Security Operations Center (SOC) analysts experience notable performance degradation under elevated cognitive stress, yet existing systems treat stress detection and decision support as separate problems. This paper presents a Cognitive–Physiological Synchronization (CPS) Framework for IoT-based Security Operations Centers (IoT-SOCs) that integrates multimodal physiological stress inference with cognitive decision-making agents to enable real-time, uncertainty-aware action selection in cybersecurity environments. Our framework employs a calibrated DNN-XGBoost ensemble to estimate stress probability from electrocardiogram (ECG), electrodermal activity (EDA), and respiration signals collected via wearable biosensors. The CPS layer converts these physiological beliefs into actionable cognitive utilities through Bayesian log-odds updates, dynamically aligning decision policies with the analyst’s momentary stress state. We further introduce a Utility-Aware Temporal Reasoner (UATR) that smooths sequential evidence over time and a Stress-Weighted Memory (SWM) mechanism that adapts experience recall within the SpeedyIBL cognitive model. Evaluated using leave-one-subject-out cross-validation on the WESAD dataset, the framework achieves 95.8% accuracy (AUC = 0.967) with sub-second latency. In zero-shot SOC simulations using CICIDS2017 tasks, unsupervised calibration enhances decision stability and reduces false escalations relative to rule-based baselines. Results confirm that synchronizing physiological stress inference with cognitive policy selection improves end-to-end action quality under uncertainty, laying a foundation for Internet of Things (IoT)-connected, human-centered adaptive cybersecurity operations across cyber–physical and edge environments.

Social media has emerged as a key arena for statesponsored disinformation campaigns, where coordinated troll accounts disseminate false narratives and manipulate public discourse. While existing research has primarily focused on detecting such troll accounts, this paper introduces the novel concept of Troll Attribution, drawing on principles from cyber threat attribution. We propose TrollSleuth, a comprehensive framework for attributing troll activity to state sponsors by analyzing linguistic and behavioral fingerprints. Our method integrates four analytical modules-Social Engagement, Word Analysis, Emotion and Sentiment Analysis, and Temporal Activity and Client Utilization Analysis-to extract distinctive features from real-world Twitter data spanning four state-sponsored campaigns. The resulting model achieves a high F1-score of $\mathbf{9 5. 4 8 \%}$ in state-sponsor identification and incorporates featurebased explanations to enhance interpretability. These findings offer actionable insights for strategic intelligence, supporting the detection and deterrence of disinformation operations, informing legal and diplomatic responses, and reinforcing defenses against state-sponsored influence campaigns. The code used in this study is publicly available.11https://github.com/CyberScienceLab/Our-Papers/tree/main/TrollSleuth/

The increasing demand for intelligent, privacy-aware, and scalable solutions at the edge of the network is accelerating the convergence of Giant AI models and Internet of Things (IoT) infrastructures in 6G environments. In this article, we propose a symbiotic threat detection framework that unifies federated learning (FL), graph neural networks (GNNs), and HE to enable decentralized anomaly detection across distributed 6G-enabled IoT ecosystems. Our approach addresses key challenges in current cloud-centric architectures, including data privacy, communication efficiency, and lack of interpretability in AI-driven threat detection. The proposed framework, SymFL-GNN, supports collaborative learning among IoT devices while retaining data locally, leveraging the PHC to ensure gradient-level encryption. To enhance interpretability, a dynamic sensor graph is constructed using self-learned embeddings and attention mechanisms, allowing the model to pinpoint anomalous behaviors and their sources. We evaluate our framework on two real-world industrial datasets (SWaT and WADI) representing cyber-physical water systems, achieving 96.3% and 96.0% accuracy, respectively, with significant improvements over existing baselines in both precision and F1 score. Our results show that SymFL-GNN effectively balances local autonomy with global intelligence, supporting the vision of symbiotic AI at the edge. The framework demonstrates how 6G-enabled IoT networks can jointly contribute to and benefit from Giant AI models, laying the foundation for secure, intelligent, and privacy-preserving distributed systems in critical infrastructure and consumer environments.

