The proliferation of resource-constrained devices in Internet of Things (IoT) environments has amplified the demand for scalable, secure, and efficient cryptographic services. While Encryption-as-a-Service (EaaS) models enable offloading cryptographic tasks to trusted infrastructure, critical challenges remain regarding path integrity, trust management, and resilience to adversarial threats in multi-domain networks. This paper introduces EaaS/PIN, a unified framework that combines cryptographically verifiable path integrity, user-centric trust scoring, collaborative threat intelligence, and machine learning-driven path selection across distributed Autonomous Systems (ASs). The framework integrates: (i) a novel anonymity protocol to conceal complete routes from intermediary ASs, (ii) lightweight, customizable encryption suitable for IoT and edge environments, (iii) real-time, AI-based path recommendation leveraging dynamic trust and performance metrics, and (iv) a blockchain-inspired audit mechanism for tamper-evident reporting and accountability. Comprehensive mathematical modeling, algorithms, and a detailed case study focused on secure data transmission in a multi-AS smart city network demonstrate that EaaS/PIN significantly enhances routing security, reduces latency, and ensures transparent and verifiable operations even under adversarial conditions. Experimental results confirm robust detection of path manipulation and compromised ASs, as well as measurable performance gains over baseline solutions. The proposed framework paves the way for scalable, user-aware, and resilient cryptographic services in next-generation heterogeneous network infrastructures.

Bringing flexibility and scalability to 5G networks has expanded networking technology to facilitate the split of service into microservices and how they can communicate. The network layer dedicated to this communication is called service mesh, and it has become a new target for cyber adversaries. The existing service mesh infrastructures, such as Istio and NGINX, apply the mutual TLS (mTLS) protocol to the connections in the service mesh layer to protect the confidentiality of the data transferred in this layer. However, the main challenge of implementing mTLS is its resource restriction, which significantly conflicts with the scalability and flexibility goals. Therefore, this paper proposes an Encryption as a Service (EaaS) framework that can be implemented on Kubernetes, mitigating man-in-themiddle, (distributed) denial of service, and eavesdropping attacks against service mesh. The implementation results show that the proposed framework decreases the adversary's success rate by at least 45% compared to the cases of having microservices apply the cryptographic processes by themselves.

Distributed Denial of Service (DDoS) attacks are among the most destructive and challenging threats to mitigate for computer networks, particularly in edge IoT environments. Moving Target Defense (MTD) is a promising security mechanism that undermines the adversary’s gathered information by dynamically altering the attack surface. A selection of network nodes is chosen for mutation, and these changes hinder the adversary from achieving their objectives. However, identifying the optimal set of nodes for effectively and efficiently mitigating a DDoS attack remains a significant challenge. Existing MTD approaches have only considered a single factor—either the node’s vulnerability level or connectivity—and often lack generality and scalability for real-world IoT implementations. In this paper, we propose an enhanced MTD approach called CVbMA (Connection- and Vulnerability-based MTD Approach) that jointly considers both the vulnerability levels and connection weights of nodes to inform mutation strategies. To ensure practical applicability and adaptability, we develop a cost-aware Reinforcement Learning (RL) framework that incorporates explicit mutation costs into the reward function and utilizes neural ranking and model compression for scalability. Extensive evaluations are conducted using both Mininet-based simulations and a physical IoT testbed with real attack traces and heterogeneous devices. Comprehensive benchmarking and ablation studies against state-of-the-art MTD baselines demonstrate that the proposed framework significantly reduces the adversary’s success rate and incidents of server crashes, while maintaining low overhead and achieving high adaptivity. A detailed analysis of real-world deployments highlights the robustness of systems under operational constraints, including fluctuating latency, hardware diversity, and asynchronous events. Limitations and future enhancements, including topology-aware RL, adaptive mutation scheduling, and continuous model updates, are discussed. The results affirm the practical, scalable, and robust potential of cost-sensitive RL-based MTD for next-generation IoT security.

5G slices are susceptible to indirect Distributed Denial of Service (DDoS) attacks, where overwhelming traffic directed to one slice can also disrupt other slices sharing the same infrastructure Many current mitigation methods rely on a detection phase, which may not be effective against unknown or sophisticated attacks. Moving Target Defense (MTD) is a security mechanism that invalidates the adversary's collected information, and it can be deployed without the detection phase. In this paper, we propose a Slice Mutation technique based on Reinforcement Learning (SMRL) that reduces the impact of DDoS attacks on 5G slices while keeping the number of allocated slices acceptable. SMRL proposes a general RL model that considers ternary and ranking numbers to improve learning performance. We tested SMRL on computer networks attacked by a real botnet called Mirai and assessed its performance using various measures, including a new functionality analysis method The results indicate that SMRL decreases the number of slices impacted by a DDoS attack and enhances the distribution of slices among infrastructure resources by 46 % and 20 %, respectively.

