As the number of IoT devices grows, ensuring the secure validation and processing of the data they generate has become critical. This challenge becomes even more pronounced for mobile nodes, such as vehicles, which must continually reconnect to new Edge Servers while in motion. This work proposes a decentralized architecture for connecting IoT devices to Edge Servers, enabling secure data delivery to applications while minimizing overhead and ensuring trustworthy handovers between Edge Servers. A fundamental concern is the integrity of Edge Servers, as they may be compromised or exhibit malicious behavior. To address this, the proposed architecture relies on an external verifier service to continuously verify the integrity of Edge Servers. To demonstrate its feasibility, two prototypes were implemented using distinct consensus technologies and evaluated under realistic conditions. The first prototype, based on BFT-SMaRt, achieved lower latency and higher throughput but required dedicated, proprietary infrastructure and lacked global auditability. In contrast, the second prototype, leveraging an existing blockchain network, provides complete auditability and decentralization without proprietary infrastructure, though at the cost of higher latency. Experimental results confirm that both approaches deliver strong security guarantees, with trade-offs between performance and transparency, validating the architecture’s suitability for dynamic IoT environments.

Mixture-of-Experts (MoE) models enhance deep learning scalability by activating only a subset of specialized subnetworks per input. However, conventional MoEs often suffer from unstable expert specialization and biased routing due to entangled gradient updates and unstructured input handling. To address these problems, this paper proposes SEAS-GMoE ( S tructured E xpert A ssignment and S upervised G ating M ixture o f E xperts), a hybrid framework that decouples expert routing from gradient noise through a double-stage feature clustering and semantic pseudo-labeling mechanism. SEAS-GMoE employs a K-means and KNN-based cluster refinement technique, followed by a Siamese Neural Network (SNN) that assigns semantic pseudo-labels to clustered features. This leads to generating interpretable and semantically coherent clusters that are explicitly mapped to dedicated experts. A supervised managing (gating) network learns these mappings through a bidirectional training process, reinforcing both expert specialization and routing reliability. In the bidirectional training process, as expert specialization improves, the gating supervision signal is simultaneously enhanced, and vice versa. During inference, soft expert routing is applied through the managing network’s probabilistic output. This enables flexible aggregation of expert(s)’ predictions on new inputs. Experimental results on GTSRB, MNIST, and CIFAR-10 show that SEAS-GMoE outperforms reimplemented V-MoE and dense baselines, achieving up to 4.1% higher accuracy, 60% lower inference latency, and 11% greater specialization stability. These results confirm SEAS-GMoE’s effectiveness for robust, interpretable, and efficient inference.

Traditional Intrusion Detection Systems (IDSs) struggle with unseen attacks, a critical gap in industrial settings, while single-view approaches lack cross-context detection for attacks that manifest across host and network layers. We propose DIversity-driven Multi-view Ensemble IDS (DIME-IDS), a diversity-driven multi-view ensemble for Supervisory Control and Data Acquistion (SCADA) systems, which manage critical industrial infrastructures. Our work introduces: (i) A public hybrid SCADA dataset with 16 attack behaviors synchronized across four Linux/Windows views (network, host, user-activity, system-activity); (ii) A novel Nondominated Sorting Genetic Algorithm II (NSGA-II) optimization constructing ensembles that maximize both accuracy and inter-view diversity; (iii) Dynamic classifier selection at inference using Pareto-optimal operation points. Evaluated against strong baselines (XGB/RF/MLP), DIME-IDS achieves 0.86 accuracy, 0.95 AUC, and 6.51% False Negative (FN) rate, outperforming single-view (10.03%) and concatenated (14.38%) approaches, with lowest FN rates in 3 of 4 unseen attacks. These results demonstrate that explicit multi-view diversity and dynamic selection significantly enhance generalization against novel threats in industrial environments.

