Personalized Federated Learning (PFL) enables client-specific models to address data heterogeneity but suffers from high communication overhead and unstable participation in resource-constrained and self-interested environments. Existing mainstream approaches predominantly prioritize training process efficiency but lack explicit consideration of incentive mechanisms and rational client behaviors, which may lead to clients behaving conservatively, reducing participation and limiting the effectiveness and scalability of PFL in real-world deployments. In this paper, we proposeIncenPNS, the first incentive-driven adaptive framework that jointly optimizes model pruning, neighbor selection, and incentive mechanisms for communication-efficient PFL.IncenPNSformulates the joint design as a unified optimization objective that balances personalization performance, communication efficiency, and incentive utility under dynamic and heterogeneous environments. To solve the resulting coupled and high-dimensional decision problem, we develop a Multi-Agent Soft Actor-Critic (MASAC)-based learning algorithm that enables clients to adapt pruning rates and collaboration decisions through online interaction. Moreover, a budget-balanced incentive mechanism is incorporated to operate under partial observability, aligning individual rationality with system-level objectives and ensuring reliable participation of self-interested clients. Extensive experiments on representative benchmarks show thatIncenPNSachieves up to 34.8% reduction in communication cost, 68.8% faster convergence, and 83.3% improvement in personalization accuracy compared with state-of-the-art baselines.

Edge computing plays a critical role in supporting low-latency IoT applications, yet the susceptibility of edge nodes to faults can disrupt services and degrade Quality of Service (QoS). Fault prediction offers a proactive solution by identifying potential failures through spatio-temporal feature learning from historical observations. However, existing spatio-temporal prediction models are typically designed for fixed network topologies with predefined input-output structures, which limits their effectiveness in dynamic edge networks where nodes are frequently added or removed. Adapting these models to topology variations often requires full retraining or architectural redesign, resulting in substantial computational overhead and limited real-time applicability. To overcome these limitations, this paper proposes ASTFNet, an adaptive spatio-temporal fault prediction framework for dynamic edge networks. The framework integrates a spatio-temporal fault prediction model that incorporates node identity embeddings to enable flexible representation learning under evolving topologies and an adaptive fine-tuning mechanism that detects topology changes and performs targeted model updates without full retraining. Experiments on real-world datasets demonstrate that ASTFNet significantly reduces retraining time while maintaining high prediction accuracy and achieves robust performance under dynamic node additions and removals.

As embedded devices become increasingly popular, monolithic firmware, known for its execution efficiency and simplicity, is widely used in resource-constrained devices. Different from ordinary firmware, the monolithic firmware image is packed without the file that indicates its format, which challenges the reverse engineering of monolithic firmware. Function identification is the prerequisite of monolithic firmware's analysis. Prior works on function identification are less effectiveness when applied to monolithic firmware due to their heavy reliance on file formats. In this paper, we propose Moye, a novel method to identify functions in monolithic firmware. We leverage the important insight that the use of registers must conform to some constraints. In particular, our approach segments the firmware, locate code sections and output the instructions. We use a masked language model to learn hiding relationships among the instructions to identify the function boundaries. We evaluate Moye using 1,318 monolithic firmware images, including 48 samples collected from widely used devices. The evaluation demonstrates that our approach significantly outperforms current works, achieving a precision greater than 98 % and a recall rate greater than 97 % across most datasets, showing robustness to complicated compilation options.

Neural network-based speech recognition models are widely used in various acoustic systems and have achieved significant success. However, they are vulnerable to adversarial attacks. Current adversarial attack methods typically mislead the model by introducing perturbations to the adversarial example that are inaudible or imperceptible to humans. In this paper, we propose a novel adversarial example generation method by discarding minute, imperceptible details in the audio, instead of adding carefully designed perturbations. Experimental results show that our proposed method can successfully deceive speech recognition models and achieves a 95.51% attack success rate, significantly outperforming other adversarial example generation methods. In addition, it not only achieves a high attack success rate but also maintains high perceptual quality.