Honeypot technologies are becoming increasingly popular in cybersecurity as they offer valuable insights into adversary behavior with a low rate of false detections. By diverting the attention of potential attackers and siphoning off their resources, honeypots are a powerful tool for protecting critical assets within a network. However, the cybersecurity landscape constantly evolves, and professional attackers are always working to uncover and bypass honeypots. Once an adversary successfully identifies a deception mechanism in place, they may change their tactics, potentially causing significant harm to the network. Maintaining a high level of deception is crucial for honeypots to remain undetectable. This paper explores various deception techniques designed specifically for honeypots to enhance their performance while making them impervious to detection. Previous research has not provided a detailed comparison of these techniques, particularly those tailored to honeynets. Therefore, we categorize the presented techniques into relevant classes, subject them to a comparative analysis, and evaluate their effectiveness in simulation scenarios. We also present a mathematical model that comprehensively represents and compares various honeynet research endeavors. In addition, we provide insightful suggestions that highlight the existing research gaps in this field and offer a roadmap for future expansion. This includes extending deception techniques to emulate vulnerabilities inherent in 5G and software-defined networks, which address the evolving challenges of the cybersecurity landscape. The findings and insights presented in this paper are valuable to honeypot developers and cybersecurity researchers alike, providing a vital resource for advancing the field and fortifying network defenses against ever-evolving threats.

The main goal of Encryption as a Service (EaaS) is to deliver cryptography services to limited-resource devices. However, due to the massive number of devices connecting EaaS platforms, they face challenging issues, such as high service delays and uncovered requests. The existing EaaS architectures lack in adequately taking advantage of both cloud and fog layers, by which the performance can be improved. Therefore, this article proposes a novel EaaS architecture called full-cloud-fog that focuses on increasing the EaaS throughput by locating the frequently accessed components on the fog layer and resolving resource allocations utilizing the cloud nodes. We have analyzed the security aspects of the proposed architecture and then implemented it in a real testbed. The evaluation results show that the proposed full-cloud-fog architecture improves the EaaS throughput by 81%.

The widespread adoption of Internet of Things (IoT) technology has introduced new cybersecurity challenges. Encryption services are being offloaded to cloud and fog platforms to mitigate these risks. Encryption as a Service (EaaS) emerges as a remedy, offering cryptographic solutions tailored to the resource constraints of IoT devices. This study thoroughly examines existing EaaS platforms, categorizing them based on encryption algorithms and service offerings. Additionally, we outline various EaaS architecture types depending on the placement of key components. Practical implementations of these platforms are explored through different testbeds. A key focus lies in dissecting the challenges that EaaS faces, particularly in the context of IoT, while suggesting potential remedies. This work stands out as an all-encompassing exploration, bridging the gap left by previous surveys.

Mafia, also known as Werewolf, is a game of uncertainty between two teams, which aims to eliminate the other team's players from the game. The similarities between detecting the Mafia members in this game and botnet detection in a computer network motivate us to solve the botnet detection problem using this game's winning strategies. None of the state-of-the-art researches have used the Mafia game strategies to detect the network's malicious nodes. In this paper, we first propose the Mafia detection strategies, which are applied using linear relation and reinforcement learning techniques. We then use the suggested strategies in a network infected by the Mirai botnet, using Mininet, to evaluate the performance of botnet detection. The average results show that the suggested strategies are 11% more accurate than the existing ones for the Mafia game. Additionally, the true positive and true negative detection rates of a network modeled by the proposed Mafia game are 71% and 91%, respectively.

Network slicing within 5G networks encounters two significant challenges: catering to a maximum number of requests while ensuring slice isolation. To address these challenges, we present an innovative actor-critic Reinforcement Learning (RL) model named ‘Slice Isolation based on RL’ (SIRL). This model employs five optimal graph features to construct the problem environment, the structure of which is adapted using a ranking scheme. This scheme effectively reduces feature dimensionality and enhances learning performance. SIRL was assessed through a comparative analysis with nine state-of-the-art RL models, utilizing four evaluation metrics. The average results demonstrate that SIRL outperforms other models with a 70% higher coverage rate of requests and an 8% reduction in damage resulting from DoS/DDoS attacks.