The VEDLIoT project aims to develop energy-efficient Deep Learning methodologies for distributed Artificial Intelligence of Things (AIoT) applications. During our project, we propose a holistic approach that focuses on optimizing algorithms while addressing safety and security challenges inherent to AIoT systems. The foundation of this approach lies in a modular and scalable cognitive IoT hardware platform, which leverages microserver technology to enable users to configure the hardware to meet the requirements of a diverse array of applications. Heterogeneous computing is used to boost performance and energy efficiency. In addition, the full spectrum of hardware accelerators is integrated, providing specialized ASICs as well as FPGAs for reconfigurable computing. The project's contributions span across trusted computing, remote attestation, and secure execution environments, with the ultimate goal of facilitating the design and deployment of robust and efficient AIoT systems. The overall architecture is validated on use-cases ranging from Smart Home to Automotive and Industrial IoT appliances. Ten additional use cases are integrated via an open call, broadening the range of application areas.

The VEDLIoT project targets the development of energy-efficient Deep Learning for distributed AIoT applications. A holistic approach is used to optimize algorithms while also dealing with safety and security challenges. The approach is based on a modular and scalable cognitive IoT hardware platform. Using modular microserver technology enables the user to configure the hardware to satisfy a wide range of applications. VEDLIoT offers a complete design flow for Next-Generation IoT devices required for collaboratively solving complex Deep Learning applications across distributed systems. The methods are tested on various use-cases ranging from Smart Home to Automotive and Industrial IoT appliances. VEDLIoT is an H2020 EU project which started in November 2020. It is currently in an intermediate stage with the first results available.

Sensor platforms used in environmental monitoring applications are often subject to harsh environmental conditions while monitoring complex phenomena. Therefore, designing dependable monitoring systems is challenging given the external disturbances affecting sensor measurements. Even the apparently simple task of outlier detection in sensor data becomes a hard problem, amplified by the difficulty in distinguishing true data errors due to sensor faults from deviations due to natural phenomenon, which look like data errors. Existing solutions for runtime outlier detection typically assume that the physical processes can be accurately modeled, or that outliers consist in large deviations that are easily detected and filtered by appropriate thresholds. Other solutions assume that it is possible to deploy multiple sensors providing redundant data to support voting-based techniques. In this article, we propose a new methodology for dependable runtime detection of outliers in environmental monitoring systems, aiming to increase data quality by treating them. We propose the use of machine learning techniques to model each sensor behavior, exploiting the existence of correlated data provided by other related sensors. Using these models, along with knowledge of processed past measurements, it is possible to obtain accurate estimations of the observed environment parameters and build failure detectors that use these estimations. When a failure is detected, these estimations also allow one to correct the erroneous measurements and hence improve the overall data quality. Our methodology not only allows one to distinguish truly abnormal measurements from deviations due to complex natural phenomena, but also allows the quantification of each measurement quality, which is relevant from a dependability perspective. We apply the methodology to real datasets from a complex aquatic monitoring system, measuring temperature and salinity parameters, through which we illustrate the process for building the machine learning prediction models using a technique based on Artificial Neural Networks, denoted ANNODE ( ANN Outlier Detection ). From this application, we also observe the effectiveness of our ANNODE approach for accurate outlier detection in harsh environments. Then we validate these positive results by comparing ANNODE with state-of-the-art solutions for outlier detection. The results show that ANNODE improves existing solutions regarding accuracy of outlier detection.

The vision of automated driving promises to have safer and more cost-efficient transport systems. Automated driving systems have to demonstrate high levels of dependability and affordability. Recent advances of new communication technologies, e.g., 5G, allow significant cost reduction of timely shared sensory information. However, the design of fault-tolerant automated driving systems remains an open challenge. This work considers the design of automated driving systems through the lenses of self-stabilization-a very strong notion of fault-tolerance. Our self-stabilizing algorithms guarantee, within a bounded period, recovery from a broad fault model and arbitrary state corruption. After this recovery period, our algorithms provide safe maneuver execution despite the presence of failures, such as unbounded periods of packet loss and timing failures as well as inaccurate sensory information and malicious behavior. We evaluate the proposed algorithms through a rigorous correctness proof and a worst-case analysis as well as a prototype that focuses on an intersection crossing protocol. We validate our prototype via computer simulations and a testbed implementation. Our preliminary results show a reduction in the number of vehicle collisions and dangerous situations.

