The vast number of devices and the complexity of requirements present significant challenges in ensuring the security of Non-Terrestrial Internet of Things (NT-IoT). Although existing studies have proposed methods like to defend against data theft and network interference attacks, there is still a need for more in-depth research on detecting data-level attacks in NTNs. Moreover, the vast and diverse nature of network traffic presents significant challenges in traffic modeling and feature extraction. Hypergraph neural networks have gained considerable attention because of capabilities in data modeling and feature extraction. However, most existing hypergraph neural networks are tailored for specific applications and are not adaptable to the detection of malicious encrypted traffic. To address these challenges, we firstly propose a hypergraph neural network-based malicious encrypted traffic detection framework to enhance the resilience of NT-IoT, enabling attack detection across unmanned aerial vehicles, base stations and satellites. Then, we introduce a Multidimensional Encrypted Traffic HyperGraph Network (METHGN). METHGN models the encrypted traffic from network, connection and time dimensions using hypergraph and uses hypergraph convolution network to extracts and fuse features. We conducted comparative experiments on IoT and The Onion Router Network encrypted traffic datasets for different classification tasks. Extensive experiments demonstrate the effectiveness and superiority of our approach.

Vehicular metaverses, blending traditional vehicular networks with metaverse technology, are expected to revolutionize fields such as autonomous driving. As virtual intelligent assistants in vehicular metaverses, Artificial Intelligence (AI) agents empowered by large language models can create immersive 3D virtual spaces for passengers to enjoy on-board vehicular applications and services. To provide users with seamless and engaging virtual interactions, resource-limited vehicles offload AI agents to RoadSide Units (RSUs) with adequate communication and computational capabilities. Due to the mobility of vehicles and the limited coverage of RSUs, AI agents need to migrate from one RSU to another. However, potential network attacks pose significant challenges to ensuring reliable and efficient AI agent migration. In this paper, we first explore specific network attacks, including traffic-based attacks (i.e., DDoS attacks) and infrastructure-based attacks (i.e., malicious RSU attacks). Then, we model the AI agent migration process as a Partially Observable Markov Decision Process (POMDP) and apply multi-agent proximal policy optimization algorithms to mitigate DDoS attacks. In addition, we propose a trust assessment mechanism to counter malicious RSU attacks. Numerical results demonstrate that the proposed solutions effectively defend against these network attacks and reduce the total latency of AI agent migration by approximately 12.8%.

Uncrewed aerial vehicle (UAV) networks are increasingly exposed to widespread and various network attacks due to their fully distributed nature and the limited defensive capabilities of individual devices. Existing defense strategies rely on network connectivity and UAV status information, which overlook information of network traffic. Malicious traffic detection offers a promising solution to achieve fine-grained attack detection. However, the dynamic nature and complexity of UAV networks limit the effectiveness of traditional traffic detection methods. Current approaches either fail to fully exploit the raw characteristics of traffic or do not consider the timeliness requirements of UAV networks. To address these challenges, we propose a novel twin graph encoder neural network, which can extract features of raw traffic bytes for efficient traffic detection. First, we propose a decoupled architecture for model training and inference to enable efficient detection of malicious traffic in UAV networks. Second, we propose a novel modeling method that models traffic as the co-occurrence graph and word frequency graph based on raw bytes. Then, we propose TGE-ETD, a Twin Graph Encoder for Encrypted Traffic Detection. TGE-ETD consists of a set of twin graph encoders that effectively extract intrinsic traffic features from graphs constructed from raw bytes. In addition, TGE-ETD employs a global attention pooling mechanism to effectively distinguish the feature contributions of different bytes. Finally, we conducted extensive experiments on a real UAV traffic dataset and four real-world network traffic datasets. TGE-ETD achieved an improvement of 1%-20% over the baseline methods by reducing the number of parameters by 20 times. Tested on multiple UAV hardware devices, TGE-ETD can achieve millisecond-level traffic detection.

Smart contracts play a significant role in automating blockchain services. Nevertheless, vulnerabilities in smart contracts pose serious threats to blockchain security. Currently, traditional detection methods primarily rely on static analysis and formal verification, which can result in high false-positive rates and poor scalability. Large Language Models (LLMs) have recently made significant progress in smart contract vulnerability detection. However, they still face challenges such as high inference costs and substantial computational overhead. In this paper, we propose ParaVul, a parallel LLM and retrievalaugmented framework to improve the reliability and accuracy of smart contract vulnerability detection. Specifically, we first develop Sparse Low-Rank Adaptation (SLoRA), a technique for efficient LLM fine-tuning tailored to smart contract vulnerability detection. Distinct from existing LoRA methods, SLoRA inserts parallel sparse and low-rank branches after the attention projection and the feed-forward block, enabling LLMs to capture both global code semantics and localized vulnerability patterns while maintaining low training overhead. We then construct a vulnerability contract knowledge base and develop a hybrid Retrieval-Augmented Generation (RAG) system that integrates Okapi BM25 with dense retrieval to provide complementary lexical and semantic evidence for smart contract vulnerability verification. Furthermore, we propose a meta-learner-based gated verification module to fuse the outputs of the SLoRA detector and the two RAG-based detectors, thereby generating the final detection results. After completing vulnerability detection, we design chain-of-thought prompts to guide LLMs to generate comprehensive vulnerability detection reports. Simulation results demonstrate the superiority of ParaVul, especially in terms of F1 scores, achieving 0.9398 for single-label detection and 0.9930 for multi-label detection.

