestions for researchers and practitioners to carry out further research.

Summary Information storage and retrieval from the cloud is growing continuously unabated. The cost‐efficient solutions offered by the cloud providers to the end‐users have motivated them to outsource their confidential data to the cloud. Outsourcing confidential data leads to enhanced privacy risks due to disclosure of sensitive information to adversaries. To handle this disclosure of information, encryption is preferred, but it hinders the efficient searching on the documents. The existing searchable encryption schemes either focused on optimization of search time or improvement of search efficiency. To solve this trade‐off between search time and search efficiency, we propose an efficient disjunctive search scheme using non‐positional inverted index. To the best of our knowledge, there is no searchable encryption scheme based on the non‐positional inverted index in the literature. Thus, we first propose a basic scheme based on a non‐positional inverted index to search the desired keywords and highlight its inefficiency in terms of high search time required. To perform efficient searching, an extended search scheme is proposed using keyword binning, which reduces comparisons required and improves the search time. The extended search scheme has recall of 100% and precision 99.75%. The experimental analysis of the proposed scheme on real datasets proves that the proposed scheme is privacy‐preserving and efficient.

Summary Organizations prefer using cloud for storing their data due to availability of cost‐effective storage. The outsourced data include sensitive information, so data is encrypted as maintaining confidentiality and privacy of the documents is of paramount importance. Retrieving the desired information from the cloud requires efficient searching, which involves submission of search query to the cloud server by the end‐user. As the search terms may include sensitive information of an organization, it is desired that the search query should not reveal any confidential information. The existing works are not suitable for big‐data scenario due to high search time required for large document collections, thereby leading to increased cloud usage cost. Thus, an efficient approach to perform search on encrypted data using clustering is proposed in this paper. As the proposed technique clusters the documents based on the relationship between the keywords, the search method involves searching documents within the relevant cluster in contrast to searching the entire dataset. An efficient ranking method is incorporated to rank the documents according to the relevance to search query using Term Frequency‐Inverse Document Frequency (tf‐idf) value of the keywords in the documents, which leads to reduced communication overheads due to reduction in unnecessary documents being downloaded. Moreover, an efficient query randomization approach is proposed so that two or more queries involving the same search terms appear distinct. Experimental results using real datasets demonstrate that our proposed multi‐keyword ranked search scheme on encrypted cloud data significantly reduce the number of comparisons and search time in comparison to the existing techniques while maintaining recall of 100% and precision of 82%.

Summary Outsourcing confidential data to cloud storage leads to privacy challenges that can be reduced using encryption. However, with encryption in place, the utilization of the data is reduced, which leads to reduced quality of experience of the users. To overcome this, searchable encryption (SE) schemes are utilized, which allow the end users to retrieve the relevant documents from the cloud, for which various researchers have worked utilizing different techniques. Despite the popularity of the searchable encryption schemes, most of the surveys either do not provide or present an incomplete taxonomy of SE schemes. Hence, in this paper, we attempt to present a complete taxonomy/classification of the searchable encryption schemes in terms of the type of search, type of index, results retrieved, implementation type, multiplicity of users, and the technique used. From the literature, it is observed that inner product similarity is widely adopted by researchers to compute the similarity of the query and the document index as it provides both conjunctive and disjunctive searching (ie, have better search capability) but requires high search time (ie, have lower search efficiency). On the other hand, schemes based on binary comparisons exist, which require less search time (ie, have better search efficiency) but support only conjunctive searching (ie, have limited search capability). Thus, a major conclusion drawn from our work is that there is an imbalance between search capability and search efficiency, ie, in the existing schemes, search capability can be improved at the cost of search time only. Therefore, we suggest that one direction where researchers should work on is to provide a balance between search capability and search efficiency.