The increasing digitization and interconnection of Industrial Control Systems (ICS) to the Internet render them susceptible to cyber attacks. Thus, a major line of research focuses on the design of reactive security solutions in the form of industrial intrusion detection systems, which aim to detect anomalies in a normal system operation. However, a crucial prerequisite for the accurate detection and localization of anomalies is the identification of typical traffic patterns that are exclusive to characterize the normal ICS behavior. Unlike previous work focusing on complex and protocol-dependent models, for characterizing ICS network traffic, in this work we propose simple, easy deployable, and effective rules for determining whether ICS network traffic, unlike traditional IT networks, remains stable over time. The main advantage of our rules is that they can be used to estimate the time required to identify the most dominant ICS traffic patterns in a given ICS. We show the efficacy of our rules by analyzing multiple ICS datasets with different industrial network protocols.
Most Internet of Things (IoT) devices rely on batteries with operational lifetimes of only a few years, resulting in high maintenance costs and significant environmental impact from battery waste. Energy harvesting (EH) combined with supercapacitor-based energy storage has emerged as a promising alternative, enabling longer-lived and more sustainable IoT systems. However, the design and deployment of such battery-free systems remain challenging due to their complexity and perceived unreliability. To overcome these barriers, we present Flute, a plug-and-play (PnP), battery-free IoT platform designed for remote sensing applications. Flute integrates energy harvesting, supercapacitor storage, and NB-IoT connectivity to enable autonomous long-term operation. In this paper, we demonstrate Flute’s capabilities through a contactless waterlevel sensing application, highlighting its potential to simplify the development and deployment of sustainable IoT systems.
Configuration vulnerabilities have emerged as a critical challenge in securing complex information systems. Unlike traditional software bugs, these vulnerabilities originate from insecure system settings in components such as databases, web servers, and cloud environments. Common misconfigurations such as using default credentials, enabling skip-grant-tables=1, or setting bind-address=0.0.0.0 can significantly compromise security, leading to issues like unauthorized access (CWE-287) and unintended public network exposure (CWE-284). Despite progress in automated vulnerability scanning and patch management, configuration-related issues remain inadequately addressed due to their contextual dependencies and the limitations of conventional tools in interpreting system semantics.In this work, we present MisConfAI, a transformer-driven framework for automated detection of configuration vulnerabilities. MisConfAI first models syntactic variations and lexical deviations in configuration files, then maps risky settings to known vulnerability classes (e.g., CWE) and compliance standards such as the CIS Benchmarks. We evaluate its efficacy across multiple pre-trained language models, including BERT, CodeBERT, RoBERTa, ELECTRA, and XLNet. To ensure operational fidelity, the framework is coupled with a dynamic analysis layer that provisions containerized testbeds via Docker to replicate real-world deployment environments.
Improving uplink communication reliability in dense LoRaWAN deployments remains a challenge, particularly under the constraints of standard compliance.In this paper, we evaluate the performance of three representative channel access mechanisms: Slotted ALOHA, Slotted ALOHA with CSMA, and TDMA, implemented using LoRaWAN Class B end-devices and the built-in synchronization service to ensure full compliance with the LoRaWAN specification. Based on ns-3 simulations, we assess the impact of network size and downlink ACKs from confirmed uplink packets on packet success ratio and energy consumption.Results show that S-ALOHA and S-ALOHA/CSMA do not consistently outperform pure ALOHA in practice, contrary to theoretical expectations. Moreover, while TDMA eliminates collisions in unconfirmed traffic, it performs poorly with confirmed traffic. Our findings highlight the difficulty of enhancing LoRaWAN through time slotted channel access without compromising standard compliance, particularly given the overhead of synchronization mechanisms.
The automotive industry’s shift to zonal Electrical/Electronic (E/E) architectures introduces new lateral movement pathways for multi-stage cyberattacks, posing significant end-user risks. Modeling these “automotive kill chains” is challenging due to the lack of a standardized framework for adversary tactics. This paper presents a methodology that integrates the Automotive Threat Matrix (ATM) with the ISO/SAE 21434 Threat Analysis and Risk Assessment (TARA) process to systematically construct and analyze attack paths. Based on this analysis, we propose the Automotive Kill Chain Correlation (AKCC), a dynamic threat response framework that correlates security alerts along modeled attack paths for high-confidence detection. Applying the methodology to a representative zonal architecture reveals systemic vulnerabilities and enables the design of targeted, stateful countermeasures. The practical utility of this approach is validated through a qualitative survey of industry experts, who confirmed it significantly simplifies and clarifies attack path analysis.