The large number of devices and complex communication requirements pose challenges to ensuring the security of Non-Terrestrial Internet of Things (NT-IoT). The large-scale data and complex communication requirements make accurate detection of malicious traffic even more challenging in NT-IoT. Hypergraph neural networks have strong performance in extracting multi-relational features. However, most existing hypergraph neural networks are tailored for graph data, and hyperedge construction methods are not well-suited. To address these challenges, we propose a malicious encrypted traffic detection method based on a hypergraph neural network. First, we propose an efficient hypergraph construction method for encrypted traffic named JointKNN. JointKNN calculates the Euclidean distance between traffic flows and adds the target nodes into the neighbor sets to form the hyperedges. Then, we propose an Encrypted Traffic HyperGraph Convolution Network (ETHGCN), which takes the encrypted traffic hypergraph as the input. ETHGCN extracts and fuses both connection and temporal features to accurately detect malicious traffic. We conduct comparative experiments on IoT and Onion Network encrypted traffic datasets for multi-class and binary classification tasks. Results indicate that ETHGCN achieves an accuracy exceeding 99.8% in IoT tasks and demonstrates an improvement of nearly 20% in Onion Network tasks.

Federated learning (FL) is a promising paradigm of distributed machine learning, since it enables the collaborative training of machine learning models across multiple edge devices without compromising privacy. However, when deploying the FL framework in real-world scenarios, the global model is plagued by the aggregate loss issue, which can result in inefficient and unfair model training. Existing works in the literature either fail to ensure high efficiency in model updates or can not achieve fair model updates. Inspired by the art of “Less is more”, we propose FedBFO, a Federated learning framework with Bi-level First-order Optimization. The key idea of FedBFO is to treat model aggregation as the second optimization of local models, which utilize knowledge trimming to design a more tailored global model for each device. To this end, we first propose a knowledgeaware trimming scheme to adaptively aggregate tailored global models for local devices. We then present a anomaly-aware trimming mechanism to iteratively select qualified local models. The theoretical analysis shows that FedBFO can ensure the efficiency, fairness, and convergence of models. Experimental results demonstrate that FedBFO outperforms six state-of-the-art baselines with a 6.7x convergence speed than FedAvg, achieving better tradeoff convergence performance, efficiency, and fairness.

Graph Neural Networks (GNNs) are inherently vulnerable to link stealing attacks, as their structural aggregation mechanisms may inadvertently leak training graph data. Existing link stealing methods primarily rely on posterior similarity for inference but suffer from critical limitations: inherent semantic bias (e.g., misclassifying semantically similar but unconnected nodes) and insufficient structural information, which constrain attack performance. To address these issues, we propose TLSA (Transfer Learning-based Link Stealing Attack), a novel framework that captures generalized structural knowledge from multi-domain heterogeneous graphs based on cross-domain knowledge transfer, and merges it with posterior similarity to enhance attack performance. The cross-domain knowledge transfer is enabled by integrating partially leaked target subgraphs with shadow graphs. Specifically, TLSA designs a triple-level alignment mechanism, including node feature reconstruction, which unifies heterogeneous posterior dimensions across domains; trainable hub nodes with gradient-driven topological optimization, forming bidirectional learning loops that bridge target and shadow domains; and domain adversarial training, which minimizes graph distribution distance and ensures deep semantic consistency across domains. Since its extracted structure-aware features are fused with node-pair semantic similarity, TLSA generates enhanced attack features for accurate edge existence prediction, significantly improving link stealing performance. Extensive experiments on diverse graph datasets validate the effectiveness of TLSA.

Based on emerging artificial intelligence (AI) tasks, cloud-edge–terminal architecture can provide powerful computing, intelligent interconnection, and real-time response, which can also be regarded as AI-driven network. Unfortunately, multiple network layers in the AI-driven network usually face various types of network threats, such as malicious network reconnaissance, side-channel attacks, and distributed denial of service (DDoS). Traditional security solutions respond to network threats after the occurrence of attacks. To solve this problem, the concept of moving target defense (MTD) has been proposed as a proactive defense mechanism that aims to defend against cyber attacks before they occur. In this article, we first provide a thorough analysis of the threats in the cloud-edge–terminal network. Then, we conduct a comprehensive survey to discuss the concept, design principles, and main classifications of MTD. Next, we further introduce the development potential in terms of AI-powered MTD on each network layer. Meanwhile, we also explore how MTD improves the security of AI algorithms. Lastly, we describe the existing challenges and research directions of MTD. The aim of this article is to provide an in-depth understanding for the readers on how to realize the integration between MTD and AI-driven network.

