We present SEED, a system that enables the deployment of distributed privacy-preserving micro-services in the cloud while maintaining the secrecy of user code and data and ensuring correct, complete results. Unlike prior approaches that minimize the TCB by pushing large parts of the software stack outside the enclave, SEED includes the entire container software stack—from the application layer up to the operating system—inside the TCB. This holistic design protects proprietary software, datasets, and optional ML models from exposure; prevents leakage of sensitive inputs or queries; and thwarts metadata-inference attacks that could reveal workload identity or versioning. Yet we achieve an optimized TCB (22 MB in total), over 30× smaller than the typical 690 MB TCB for confidential privacy-enhancing VMs. In practice, SEED runs on AMD SEV-SNP–capable machines and supports real container workloads (i.e., TensorFlow, OpenVINO inference, PyTorch training, Redis, NGINX, Apache httpd). We demonstrate that SEEDCore matches or outperforms mainstream runtime workload deployment, staying within 5% of native throughput and reaching up to 6× higher performance on CPU-bound jobs. Finally, we conduct a thorough privacy and security evaluation against 11 cloud attack vectors and show that SEED blocks or confines every exploit that remains possible even under the state-of-the-art Gramine-TDX model, thanks to late binding, per-container PCR chains, and continuous in-TEE attestation throughout the workload’s lifetime.

Cyber-Physical Systems (CPSs) are the backbone of Industry 4.0, seamlessly integrating physical and software components for advanced automation in diverse sectors. Recent cyber incidents have shown that these systems are increasingly vulnerable to targeted attacks. Undetected attacks on CPSs can disrupt operations, compromise safety, and cause significant economic losses. Thus, anomaly-based Intrusion Detection Systems (IDSs) are essential to ensure their safety and security, especially in an unsupervised setting where manual labelling is cost-prohibitive. However, current methods encounter significant challenges with complex and evolving characteristics of data streams generated from CPSs, like high dimensionality, uncertainty, and changing patterns, often resulting in high false alarms and missed attacks. This paper introduces RDSAD, an unsupervised, robust and adaptive anomaly-based intrusion detection method tailored to effectively monitor evolving complex CPS data streams. RDSAD integrates two innovative components: Dynamic Deviation Recognition (DDR) for capturing the underlying system dynamics, and Shift-aware Model Adaptation (SMA) for adaptive model updates in response to changing patterns. Through extensive evaluations, the experimental results demonstrate the superior performance of RDSAD compared with static and streaming state-of-the-art methods. It achieved the best AUC of 0.90 and 0.88 on SWaT and WADI datasets, respectively, and it obtained efficient runtime with large data streams.

Challenges pertaining to user anonymity and data privacy are among the major concerns in blockchain-based bilateral Peer-to-Peer Energy Trading (P2P-ET). However, existing solutions focus only on user anonymity and are severely exposed to fake energy offers that can lead to denial-of-service attacks. Moreover, the off-chain communication mechanism used for private energy negotiation is computationally inefficient. This paper proposes a Multi-Level Privacy-Preserving system (MuLPP) for blockchain-based bilateral P2P-ET that provides user anonymity, energy price and energy amount privacy while protecting against fake energy offers. To address the privacy concerns in a comprehensive way, MuLPP offers three levels of privacy: public-level, energy authority-level and participant-level. MuLPP is based on blockchain smart contracts , RSA accumulators, public key aggregation and BLS-based multi-signature to achieve user anonymity, data privacy, robustness against fake energy offers and security in off-chain negotiation. This paper also proposes a permissioned anonymous decentralized P2P off-chain communication protocol, known as PADPeC, to enhance the privacy and performance of off-chain energy negotiations. Experimental results conducted in a real environment indicate that MuLPP provides 75 to 100 times lower on-chain latency. On the other hand, PADPeC reduces the message-sending time and the number of message exchanges in the off-chain communication by a factor of 4123 and 7.88 respectively compared to the existing systems. Formal security verification conducted using AVISPA security verification tool also revealed that the system is secure against various attacks such as sybil, network flooding and fake energy offer attack.