This work presents the design and evaluation of a LoRaWAN-based IoT architecture for wildfire monitoring in rural and forested environments. The proposed system offers a solution for the elaboration of data gathered in the forested area, to support fire prevention and firefighting duties on the edge. To cope with this goal, the solution relies on resourceconstrained sensor nodes and LoRaWAN gateways to enable reliable data transmission under challenging conditions, including dense vegetation and limited communication infrastructure. The study models and analyzes the communication dynamics of largescale LoRaWAN deployments using Generalized Stochastic Petri Nets (GSPNs), capturing the impact of multiple transmission channels and varying traffic loads characterizing the wildfire monitoring system analyzed. Particular emphasis is placed on assessing network scalability and reliability when a large number of sensor nodes concurrently transmit environmental data. The findings contribute to the development of efficient and resilient IoT-based solutions for environmental monitoring and emergency response in remote and resource-constrained scenarios.
Machine learning has significantly improved malware detection, yet classifiers remain vulnerable to targeted evasion. This paper examines a category-specific evasion attack, where a malicious Windows PE sample is modified to imitate a specific benign class. We propose a feature injection approach that activates a fixed number of benign import indicators without retraining the classifier. Using four standard classifiers and a balanced dataset of real benign applications and malware, we show that such targeted injections can consistently redirect model predictions toward the targeted benign categories. The results demonstrate significant vulnerability to category adversarial attacks and highlight the need for more secure defences.
The developers of critical networked applications currently relied on kernel-level protections to ensure the timely delivery of critical messages like Wireless Emergency Alert (WEA) or multi-factor authentication (MFA) notifications. However, the increasing complexity of mobile operating system kernels and network stacks increases the attack surface for adversaries to exploit. In this paper, we introduce a system which safeguards network availability for critical mobile applications against powerful attackers. We achieve this by using the Trusted Execution Environment (TEE) found in most mobile devices to host minimal network drivers. Further, we utilize Trusted I/O to ensure that critical messages reach the end-user even if the device’s kernel is compromised. To demonstrate the feasibility of our approach, we provide a PoC implementation that mimics multi-factor authentication. Our Evaluation demonstrates that latency for all applications is reduced by around $21 \%$ on a representative mobile platform (ARM Cortex A9), though a significant throughput performance is observed.
This poster presents the project INTELLIGi - Quality Threat Intelligence to Enhance Cyber Defence, which aims to propose and develop a cost-effective cybersecurity solution specially designed for the Portuguese Public Administration. This solution integrates enriched threat intelligence to identify and analyse cyber risks proactively, thus augmenting threat detection and prevention capabilities. The poster focuses on the current platform architecture, the strategies to enrich cyber threat intelligence collected from public sources, and cyber risk metrics. A pilot study is being conducted within the IT Services Unit of the Faculty of Sciences of the University of Lisbon. The platform is designed for easy adaptation to other public administration entities.
As quantum computing evolves, distributing circuits across multiple Quantum Processing Units (QPUs) is crucial to scaling algorithms and overcoming the limitations of current Noisy Intermediate-Scale Quantum (NISQ) devices. We introduce HyPAQ, a hypergraph partitioning framework for efficient circuit cutting and distribution in multi-QPU environments. HyPAQ reduces inter-QPU communication and improves performance by optimizing partitioning for both static and adaptive circuits, leveraging segmentation and a codesign threading model, respectively. For static circuits, HyPAQ employs weighted hypergraph partitioning heuristics, dividing circuits into smaller subcircuits that balance computational load while minimizing communication costs. This approach extends to reduced hypergraph representations, enabling more efficient cuts in larger circuits and outperforming traditional bipartite methods. In adaptive circuits, where operations depend on intermediate measurements, HyPAQ introduces an assisted segmentation model capable of addressing runtime dynamics absent in static cases, ensuring scalable execution even in measurement-driven scenarios. Designed to integrate with a full-stack architecture, HyPAQ coordinates partitioning, execution, and resource allocation across multi-QPU systems. Experimental results demonstrate significant reductions in communication overhead and improved scalability, making HyPAQ a practical and adaptable solution for distributed quantum computing.