Federated Learning (FL) has emerged as a promising distributed machine learning paradigm that allows clients to jointly train a global model without sharing their raw training datasets. However, FL is vulnerable to backdoor attacks, where malicious clients inject specific backdoors into their local models to manipulate the global model’s outputs. Recent studies widely applied gradient compression to construct efficient and robust FL systems against backdoor attacks, but we argue that gradient compression cannot be seen as a reliable defense strategy against backdoor attacks. In this work, we systematically evaluate the effectiveness of gradient compression against backdoor attacks. The experimental results indicate that, in addition to the effectiveness of SignSGD in preventing backdoor injection without significantly reducing the accuracy of the global model, most gradient compression methods do not provide effective defenses against backdoor attacks. Furthermore, we develop a novel adaptive backdoor attack, named FinBack, that can effectively infiltrate the gradient compressor SignSGD and implant backdoors in FL, by inducing small weight changes on specific neurons that do not conflict with benign clients while avoiding counteraction by benign clients and perturbation triggers thereby ensuring the effectiveness and persistence of backdoors. FinBack encompasses two attack modes: FinBack with the server collusion and FinBackR without the server collusion. Extensive experiments demonstrate the effectiveness and persistence of the proposed attacks, which increases the Attack Success Rate (ASR) from 10% to over 90% in SignSGD, even with 1% of malicious clients.

By synergistically integrating mobile networks and embodied artificial intelligence (AI),mobileembodiedAInetworks (MEANETs) represent an advanced paradigm that facilitates autonomous, context-aware, and interactive behaviors within dynamic environments. Nevertheless, the rapid development of MEANETs is accompanied by challenges in trustworthiness and operational efficiency. Fortunately, blockchain technology, with its decentralized and immutable characteristics, offers promising solutions for MEANETs. However, existing block propagation mechanisms suffer from challenges such as low propagation efficiency and weak security for block propagation, which results in delayed transmission of messages or vulnerability to malicious tampering, potentially causing severe accidents in blockchain-enabled MEANETs. Moreover, current block propagation strategies cannot effectively adapt to real-time changes of dynamic topology in MEANETs. Therefore, in this paper, we propose a graph Resfusion model-based trustworthy block propagation optimization framework for consortium blockchain-enabled MEANETs. Specifically, we propose an innovative trust calculation mechanism based on the trust cloud model, which comprehensively accounts for randomness and fuzziness in the validator trust evaluation. Furthermore, by leveraging the strengths of graph neural networks and diffusion models, we develop a graph Resfusion model to effectively and adaptively generate the optimal block propagation trajectory. Simulation results demonstrate that the proposed model outperforms other routing mechanisms in terms of block propagation efficiency and trustworthiness. Additionally, the results highlight its strong adaptability to dynamic environments, making it particularly suitable for rapidly changing MEANETs.

Federated learning (FL) is a promising artificial intelligence framework that enables clients to collectively train models with data privacy. However, in real-world scenarios, to construct practical FL frameworks, several challenges have to be addressed, including statistical heterogeneity, constrained resources, and fairness. Therefore, we first investigate anaggregation gapcaused by statistical heterogeneity during local model initialization, which not only causes additional computational overhead for clients but also leads to the degradation of fairness. To bridge this gap, we proposepFedCal, a novelpersonalizedfederated learning with lightweight adaptivecalibration strategy that performs calibration compensation through the prior knowledge of clients. Specifically, we introduce compensation for each client at the model initialization, with the compensation derived from the global gradient and the latest gradient bias. To enhance the calibration effect, we introduce a smoothing-based calibration strategy, and we design an adaptive calibration strategy. A representative example demonstrates that the proposed calibration and smoothing strategies improve fairness for clients. The theoretical analysis indicates that with an appropriate learning rate, pFedCal converges to a first-order stationary point for non-convex loss functions. Comprehensive experimental results show that pFedCal achieves faster convergence, higher accuracy, and improved fairness than the state-of-the-art methods.

Vehicle trajectory data plays a pivotal role in simulation testing for autonomous driving. Hence, there exist well-established trajectory generation methods employing deep generative models to generate trajectories mapping the distribution of the original dataset, thereby augmenting existing trajectory datasets. However, these methods typically rely on large datasets gathered by governmental or organizational entities for central training, which may pose data privacy, security, and accessibility issues. Therefore, it is challenging to generate high-quality traffic trajectory data while preserving privacy which involves a delicate balance between these two objectives. To deal with this challenge, we introduce Federated Learning into the diffusion model and propose a Federated Learning-based diffusion model (FedDifftraj) to generate traffic trajectory data. Unlike existing central training methods, FedDifftraj aggregates model parameters uploaded by different vehicles and then updates a global model. Additionally, there is a substantial communication overhead incurred during the training of the federated diffusion model. Therefore, we quantize the local diffusion model before uploading it to the parameter server. Through extensive simulations on real-world datasets, FedDifftraj can generate high-quality traffic trajectory data that is consistent with the results of the central training while preserving privacy and reducing communication overhead by 93.74% when utilizing 8-bit quantization.

With the advancement of unmanned aerial vehicles (UAVs) technology, UAV-assisted cellular networks (UACNs) have emerged as a new communication paradigm aimed at enhancing the coverage and capacity of ground networks. Unfortunately, the limited energy capacity of UAVs significantly restricts their operational duration, so optimizing energy efficiency is of importance. However, existing optimization schemes often overlook the impact of ground user mobility on user association, lacking ability to achieve optimal energy efficiency. In this paper, the K-Means method is applied to optimize user association by periodically clustering users. Additionally, given the dynamic nature of the wireless channels, we utilize the Multi-Agent Twin Delayed Deep Deterministic Policy Gradient (MATD3) approach to jointly optimize 3D trajectory and power allocation. The objective is to maximize the sum energy efficiency while meeting the constraints included maximum power, minimum achievable data rate and spatial limitation. Simulation results demonstrate the effectiveness of the proposed algorithm compared with other benchmark algorithms.