The time-delay attacks pose serious security threats to the industrial control systems (ICSs), where ICS infrastructures (e.g., chemical factories) could suffer severe safety consequences. They could bypass current delay detection methods by avoiding triggering packet timeouts. In this article, we reveal that malicious states caused by the time-delay attacks in ICS scenarios can be detected by analyzing ICS programs. We propose detecting a time-delay attack in ICS scenarios by comparing the difference between malicious and benign states, meeting the real-time and noninterference requirements. Specifically, we utilize symbolic execution to analyze ICS programs to generate the benign states of ICS and leverage the key features of time-delay attacks to create the malicious states of ICS, where the states are transferred through the network for remote control and monitoring. We propose a multimodal neural network whose inputs are the malicious states sampled from the ICS network traffic and the time domain features, and the output is whether such a time-delay attack exists. We implement a prototype system and conduct real-world experiments to evaluate the performance of our detection approach. Our experiments cover 102 vulnerable ICS programs and five types of time-delay attacks. The evaluation results show that our approach can detect ICS time-delay attacks in 0.6 s, with 97.2% precision and 98% recall.

To bridge the gap of conventional single-hop task offloading schemes in infrastructure-free scenarios, multi-hop task offloading schemes for IoT devices in Mobile Edge Computing (MEC) are desired to jointly optimize task offloading decisions and routing paths. In this paper, we investigate a hierarchical multi-hop edge computing framework and propose a joint Task Offloading and Relay Selection (TORS) scheme. It considers real-time computation at each relay node and employs directional searches to facilitate the task execution and results reporting at the fastest speed. However, finding the optimal TORS solution is a formidable challenge due to the time-varying network environments, the strong interdependence of decision sets across different time slots, and the high computational complexity. To address these challenges, we first leverage Lyapunov optimization to transform the stochastic TORS problem into a deterministic per-slot block problem, avoiding the need for extensive system prior knowledge. Subsequently, we propose a Soft Actor-Critic (SAC)-based algorithm, SAC-TORS, to find a satisfactory TORS solution with minimal computational complexity in a distributed manner. Accordingly, each IoT device can independently make self-determined and directional decisions with observable network information. Through extensive experiments, we demonstrate that the SAC-TORS outperforms state-of-the-art solutions, achieving performance improvements of up to 66%.

The principal tasks of program analysis, including bug searching and code similarity detection, are executed at the function level. However, the accurate identification of functions within stripped binary files poses a significant challenge. This difficulty is exacerbated by unformatted monolithic firmware images typically found in industrial controlling device, rendering existing methods ineffective due to their dependence on specific metadata, which may be absent.

Along with the rapid-growth number of Internet of Things (IoT) devices, significant security concerns are raised due to the hidden vulnerabilities among them. Illuminating the characteristics of online devices would shed a light on protecting these potential vulnerable devices. State-of-arts methodologies enumerate devices characteristics as keywords and rules and match them with IoT network data. However, the heterogeneous implementations of IoT devices introduce intricate characteristics features, which impede the large-scale identification. In this work, we close this gap and present a semantic extraction-based approach that can automatically and effectively characterize online devices. We leverage the observation that IoT devices can be identified by analyzing the semantic information of the network packets. Specifically, we first collect the network data of IoT devices and utilize a co-training algorithm to annotate the data. We propose a residual dilate gated convolutional neural network (RDGCNN)-based encoder to extract semantic features from the annotated data. Then, we put forward an entity relationship-based decoder to generate the characteristic triplet (type, brand, and model) of IoT devices by decoding extracted features. We have implemented the prototype of the system and conducted real-world experiments to evaluate the performance. Results show that our approach achieves 92.16% precision and 86.79% recall. In addition, we apply our proposed method to characterize 15 millions IoT devices on the Internet.

Nowadays, the industrial control system (ICS) plays a vital role in critical infrastructures like the power grid. However, there is an increasing security concern that ICS devices are being vulnerable to malicious users/attackers, where any subtle changing or tampering attack would cause significant damage to industrial manufacturing. In this paper, we propose the iFinger, a novel detection approach designed to mitigate ICS attacks adapting to various industrial scenes. We take advantage of an important insight that industrial protocol packets include register status values that are used to reflect the physical characteristics of ICS controllers. The iFinger utilizes register states to generate ICS fingerprints to detect malicious attacks on industrial networks. Specifically, the boolean logic represents every register state sequence of the ICS controller, and the deterministic finite automaton (DFA) generates a device fingerprint. To discover the ICS attacks, we propose two detection approaches based on device fingerprints, including passive and active detection. We present a prototype of the iFinger and conduct real-world experiments to validate its performance. Results show that our approach achieves 97.1% F1 score in ICS device identification. Furthermore, we simulate two typical ICS attacks (replacement and code modification) to validate the effectiveness of our iFinger in industrial networks. Our device fingerprints would detect those malicious attacks within 2s latency at 98.0% recall.