Artificial intelligence-based security systems have emerged as an effective solution to proactively identify anomalous behavior in Internet of Things traffic. However, the high dimensionality and heterogeneity of IoT datasets pose significant challenges for efficient and robust model training, making feature selection a fundamental step. In this work, we present a case study on Quantum Annealing-Driven Feature Selection applied to the NF-UNSW-NB15-v3 dataset by formulating the problem as a Quadratic Unconstrained Binary Optimization model and solving it using the quantum computing platform D-Wave. The proposed formulation incorporates tunable parameters ( α , β , and λ ) that allow the optimization process to be adapted to different objectives, such as emphasizing relevance, reducing redundancy, or achieving a balanced trade-off between both. Among the evaluated configurations, the Balanced case ( α =β =λ =1 ) proves to be the most effective, achieving the best compromise between predictive performance and computational efficiency, with the highest average accuracy and the shortest training time. Our analysis indicates that flow description features capture most of the discriminative information, moreover temporal features provide complementary information but are not selected by the feature selection process.
Digital forensic investigations increasingly face the challenge of analyzing large volumes of heterogeneous data. Identifying relevant digital traces remains a complex and resource-intensive task. This paper proposes a methodology for the systematic identification of relevant forensic artifacts based on time window aggregation and hierarchical clustering. The proposed approach introduces quantitative metrics, such as attack rate and attack lift, to evaluate the relevance of clusters. At the same time, it emphasizes explainability by identifying key attributes that characterize individual clusters. The proposed methodology is evaluated on multiple publicly available datasets. The results indicate that the approach effectively supports the identification of incident-related behavior while maintaining interpretability. The proposed methodology contributes to the automation and increased efficiency of handling cybersecurity incidents, including digital forensic analysis.
The rapid expansion of Internet of Things (IoT) devices has significantly increased the attack surface, necessitating the development of robust and privacy-preserving intrusion detection systems. This research delves into the application of Federated Learning (FL) to detect network-based attacks in IoT environments, utilizing the NF-ToN-IoT dataset. We compare a centralized machine learning model with a federated counterpart, employing the Federated Averaging (FedAvg) algorithm. Both models employ a Multi-Layer Perceptron (MLP) architecture trained on NetFlow features for binary classification of benign versus malicious traffic. Our experimental results reveal that the federated model achieves comparable and even slightly superior performance across various metrics, including precision, recall, and F1-score, while preserving data privacy by decentralizing the training data. These findings underscore the potential of FL as a viable alternative to traditional intrusion detection systems in real-world, privacy-sensitive IoT scenarios.
Flow-based network traffic analysis is widely adopted for securing IoT environments owing to its scalability and computational efficiency. However, reliance on basic statistical flow features may fail to detect subtle layer 2 intrusions and can lead to laboratory overfitting when static identifiers are implicitly learned. This paper presents a rigorous evaluation on a publicly available IoT flow dataset comprising seven attack categories, using a methodology explicitly designed to prevent data leakage. While tree-based ensemble models achieved near-perfect detection (F1 > 0.99) for most attacks, initial experiments revealed a critical performance gap for ARP Spoofing. Even after hyperparameter optimization, standard flow statistics yielded a Recall of 0.86, leaving a significant portion of malicious activity undetected. Through Explainable AI (SHAP), we demonstrated the statistical overlap that causes this limitation. Finally, we propose a context-aware feature engineering approach—specifically introducing flow symmetry ratios and cardinality metrics—which successfully restored detection capabilities to a perfect F1-Score of 1.0, proving the viability of behavioral state analysis for complex IoT threats.
Machine Learning-based intrusion detection systems often exhibit limited generalization when deployed in network environments different from those used for training. This study evaluates the cross-dataset generalization capability of a Random Forest classifier for network traffic attack detection. Using raw PCAP data from multiple heterogeneous datasets, network flows are labeled as benign or malicious, and DoS and DDoS TCP attacks are grouped into a single attack class. Several training strategies that combine different datasets are evaluated and tested on unseen datasets. The results indicate that training on multiple sources improves detection performance compared to single-dataset training, highlighting the relevance of dataset diversity in realistic intrusion detection scenarios.