Generative Artificial Intelligence (GAI) shows remarkable productivity and creativity in Mobile Edge Networks, such as the metaverse and the Industrial Internet of Things. Federated learning is a promising technique for effectively training GAI models in mobile edge networks due to its data distribution. However, there is a notable issue with communication consumption when training large GAI models like generative diffusion models in mobile edge networks. Additionally, the substantial energy consumption associated with training diffusion-based models, along with the limited resources of edge devices and complexities of network environments, pose challenges for improving the training efficiency of GAI models. To address this challenge, we propose an on-demand quantized energy-efficient federated diffusion approach for mobile edge networks. Specifically, we first design a dynamic quantized federated diffusion training scheme considering various demands from the edge devices. Then, we study an energy efficiency problem based on specific quantization requirements. Numerical results show that our proposed method significantly reduces system energy consumption and transmitted model size compared to both baseline federated diffusion and fixed quantized federated diffusion methods while effectively maintaining reasonable quality and diversity of generated data.

The development of LEO satellite networks (LSN) makes them a potential solution to deliver broadcast/multicast traffic to deploy and upgrade massive amounts of Internet of Things (IoT) devices in future 6G networks. However, inherent resource constraints of LSN leave them vulnerable to a multitude of security threats, most notably distributed denial-of-service (DDoS) attacks. Existing solutions are primarily based on machine learning detection methods which are incapable of defending against unknown zero-day attacks. This paper presents an innovative solution leveraging deep reinforcement learning (DRL) to create a dynamic multicast tree based on moving target defense (MTD), aimed at enhancing the security of multicast services in LSN. The proposed solution adopts an adaptive orbital tree mutation (AOTM) scheme that dynamically adjusts multicast tree configurations considering quality of service (QoS) constraints to avoid attacks on vulnerable nodes. Simulations demonstrate the effectiveness of the AOTM scheme, showcasing its superior defense success rates compared to existing state-of-the-art algorithms.

Unmanned aerial vehicle (UAV)-assisted video streaming is gaining growing interests in satellite-terrestrial networks due to the mobility and caching capability. However, it is challenging to perform trajectory planning and cache management towards maximizing quality of experience (QoE) for video streaming due to a dynamic network topology and a class of hybrid control actions. In this paper, we consider a QoE-oriented video streaming transport system in satellite-UAV-terrestrial network. Our goal is to design a transmission scheduling policy that can maximize the QoE received by the ground users (GUs) under the cache capacity constraints. In this regard, we formulate a scheduling problem as a cache-constrained Markov decision process (CMDP). To tackle the CMDP, we propose a novel hybrid reinforcement learning algorithm with risk sensibility. Extensive simulations show that our proposed scheme improves QoE by more than 50% over the conventionally configured schemes.

When ground base stations are not available in the aftermath of a disaster, unmanned aerial vehicle (UAV) acting as flying relay is a promising option. The UAVs with limited energy as flying relays allow for wider data coverage and more stable data transmission. However, with the changes of ground devices topology and channel, it is challenging to consider quality of service (QoS) and the age of information (AoI) in UAV communication under the energy constraint. In this paper, we propose a dynamic priority packet scheduling for UAV assisted AoI-aware network whose utility is maximized subject to QoS to get the best tradeoff of the energy consumption and the weighted AoI. Specifically, the dynamics of devices are characterized by Gauss-Markov mobility model. Dynamic priority is affected by devices' movement, channel changes and others. We optimize the trajectory of the UAV and the scheduling scheme of the packets by the Dueling Double Deep Q Network (D3QN) algorithm. Simulations show that the scheme significantly improves the utility of the system compared to the benchmarks.

Unmanned aerial vehicles (UAVs) have shown great potential in live video streaming applications, especially in surveillance and reconnaissance. However, ensuring high quality of service (QoS) remains a challenge due to the dynamic nature of wireless channels. In this paper, we tackle the crucial challenge of energy-efficient and secure UAV-enabled live video streaming. To maximize long-term energy efficiency, we propose a cross-layer optimization framework that coordinates the adjustment of video coding parameters, wireless resource allocation, and UAV trajectory planning. We formulate the joint optimization as a constrained Markov decision process (CMDP) to capture the complex interdependencies between video quality, energy usage, and security risks. We introduce a new performance metric that captures the trade-off between video quality and energy consumption. The core of our method is a customized first-order constrained policy optimization, which efficiently handle complex real-world constraints like UAV battery capacities and end-to-end transmission delays. Our approach achieves scalability and sample efficiency with minimal gradient information. Through extensive system modeling and simulations under various network conditions, we validate the effectiveness of the proposed method compared with existing reinforcement learning algorithms.

