ABSTRACT The increasing complexity and interconnectivity of industrial cyber‐physical systems (ICPSs), while enhancing operational security and reliability, have also introduced significant cybersecurity challenges. Software‐defined networking (SDN), a transformative technology for centralized and dynamic resource management, is particularly vulnerable as centralized control planes can become single points of failure. The integration of Digital Twin technology, which creates virtual replicas of physical systems for real‐time monitoring and prediction, further exacerbates security risks. To address these issues, we present TwinSec‐IDS, an advanced intrusion detection framework designed for SDN‐Digital‐Twin‐based ICPS. TwinSec‐IDS provides comprehensive and proactive intrusion detection, thereby enhancing the resilience of industrial networks. This paper introduces an ensemble approach, leveraging hybrid deep learning models—such as Bi‐GRU‐CNN, Bi‐GRU‐LSTM, and Bi‐GRU‐LSTM‐CNN—integrated with ensemble‐based feature selection techniques. The system employs weighted majority voting to combine predictions from multiple models, improving detection accuracy. To ensure optimal feature selection, the framework incorporates explainable AI and multiple filter methods, including mutual information, chi‐square tests, and correlation coefficients, aggregated through a voting mechanism. TwinSec‐IDS demonstrates high accuracy in detecting and categorizing anomalies and effectively responds to potential threats. Extensive evaluations show that TwinSec‐IDS significantly improves the security and resilience of SDN‐Digital‐Twin‐based ICPS, addressing critical cybersecurity concerns and making industrial processes safer and more reliable.

Abstract Penetration testing (PT) is a method for assessing and evaluating the security of digital assets by planning, generating, and executing possible attacks that aim to discover and exploit vulnerabilities. In large networks, penetration testing becomes repetitive, complex and resource consuming despite the use of automated tools. This paper investigates reinforcement learning (RL) to make penetration testing more intelligent, targeted, and efficient. The proposed approach called Intelligent Automated Penetration Testing Framework (IAPTF) utilizes model-based RL to automate sequential decision making. Penetration testing tasks are treated as a partially observed Markov decision process (POMDP) which is solved with an external POMDP-solver using different algorithms to identify the most efficient options. A major difficulty encountered was solving large POMDPs resulting from large networks. This was overcome by representing networks hierarchically as a group of clusters and treating each cluster separately. This approach is tested through simulations of networks of various sizes. The results show that IAPTF with hierarchical network modeling outperforms previous approaches as well as human performance in terms of time, number of tested vectors and accuracy, and the advantage increases with the network size. Another advantage of IAPTF is the ease of repetition for retesting similar networks, which is often encountered in real PT. The results suggest that IAPTF is a promising approach to offload work from and ultimately replace human pen testing.

Many millions of users routinely use Google, Facebook and Microsoft to log in to websites supporting OAuth 2.0 and/or OpenID Connect. The security of OAuth 2.0 and OpenID Connect is therefore of critical importance. Unfortunately, as previous studies have shown, real-world implementations of both schemes are often vulnerable to attack, and in particular to cross-site request forgery (CSRF) attacks. In this paper we propose a new and practical technique which can be used to mitigate CSRF attacks against both OAuth 2.0 and OpenID Connect.

Low-power wide-area network (LPWAN) technologies enable Internet of Things (IoT) devices to efficiently and robustly communicate over long distances, thus making them especially suited for industrial environments. However, the stringent regulations on the usage of certain industrial, scientific, and medical bands in many countries in which LPWAN operate limit the amount of time IoT motes can occupy the shared bands. This is particularly challenging in industrial scenarios, where not being able to report some detected events might result in the failure of critical assets. To alleviate this, and by mathematically modeling LPWAN-based IoT motes, we have derived optimal transmission policies that maximize the number of reported events (prioritized by their importance) while still complying with current regulations. The proposed solution has been customized for two widely known LPWAN technologies: 1) LoRa and 2) Sigfox. Analytical results reveal that our solution is feasible and performs remarkably close to the theoretical limit for a wide range of network activity patterns.

