Adversarial attacks pose a significant challenge to the reliable deployment of machine learning models in EdgeAI applications, such as autonomous driving and surveillance, which rely on resource-constrained devices for real-time inference. Among these, patch-based adversarial attacks, where small malicious patches (e.g., stickers) are applied to objects, can deceive neural networks into making incorrect predictions with potentially severe consequences. In this paper, we present PatchBlock, a lightweight framework designed to detect and neutralize adversarial patches in images. Leveraging outlier detection and dimensionality reduction, PatchBlock identifies regions affected by adversarial noise and suppresses their impact. It operates as a pre-processing module at the sensor level, efficiently running on CPUs in parallel with GPU inference, thus preserving system throughput while avoiding additional GPU overhead. The framework follows a three-stage pipeline: splitting the input into chunks (Chunking), detecting anomalous regions via a redesigned isolation forest with targeted cuts for faster convergence (Separating), and applying dimensionality reduction on the identified outliers (Mitigating). PatchBlock is both model- and patch-agnostic, can be retrofitted to existing pipelines, and integrates seamlessly between sensor inputs and downstream models. Evaluations across multiple neural architectures, benchmark datasets, attack types, and diverse edge devices demonstrate that PatchBlock consistently improves robustness, recovering up to 77% of model accuracy under strong patch attacks such as the Google Adversarial Patch, while maintaining high portability and minimal clean accuracy loss. Additionally, PatchBlock outperforms the state-of-the-art defenses in efficiency, in terms of computation time and energy consumption per sample, making it suitable for EdgeAI applications.

Urban congestion and environmental pollution are pressing issues in urban sustainability. This study introduces the Streamlined Traffic Optimizer (STO), an AIoT-based system designed to improve urban traffic flow and reduce energy consumption. The STO algorithm dynamically adapts traffic signals using real-time data from the Uber Movement dataset. Initial results from simulations show a significant reduction in average travel time from 35 minutes to 28 minutes and an increase in average speed from 30 km/h to 36 km/h. Additionally, congestion levels dropped from 40% to 25%, while fuel consumption decreased by 18%, from 10,000 liters to 8,200 liters. These improvements are accompanied by a reduction in CO2 emissions from 1,200 to 950 tons per year. The STO system offers a scalable and flexible solution for cities aiming to reduce their environmental impact while optimizing traffic efficiency.

Adversarial attacks present a significant challenge to the dependable deployment of machine learning models, with patch-based attacks being particularly potent. These attacks introduce adversarial perturbations in localized regions of an image, deceiving even well-trained models. In this paper, we propose Outlier Detection and Dimension Reduction (ODDR), a comprehensive defense strategy engineered to counteract patch-based adversarial attacks through advanced statistical methodologies. Our approach is based on the observation that input features corresponding to adversarial patches-whether naturalistic or synthetic-deviate from the intrinsic distribution of the remaining image data and can thus be identified as outliers. ODDR operates through a robust three-stage pipeline: Fragmentation, Segregation, and Neutralization. This model-agnostic framework is versatile, offering protection across various tasks, including image classification, object detection, and depth estimation, and is proved effective in both CNN-based and Transformer-based architectures. In the Fragmentation stage, image samples are divided into smaller segments, preparing them for the Segregation stage, where advanced outlier detection techniques isolate anomalous features linked to adversarial perturbations. The Neutralization stage then applies dimension reduction techniques to these outliers, effectively neutralizing the adversarial impact while preserving critical information for the machine learning task. Extensive evaluation on benchmark datasets against state-of-the-art adversarial patches underscores the efficacy of ODDR. Our method enhances model accuracy from 39.26% to 79.1% under the GoogleAp attack, outperforming leading defenses such as LGS (53.86%), Jujutsu (60%), and Jedi (64.34%).