Unmanned aerial vehicles (UAVs) are integrated into existing networks to enhance coverage, increase network capacity and provide ubiquitous access service. However, the channel in the UAV network is prone to noise and interference due to the complex environments. Reconfigurable intelligent surface (RIS), as an emerging technology in recent years, can be applied to the UAV network to establish the transmission environment by intelligibly adjusting signal characteristics, which can achieve significant gains in coverage and spectral efficiency. Thus, we consider RIS aided UAV networks for virtual reality (VR) content transmission under the presence of eavesdroppers, and maximize the time average sum secrecy energy efficiency (SEE) via adjusting UAV trajectory, beamforming matrix of UAV and RIS jointly by the deep reinforcement learning (DRL) approach. To eliminate the time correlation and the coupling of variables, we propose a Lyapunov guided decay twin-delayed deep deterministic policy gradient (TD3) scheme to tackle the decoupled problem. Simulations demonstrate the effectiveness of the proposed scheme and its outperformance in SEE compared with other benchmarks.

Generative diffusion models (GDMs) have emerged as potent tools for generating high-quality, creative content across various media, including audio, images, videos, and 3-D models. Their application in artificial intelligence-generated content (AIGC) marks a pivotal advancement in the evolution from the Internet of Things (IoT) to the Artificial Intelligence of Things (AIoT). Considering the inherent multiple-access nature of AIoT, training GDMs via federated learning and deploying them collaboratively is paramount. However, such approaches introduce considerable security risks and energy consumption challenges. To address these issues, we propose a comprehensive architecture for GDMs, encompassing both training and sampling stages. This architecture, termed secure and sustainable diffusion (SS-Diff), aims to thwart trigger-based security threats, such as backdoor attacks and trojan attacks, while simultaneously reducing energy consumption in multiple-access AIoT. The SS-Diff architecture incorporates a dynamic quantization mechanism within the training phase, significantly reducing communication overhead and thereby improving both spectrum and energy efficiency. During the sampling stage, a detection-based defense strategy is employed to identify and negate trigger inputs associated with malicious attacks. Through extensive simulations, we evaluate the performance of the SS-Diff architecture. The results demonstrate that the SS-Diff can effectively train GDMs and eliminate the impact of the attacks, compared with existing schemes.

5G and Beyond 5G communication technologies have promoted the architectural innovation of the Industrial Internet of Things (IIoT) and the wide application of edge learning. As Beyond 5G technologies enhance wireless communication within IIoT, the demand for efficient, secure data management becomes paramount. Edge learning emerges as a solution for localized model training, reducing the necessity for extensive data transmission. However, this decentralization introduces vulnerabilities, particularly in data security during transmission and efficient resource utilization. To address the challenges of data scheduling for edge learning in the Wireless IIoT (WIIoT), we propose a novel architecture that leverages blockchain for secure, decentralized data scheduling and employs physically unclonable functions (PUFs)-based algorithm to ensure data integrity and confidentiality. The primary contributions consist of a task scheduling model based on blockchain, along with a data compression scheme in multiple stages combined with a data scheduling algorithm that is optimized for energy efficiency in edge learning environments. Experiments conducted on a simulated WIIoT platform comprising embedded devices validate our approach, demonstrating enhanced data security and learning efficiency which can reduce 40% in the training stage and 70% in the inference stage. Our findings contribute to the advancement of security and efficient edge learning frameworks in the context of WIIoT, addressing the intricate balance between security, efficiency, and decentralized trust.

In recent years, electric vehicles (EVs) have emerged as a promising mode of transportation. With the development of Internet of Robotic Things (IoRT) technology, charging stations are employing interconnected robots to charge EVs, automating the collection and transmission of user charging information. However, charging processes pose risks of privacy leakage to users, as malicious attackers could potentially exploit the collected charging information to infer the real identities and behavioral habits of EV users. Existing studies leverage the decentralization and anonymity of blockchain to achieve privacy-preserving charging management. Due to the increasing number of users and limited battery capacity, there is a large volume of charging requests demand to be processed. However, the consensus mechanism of blockchain limits the system throughput. Therefore, it is a challenge to preserve the privacy of EV users and simultaneously improve the system processing efficiency. To address these concerns, we propose an efficient and privacy-preserving EV charging scheme (EPDB), which leverages decentralized identifier (DID) and Pedersen commitment scheme to achieve reliable charging reservations while hiding EV User’s charging information. Additionally, we propose an efficient blockchain consensus protocol, which serves as the underlying storage for DID, thus significantly improving the system throughput. Furthermore, our proposed consensus protocol maintains high throughput even when encountering Byzantine attacks. Our theoretical analysis indicates that EPDB scheme effectively mitigate Byzantine attacks, preserve privacy and prevents deception of charging services, and our experimental results demonstrate the high efficiency of EPDB scheme.