With the advancement of Mobile Edge Computing (MEC), App vendors are increasingly motivated to cache multiple data replicas on geographically distributed edge servers to ensure rapid responses for latency-sensitive applications. However, the security of data replicas is a critical concern due to the dynamic nature and resource limitations of MEC environments. To this end, data replicas’ integrity must be regularly verified to maintain the accuracy of data-driven decision-making. Existing Edge Data Integrity (EDI) verification solutions suffer from low efficiency due to relying on indiscriminative verification, where all data replicas are checked at each round without considering their inherent reliability characteristics. This paper designs an Intelligent framework called I-EDI, which enables discriminative EDI verification by integrating a novel Long-term Unreliable data Replica Selection (L-URS) mechanism. This framework aims to reduce verification costs without compromising accuracy, while resisting spoofing, forgery, outsourcing, collusion, alteration-before-verification, delayed-response, and adaptive attacks. Specifically, each data replica is associated with a reliability representation by evaluating its long-term performance. Based on that, the L-URS problem is defined as stochastically minimizing the global reliability representation over time, subject to constraints on the number of data replicas to be verified. To make it easy-to-handle, the L-URS problem is decomposed into a series of online minimization problems. An Online Opportunistic-based Replica Selection approach called O2RS is developed. O2RS allows App vendors to significantly decrease verification costs by targetedly inspecting unreliable data replicas. Moreover, this work provides a thorough theoretical analysis of O2RS’s time complexity and approximation bound, as well as I-EDI’s security. Extensive experiments are conducted to validate the effectiveness and efficiency of O2RS and I-EDI. The results demonstrate that, compared to commonly used alternatives, O2RS achieves an approximate 50% improvement in selection efficiency, while I-EDI reduces verification costs by 1.23 times on average.

In recent years, the combination of unmanned aerial vehicles (UAVs) and wireless sensor networks (WSNs) has gained popularity in livestock management (LM) due to energy constraints and network instability. Limited energy storage of sensor nodes (SNs) and the possibility of packet loss contribute to fast energy consumption and unstable networks, respectively. UAVs serve as relay nodes and data sinks, addressing these issues by temporarily storing data to reduce SN workload and establishing mobile nodes for network stability. We propose two innovations based on previous work: 1) We introduce a multi-layer wireless network architecture, categorizing UAVs into two layers based on their functions including data collection and data processing. This enhances task parallelization, bridging performance gaps among multiple UAVs; 2) We overcome the mobility limitation of SNs, considering their real-time movement in the network. Through deep reinforcement learning, UAVs learn to cooperatively locate moving SNs. This accounts for the inevitable mobility of livestock in the industry. Additionally, we simulate the environment and compare our approach to traditional methods, evaluating metrics such as collected data per timestep (DCPS), energy consumed per timestep (ECPS), and network stability (NS). Experimental results demonstrate that our method outperforms traditional approaches, achieving a data collecting gain of 4.84% and 8.20% compared to the methods without considering SN mobility or the multi-layer characteristics of WSNs, respectively. Under energy consumption limits, our method yields energy savings of 3.00% and 1.35% respectively. Furthermore, we extensively study and validate our method against other path planning algorithms, including genetic particle swarm optimization (GPSO), modified central force optimization (MCFO), and rapidly-exploring random trees (RRT). Our approach surpasses these methods in terms of data collecting efficiency and network stability.