Advanced Driver Assistance Systems (ADAS) significantly enhance road safety by detecting potential collisions and alerting drivers. However, their reliance on expensive sensor technologies such as LiDAR and radar limits accessibility, particularly in low- and middle-income countries. Machine learning-based ADAS (ML-ADAS), leveraging deep neural networks (DNNs) with only standard camera input, offers a cost-effective alternative. Critical to ML-ADAS is the collision avoidance feature, which requires the ability to detect objects and estimate their distances accurately. This is achieved with specialized DNNs like YOLO, which provides real-time object detection, and DECADE, a lightweight, detection-wise distance estimation approach that relies on key features extracted from the detections like bounding box dimensions and size. However, the robustness of these systems is undermined by security vulnerabilities in object detectors. In this paper, we introduce ShrinkBox, a novel backdoor attack targeting object detection in collision avoidance ML-ADAS. Unlike existing attacks that manipulate object class labels or presence, ShrinkBox subtly shrinks ground truth bounding boxes. This attack remains undetected in dataset inspections and standard benchmarks while severely disrupting downstream distance estimation. We demonstrate that ShrinkBox can be realized in the YOLOv9m object detector at an Attack Success Rate (ASR) of 96%, with only a 4% poisoning ratio in the training instances of the KITTI dataset. Furthermore, given the low error targets introduced in our relaxed poisoning strategy, we find that ShrinkBox increases the Mean Absolute Error (MAE) in DECADE’s distance estimation by more than 3x on poisoned samples, potentially resulting in delays or prevention of collision warnings altogether.

Quishing, a novel form of phishing that exploits QR codes, has emerged as a growing cybersecurity threat. Attackers embed malicious URLs within QR codes to deceive users into accessing fraudulent websites or executing harmful actions. Given the increasing reliance on QR codes in banking, retail and public services, the need for robust detection mechanisms is critical. This paper presents a machine learning-based approach to detecting malicious URLs within QR codes, integrating lexical and behavioral analysis to improve classification accuracy. We evaluated multiple models, including Decision Trees, Support Vector Machines (SVM), Random Forest, and Long-Short-Term Memory (LSTM) networks. Experimental results indicate that the Random Forest model achieves superior performance in terms of detection accuracy and computational efficiency, making it suitable for real-time deployment. The findings contribute to the advancement of QR code security and malicious URL detection, providing practical solutions for cybersecurity applications.

In this paper, we introduce a novel framework designed specifically for federated reinforcement learning in IoT-driven networks, focusing on flow management in autonomous systems. Our framework optimizes flow table matching by monitoring IoT network traffic and ensuring efficient flow management across connected devices. By considering the specific flow requirements of IoT traffic, our framework enables an intelligent agent to make informed decisions regarding flow table entries, thereby improving the performance and management of autonomous systems. To gather essential data for decision-making, our framework utilizes an IoT-based SDN module that collects traffic statistics and relevant information from the network’s data plane. By leveraging SDN, our system enhances the learning and decision-making capabilities of IoT devices within autonomous systems. We introduce an optimization model called Software-Defined Network Assisted Federated Reinforcement Learning (SORE), based on the Markov decision process. SORE capitalizes on the advantages of SDN to boost the overall performance of IoT-based autonomous systems. By applying reinforcement learning techniques, our framework demonstrates significant improvements over existing models. Extensive simulations validate the effectiveness of our proposed system, showcasing superior performance and efficiency in IoT-enabled wireless networks within autonomous systems. The results underscore the potential of our approach in real-world IoT deployments.