Federated learning has emerged as a promising approach for fault diagnosis, as its ability to learn from decentralized data while preserving client privacy for industry. Yet, it also brings the problem of nonidentically and independently distributed (Non-IID) data, which can result in model convergence delay and performance degradation. Recent research aims to alleviate the problem caused by cross-domain without considering by cross-location. However, it is common in industrial production to have devices across different monitoring locations. Furthermore, experimental results indicate that the diagnostic models' performance of the latest techniques is significantly affected. To address the cross-location Non-IID data problem, we propose DecFFD, a personalized federated fault diagnosis framework that decouples global and personalized features. In DecFFD, we design a reconstructor for each client that acts as a supervisor and decoupler to disentangle global and personalized features. We then present a client alignment algorithm to eliminate the differences in global features among clients. In addition, we provide a theoretical analysis of fairness and generalization capability, offering a theoretical guarantee for model convergence. Finally, extensive experiments are conducted on two real-world datasets. Experimental results show that the accuracy of DecFFD outperforms the accuracy that of the state-of-the-art approach by 14.67% and converges at a faster rate.

Federated learning (FL) opens a new promising paradigm for the Industrial Internet of Things (IoT) since it can collaboratively train machine learning models without sharing private data. However, deploying FL frameworks in real IoT scenarios faces three critical challenges, i.e., statistical heterogeneity, resource constraint, and fairness. To address these challenges, we design a fair and efficient FL method, termed FedASA, which can address the challenge of statistical heterogeneity in resource-constrained scenarios by determining the shared architecture adaptively. In FedASA, we first present a cell-wised shared architecture selection strategy, which can adaptively construct the shared architecture for each device. We then design a cell-based aggregation algorithm for aggregating heterogeneous shared architectures. In addition, we provide a theoretical analysis of the federated error bound, which provides a theoretical guarantee for the fairness. At the same time, we prove the convergence of FedASA at the first-order stationary point. We evaluate the performance of FedASA through extensive simulation and experiments. Experimental results in cross-location scenarios show that FedASA outperformed the state-of-the-art approaches, improving accuracy by up to 13.27% with better fairness and faster convergence and communication requirement has been reduced by 81.49%.

With rapid development of emerging technologies for Internet of Things (IoT), digital twins (DT) have been proposed to support a wide variety of applications. A mobile network is expected to be integrated with DT to form a DT mobile network (DTMN). Unfortunately, DTMN still faces security threats, which have attracted great research attention. Current defense mechanisms are mostly static, i.e., responding after attacks happening. To solve the aforementioned problem, moving target defense (MTD) has been proposed as an innovative solution. However, there exist three major challenges when applying MTD into DTMN. Firstly, less emphasis was paid to collaborative scheduling between multiple MTD schemes, which can improve the security of DTMN. Secondly, MTD schemes require lots of network resources, but few works focus on the time allocation of multiple MTD schemes to reduce network resource consumption. Thirdly, existing defense strategies only rely on current information, but do not consider future information. In this paper, we propose a collaborative mutation-based MTD (CM-MTD) in DTMN. We mainly consider two MTD schemes called host address mutation (HAM) and route mutation (RM), respectively, which adjust network properties and invalidate different stages of cyber kill chain. We firstly formulate a semi-Markov decision process (SMDP) to model time-varying security events and dynamic deployment of multiple MTD schemes. Then, security events are predicted by long short-term memory (LSTM), which are regarded as network states in SMDP. Next, infeasible actions that do not satisfy network constraints will be removed from the action space of the SMDP. Lastly, we design a hierarchical deep reinforcement learning algorithm for collaborative scheduling. Simulation results highlight the effectiveness of CM-MTD compared with baseline solutions.

Network function virtualization (NFV) supports the rapid development of service function chain (SFC), which efficiently connects a sequence of network virtual function instances (VNFIs) placed into physical infrastructures. Current SFC migration mechanisms usually keep static SFC deployment after finishing certain objectives, and deployment methods mostly provide static resource allocation for VNFIs. Therefore, the adversary has enough time to plan for devastating attacks for in-service SFCs. Fortunately, moving target defense (MTD) was proposed as a game-changing solution to dynamically adjust network configurations. However, existing MTD methods mostly depend on attack-defense models, and lack adaptive mutation period. In this article, we propose an Intelligence-Driven Service Function Chain Migration (ID-SFCM) scheme. First, we model a Markov decision process (MDP) to formulate the dynamic arrival or departure of SFCs. To remove infeasible actions from the action space of MDP, we formalize the SFC deployment as a constrained satisfaction problem. Then, we design a deep reinforcement learning (DRL) algorithm named model-based adaptive proximal policy optimization (MA-PPO) to enable attack-resistant migration decisions and adaptive migration period. Finally, we evaluate the defense performance by multiple attack strategies and two realistic datasets called CICIDS-2017 and LYCOS-IDS2017 respectively. Simulation results highlight the effectiveness of ID-SFCM compared with representative solutions.

With the explosive growth of Internet traffic, large sensitive and valuable information is at risk of cyber attacks, which are mostly preceded by network reconnaissance. A moving target defense technique called host address mutation (HAM) helps facing network reconnaissance. However, there still exist several fundamental problems in HAM: 1) current approaches cannot be self-adaptive to adversarial strategies; 2) network state is time-varying because each host decides whether to mutate IP address; and 3) most methods mainly focus on enhancing security, but ignore the survivability of existing connections. In this paper, an Intelligence-Driven Host Address Mutation (ID-HAM) scheme is proposed to address aforementioned challenges. We firstly model a Markov decision process (MDP) to describe the mutation process, and design a seamless mutation mechanism. Secondly, to remove infeasible actions from the action space of MDP, we formulate address-to-host assignments as a constrained satisfaction problem. Thirdly, we design an advantage actor-critic algorithm for HAM, which aims to learn from scanning behaviors. Finally, security analysis and extensive simulations highlight the effectiveness of ID-HAM. Compared with state-of-the-art solutions, ID-HAM can decrease maximum 25% times of scanning hits while only influencing communication slightly. We also implemented a proof-of-concept prototype system to conduct experiments with multiple scanning tools.