In a service-oriented Internet of things (IoT) deployment, it is difficult to make consensus decisions for services at different IoT edge nodes where available information might be insufficient or overloaded. Existing statistical methods attempt to resolve the inconsistency, which requires adequate information to make decisions. Distributed consensus decision making (CDM) methods can provide an efficient and reliable means of synthesizing information by using a wider range of information than existing statistical methods. In this paper, we first discuss service composition for the IoT by minimizing the multi-parameter dependent matching value. Subsequently, a cluster-based distributed algorithm is proposed, whereby consensuses are first calculated locally and subsequently combined in an iterative fashion to reach global consensus. The distributed consensus method improves the robustness and trustiness of the decision process.

SUMMARY Intruders that log in through a series of machines when conducting an attack are hard to trace because of the complex architecture of the Internet. The thumbprinting method provides an efficient way of tracing such intruders by determining whether two connections are part of the same connection chain. Because many connections are transient and therefore short in length, choosing the best time interval to thumbprint over can be an issue. In this paper, we provide a way to shorten the time interval used for thumbprinting. We then study some special properties of the thumbprinting function. We also study another mechanism for tracing intruders in the Internet based on a timestamping approach, which passively monitors flows between source and destination pairs. Given a potentially suspicious source, we identify its true destination. We compute the error probability of our algorithm and show that its value decreases exponentially as the observation time increases. Our simulation results show that our approach performs well. Copyright © 2012 John Wiley & Sons, Ltd.

Abstract Dedicated short range communications (DSRC) has been regarded as one of the most promising technologies to provide robust communications for large scale vehicle networks. It is designed to support both road safety and commercial applications. Road safety applications will require reliable and timely wireless communications. However, as the medium access control (MAC) layer of DSRC is based on the IEEE 802.11 distributed coordination function (DCF), it is well known that the random channel access based MAC cannot provide guaranteed quality of services (QoS). It is very important to understand the quantitative performance of DSRC, in order to make better decisions on its adoption, control, adaptation, and improvement. In this paper, we propose an analytic model to evaluate the DSRC‐based inter‐vehicle communication. We investigate the impacts of the channel access parameters associated with the different services including arbitration inter‐frame space (AIFS) and contention window (CW). Based on the proposed model, we analyze the successful message delivery ratio and channel service delay for broadcast messages. The proposed analytical model can provide a convenient tool to evaluate the inter‐vehicle safety applications and analyze the suitability of DSRC for road safety applications. Copyright © 2009 John Wiley & Sons, Ltd.

When worms self replicate, their probe traffic increases the network load. It is known that some "bandwidth- limited" worms such as Slammer spread so rapidly that they impede their own progress by congesting the network. Existing worm epidemic models do not take into consideration the phenomenon of network congestion acting naturally to slow down the epidemic rate. In this paper, we present a new epidemic model, the community of households with limited inter-household bandwidths (COH-LIHB), which we believe is the first model to account for limited network capacity and its impact on the spreading rate of a random scanning worm. In addition to explaining the natural dampening effect of network congestion, we use the new model to study the effectiveness of active defenses, namely dynamic quarantine and rate limiting, which artificially restrict the bandwidth available to worm traffic. The COH- LIHB model is applied to the specific example of a Slammer-like worm to show how the combination of quarantine and rate throttling hypothetically could have been effective in suppressing the Slammer outbreak.

SQL injection attacks continue to be a major problem for Web applications. We investigate design considerations for an application layer honeypot to attract and learn about SQL injection attacks. The honeypot responds with indications of vulnerability leading attackers ultimately to disinformation that could be useful to track them. The honeypot restricts attackers from escalating the attack to the operating system or launching attacks on other systems. The honeypot could emulate the appearance of common defenses against SQL injection in order to seem more genuine. Finally, we describe considerations to implement an experimental honeypot with honeyd.