Federated learning (FL) is a promising collaborative and privacy-preserving machine learning approach in data-rich smart cities. Nevertheless, the inherent heterogeneity of these urban environments presents a significant challenge in selecting trustworthy clients for collaborative model training. The usage of traditional approaches, such as the random client selection technique, poses several threats to the system’s integrity due to the possibility of malicious client selection. Primarily, the existing literature focuses on assessing the trustworthiness of clients, neglecting the crucial aspect of trust in federated servers. To bridge this gap, in this work, we propose a novel framework that addresses the mutual trustworthiness in FL by considering the trust needs of both the client and the server. Our approach entails: 1) creating preference functions for servers and clients, allowing them to rank each other based on trust scores; 2) establishing a reputation-based recommendation system leveraging multiple clients to assess newly connected servers; 3) assigning credibility scores to recommending devices for better server trustworthiness measurement; 4) developing a trust assessment mechanism for smart devices using a statistical interquartile range (IQR) method; and 5) designing intelligent matching algorithms considering the preferences of both parties. Based on simulation and experimental results, our approach outperforms baseline methods by increasing trust levels, global model accuracy, and reducing nontrustworthy clients in the system.

Adversarial patch-based attacks have shown to be a major deterrent towards the reliable use of machine learning models. These attacks involve the strategic modification of localized patches or specific image areas to deceive trained machine learning models. In this paper, we propose DefensiveDR, a practical mechanism using a dimensionality reduction technique to thwart such patch-based attacks. Our method involves projecting the sample images onto a lower-dimensional space while retaining essential information or variability for effective machine learning tasks. We perform this using two techniques, Singular Value Decomposition and t-Distributed Stochastic Neighbor Embedding. We experimentally tune the variability to be preserved for optimal performance as a hyper-parameter. This dimension reduction substantially mitigates adversarial perturbations, thereby enhancing the robustness of the given machine learning model. Our defense is model-agnostic and operates without assumptions about access to model decisions or model architectures, making it effective in both black-box and white-box settings. Furthermore, it maintains accuracy across various models and remains robust against several unseen patch-based attacks. The proposed defensive approach improves the accuracy from 38.8% (without defense) to 66.2% (with defense) when performing LaVAN and GoogleAp attacks, which supersedes that of the prominent state-of-the-art like LGS [19] (53.86%) and Jujutsu [7] (60%).

Monocular depth estimation (MDE) has advanced significantly, primarily through the integration of convolutional neural networks (CNNs) and more recently, Transformers. However, concerns about their susceptibility to adversarial attacks have emerged, especially in safety-critical domains like autonomous driving and robotic navigation. Existing approaches for assessing CNN-based depth prediction methods have fallen short in inducing comprehensive disruptions to the vision system, often limited to specific local areas. In this paper, we introduce SSAP (Shape-Sensitive Adversarial Patch), a novel approach designed to comprehensively disrupt monocular depth estimation (MDE) in autonomous navigation applications. Our patch is crafted to selectively undermine MDE in two distinct ways: by distorting estimated distances or by creating the illusion of an object disappearing from the system’s perspective. Notably, our patch is shape-sensitive, meaning it considers the specific shape and scale of the target object, thereby extending its influence beyond immediate proximity. Furthermore, our patch is trained to effectively address different scales and distances from the camera. Experimental results demonstrate that our approach induces a mean depth estimation error surpassing 0.5, impacting up to 99% of the targeted region for CNN-based MDE models. Additionally, we investigate the vulnerability of Transformer-based MDE models to patch-based attacks, revealing that SSAP yields a significant error of 0.59 and exerts substantial influence over 99% of the target region on these models.

Recently, metaverse-empowered wireless systems have gained significant interest in the research community because of the appealing features of self-sustainability and proactive learning. Self-sustainability allows a system to run with the least amount of assistance from network administrators, whereas proactive learning allows for the development of machine learning models prior to user requests. As a result, the idea of the metaverse in vehicular networks can be used to enable a variety of applications (e.g., infotainment and collision avoidance) for a massive number of autonomous vehicles. However, metaverse-empowered vehicular networks are challenging to implement due to computing (i.e., at autonomous cars and network edges) and communication resource constraints. We present a novel framework for joint sensing, communication, and task offloading for vehicular networks empowered by the metaverse in order to address these issues. We formulate a problem to minimize a cost function that takes into account transmission latency, sensing, and transmission energy. Sensing interval, resource distribution, and task offloading are all optimized for minimizing the cost. We use convex optimization for the sensing problem while a decomposition-relaxation-based approach is used for joint resource allocation and task offloading. Finally, numerical results are provided to support the proposed scheme.