As a way of obtaining useful information about the adversaries behavior with a low rate of false detection, honeypots have made significant advancements in the field of cybersecurity. They are also powerful in wasting the adversaries resources and attracting their attention from other critical assets in the network. A deceptive network with multiple honeypots is called a honeynet. The honeypots in a honeynet aim to cooperate in order to increase their deception power. Professional adversaries utilize strong detection mechanisms to discover the existence of the honeypots in a network. When an adversary finds that a deception mechanism is deployed, it may change their behavior and cause malicious effects on the network. Therefore, a honeynet has to be deceptive enough in order not to be identified. This paper aims to review the techniques that are designed for the honeynets to make them improve their deception performance. The recent related surveys do not focus on the honeynet-specific techniques, and also have no comparison analysis. The main presented techniques in this paper are fully investigated through comparative analysis and simulation scenarios. Some suggestions on the research gap are also provided. The results of this paper can be used by the honeynet developers and researchers to improve their work.

Abstract Increasing amounts of data are being generated every year. Sustainable computing systems have become capable of extracting and learning information from the underlying data. Edge and AI (artificial intelligence) are expanding into industrial systems requiring new computing and networking infrastructure. Due to this, SLA computing is becoming increasingly challenging to handle in these emerging cloud environments. The cloud is a service that provides virtual resources to users. Qualitative and quantitative findings in market-oriented approaches are one of the most common methods for managing virtual and physical machines in a network. When allocating services, price is an important factor to consider. In this study, we aim to determine the initial price of VMs while considering the dynamic pricing model in a competitive, sustainable computing system. Besides negotiation-based trading, a multifactor architecture is used for trading in the marketplace. Based on the simulation results, it was found that the performance could be improved by categorizing the VMs based on regression. According to the simulation results, the cloud market system provides a better service-level agreement (SLA) and response time when assigning virtual machines to the market. Based on the results, we found that using the regression method for categorizing the VMs to manage the market improved the SLA.

Protecting large-scale networks, especially Software-Defined Networks (SDNs), against distributed attacks in a cost-effective manner plays a prominent role in cybersecurity. One of the pervasive approaches to plug security holes and prevent vulnerabilities from being exploited is Moving Target Defense (MTD), which can be efficiently implemented in SDN as it needs comprehensive and proactive network monitoring. The critical key in MTD is to shuffle the least number of hosts with an acceptable security impact and keep the shuffling frequency low. In this paper, we have proposed an SDN-oriented Cost-effective Edge-based MTD Approach (SCEMA) to mitigate Distributed Denial of Service (DDoS) attacks at a lower cost by shuffling an optimized set of hosts that have the highest number of connections to the critical servers. These connections are named edges from a graph-theoretical point of view. We have proposed a three-layer mathematical model for the network that can easily calculate the attack cost. We have also designed a system based on SCEMA and simulated it in Mininet. The results show that SCEMA has lower complexity than the previous related MTD field with acceptable performance.

Monitoring security and quality of service is essential, due to the rapid growth of the number of nodes in wireless networks. In healthcare/industrial environments, especially in wireless body area networks (WBANs), this is even more important. Because the delays and errors can directly affect patients'/scientists' health. To increase the Monitoring Quality of Services (MQoS) in WBANs, a secure medium access control (MAC) protocol needs to be developed to provide optimal services. This article provides a comprehensive review of MAC protocols in WBANs with a technical security analysis approach. Time-based, contention-based, and hybrid protocols are compared in this article, regarding MQoS and their security vulnerabilities. We have considered delay, packet loss, and energy consumption as performance evaluation criteria in WBANs, which may be degraded under a cyberattack. This work shows that there is a research gap in the literature, which is the failure of covering security and privacy issues in the MAC layer protocols.