Although federated learning offers a level of privacy by aggregating user data without direct access, it remains inherently vulnerable to various attacks, including poisoning attacks where malicious actors submit gradients that reduce model accuracy. In addressing model poisoning attacks, existing defense strategies primarily concentrate on detecting suspicious local gradients over plaintext. However, detecting non-independent and identically distributed encrypted gradients poses significant challenges for existing methods. Moreover, tackling computational complexity and communication overhead becomes crucial in privacy-preserving federated learning, particularly in the context of encrypted gradients. To address these concerns, we propose a robust privacy-preserving federated learning model resilient against model poisoning attacks without sacrificing accuracy. Our approach introduces an internal auditor that evaluates encrypted gradient similarity and distribution to differentiate between benign and malicious gradients, employing a Gaussian Mixture Model and Mahalanobis Distance for byzantine-tolerant aggregation. The proposed model utilizes Additive Homomorphic Encryption to ensure confidentiality while minimizing computational and communication overhead. Our model demonstrates superior performance in accuracy and privacy compared to existing strategies and encryption techniques, such as Fully Homomorphic Encryption and Two-Trapdoor Homomorphic Encryption. The proposed model effectively addresses the challenge of detecting maliciously encrypted non-independent and identically distributed gradients with low computational and communication overhead.

Ethereum blockchain has shown great potential in providing the next generation of the decentralized platform beyond crypto payments. Recently, it has attracted researchers and industry players to experiment with developing various Web3 applications for the Internet of Things (IoT), Defi, Metaverse, and many more. Although Ethereum provides a secure platform for developing decentralized applications, it is not immune to security risks and has been a victim of numerous cyber attacks. Adversarial attacks are a new cyber threat to systems that have been rising. Adversarial attacks can disrupt and exploit decentralized applications running on the Ethereum platform by creating fake accounts and transactions. Detecting adversarial attacks is challenging because the fake materials (e.g., accounts and transactions) as malicious payloads are similar to benign data. This article proposes a model using Generative Adversarial Networks (GAN) and Deep Recurrent Neural Networks (RNN) for cyber threat hunting in the Ethereum blockchain. Firstly, we employ GAN to generate fake transactions using genuine Ethereum transactions as the first phase of the proposed model. Then in the second phase, we utilize bi-directional Long Short-Term Memory (LSTM) to identify adversarial transactions in a hunting exercise. The results of the first phase evaluation show that the GAN can generate transactions identical to the actual Ethereum transactions with an accuracy of 82.51%. Also, the results of the second phase show 99.98% accuracy in identifying adversarial transactions.

Nowadays, blockchain-based technologies are being developed in various industries to improve data security. In the context of the Industrial Internet of Things (IIoT), a chain-based network is one of the most notable applications of blockchain technology. IIoT devices have become increasingly prevalent in our digital world, especially in support of developing smart factories. Although blockchain is a powerful tool, it is vulnerable to cyberattacks. Detecting anomalies in blockchain-based IIoT networks in smart factories is crucial in protecting networks and systems from unexpected attacks. In this article, we use federated learning to build a threat hunting framework called block hunter to automatically hunt for attacks in blockchain-based IIoT networks. Block hunter utilizes a cluster-based architecture for anomaly detection combined with several machine learning models in a federated environment. To the best of our knowledge, block hunter is the first federated threat hunting model in IIoT networks that identifies anomalous behavior while preserving privacy. Our results prove the efficiency of the block hunter in detecting anomalous activities with high accuracy and minimum required bandwidth.

The security of Industrial Control Systems is of high importance as they play a critical role in uninterrupted services provided by Critical Infrastructure operators. Due to a large number of devices and their geographical distribution, Industrial Control Systems need efficient automatic cyber-attack detection and attribution methods, which suggests us AI-based approaches. This paper proposes a model called SteelEye based on Semi-Deep Learning for accurate detection and attribution of cyber-attacks at the application layer in industrial control systems. The proposed model depends on Bag of Features for accurate detection of cyber-attacks and utilizes Categorical Boosting as the base predictor for attack attribution. Empirical results demonstrate that SteelEye remarkably outperforms state-of-the-art cyber-attack detection and attribution methods in terms of accuracy, precision, recall, and Fl-score.

Blockchain technology has found extensive applications in recent years, especially in financial and currency exchange applications, due to improved trustworthiness and security. Although blockchain technology improves security by design, it is not immune to security threats and vulnerabilities. Ethereum, as a decentralized, open-source blockchain, has shown high growth and widespread adoption in recent years, however, there is a wide range of vulnerability, security risks, and also attacks around it. To tackle such issues, machine learning could be a viable solution for threat hunting in the Ethereum blockchain. Machine learning algorithms, by analyzing the behav-ioral patterns, can achieve an insight for threat hunting. In this paper, we proposed a deep learning-based model for Ethereum threat hunting. The model applies a deep neural network for attack detection and uses a combination of machine learning algorithms (unsupervised with supervised algorithms) for attack classification. The performance evolution of the proposed model in terms of accuracy presents 97.72 % in Ethereum attack detection and 99.4% in attack classification.