The emergence of the Internet of Things (IoT) has revolutionized people’s daily lives, providing superior quality services in cognitive cities, healthcare, and smart buildings. However, smart buildings use heterogeneous networks. The massive number of interconnected IoT devices increases the possibility of IoT attacks, emphasizing the necessity of secure and privacy-preserving solutions. Federated learning (FL) has recently emerged as a promising machine learning (ML) paradigm for IoT networks to address these concerns. In FL, multiple devices collaborate to learn a global model without sharing their raw data. However, FL still faces privacy and security concerns due to the transmission of sensitive data (i.e., model parameters) over insecure communication channels. These concerns can be addressed using fully homomorphic encryption (FHE), a powerful cryptographic technique that enables computations on encrypted data without requiring them to be decrypted first. In this study, we propose a secure FL approach in IoT-enabled smart cities that combines FHE and FL to provide secure data and maintain privacy in distributed environments. We present four different FL-based FHE approaches in which data are encrypted and transmitted over a secure medium. The proposed approaches achieved high accuracy, recall, precision, and F-scores, in addition to providing strong privacy and security safeguards. Furthermore, the proposed approaches effectively reduced communication overhead and latency compared to the baseline approach. These approaches yielded improvements ranging from 80.15% to 89.98% in minimizing communication overhead. Additionally, one of the approaches achieved a remarkable latency reduction of 70.38%. The implementation of these security models is nontrivial, and the code is publicly available athttps://github.com/Artifitialleap-MBZUAI/Secure-Federated-Learning-with-Fully-Homomorphic-Encryption-for-IoT-Communications.

With the increasing popularity of Cyber-physical Systems (CPS), there is a growing need for efficient and reliable methods for detecting and responding to threats. Federated Learning (FL) is a distributed Machine Learning (ML) technique that can be used to train models on data from multiple devices (i.e., edge devices) while keeping the data local. FL has the potential to improve the security and privacy of data while also reducing the training time and cost. Particularly, CNN-based FL has been shown to be effective for various tasks such as image classification and object detection. However, selecting suitable hyperparameters for constructing local ML models in FL is a significant challenge for practical inference and training on edge devices. In this paper, we focus on the optimization of CNN-based federated learning for the task of cyber-physical detection and we propose employing a novel metaheuristic optimization algorithm called Honey Badger Algorithm (HBA) for tuning the hyperparameters in local ML models (FL-HBA). To show the effectiveness of FL-HBA, we make an evaluation using an intelligent healthcare case study where we consider Sleep Apnea (SA) and use the PhysioNet apnea ECG dataset to diagnose SA. Our results show that the FL-HBA is superior to a Convolutional Neural Network (CNN) baseline, traditional ML techniques, and centralized learning models. Furthermore, we demonstrate that the proposed method for assigning the near-optimal hyperparameter values for centralized learning models improves accuracy by 2%.

Neural networks have demonstrated remarkable success in learning and solving complex tasks in a variety of fields including cognitive cities. Nevertheless, the rise of those networks in modern computing has been accompanied by concerns regarding their vulnerability to adversarial attacks. In this work, we propose a novel gradient-free, gray box, incremental attack that targets the training process of neural networks. The proposed attack, which implicitly poisons the intermediate data structures that retain the training instances between training epochs acquires its high-risk property from attacking data structures that are typically unobserved by professionals. Hence, the attack goes unnoticed despite the damage it can cause. Moreover, the attack can be executed without the attackers' knowledge of the neural network structure or training data, making it more dangerous. The proposed attack was tested under a sensitive application of secure cognitive cities, namely, biometric authentication. The conducted experiments showed that the proposed attack is effective and stealthy. Finally, the attack effectiveness property was concluded from the fact that it was able to flip the sign of the loss gradient in the conducted experiments to become positive, which is noisy and unstable training. Moreover, the attack was able to decrease the inference probability in the poisoned networks compared to their unpoisoned counterparts by 15.37%, 14.68%, and 24.88% for the Densenet, VGG, and Xception, respectively. Finally, the attack retained its stealthiness despite its high effectiveness. This was demonstrated by the fact that the attack did not cause a notable increase in the training time, in addition, the Fscore values only dropped by an average of 1.2%, 1.9%, and 1.5% for the poisoned Densenet, VGG, and Xception, respectively.