The Internet of Things (IoT) enables smart cities, efficient logistics, and intelligent infrastructure. Low-Power Wide Area Networks (LPWANs), such as LoRaWAN, offer long-range connectivity with low energy consumption; however, designing and testing these networks often requires programming skills, which can limit accessibility. This paper presents NC-LoRaSim, a No Code LoRaWAN simulation platform based on NS-3, suitable for users with varying backgrounds. It offers three operation modes: Manual, for step-by-step scenario configuration; Automatic, for running simulations under multiple predefined parameters; and Advanced, which allows users, like researchers with basic C++ knowledge, to develop and evaluate new protocols using pre-built functions. A user-friendly interface and real-time terminal simplify parameter selection and result visualization. By combining NS-3’s modeling capabilities with an intuitive interface, NC-LoRaSim enables students, engineers, and researchers to explore, analyze, and optimize LoRaWAN networks without extensive programming, bridging usability and technical depth.
We present Rûm, a randomized asynchronous multivalued byzantine consensus algorithm designed for mobile ad-hoc networks, operating under the message omission/loss model of Santoro-Widmayer. Rûm is optimal with respect to the byzantine fault bound, and makes progress in rounds where the number of message omissions is bounded, while always ensuring safety. Through network simulations conducted in ns-3, Rûm’s performance is evaluated against Turquois and Ezhilchelvan et al.’s multivalued consensus algorithm, demonstrating its ability to achieve consensus in the presence of byzantine faults and message loss. The results indicate that Rûm can efficiently handle message omissions and byzantine faults, maintaining reliable decision-making processes, making it a suitable solution for consensus in mobile ad-hoc networks.
In learning the art of cybersecurity, Capture The Flag (CTF) competitions are a widely used tool, as they provide a rewarding gamification framework for the learner. In particular, in Attack and Defense CTFs each team is responsible for managing an infrastructure both in terms of defending its own and attacking the infrastructure of other teams. This means that attacking and defensive skills can be trained simultaneously. However, approaching this type of challenges is difficult for newcomers, since a fairly complicated player infrastructure is required for a team to participate properly. In this paper, we present an open source player side infrastructure that has been used in such competitions. It enables the automatic setup of all essential services for common blue teaming activities, such as packet inspection and request filtering rules. It also provides all of the mechanisms related to automating the launch of exploits against other competitors. Moreover, a mechanism for offloading computationally intensive task to an external machine (known as a support box) was implemented to overcome the hardware limitations of virtual machines provided by the organizers in these scenarios. Finally, we evaluate the proposed infrastructure under realistic workloads.
Federated Learning enables collaborative model training across distributed clients without exposing raw data, offering clear advantages for privacy and scalability. However existing approaches often fail to provide comprehensive protection across the entire lifecycle and struggle with client heterogeneity. This paper introduces a multi-stage privacy-preserving Federated Learning framework for short-term forecasting. On the privacy side, it integrates a threshold-based secret sharing protocol with mix-net–inspired anonymization. On the aggregation side, a lightweight clustering strategy that groups clients with similar consumption patterns is proposed, improving accuracy while preserving privacy. Real industrial and residential datasets have been used for validation purpose.
Service Level Agreements (SLAs) play a critical role in modern service ecosystems, formalizing commitments between providers and customers to ensure compliance with performance metrics and Quality of Service (QoS) requirements. However, the lack of standardized, user-friendly tools for defining and customizing 5G SLAs in machine-readable formats, such as XML, hinders automation and interoperability in service management. To address this challenge, we propose a formal approach based on the Event-B method to model SLA contracts and ensure their correctness and reliability. We define an incremental Event-B model that captures SLA constraints and verify their consistency using proof obligations and animation. This ensures that SLA enforcement does not alter the expected execution semantics of contracts.