State machine replication (SMR) is a fundamental technique for implementing stateful dependable systems. A key limitation of this technique is that the performance of a service does not scale with the number of replicas hosting it. Some works have shown that such scalability can be achieved by partitioning the state of the service into shards. The few SMR-based systems that support dynamic partitioning implement ad-hoc state transfer protocols and perform scaling operations as background tasks to minimize the performance degradation during reconfigurations. In this work we go one step further and propose a modular partition transfer protocol for creating and destroying such partitions at runtime, thus providing fast elasticity for crash and Byzantine fault tolerant replicated state machines and making them more suitable for cloud systems.

For intelligent vehicles to become a reality, further research and development must be performed, addressing the needs of multidisciplinary approaches like integrated control systems, communication and network, security algorithms, artificial intelligence, verification and validation, neural networks, safety assets and other technological concerns. The goal of this workshop is to explore the challenges and innovative solutions regarding intelligent vehicles, considering the implications of security and real-time issues on safety and certification, which emerge when introducing networked, autonomous and cooperative functionalities. It aims at joining together in an active debate, researchers and practitioners from several communities, namely dependability and security, realtime and embedded systems, intelligent transportation and mobile robot systems. This workshop is aimed at exploring the challenges and innovative solutions related to the security and safety of intelligent vehicles.

Real-time operation in Wireless Sensor Networks (WSNs) is conditioned not only by the current technological level (e.g., limited computing power) but also inherently by the target problem itself: WSNs are required to operate in very open and uncertain environments, subject to external radio interferences, highly dynamic network load, etc. Current WSN solutions either provide only best-effort real-time guarantees or make (generally implicit) assumptions on the dynamics of the open environment. These assumptions, in turn, are either very relaxed (i.e., compatible only with undemanding real-time requirements) or very hard to justify. When dealing with WSNs supporting highly dynamic applications and operating environments (e.g., media streaming, robot control, vehicle coordination, etc.) this problem cannot be ignored. Accordingly, we argue for, and show the efficacy of, using probabilistic models to characterize dynamic WSN QoS, which is the first step to tackle the problem head on. Using our network monitoring technique, we demonstrate that it is possible to meet probabilistic real-time objectives.

Distributed protocols executing in uncertain environments, like the Internet or ambient computing systems, should dynamically adapt to environment changes in order to preserve Quality of Service (QoS). In earlier work, it was shown that QoS adaptation should be dependable, if correctness of protocol properties is to be maintained. More recently, some ideas concerning specific strategies and methodologies for improving QoS adaptation have been proposed. In this article we describe Adaptare , a complete framework for dependable QoS adaptation. We assume that during its lifetime, a system alternates periods where its temporal behavior is well characterized, with transition periods during which a variation of the environment conditions occurs. Our method is based on the following: if the environment is generically characterized in analytical terms, and we can detect the alternation of these stable and transient phases, we can improve the effectiveness and dependability of QoS adaptation. To prove our point we provide detailed evaluation results of the proposed solutions. Our evaluation is based on synthetic data flows generated from probabilistic distributions, as well as on real data traces collected in various Internet-based environments. We compare our solution with other approaches and we show that Adaptare, albeit more complex, is very effective, allowing protocols to adapt to the available resources in a dependable way.