The development of the Internet of Things (IoT) has dramatically expanded our daily lives, playing a pivotal role in the enablement of smart cities, healthcare, and buildings. Emerging technologies, such as IoT, seek to improve the quality of service in cognitive cities. Although IoT applications are helpful in smart building applications, they present a real risk as the large number of interconnected devices in those buildings, using heterogeneous networks, increases the number of potential IoT attacks. IoT applications can collect and transfer sensitive data. Therefore, it is necessary to develop new methods to detect hacked IoT devices. This paper proposes a Feature Selection (FS) model based on Harris Hawks Optimization (HHO) and Random Weight Network (RWN) to detect IoT botnet attacks launched from compromised IoT devices. Distributed Machine Learning (DML) aims to train models locally on edge devices without sharing data to a central server. Therefore, we apply the proposed approach using centralized and distributed ML models. Both learning models are evaluated under two benchmark datasets for IoT botnet attacks and compared with other well-known classification techniques using different evaluation indicators. The experimental results show an improvement in terms of accuracy, precision, recall, and F-measure in most cases. The proposed method achieves an average F-measure up to 99.9%. The results show that the DML model achieves competitive performance against centralized ML while maintaining the data locally.

The increasing number of applications and devices in the Sixth-generation (6G) networks and the diversity of mobile data, architectures, and technologies make security and privacy a critical concern. Advanced metaheuristics algorithms (MHAs) have recently become a viable solution for optimizing security and privacy in wireless networks, combining game theory and convex optimization, and several other advanced models. As a subfield of Artificial Intelligence (AI), MHAs are inspired by concepts from Evolutionary Algorithms (EAs), Trajectory-based Algorithms (TAs), and Swarm Intelligence (SI). Recent implementations of MHAs in the 6G networks have effectively solved complex security and privacy problems. This study examines MHAs’ utilization in addressing security and privacy challenges in 6G networks. The paper provides a comprehensive overview of MHAs and their use in solving security and privacy problems in 6G. The current limitations of the literature are also identified, and avenues for further research are suggested. The reader will have a clear image of the needed technologies and tools for securing 6G networks using MHAs.

The advancement in technology has brought to life the concept of Autonomous vehicles (AV). The primary goal of AV is to reduce driving stress and provide comfort to the occupants. Since AVs can drive themselves, it poses a question of passenger security. Furthermore, AVs are connected to an open network like a public Internet to communicate to the outer world, raising security and privacy concerns. Skillful attackers can effortlessly infiltrate the vehicle by injecting malware which can disrupt the regular operation of the entire AV system. A Deep Learning (DL) and Blockchain framework is proposed for AV to resolve the aforementioned security challenges. The network traffic is continuously monitored, and the malware binaries are converted to grey-scale images, which are then classified by Convolutional Neural Network (CNN) employed in the DL model. The CNN architecture, ResNet50V2, has been tested and proves to be efficient in detecting malware with an accuracy of 97.56%.

This paper presents an energy estimation approach for embedded low power operating systems (OS). The methodology consists in characterizing and estimating energy and power overheads of a set of embedded OS basic services : scheduling, context switch and inter-process communication. We analyze the impact of hardware and software parameters like processor frequency and scheduling policy on the energy consumption. Then, energy and power models are extracted and the OS energy overhead of H264 application is estimated using the STORM tool. For the measurement setup, the hardware platform used is OMAP35x EVM board running Linux omap as operating system.