Space-Air-Ground Integrated Network (SAGIN) has recently emerged as a viable solution for reliable transmission, high data rates, and seamless connectivity with extensive coverage. However, the characteristics of the computation and communication devices located at various levels of SAGIN make application placement within such environments a challenging task. Real-time service expectations and resource requirements of applications further intensify this issue, and push the domain to operate beyond its capacity, resulting in uneven delays and significant overhead. Taking these constraints into account, SAGIN’s application placement problem can be expressed as a multiobjective optimisation problem. This paper aims to solve such a problem using a Dynamic Weight-configurable Harris Hawks Optimisation (DW-HHO) algorithm, considering diverse application contexts such as deadlines, resource usage and the number of application activities. It simultaneously minimises application total service time and host resource overhead with a robust global search. The performance of the proposed solution is compared with benchmark metaheuristic solutions such as PSO, NSGA-II, Greedy and Random. Experimental results demonstrate that DW-HHO outperforms other benchmark metaheuristic solutions in optimising resource utilisation and service delivery time of applications in SAGIN environments. The proposed DW-HHO demonstrates notable improvements over existing methods. Specifically, when evaluating the total service time for PSO, NSGA-II, Greedy, and Random, DW-HHO outperforms these methods by 7.28%, 9.07%, 13.01%, and 14.97%, respectively.

The accuracy and performance of Machine Learning (ML) models can gradually or even suddenly degrade when the underlying statistical distribution of data streams changes over time; this is known as concept drift. This phenomenon could adversely affect the IoT data management and analysis landscape that relies intensely on data-driven cognitive technologies. Therefore, concept drift should be detected immediately, which is challenging due to the increasing number of dimensional features and lack of ground truth. Its adaptive countermeasures also become difficult to design when data streams are being generated frequently and require latency-sensitive responses. The uncertainty and time dependencies characteristics of IoT data streams further intensify the complexity of concept drift management. This work proposes a reactive drift management framework named RADAR for streaming IoT applications that can simultaneously detect and react to concept drift using two novel methods: temporal discrepancy measure, and intensity-aware analyser. Collectively, these methods help to determine the adaptation decision to ensure reliable performance, thereby limiting the scope of the frequent ML model update. Experiments conducted using synthetic and real-world setups comprising end-to-end systems demonstrate that RADAR outperforms other benchmarks in achieving better improvement of the performance with the best F-score of 0.86, and obtaining efficient runtime with large data streams.

The popularity of Ethereum as a platform for Stablecoin transactions (for example, AUDN) continues to rise. It is therefore paramount that the integrity and security of transactions within these decentralized systems are guaranteed. The intricate network of interactions occurring during the exchange of cryptocurrencies made the task of identifying specific transactions as fraudulent difficult because fraudulent behaviour can be concealed within legitimate smart contract operations. Leveraging the inherent structure and interconnectedness of Ethereum transactions, this paper proposes a comprehensive framework to address issues such as Frontrunning within the cryptocurrency ecosystem. Constructing a knowledge graph representation of fraudulent Ethereum blockchain transactions, the proposed solution captures the relationships between addresses, transactions, and smart contracts and generates BotVictim recommendations based on Victim Receiver similarity scores exceeding 85%. These results are generated by excluding temporal transactions, a unique approach when examining the Ethereum network. Thus, our approach enables early detection and prevention of fraudulent activities, potentially safeguarding the interests of cryptocurrency users and mitigating potential financial losses. To evaluate the effectiveness of the proposed framework, its performance is compared against traditional fraud detection methods. The proposed solution demonstrates superiority in terms of accuracy and efficiency.

Compliance issues riddle the agricultural sector despite being an essential industry for the human race. Many factors contribute to compliance issues; however, meat cut label verification is one of the most critical concerns due to its erroneous nature. In addition, meat cut identification is complex for the human eye. Thus, access to a skilled labor force is challenging. Nevertheless, meat compliance is essential since it has export compliance ramifications. These factors, along with others, are pushing for a digital alternative. An alternative that can augment human decision-making in verifying meat cut box labels. Artificial Intelligence (AI) is a digital alternative that can boost quality assurance tasks. One of AI’s potential quality assurance solutions is a Meat Box Labeling Verification (BLV) solution that can verify the boxed meat type against the label to ensure no mismatch. Two major components make up the BLV solution: Meat Identification and Label Analysis. This work aims to solve the former component by exploring different meat-type identification techniques. It explores them by building, evaluating, and testing different computer vision solutions. Hence, the novel contribution of this work is three folds. We first build, test, and design computer vision solutions that detect meat boxes and pieces accurately. These solutions include deep learning methods in classification and object detection techniques. Following that, we evaluate these models and derive key insights. Such insights are valuable for prototyping such solutions in production environments. For example, classification models achieve a 99% testing accuracy in identifying box types. In contrast, object detection achieved 89% [email protected]:.95 in identified individual meat cuts. Finally, we prototype an object detection model in a natural meat processing environment—the demonstration showed comparable object detection precision at 85% [email protected]:.95.