In today’s world, interconnected Vehicular ad-hoc networks (VANET) and intelligent transportation systems have become more popular. Although IoV can bring many benefits for the smart cities and provide comforts for the passengers, however, the increasing needs for keeping the QoS and QoE at an acceptable level in time sensitive applications seems crucial and needs to be investigated deeply. Also, allocating the right number of resources to avoid congestions and fill the deficiencies in a distributed manner is a challenging issue. So, with the increase in users, attention must be given to Quality of Service (QoS) and resource allocation. As the vehicle network provides information to provide safety, comfort, and entertainment to drivers and passengers, they are one of the most compelling research topics in intelligent transportation systems. TDMA protocol is used in this study to increase the efficiency of the network and the quality of service it provides. To solve the synchronization problem, the Markov method predicts the size of slots and frames. The scenario field is used in the Markov application section to better predict TDMA gaps on solving the synchronization problem. Accordingly, the higher the quality of service, the lower the latency of the network, and the better the allocation of resources. Optimizing allocation and quality of service is further motivated by reducing collision between packets. In terms of its implementation, this method is divided into two components, the first being the database proposal for constructing the Markov matrix and the second being the simulation on VanetMobisim and implementation of the network in NS2. The proposed method performed better in different scenarios in terms of computational complexity, PDF, latency, and overhead, as shown in the results section.

Each group in a data-driven automobile network has its cluster head. A group can communicate with each other and members of other groups once it has been founded. Vehicles belonging to each group near the other group allow intergroup communication. Because nodes in automotive networks move so quickly, routing in these networks is a complex problem to solve. Each cluster in hierarchical clustering can be partitioned into multiple sub-clusters. Put another way, and the data is stored in a cluster, which is then divided into more clusters. The data is stored directly in separate clusters in non-hierarchical approaches. A dendrogram is a type of hierarchical tree. We anticipate increasing information sharing in clusters by properly clustering vehicles on the road and establishing clusters of the desired size in the relevant dendrogram. We can select clusters of the necessary extent and compare the Quality of Service (QoS) network’s outcomes by breaking the dendrogram at different levels. The findings reveal that the suggested method outperforms AIVISN in delay, PDR, overhead, and Drooped packets compared to AIVISN, 7.12%, 12.21%,8.32%, and 7.34%, respectively.

Network slicing in 5G networks can be modeled as a Virtual Network Embedding (VNE) problem, wherein the slice requests must be efficiently mapped on the core network. This process faces two major challenges: covering the maximum number of requests and providing slice isolation. Slice isolation is a mechanism for protecting the slices against Distributed Denial of Service (DDoS) attacks. To overcome these two challenges, we have proposed a novel actor-critic Reinforcement Learning (RL) model, called Slice Isolation-based Reinforcement Learning (SIRL), using five optimal graph features to create the problem environment, the form of which is changed based on a ranking scheme. The ranking procedure reduces the dimension of the features and improves learning performance. We evaluated SIRL by comparing it against four non-RL and nine state-of-the-art RL models. The average results show that the ratio of the covered requests and the damage caused by a DDoS attack of SIRL is 54% higher and 23% lower than that of the other models, respectively. It also has an acceptable learning performance and generality, regarding the reported results that show SIRL agents trained and tested with different networks outperform the other agents by 97%.

Protecting large-scale networks, especially Software-Defined Networks (SDNs), against distributed attacks in a costeffective manner plays a prominent role in cybersecurity. One of the pervasive approaches to plug security holes and prevent vulnerabilities from being exploited is Moving Target Defense (MTD), which can be efficiently implemented in SDN as it needs comprehensive and proactive network monitoring. The critical key in MTD is to shuffle the least number of hosts with an acceptable security impact and keep the shuffling frequency low. In this paper, we have proposed an SDN-oriented Cost-effective Edge-based MTD Approach (SCEMA) to mitigate Distributed Denial of Service (DDoS) attacks with a lower cost by shuffling an optimized set of hosts have the highest number of connections to the critical servers. These connections are named edges from a graph-theoretical point of view. We have designed a system based on SCEMA and simulated it in Mininet. The results show that SCEMA has lower (52.58%) complexity than the previous related MTD methods with improving the security level by 14.32%.

Recent studies in information computation technology (ICT) are focusing on Next-generation networks, SDN (Software-defined networking), 5G, and 6G. Optimal working mode for device-to-device (D2D) communication is aimed at improving the quality of service with the frequency spectrum structure is of research areas in 5G. D2D communication working modes are selected to meet both the predefined system conditions and provide maximum throughput for the network. Due to the complexity of the direct solutions, we formulated the problem as an optimization problem and found the optimal working modes under different parameters of the system through extensive simulations. After determining the links’ optimal modes, we calculated the network throughput; because of selecting the best working modes, we obtained the highest throughput. A major finding from this research is that D2D communication pairs are more inclined to use full-duplex (FD) mode in short distances to meet system requirements, and so most communications take place in FD mode at these distances. According to these results, using FD communication at short distances offers better conditions and Quality of service (QoS) than QoS-D2D method.