Unreliable failure detectors are a fundamental building block in the design of reliable distributed systems. But unreliability must be bounded, despite the uncertainties affecting the timeliness of communication. This is why it is important to reason in terms of the quality of service (QoS) of failure detectors, both in their specification and evaluation. We propose a novel dependability-oriented approach for specifying the QoS of failure detectors, and introduce Adapt are-FD, an autonomous and adaptive failure detector that executes according to this new specification. The main distinguishing features of Adapt are-FD with respect to existing adaptive failure detection approaches are discussed and explained in detail. A comparative evaluation of Adapt are-FD is presented. We highlight the practical differences between our approach and the well known Chen et al. approach for the specification of QoS requirements. We show that Adapt are-FD is easily configured, independently of the specific network environment. Furthermore, the results obtained using the Planet Lab platform indicate that Adapt are-FD outperforms other timeout-based solutions, combining versatility with improved QoS and dependability assurance.

Although the technology and applications of wireless sensor networks have greatly increased over the last years, ensuring a dependable real-time operation despite faults and temporal uncertainties is still an on-going research topic. The problems are particularly significant when considering that future applications will interact with their environment not only for supervision or monitoring, but also to directly control physical (real-time) entities, sometimes with safety-critical requirements. We believe that reasoning in terms of data validity might be a good way to approach the problem. The ability to know if sensor data flowing in the system is valid - data validity awareness -, is a first step to achieve a dependable operation. But more than that, it should be possible to ensure, given requirements for data validity throughout the operation, a dependable perception of the environment. In this paper we essentially discuss the problem, analyzing some of the issues that need to be addressed to achieve these goals. Particularly, we introduce fundamental concepts and relevant definitions, we elaborate on the main impediments to achieve data validity awareness and describe relevant means to deal with these impediments. Finally, we address the issue of ensuring a dependable perception and present some research ideas in this direction.

This workshop summary gives a brief overview of the workshop on “Architecting Dependable Systems” held in conjunction with DSN 2009. The main aim of this workshop is to promote cross-fertilization between the software architecture and dependability communities. We believe that both of them will benefit from clarifying approaches that have been previously tested and have succeeded as well as those that have been tried but have not yet been shown to be successful.

This paper describes the design and development of a proof-of-concept platooning application, which operates in a mobile and dynamic environment and makes use of architectural and middleware solutions that were proposed in the scope of the HIDENETS project. With this application it is possible to demonstrate the practical feasibility of a hybrid system architecture, with realms of operation with distinct synchrony properties, and the benefits of adopting such architecture. In particular, we show that it is possible to improve the performance and behavior of the platooning application, which operates over an intrinsically uncertain environment (due to mobility and wireless communication), and still secure fundamental safety-critical requirements.

This paper presents a study on the performance of intrusion-tolerant protocols in wireless LANs. The protocols are evaluated in several different environmental settings, and also within the context of a car platooning application for distributed cruise control. The experimental evaluation reveals how performance is affected by the various environmental parameters such as the wireless standard, group size, and network topology. The distributed cruise control application demonstrates the practicability of such protocols, even when subjected to malicious faults.

On time data management is becoming a key difficulty faced by organizations. In spite of the importance of timeliness requirements in database applications, commercial DBMS do not assure the detection of the cases when a transaction takes longer than the expected/desired time. This paper discusses the problem of timing failure detection in database applications and proposes a transaction programming approach to help developers in programming database applications with time constraints

This paper describes and discusses the work carried on in the context of the CORTEX project, for the development of adaptive real-time applications in wormhole based systems. The architecture of CORTEX relies on the existence of a timeliness wormhole, called timely computing base (TCB), which we have described in previous papers. Here we focus on the practical demonstration of the wormhole concept, through a demo with two complementary facets. The objective is to illustrate the effectiveness of the concept from a practical, yet rigorous, perspective, which is done with the help of an emulation framework that we present in the paper. Furthermore, the paper also describes two different ways of implementing timeliness wormholes on top of both wired and wireless infrastructures.