We present a worm simulator which can be run remotely through the Web, based on the parameters supplied by the client. The core simulator program executes on the server and simulates the flow of the worm through a user-specified topology. The results of the simulation are then graphically displayed to the client. A variety of worm vectors can be simulated and various countermeasures such as rate throttling and quarantining can also be employed. The simulator uses a design that is efficient in terms of speed and memory requirements, while providing a lot of features for realistic simulations.

Rate control is an automated defense to slow down a worm outbreak to buy time for conventional defenses to take effect. In this study, we apply the community of households model from biological epidemiology to evaluate rate control strategies. We find that rate throttling of outbound worm traffic, implemented in the network or hosts, can be effective in slowing down a new worm outbreak given sufficient coverage of hosts. An outbreak is slowed down exponentially as the fraction of protected hosts is increased. We also find that throttling both inbound and outbound traffic can be much more effective than rate throttling only outbound traffic.

Quarantine is a natural concept borrowed from human disease control to slow down worm outbreaks. We study the effectiveness of partial quarantine for simple epidemics (without removals) and find that the optimal quarantine strategy is not as simple as expected. The strategy depends on which networks are most important to protect. We also investigate the effectiveness of quarantine for general epidemics (with removals) and derive the critical threshold for networks to have herd immunity. We show that, given a limited capability to quarantine a given number of networks, the optimal quarantine strategy is to isolate the networks small enough to have herd immunity, and then divide the remaining networks as evenly as possible.

This paper presents a new approach to measurement-based admission control (MBAC) using real-time traffic classification. The network traffic is classified based on Bayesian decision theory. We derive the decision rules and cost functions considering utilization, packet loss rate, and rejection rate. The approach is compared by simulations against other measurement-based admission control approaches. Experiments show that the new method offers significant advantages particularly when the traffic is highly dynamic or complex.

Previous studies have argued that the performance of the IEEE 802.11 protocol is poor when used as a platform to implement multi-hop ad hoc networks. In this paper, we analyze the negative behavior caused by having multiple overlapping IBSSs (independent basic service sets) operating at the same frequency channel in an 802.11 ad hoc network. We propose an overlay algorithm on top of 802.11 to help discipline the interaction of overlapping IBSSs. Our algorithm yields noticeable improvement in the aggregate normalized throughput value per IBSS as well as the stability of the system.

A new method for real-time traffic model classification is proposed and evaluated. The method classifies the current measured traffic to a "best-fit" model selected from a library of candidate models using statistical estimation techniques. A two-model system has been prototyped and evaluated through simulation experiments. The experimental system consists of a short-range dependent model and long-range dependent model, and uses the estimated Hurst parameter to select between the two models to choose the model requiring an equivalent bandwidth (EB) that is closest to the actual required EB. Results have demonstrated that the two-model system can classify the observed traffic to the correct model with fair accuracy, and can automatically detect a change in traffic characteristics after a delay. The design parameters affecting the classification accuracy and delay to detect traffic changes are discussed.

Previous studies have proved that the performance of IEEE 802.11 protocol is poor when used as a platform to implement multihop ad-hoc networks. We elaborate on the negative behavior caused by having multiple overlapping IBSSs (independent basic service sets) operating on the same frequency channel in an 802.11 ad-hoc network. Then we propose an overlay algorithm on top of 802.11 to help discipline the interaction of overlapping IBSSs with one or more stations in the overlap zone. Such algorithm enhances the support of multihopping in 802.11 ad-hoc mode. Performance analysis and simulation results of this algorithm show noticeable improvement in overall system throughput as well as stability.