Cyber-Physical Systems (CPSs) enable Information Technology to be integrated with Operation Technology to efficiently monitor and manage the physical processes of various critical infrastructures. Recent incidents in cyber ecosystems have shown that CPSs are becoming increasingly vulnerable to complex attacks. These incidents often lead to sensing and actuation misbehaviour by illegal manipulations of data, which can severely impact the underlying physical processes of critical infrastructures. Current research acknowledges that IT-based security measures cannot entirely protect CPSs from such threats. Moreover, they are not designed to monitor the measurement level activities of physical processes, and they fail to mitigate blended cyberattacks, especially multi-stage and zero-day ones. This article addresses these limitations by proposing a framework, named UnSupervised Misbehaviour Detection (USMD), comprising a deep neural network that learns about a system's expected behaviour from data-driven representations. USMD can identify in real-time the attacks on CPSs by using the long-short term memory and Attention method for multi-sensor data. The USMD's performance is evaluated on various known data sets (i.e., ToN_IoT, SWaT, WADI and Gas pipeline datasets). The experimental results indicate that the superior performance of USMD compared with six state-of-the-art methods, which we implemented and extensively tested. USMD achieves F-scores of 0.9699 and 0.9702 on SWaT and WADI datasets, respectively.

Edge and Fog computing paradigms overcome the limitations of cloud-centric execution for different latency-sensitive Internet of Things (IoT) applications by offering computing resources closer to the data sources. Small single-board computers (SBCs) like Raspberry Pis (RPis) are widely used as computing nodes in both paradigms. These devices are usually equipped with moderate speed processors and provide support for peripheral interfacing and networking, making them well suited to deal with IoT-driven operations, such as data sensing, analysis, and actuation. However, these small Edge devices are constrained in facilitating multitenancy and resource sharing. The management of computing and peripheral resources through centralized entities further degrades their performance and service quality significantly. To address these issues, a fully distributed framework, namedCon-Pi, is proposed in this work to manage resources at the Edge or Fog environments. Con-Pi exploits the concept of containerization and harnesses Docker containers to run IoT applications as microservices. The software system of the proposed framework also provides a scope to integrate different IoT applications, resource and energy management policies for Edge and Fog computing. Its performance is compared with the state-of-the-art frameworks through real-world experiments. The experimental results show that Con-Pi outperforms others in enhancing response time and managing energy usage and computing resources through its distributed offloading model. Further, we have developed an automated pest bird deterrent system using Con-Pi to demonstrate its suitability in developing practical solutions for various IoT-enabled use cases, including smart agriculture.

The use of Internet of Things (IoT) has introduced genuine concerns regarding data security and its privacy when data are in collection, exchange, and use. Meanwhile, blockchain offers a distributed and encrypted ledger designed to allow the creation of immutable and tamper-proof records of data at different locations. While blockchain may enhance IoT with innate security, data integrity, and autonomous governance, IoT data management and its allocation in blockchain still remain an architectural concern. In this article, we propose a novel context-aware mechanism for on-chain data allocation in IoT-blockchain systems. Specifically, we design a data controller based on fuzzy logic to calculate the Rating of Allocation (RoA) value of each data request considering multiple context parameters, i.e., data, network, and quality and decide its on-chain allocation. Furthermore, we illustrate how the design and realization of the mechanism lead to refinements of two commonly used IoT-blockchain architectural styles (i.e., blockchain-based cloud and fog). To demonstrate the effectiveness of our approach, we instantiate the data allocation mechanism in the blockchain-based cloud and fog architectures and evaluate their performance using FogBus. We also compare the efficacy of our approach to the existing decision-making mechanisms through the deployment of a real-world healthcare application. The experimental results suggest that the realization of the data allocation mechanism improves network usage, latency, and blockchain storage and reduces energy consumption.