Designing applications with timeliness requirements in environments of uncertain synchrony is known to be a difficult problem. In this paper we follow the perspective of timing fault tolerance: tinting errors occur and they are processed using redundancy, e.g., component replication, to recover and deliver timely service. We introduce a paradigm for generic tinting fault tolerance with replicated state machines. The paradigm is based on the existence of Timing Failure Detection with tinted completeness and accuracy properties. Generic timing fault tolerance implies the ability to dependably observe the system and to timely notify timing failures, which we discuss in the paper On the other hand, it ensures replica determinism with respect to time (temporal consistency), and safety in case of spare exhaustion. We show that the paradigm can be addressed and realized in the framework of the timely computing base (TCB) model and architecture. Furthermore, we illustrate the generality, of our approach by reviewing previous existing solutions and by showing that in contrast with ours, they, only secure a restricted semantics, or simply provide ad-hoc solutions.

Current systems are very often based on large-scale, unpredictable and unreliable infrastructures. However, users of these systems increasingly require services with timeliness properties. This creates a difficult-to-solve contradiction with regard to the adequate time model: should it be synchronous, or asynchronous? In this paper, we propose an architectural construct and programming model which address this problem. We assume the existence of a component that is capable of executing timely functions, however asynchronous the rest of the system may be. We call this component the "timely computing base", and it can be used by the other components to execute a set of simple but crucial time-related services. We also show how to use it to build dependable and timely applications exhibiting varying degrees of timeliness assurance, under several synchrony models.

The round-trip duration measurement technique is fundamental in solving many problems in asynchronous distributed systems. In essence, this technique provides the means for reading remote clocks with a known and bounded error. Therefore, it is used as a fundamental building block in several clock synchronization algorithms. In general, the technique can be used to implement duration measurement services, such as that of the timely computing base model. In this paper we propose a new technique for measuring distributed durations that minimizes the measurement error and is able to keep this error almost stable. The new technique can be used to improve the precision of remote clock reading in certain situations. We provide a protocol that implements this new technique and present some evaluation results. The results clearly show that our solution is better than existing ones.

In open and heterogeneous environments, where an unpredictable number of applications compete for a limited amount of resources, executions can be affected by also unpredictable delays, which may not even be bounded. Since many of these applications have timeliness requirements, they can only be implemented if they are able to adapt to the existing conditions. We present a novel approach, called dependable QoS adaptation, which can only be achieved if the environment is accurately and reliably observed. Dependable QoS adaptation is based on the timely computing base (TCB) model. The TCB model is a partial quality of service synchrony model that adequately characterizes environments of uncertain synchrony and allows, at the same time, the specification and verification of timeliness requirements. We introduce the coverage stability property and show that adaptive applications can use the TCB to dependably adapt and enjoy this property. We describe the characteristics and the interface of a QoS coverage service and discuss its implementation details.

Real-time behavior is specified in compliance with timeliness requirements, which in essence calls for synchronous system models. However systems often rely on unpredictable and unreliable infrastructures, that suggest the use of asynchronous models. Several models have been proposed to address this issue. We propose an architectural construct that takes a generic approach to the problem of programming in the presence of uncertain timeliness. We assume the existence of a component, capable of executing timing functions, which helps applications with varying degrees of synchrony to behave reliably despite the occurrence of timing failures. We call this component the Timely Computing Base, TCB. This paper describes the TCB architecture and model, and discusses the application programming interface for accessing the TCB services. The implementation of the TCB services uses fail-awareness techniques to increase the coverage of TCB properties.

A clock synchronization algorithm was given by P. Verissimo et al. (1989), dubbed a posteriori agreement, a variant of the convergence nonaveraging technique. By exploiting the characteristics of broadcast networks, the effect of message delivery delay variance is largely reduced. In consequence, the precision achieved by the algorithm is drastically improved. Accuracy preservation is near to optimal. A particular materialization of this algorithm, implemented as a time service of the xAMp group communications system, is given here. The algorithm was implemented using some of the primitives offered by xAMp, which simplified the work and stressed its advantages. Performance results for this implementation obtained on two different infrastructures are presented. Timings validate the design choices and clearly show that the algorithm is able to provide improved precision without compromising accuracy and reliability.>