One of the most reliable and effective solutions against Return-Oriented Programming (ROP) attacks is the incorporation of Backward Edge Control-Flow Integrity. The most prominent implementation of this concept involves the integration of a dedicated shadow stack, which is a distinct memory structure used for saving and checking functions’ return addresses, and consequently, enforcing the control flow within a program. In this article we propose an alternative perspective to this established notion via the introduction of KSS, a Kernel Shadow Stack for user programs. Our solution not only upholds program flow but also enables determining which code block has been the origin of stack tampering. Furthermore, by placing itself at a higher privilege level, its information can no way be altered by the (attacked) user-level code. Overall, it does not only offer the support for more secure program operations, rather it also allows the analysis of program flows-an aspect that can be very relevant in software deploy phases. Beyond a kernellevel subsystem, which we developed for Linux, KSS includes an instrumentation engine and a custom loader designed to enable its usage with preexisting programs, with no need for any access to the program’s source code. Via experimental results we show how the impact of costs (in terms of CPU-cycles) inherent to the implementation of KSS can be definitely reduced in scenarios involving networking-based applications where threads classically exhibit an I/O-bound execution profile.
We study distributed directory protocols for accessing shared objects in large-scale distributed systems under the recently proposed framework of learning-augmentation. Each shared object has an owner node that can modify its value. The ownership may change by moving the object from one node to another in response to move requests. The value of an object can be read by other nodes with lookup requests. The existing directory protocols were designed in the online model where both the arrival time of requests and the nodes issuing requests are not known a priori. We consider the learned-augmented framework that involves a priori knowledge on nodes that issue requests; the arrive time of requests as well as whether in fact predicted nodes issue those requests are unknown (i.e., the predictions may be error-prone). We design two distributed directory protocols, one tree-based and another cluster-based, and provide better guarantees that were known in the literature in the online model, when predictions are perfect (no prediction error). We additionally show that the guarantees degrade gracefully with prediction error but do not get worse than the guarantees in the online model even with maximum prediction error. To the best of our knowledge, this is the first study of distributed directory protocols under learning-augmented framework.
This paper develops Spark - a novel algorithm for predicting fire spread in smart buildings. Spark leverages prior information about the building (e.g., room flammability, structural layout, and occupant distribution) together with real-time multimodal sensing data from static sensors (e.g., temperature sensors, smoke detectors, and embedded structural monitoring devices), dynamic sensors (e.g., drones and robots), and human sensors such as firefighters. By continuously integrating these heterogeneous information streams, Spark produces a realtime and adaptive prediction of fire spread. Specifically, Spark classifies rooms into risk zones (e.g., safe, vulnerable, and critical) using a clustering algorithm.
Dynamic batching in machine learning (ML) serving systems can significantly improve throughput, yet it also introduces a non-trivial trade-off between inference latency and system energy consumption. This paper presents Energy-Latency Trade-off Optimization (ELTO) for ML Inference with Dynamic Batching. ELTO empirically profiles the latency and energy characteristics of any newly deployed model under varying batch sizes and request rates using NVIDIA Triton Server. It leverages supervised regression to predict per-batch latency and energy based on profiled data. ELTO formulates and solves a cost-based optimization to select the batch size that minimizes a weighted sum of normalized predicted latency and energy for deployed ML models. Experimental evaluations using ML vision models (ResNet18, ResNet50) on the NVIDIA GeForce RTX 3060Ti demonstrate the effectiveness of the proposed ELTO. ELTO is compared to heuristic baselines like fixed small or large batch sizes, ELTO significantly reduces the average scaled operational cost-a balanced measure of both latency and energy. For instance, evaluations show cost reductions of $\mathbf{7 5. 5 \%}$ for ResNet18 and $48.2 \%$ for ResNet50 relative to a no-batching strategy, thereby ensuring a more consistently near-optimal operational balance under diverse load conditions
Federated Learning traditionally relies on differential privacy or cryptographic techniques such as Secure Aggregation and Homomorphic Encryption to protect data during distributed training, but these approaches incur high computational and communication costs. The emergence of hardware-based Trusted Execution Environments, particularly Confidential Virtual Machines (CVMs), offers a practical alternative by enabling secure computation on untrusted cloud infrastructures without algorithmic changes.However, CVM deployments by cloud providers—Google Cloud, Microsoft Azure, and AWS—remain opaque, inconsistent, and difficult to reproduce. This paper analyzes their trust models, attestation mechanisms, and deployment limitations, and introduces EVIDENT, a unified framework for transparent CVM lifecycle management. Furthermore, it supports attested interaction scenarios in which CVMs execute workloads owned by third parties—such as confidential AI inference—under cryptographically verifiable trust conditions.
