The post-Matter smart home is an ad-hoc mesh network built on IEEE 802.15.4, Thread, Zigbee, Bluetooth Low Energy mesh, and Wi-Fi EasyMesh, unified at the application layer by Matter fabrics and border routers. Security in this environment is a multi-hop, multi-protocol problem, yet existing surveys either predate Matter or treat the household as a protocol-agnostic attack catalogue, leaving commissioning trust, mesh routing vulnerabilities, MAC/PHY threats, and border-router trust concentration without unified treatment. We present a systematic survey of smart-home mesh security (January 2019 to March 2026) following the PRISMA 2020 reporting framework, drawing on 241 records from IEEE Xplore, ACM DL, ScienceDirect, SpringerLink, DBLP, and standards portals, each coded along fifteen dimensions covering protocol layer, attack class, defence class, and evaluation method. Six recurring findings emerge from the synthesis: (i) post-Matter commissioning reshapes rather than removes onboarding trust, concentrating the attack surface at the controller; (ii) mesh routing attacks from MANET/WSN literature remain applicable but require border-router-aware revision for post-Matter fabric interactions; (iii) 802.15.4 MAC/PHY threats transfer directly to constrained Thread and Zigbee nodes; (iv) Thread and Matter border routers concentrate cross-fabric trust in ways prior hub-centric surveys did not capture; (v) encrypted traffic analysis and RF side-channels sustain privacy leakage despite link-layer confidentiality; and (vi) learning-based intrusion detection for constrained nodes remains fragmented across incompatible datasets and threat models. Contributions include a cross-layer attack and defence taxonomy, a key-management comparison across Thread, Zigbee, BLE mesh, and Matter, an IDS dataset inventory, and a prioritised research agenda on multi-hop trust propagation, border-router hardening, and federated intrusion detection for constrained mesh nodes.

As the use of GPUs in collaborative computing environments increases, the demand for memory capacity continues to grow. The introduction of Compute Express Link (CXL) technology enables GPUs to access extended memory but also introduces new security challenges. Expressly, data transmission between secure memory regions incurs overhead due to ciphertext conversion, driven by independent security meta data for each memory region, which results in additional memory access overhead and degrades performance. Existing solutions alleviate this issue by sharing security metadata, thus reducing overhead from additional memory accesses. However, transmitting security metadata still consumes significant bandwidth, limiting overall system performance. To address this limitation, we propose a data transmission optimization method based on secure metadata reconstruction tailored to the unique characteristics of GPU multi-memory architectures in collaborative computing. Our method minimizes the amount of security metadata transmitted and reconstructs complete metadata at the receiver's end. This approach significantly reduces bandwidth usage and enhances system performance. Experimental results demonstrate that our method outperforms the Salus approach, achieving an 11.0% improvement in IPC (Instructions Per Cycle) performance.

With the increasing adoption of GPUs in neural networks, memory security concerns have become more pronounced. As a widely used memory integrity protection mechanism, the Integrity Tree effectively defends against replay attacks. However, the access and processing overhead associated with Integrity Trees has emerged as a significant performance bottleneck. Existing optimization strategies primarily rely on runtime prediction of frequently accessed regions to adjust the Integrity Tree structure, thereby reducing node access and processing costs. Nevertheless, due to the spatial accumulation and temporal locality characteristics of GPU memory access, these methods suffer from limitations in prediction accuracy and responsiveness: the influence of historical data can lead to inaccurate predictions, while the dynamic evolution of frequently accessed regions is challenging to detect in real-time, ultimately impacting the optimization effectiveness of the Integrity Tree. To address these challenges, this paper proposes an Integrity Tree optimization method based on a gradient-threshold mechanism to improve the access efficiency of secure GPU memory. The proposed approach introduces a gradient-based access weighting mechanism to mitigate the influence of historical data, enabling predictions to capture current memory access patterns more accurately. Additionally, a threshold-based real-time detection strategy is employed to continuously monitor changes in frequently accessed regions and adapt the Integrity Tree structure accordingly. Experimental results demonstrate that the proposed method significantly reduces the node traversal overhead associated with Integrity Tree.