Software defined Internet of Vehicles (SD-IoV) is an emerging paradigm for accomplishing Industrial Internet of Things (IIoT). Unfortunately, SD-IoV still faces security challenges. Traditional solutions respond after attacks happening, which is low-effective. To cope with this problem, moving target defense (MTD) was proposed to modify network configurations dynamically. However, current MTD for IIoT has several drawbacks: 1) it cannot handle highly dynamic environments; 2) MTD strategy lacks intelligence because it needs attack–defense models; 3) they are difficult to trace sources. In this article, we propose an intelligent MTD scheme to defend against distributed denial-of-service in SD-IoV. Firstly, we model the configuration mutation of roadside units as a Markov decision process (MDP), and adopt deep reinforcement learning to solve the optimal configuration. Next, we evaluate the trust of vehicles after shuffling, which can distinguish spy vehicles. Finally, extensive simulation results confirm the effectiveness of our solution compared with representative methods.

Network performance of multicast transmissions such as bandwidth, utilization and delay is very important to improve the quality of user experience and the above constraints have to be considered. Most of the current multicast protocol infrastructures use static routes, however, static routing policies provide potential convenience for attackers who can perform network sniffing or initiate DoS attacks. We propose a multi-constraint multicast routing mutation mechanism to enable dynamic changes in multicast routing while satisfying certain quality of service to achieve proactive multicast routing defense, which increases the attacker's attack cost and reduces the defender's defense overhead. In addition, for the high time complexity of the multicast tree generation algorithm, we propose a multi-controller multicast routing algorithm with multi-domains. We perform simulations and show that the defense performance of multicast routing is significantly improved after adopting this mechanism.

Concurrent multipath transfer(CMT) can make better use of network resources to increase the data transmission rate. However, there are heterogeneous paths in the real network, the existing scheduling strategy is fixed and does not have self-adaptation, there are still some problems with delay and throughput performance, which reduces the reliability of transmission. Therefore, we propose a novel CMT scheduling strategy based on multi-QoS (CMT-MQ). Combined with reinforcement learning (RL), scheduling strategies are generated according to service QoS requirements and path characteristics. At the same time, in order to reduce the action space of RL and eliminate poor paths, clustering algorithm is introduced to filter the set of paths before training. Finally, the simulation comparison experiment on OmNET++ shows that CMT-MQ has higher throughput and lower message delay.

Vehicular Ad hoc Networks (VANETs) are prone to packet drop attacks because of their inherent distributed architecture and dynamic topology. Existing security schemes mainly focus on multi-path and trust-based routing. Unfortunately, the former causes high energy consumption and the latter requires trust assessment, which is not easy to implement in practice. Route mutation (RM) is emerging as an active defense technology that changes routes periodically. Traditional RM is conceived for fixed network topologies, and needs a centralized controller, so that it cannot be applied to VANETs. Therefore, the present contribution investigates RM in VANETs by proposing a Grid-based extended Joint Action Learning approach (Grid-eJAL). To the best of our knowledge, this is the first contribution that designs an online and adaptive multi-agent reinforcement learning (MARL) for RM to mitigate attacks in VANETs. Differently from existing MARL schemes, Grid-eJAL allows vehicles to share parameters to accelerate the convergence speed of learning. In Grid-eJAL, the area of interest is split in equally sized grids and, when a vehicle transmits packets, the next hop with the minimum angle of mobility is selected within the grid considered as optimal by the learning policy. The convergence of Grid-eJAL is proved theoretically. Finally, extensive simulation results highlight the effectiveness of Grid-eJAL compared to representative state-of-the-art solutions.

The growing multimedia services have brought unprecedented challenges to the traditional static network architecture. Moving Target Defense (MTD) has been proposed to solve the inherent disadvantages of existing defense techniques. As an important area of MTD research, Route Mutation (RM) can dynamically change the forwarding routes in the network. In our previous work, we applied Reinforcement Learning (RL) to RM. However, there are still two problems that need to be addressed. 1) We consider too few constraints to reflect the actual network situation. 2) Due to the slow rate of convergence, it becomes difficult for efficient deployment. In this paper, we propose a Proximal Policy Optimization Based Route Mutation (PPO-RM) scheme to solve these problems. Firstly, we utilize the Satisfiability Module Theory (SMT) to formalize the space of all possible mutated routes. Then, we design an RM algorithm based on Proximal Policy Optimization (PPO) and implement it in the SDN controller. Finally, we simulate on Mininet to validate our method. The experiment results show that PPO-RM achieves the improvement in terms of convergence rate, defense performance, and network performance.

