ABSTRACT This paper proposes an intelligent and adaptive security framework for internet of things (IoT) environments by integrating edge Honeypots, AI‐driven intrusion detection systems (IDS), and software‐defined networking (SDN). The system is designed to enhance real‐time threat detection, reduce false positives, and dynamically mitigate attacks. Edge Honeypots are deployed at the network perimeter to attract and analyze malicious traffic, which is then used to train AI‐based IDS models. The IDS employ a hybrid detection mechanism combining signature‐based and anomaly‐based techniques. SDN facilitates centralized traffic control and dynamic rule updates, enabling rapid responses to new attack vectors. The framework is implemented and evaluated in a simulated SDN‐IoT environment using Mininet, with several machine learning models benchmarked. The Decision Tree model achieves the highest detection accuracy (97%) for IoT threats. Experimental results demonstrate improved detection performance, reduced false positives, and enhanced adaptability through a continuous learning loop between the IDS and honeypots.

Mobile Ad-hoc Networks (MANETs) are highly vulnerable to security threats due to their dynamic topology, resource constraints, and lack of centralized infrastructure. This paper introduces SecureMANET, a novel system designed to enhance MANETs’ security and performance. SecureMANET integrates an LSTM-based intrusion detection mechanism with multi-objective Quality of Service (QoS) routing. The proposed system utilizes a deep learning model trained on network traffic to identify anomalous links; preliminary evaluation showed a 20% detection rate. Subsequently, a modified Dijkstra’s algorithm computes optimal routing paths, incorporating a multi-objective optimization that considers QoS parameters such as security (0.2), delay (0.2), energy (0.15), and packet loss (0.15), etc. Experimental simulations on a $\mathbf{2 5}$-node MANET testbed substantiated the approach’s efficacy. Results indicate that SecureMANET successfully bypasses attack-compromised network segments while maintaining acceptable performance (average delay: 31.61 ms, average hop count: 1.5). Comparative analysis demonstrates that our algorithm reduces security threats by up to 50% with minimal degradation in network efficiency. The framework’s modular design offers flexibility across diverse MANET deployments, positioning SecureMANET as a promising solution for securing resource-constrained wireless networks.

Mobile Ad Hoc Networks (MANETs) are faced with great challenges of dynamic topology change and node mobility that necessitate routing schemes with fast convergence and excellent adaptability. Current routing schemes struggle to cope with the inherent characteristics of MANETs. In this paper,a QoS-aware routing optimization based on an adapted deep reinforcement learning network is proposed,The solution employs a three-layered architecture based on Software-Defined Networking (SDN) and deep reinforcement learning agents. Results of experiments from Mininet simulation and PyTorch implementation demonstrate improvement with much: $15.26 \%$ improvement in mean throughput,$44.59 \%$ reduction in average delay, and $10.90 \%$ reduction in jitter over the traditional routing techniques.

ABSTRACT Mobile ad hoc networks (MANETs) face significant routing challenges in dynamic environments due to frequent topology changes, limited bandwidth, and resource constraints. To address these issues, this paper proposes a novel routing framework that integrates deep reinforcement learning (DRL) with software‐defined networking (SDN) to enable adaptive, QoS‐aware routing. The system models the routing process as a Markov decision process, where a DRL agent employs a gated recurrent unit (GRU)‐based actor–critic architecture to learn optimal link weight adjustments from real‐time network states. A dynamic weight strategy and an action discretization module allow the model to operate efficiently in a continuous action space while maintaining compatibility with SDN‐based control deployment. The routing policy is optimized using a multi‐objective reward function that targets throughput, delay, and jitter. The framework is implemented using Mininet and PyTorch and evaluated against traditional routing protocols (AODV and OLSR) as well as an SDN‐based static routing baseline. Experimental results show that the proposed method improves average throughput by 15.26% over the next best protocol, while simultaneously reducing average delay and jitter by 44.59% and 10.90%, respectively. These findings validate the potential of distributed DRL to provide scalable, intelligent routing solutions in highly dynamic MANET environments.