The proliferation of collaborative technologies and the Internet of Things (IoT) has led to a greater diversity of devices. However, it also increased their vulnerability to potential attacks. The inherent heterogeneity and complexity of IoT devices make it difficult to accurately detect abnormal behavior, leaving them open to manipulation by attackers. To address this issue, we propose Talos, an innovative solution to detect abnormal device behavior in IoT systems. Talos employs advanced deep neural networks to analyze and comprehend historical event sequences, enabling it to accurately model the normal behaviors of IoT devices and detect any anomalies through reconstruction error. We evaluate our prototype on a real-world testbed and test it for three different anomaly cases. The experimental results demonstrate that Talos achieved high precision and recall, achieving an average F1-Score of 99.73% while raising only a few false alarms.

GPUs have become critical accelerators in applications such as scientific computing and deep learning. The demand for more robust security measures has significantly increased as their usage expands across a broader range of applications. To address this need, Trusted Execution Environments (TEEs) have been integrated into GPU systems to safeguard applications and data. However, with technologies like Compute Express Link expanding the memory capacity of GPUs, cross-memory data transfers now pose new security challenges. Existing methods attempt to optimize the performance overhead associated with these transfers by sharing security metadata. However, this shared metadata is unreliable, raising concerns about data integrity and freshness and making systems vulnerable to replay attacks. In response to these issues, this paper introduces the trusted shared security metadata concept. Leveraging the tamper-resistant of MoveCtr, the paper develops a trusted shared security metadata scheme and a secure cross-memory integrity tree, ensuring the integrity and freshness of transferred data and protecting against replay attacks. Experimental results demonstrate that this method provides strong security guarantees while maintaining performance overhead within an acceptable range.

Integrating IoT devices into physical environments through automation can result in device state inconsistency (DSI) anomalies. These anomalies can be caused by malicious attacks or device malfunctions, making it crucial to detect them for the security and reliability of IoT systems. Physical fingerprint-based verification methods have proven effective in detecting these anomalies by verifying whether the device state changes have physically occurred. However, these methods have limitations when there is no event notification. We propose a hybrid event occurrence detection method called HySense to address this issue. This method uses time-frequency (TF) analysis to locate events in the time domain and identifies real events from noise by spectrum analysis. To evaluate the performance of HySense, we used a real-world power signal dataset called PLAID, which contains 1170 events from 12 different appliances. Our experimental results demonstrate that HySense enhances detection performance with minimal computational overhead.

Numerous recent works in side-channel attacks have experimentally shown that Simultaneous Multi-Threading (SMT) inherently has a broader attack surface as it exposes more microarchitecture components per-core than cross-core. Existing mechanisms that protect against these attacks either incur high execution costs or are ineffective against certain attack variants. In this paper, we propose Partial-SMT, a system based on core-scheduling that protects security-critical programs from all contention-based attacks due to SMT. Partial-SMT allocates some complete physical cores for the exclusive use of the individual applications and provides a user-level threading library linked into each application to control the placement of their threads on dedicated cores, thereby preventing the attacker from accessing shared CPU resources simultaneously on the victim's core. The key insight is that by limiting ourselves to SMT contention-based side channels, we can translate the protection into an allocation policy that allocates or frees computing resources with a granularity of one physical core. Security-critical applications can be implemented on-demand and coexist with existing applications. We demonstrate that Partial-SMT effectively defeats typical SMT contention-based attacks. We modify AES and SPEC 2006 to use Partial-SMT, and they all incur the slight negligible performance overhead.

Hypervisors are becoming a widespread virtualisation layer in current computer systems. Recent successful attacks against hypervisors indicate that they face the similar integrity threats as traditional operating systems. Current approaches that secure hypervisors mainly focus on code or control‐data integrity, without paying attention to non‐control data integrity. In this study the authors construct attacks that target hypervisor non‐control data to demonstrate which types of data within the Xen hypervisor are critical to system security. It shows privilege, resource utilisation and security policy related data are vulnerable to return‐oriented programming or DMA attacks. By modifying their values from one to another, the whole system's performance will be affected. By discussing current approaches that secure hypervisors, which are not suitable for non‐control data, the work is to motivate new innovation in this area to protect them.

In this paper, we present an approach to attack on the Xen hypervisor utilizing return-oriented programming (ROP). It modifies the data in the hypervisor that controls whether a VM is privileged or not and thus can escalate the privilege of an unprivileged domain (domU) at run time. As ROP technique makes use of existed code to implement attack, not modifying or injecting any code, it can bypass the integrity protections that base on code measurement. By constructing such kind of attack at the virtualization layer, it can motivate further research work towards preventing or detecting ROP attack on the hypervisor.