Measurements of high-speed network traffic have shown that traffic data exhibits a high degree of self-similarity. Traditional traffic models such as AR and ARMA are not able to capture this long-range-dependence making them ineffective for the traffic prediction task. In this paper, we apply the fractional ARIMA (F-ARIMA) model to predict one-step-ahead traffic value at different timescales. F-ARIMA has the ability to capture both the short- and long-range dependent characteristics of the underlying data. We present a simplified adaptive prediction scheme to reduce the F-ARIMA computational complexity. The performance of the proposed F-ARIMA prediction model is tested on four different types of traffic data: MPEG and JPEG video, Ethernet and Internet. We also apply the F-ARIMA prediction model to a dynamic bandwidth allocation scheme. The results show that the performance of F-ARIMA outperforms the AR model. They also show that the prediction performance depends on the traffic nature and the timescale.

This paper develops an analytical framework to model and compare centralized and distributed approaches for network management. Each scheme is evaluated in terms of performance and scalability for two applications, network monitoring, and data searching. The results support the intuitive argument that distributed approaches can have considerable advantages over traditional centralized network management, but a single approach may not be best for all types of applications. Instead, the most appropriate approach for a specific application should be selected after a careful evaluation. The modeling framework presented is intended to quantify the tradeoffs between different approaches to lend a basis for the selection decision.

The growing diversity of services in the Internet is motivating research to improve measurability of traffic and Internet performance. This paper surveys current projects and tools for Internet performance monitoring, ranging from passive router-based traffic flow measurement methods to large-scale active performance monitoring projects. The tools and methods are discussed according to their protocol layer, starting from the network layer (ATM, MPLS) to IP/ICMP and transport/application layers. At each protocol layer the strengths and limitations of the methods are highlighted. Finally, issues and challenges for future research are reviewed.

This paper develops an analytical framework to model and compare different distributed approaches for network monitoring. The performance of each scheme is evaluated in terms of traffic, completion time, and processing and memory resources. It is shown that distributed approaches have considerable advantages over traditional centralized network management, but a single distributed approach may not be best for all applications. Analytical results suggest that the weak mobility approach performs well for routine monitoring, and the mobile agent approach is well suited for searching types of applications. However, the best approach for a given application will depend on many parameters requiring careful quantification.

This paper investigates distributed fault restoration techniques for multiprotocol label switching (MPLS) to automatically reroute label switched paths in the event of link or router failures while maintaining quality of service (QoS) requirements. Protocols for path and partial path restoration are evaluated. A backup route selection algorithm based on optimization of equivalent bandwidth is formulated and demonstrated for an example network.

We consider parameter estimation for a FIFO queue with deterministic service times and two independent arrival streams of "observed" and "unobserved" packets. The arrivals of unobserved packets are Poisson with an unknown rate /spl lambda/ while the arrivals of observed packets are arbitrary. Maximum likelihood estimation of /spl lambda/ is formulated based on the arrival times and waiting times of k observed packets. The likelihood function is derived in terms of the transition probabilities of the unfinished work process which are calculated recursively. Sufficient conditions for consistency, asymptotic normality, and asymptotic efficiency are given. The mean and variance of the MLE are measured in simulation experiments. Numerical results indicate that the MLE is consistent and asymptotically normal.>

Since the reconstruction of continuous speech from voice packets is complicated by the variable delays of the packets through the network, a dynamic priority protocol is proposed to minimize the variability of packet delays. The protocol allows the priority of a packet to vary with time. After a discussion of the concept of dynamic priorities, two examples of dynamic priorities are studied through queueing analysis and simulations. Optimal properties of the oldest customer first (OCF) and earliest deadline first (EDF) disciplines are proven, suggesting that they may be theoretically effective in reducing the variability of packet delays. Simulation results of the OCF discipline indicate that the OCF discipline is most effective under conditions of long routes and heavy traffic, i.e., the conditions when delay variability is most likely to be significant. Under OCF, the delays of packets along long routes are improved at the expense of packets along short routes. It is noted that more complex and realistic simulations, including simulations of the EDF discipline, are needed.>