ABSTRACT Software Defined Networking (SDN) is an open network approach that has been proposed to address some of the main problems with traditional networks. However, SDN faces cybersecurity issues. To provide a network defense against attacks, an Intrusion Detection System (IDS) needs to be updated and included into the SDN architecture on a regular basis. Machine learning methods have proved effective in detecting intrusions in SDN. Moreover, these techniques pose the problem of significant computational overload and the absence of regular updates when new cyber‐attacks appear. To address these issues, we propose a new SDN‐based cloud intrusion detection system called Continual Federated Learning (CFL). In CFL, we modify the classical federated learning process by granting a more important and dynamic role to each participating client. On the one hand, it can trigger this process whenever a new type of intrusion is detected. On the other hand, once the new model has been identified, the customer can decide whether or not to deploy it in his network. In addition, to verify the accuracy of the CFL system, we have formally specified it by a communication protocol. This specification organizes the exchanges between the different communicating entities involved in the CFL. To verify the accuracy of this specification, we described it using the PROMELA language and checked with the associated SPIN tool. On the experimental side, we deployed this specification of the CFL system in an SDN computing environment. We defined different scenarios, and we proposed that each client decides locally to deploy or not the newly obtained intrusion detection model. The decision is based on a modified metric where we integrate the severity of the intrusions. Experimental results using private local datasets show that the proposed CFL system can efficiently and accurately detect new types of intrusions while preserving client confidentiality. Thus, it can be considered a promising system for SDN‐based edge computing.

Summary Software defined networking (SDN) separates control from data operations. However, this technology adds a new security cost to the network architecture because of the ongoing and developing security vulnerabilities. An intrusion detection system must be continuously improved and integrated into the SDN architecture in order to provide a network defense against attacks. In this study, we propose a continual learning system based on risk assessment to detect intrusion in SDN. We suggest a technique for continually enhancing datasets to produce a more accurate prediction. The proposed system includes various processes, including risk assessment and the selection of the deep learning (DL) approach. We propose assessing the risks related to different intrusion types. Based on the risk value, we can identify which intrusion types are more important and have a dangerous impact. We use the risk values to choose the most appropriate DL approach and for the dataset's continual enrichment. We compare different DL methods using the standard metrics and two proposed metrics. Then, we propose to use a method based on the bit alternation approach to obtain a unique metric for decision‐making. Finally, we have studied the efficacy of our system using two case studies.

Nowadays, to survey and guarantee the security policy in networks, the administrator uses different network security components, such as firewalls and intrusion detection systems (IDS). For a perfect interoperability between these components in the network, these latter must be configured properly to avoid misconfiguration anomalies between them. However, there are a set of anomalies between alerting rules in the IDS and filtering rules in firewalls, that degrade the network security policy. In this paper, we will present a mobile agent based architecture to detect misconfigurations between these distributed components and generate a new set of rules free of errors. A case study will illustrate the effectiveness of our approach.

Firewalls are core elements in network security. However, detecting anomalies, particularly in distributed firewalls has become a complex task. Mobile agents promise an interesting approach for communications between different distributed systems specially Web services applications. In this work, we propose a firewall anomaliespsila detection system based on interactions between the Web services and the mobile agents technologies. Then, we highlight the trumps of this approach compared to the client/server model.

Firewalls are core elements in network security. However detecting anomalies, particularly in distributed firewalls has become a complex task. Mobile agents promise an interesting approach for communications between different distributed systems. The main challenge when deploying mobile agent environments pertains to security issues concerning mobile agents and their executive platform. In this work, we propose a firewall anomalies' detection system using a secure mobile agents approach where protection is based on the cooperation of a trust agent running inside a trust host.

It is well known that the tests and diagnostics influence greatly communication software reliability. The testability and the easiness of the diagnostic process of communication software are becoming major concerns of the design community. The fault detection and the fault localization problems are strongly related issues. The ease of diagnostics can be seen as a criterion of testability; it is in fact characterized by specific requirements at the design level. We make a clear link between these two issues and we study the influence of some testability factors on the diagnostic activity. We present our results and hints on "diagnosability" in the context of a finite state machine model.