The fourth industrial revolution, widely known as Industry 4.0, is realizable through widespread deployment of Internet of Things (IoT) devices across the industrial ambiance. Due to communication latency and geographical distribution, Cloud-centric IoT models often fail to satisfy the Quality of Service requirements of different IoT applications assisting Industry 4.0 in real time. Therefore, Fog computing focuses on harnessing edge resources to place and execute these applications in the proximity of data sources. Since most of the Fog nodes are heterogeneous, distributed, and resource-constrained, it is challenging to place Industry 4.0-oriented applications (I4OAs) over them ensuring time-optimized service delivery. Diversified data sensing frequency of different industrial IoT devices and their data size further intensify the application placement problem. To address this issue, in this article we propose a context-aware application placement policy for Fog environments. Our policy coordinates the IoT device-level contexts with the capacity of Fog nodes and minimizes the service delivery time of various I4OAs such as image processing and robot navigation applications. It also ensures that the streams of input data flowing toward the placed applications neither congest the network nor increase the computing overhead of host Fog nodes significantly. Performance of the proposed policy is evaluated in both real-world and simulated Fog environments and compared with the existing placement policies. The experiment results show that our policy offers overall 16% improvement in service latency, network relaxation, and computing overhead management compared to other placement policies.

The fog computing paradigm has drawn significant research interest as it focuses on bringing cloud-based services closer to Internet of Things (IoT) users in an efficient and timely manner. Most of the physical devices in the fog computing environment, commonly named fog nodes, are geographically distributed, resource constrained, and heterogeneous. To fully leverage the capabilities of the fog nodes, large-scale applications that are decomposed into interdependent Application Modules can be deployed in an orderly way over the nodes based on their latency sensitivity. In this article, we propose a latency-aware Application Module management policy for the fog environment that meets the diverse service delivery latency and amount of data signals to be processed in per unit of time for different applications. The policy aims to ensure applications’ Quality of Service (QoS) in satisfying service delivery deadlines and to optimize resource usage in the fog environment. We model and evaluate our proposed policy in an iFogSim-simulated fog environment. Results of the simulation studies demonstrate significant improvement in performance over alternative latency-aware strategies.

Summary Application software execution requests, from mobile devices to cloud service providers, are often heterogeneous in terms of device, network, and application runtime contexts. These heterogeneous contexts include the remaining battery level of a mobile device, network signal strength it receives and quality‐of‐service (QoS) requirement of an application software submitted from that device. Scheduling such application software execution requests (from many mobile devices) on competent virtual machines to enhance user quality of experience (QoE) is a multi‐constrained optimization problem. However, existing solutions in the literature either address utility maximization problem for service providers or optimize the application QoS levels, bypassing device‐level and network‐level contextual information. In this paper, a multi‐objective nonlinear programming solution to the context‐aware application software scheduling problem has been developed, namely, QoE and context‐aware scheduling (QCASH) method, which minimizes the application execution times (i.e., maximizes the QoE) and maximizes the application execution success rate. To the best of our knowledge, QCASH is the first work in this domain that inscribes the optimal scheduling problem for mobile application software execution requests with three‐dimensional context parameters. In QCASH, the context priority of each application is measured by applying min–max normalization and multiple linear regression models on three context parameters—battery level, network signal strength, and application QoS. Experimental results, found from simulation runs on CloudSim toolkit, demonstrate that the QCASH outperforms the state‐of‐the‐art works well across the success rate, waiting time, and QoE. Copyright © 2016 John Wiley & Sons, Ltd.