There is currently widespread use of drones and drone technology due to their rising applications that have come into fruition in the military, safety surveillance, agriculture, smart transportation, shipping, and delivery of packages in our Internet-of-Things global landscape. However, there are security-specific challenges with the authentication of drones while airborne. The current authentication approaches, in most drone-based applications, are subject to latency issues in real time with security vulnerabilities for attacks. To address such issues, we introduce a secure authentication model with low latency for drones in smart cities that looks to leverage blockchain technology. We apply a zone-based architecture in a network of drones, and use a customized decentralized consensus, known as drone-based delegated proof of stake (DDPOS), for drones among zones in a smart city that does not require reauthentication. The proposed architecture aims for positive impacts on increased security and reduced latency on the Internet of Drones (IoD). Moreover, we provide an empirical analysis of the proposed architecture compared to other peer models previously proposed for IoD to demonstrate its performance and security authentication capability. The experimental results clearly show that not only does the proposed architecture have low packet loss rate, high throughput, and low end-to-end delay in comparison to peer models but also can detect 97.5% of attacks by malicious drones while airborne.

Traditional Internet of Things (IoT) system architectures are centralized. Data from the devices are stored on the back-end, where they are processed and analyzed, and then reconnected to IoT devices. The scalability of centralized systems is very limited especially when an abundance of devices exist on an IoT network. Network security in IoT networks is another aspect at stake that could be compromised easily due to the unavailability of security in design mechanisms in most IoT networks. Blockchain technology is a distributed ledger without any intensive management that can store all transactions which leads to large amounts of data that increases over time. Large data amounts will be more pronounced with the increasing IoT devices and blockchain use cases involving IoT. IoT devices are for the most part constrained in both energy, storage, and computation, unlikely to be able to store all blockchain data. The current implementation of blockchain is not IoT friendly. Moreover, consensus on the blockchain using Proof of Work (PoW) is infeasible due to computational constraints. In this paper, we propose a Secure and Low latency Proof of Work (SLPoW) protocol. We also bring the computation of miners onto a Field-programmable gate array (FPGA) to improve the processing speeds of computation. We consider our resulting blockchain technology using SLPoW suitable for the evolving Green IoT setting.

In any interconnected healthcare system (e.g., those that are part of a smart city), interactions between patients, medical doctors, nurses and other healthcare practitioners need to be secure and efficient. For example, all members must be authenticated and securely interconnected to minimize security and privacy breaches from within a given network. However, introducing security and privacy-preserving solutions can also incur delays in processing and other related services, potentially threatening patients lives in critical situations. A considerable number of authentication and security systems presented in the literature are centralized, and frequently need to rely on some secure and trusted third-party entity to facilitate secure communications. This, in turn, increases the time required for authentication and decreases throughput due to known overhead, for patients and inter-hospital communications. In this paper, we propose a novel decentralized authentication of patients in a distributed hospital network, by leveraging blockchain. Our notion of a healthcare setting includes patients and allied health professionals (medical doctors, nurses, technicians, etc), and the health information of patients. Findings from our in-depth simulations demonstrate the potential utility of the proposed architecture. For example, it is shown that the proposed architecture's decentralized authentication among a distributed affiliated hospital network does not require re-authentication. This improvement will have a considerable impact on increasing throughput, reducing overhead, improving response time, and decreasing energy consumption in the network. We also provide a comparative analysis of our model in relation to a base model of the network without blockchain to show the overall effectiveness of our proposed solution.

Internet of Things (IoT) is a disruptive technology in many aspects of our society, ranging from communications to financial transactions to national security (e.g., Internet of Battlefield / Military Things), and so on. There are long-standing challenges in IoT, such as security, comparability, energy consumption, and heterogeneity of devices. Security and energy aspects play important roles in data transmission across IoT and edge networks, due to limited energy and computing (e.g., processing and storage) resources of networked devices. Whether malicious or accidental, interference with data in an IoT network potentially has real-world consequences. In this article, we explore the potential of integrating blockchain and software-defined networking (SDN) in mitigating some of the challenges. Specifically, we propose a secure and energy-efficient blockchain-enabled architecture of SDN controllers for IoT networks using a cluster structure with a new routing protocol. The architecture uses public and private blockchains for Peer to Peer (P2P) communication between IoT devices and SDN controllers, which eliminates Proof-of-Work (POW), as well as using an efficient authentication method with the distributed trust, making the blockchain suitable for resource-constrained IoT devices. The experimental results indicate that the routing protocol based on the cluster structure has higher throughput, lower delay, and lower energy consumption than EESCFD, SMSN, AODV, AOMDV, and DSDV routing protocols. In other words, our proposed architecture is demonstrated to outperform classic blockchain.