Moving target defense (MTD) is an emerging proactive defense technology, which can reduce the risk of vulnerabilities exploited by attacker. As a crucial component of MTD, route mutation (RM) faces a few fundamental problems defending against sophisticated Distributed-Denial of Service (DDoS) attacks: 1) it is unable to make optimal mutation selection due to insufficient learning in attack behaviors and 2) because network situation is time varying, RM also lacks self-adaptation in mutation parameters. In this article, we propose a context-aware Q-learning algorithm for RM (CQ-RM) that can learn attack strategies to optimize the selection of mutated routes. We first integrate four representative attack strategies into a unified mathematical model and formalize multiple network constraints. Then, taking above network constraints into considerations, we model RM process as a Markov decision process (MDP). To look for the optimal policy of MDP, we develop a context estimation mechanism and further propose the CQ-RM scheme, which can adjust learning rate and mutation period adaptively. Correspondingly, the optimal convergence of CQ-RM is proved theoretically. Finally, extensive experimental results highlight the effectiveness of our method compared to representative solutions.

Increasingly growing various multimedia services (e.g., interactive live video and so on) have brought tremendous pressure on existing static defense techniques. To cope with inherent drawback of static defense techniques, Network Moving Target Defense (NMTD) such as route mutation (RM) was proposed. What's more, applying reinforcement learning (RL) into RM has been proved feasible in our previous work. But two main problems still need to be considered in this combination of RL with RM: 1) It lacks the consideration of multiple flows situation. 2) With the state-action space grow larger, current solution can't handle efficiently. In this paper, we propose a deep Q-learning method for RM (DQ-RM) to solve above two problems. Firstly, benefited from the satisfiability module theory, we formalize RM space considering single flow and multiple flows concurrently. Then we further propose a deep reinforcement learning-based RM scheme based on our previous work, which is suitable for large-scale state-action space. Finally, extensive experimental results highlight the improvement of DQ-RM in defense performance and convergence speed compared to the representative solution.

Static network defense technologies are always in a passive defense state because of their disadvantages in cost, time and information. So Network Moving Target Defense (NMTD) is proposed as a kind of proactive defense technology. As an important research direction of NMTD, route mutation techniques still have limitations that they can not learn attack strategies and be adaptive in dynamical security situation. In this paper, we propose a novel route mutation mechanism based on reinforcement learning. We firstly investigate four different attack strategies and introduce a mixed attack strategy with entropy constraints. Then we formulate the network requirements using Satisfiability Module Theory (SMT) logic to acquire the route mutation space. We further propose a security-awareness Q- learning algorithm to select routes from the mutation space iteratively and conduct security awareness to adjust learning rate adaptively. Meanwhile, the optimal convergence of our algorithm is proved theoretically. Finally, experimental results highlight the effectiveness as defense performance, network overhead and convergence speed of our method compared to the representative solution.

In vehicular ad-hoc network (VANET), vehicles exchange information on road conditions which guarantees safety. However, there exists malicious nodes which interfere the communication between vehicles. Thus, it is vital to identify malicious vehicles in VANET. Reputation-based schemes are one of the most promising schemes to identify malicious nodes in time. However, existing methods can only identify malicious nodes of a specific attack. Additionally, the efficiency and effectiveness of existing work in solving advanced attacks are unsatisfactory. In this paper, we propose a scheme to identify malicious nodes in VANET based on collaborative filtration. Distinguished from the existing solutions, we consider a variety of attacks in VANET, instead of a specific attack. In addition, our scheme updates the reputation of nodes in time according to the result of each communication, which brings better efficiency and effectiveness. The superiority of our proposed scheme has been demonstrated through simulation experiments.

For the reasons that defect remedy is an endless arduous work for static network defense technologies and cyberspace security remains unguaranteed, moving target defense (MTD) is proposed to stem the tide. Whereas, as an important branch of MTD, route mutation technologies still have limitations against some sophisticated adversaries like Advanced Persistent Threat (APT), multiple-step complex or combined attacks. In this paper, we propose a new spatio-temporal route mutation method based on MTD. We first take the maximization of resistibility towards not only multiple forms of attacks but also attackers' long-term background knowledge into consideration. We also formulate the problem into a stochastic optimization model and make it possible to agilely generate the satisfying mutation route meets the demands of various parties jointly by only solving one uniform problem. Thus, network Security is guaranteed from both flows(users) and nodes(infrastructure) perspectives. Experimental results highlight the security advantages as traffic dispersion, potential victim number and attack failure rates of our method compared to existing solutions.

Most of the existing algorithms for protein similarity comparison focus on the sequence comparison and structure comparison. However, the 3D structure of a protein is determined by the force field generated by all of its atoms in essence. Thus the similarity of force field implies the similarity of 3D structure. In this paper, we propose a novel approach to compare the similarity of protein's force fields. First, we use blurred map to sample the force field into volumetric data sets. Second, the volume data set is resampled into a unified resolution. Third, the data set is band-pass filtered and quantized to reveal its physical attributes. The resulting voxels are then normalized into a canonical coordinate system concerning the center of mass and scale. Subsequently, a series of uniformly spaced concentric shells around the center of mass are constructed, based on which spherical harmonics analysis (SHA) is applied. The coefficient of SHA constitutes rotation invariant spectrum descriptors which are used to measure the similarity between two data sets. The algorithm has been performed on a set of proteins (taken from PDB) and the preliminary results are fairly inspiring.