This paper presents a novel approach to Edge Cybersecurity by deploying autonomous Q-learning agents capable of operating in isolation to mitigate cyber-physical attacks. We propose a hierarchical architecture where a Large Language Model at a superior level acts as a supervisor, defining reward functions and guiding the training process of the edge agent. The edge device, implemented on an ESP32 microcontroller, utilizes this pre-trained or periodically updated policy to autonomously detect and correct anomalies—such as voltage instability—even when disconnected from the central network. This decoupling ensures system resilience and operational continuity under adversarial conditions. We demonstrate the efficacy of this Large Language Model-guided reinforcement learning framework through a voltage control prototype, highlighting its potential for securing critical infrastructure at the edge.
Network intrusion detection in IoT deployments increasingly relies on flow-level telemetry because end-to-end encryption limits the applicability of payload-based inspection. However, when traffic is aggregated over time into fixed-length windows to incorporate additional context and improve predictions, benign activities and multiple attack families may overlap within the same interval, naturally requiring a multi-label formulation. This study proposes a transformer-based multi-label IDS that represents each time window as an ordered sequence of flows, preserving inter-flow dependencies instead of collapsing windows into aggregated statistics. Using an end-only window assignment and multi-label aggregation on the NF-ToN-IoT-v3 dataset, the proposed model achieved strong window-level performance, reaching 0.9243 subset accuracy, 0.9786 micro-F1, and 0.9010 macro-F1 in 5-fold cross-validation. Error analysis shows that most non-exact predictions are near-misses with a high set overlap, while the per-class results indicate excellent performance on frequent attack families and a recall–precision trade-off on highly imbalanced labels. These findings support the practical viability of window-level multi-label detection for mixed-encrypted IoT traffic.
Federated Learning (FL)-based Intrusion Detection Systems (IDS) are emerging as a promising approach for securing IoT networks and preserving data confidentiality. Moreover, FL introduces novel vulnerabilities. These include inference attacks by malicious aggregators, who can extract sensitive information from model updates, as well as malicious clients capable of submitting falsified updates to the aggregator server. Additionally, with the rapid development of quantum computers, existing privacy protection schemes mainly based on Secure Multi-Party Computation (SMPC) will no longer be able to guarantee the data.This paper presents a Secure Aggregation (SA) method that combines Post-Quantum-secure channels for client key exchange and Verifiable Secret Sharing (VSS), achieving resilience against malicious clients. Experiments conducted in an FL-based IDS for real-world IoT networks demonstrate the viability of our proposal.
The transition to sixth-generation telecommunications introduces a paradigm shift in vehicular networks, enabling hyper-connected autonomous driving through advanced machine learning. However, training these models requires vast amounts of sensitive telemetry data, creating a conflict between data utility and user privacy. This paper addresses this trade-off by proposing a dual-framework architecture. First, we introduce a soft privacy framework, leveraging attribute-based encryption and proxy re-encryption to achieve ultra-low latency suitable for safety-critical applications like collision avoidance. Second, we present a hard privacy framework, utilizing homomorphic encryption, multi-party computation, and zero-knowledge proofs to establish a zero-trust environment for long-term statistical analysis. We provide a rigorous security analysis demonstrating resilience against collusion and data poisoning attacks. Furthermore, a theoretical performance evaluation compares computational complexities to confirm that while soft privacy optimizes for real-time actuation, hard privacy provides necessary information-theoretic security at the cost of higher latency. We validate these findings through application scenarios and network simulations, offering a roadmap for privacy-preserving sixth-generation vehicular architecture.
Machine Learning-based Intrusion Detection Systems (IDS) commonly rely on statistical features extracted from network flows derived from raw packet capture (PCAP) files. When traffic is processed in fixed temporal windows, the method used to aggregate flow records before classification becomes a relevant design choice. In this work, two temporal aggregation strategies are evaluated for multiclass IoT traffic classification: segment, where flows are extracted independently from non-overlapping 5-second windows, and incremental, where each sample is built from a 120-second sliding context composed of 24 consecutive 5-second windows. Both strategies were assessed under identical conditions using a Transformer-based classifier and a chronological evaluation protocol. The results show that the incremental strategy outperforms the segment-based strategy, achieving a balanced accuracy of 0.9769 and a macro-averaged F1-score of 0.9772, compared with 0.9517 and 0.9409 for the segment mode, respectively. These findings indicate that incorporating the temporal context into the prediction unit improves the multiclass intrusion detection performance and reduces the ambiguity between traffic categories.
Industrial Internet of Things (IIoT) edge gateways require intrusion detection systems (IDS) that combine strong detection capability with low computational cost and transparent decision mechanisms. While deep learning approaches often achieve high predictive performance, their limited interpretability and resource requirements restrict their deployment on constrained edge devices. This paper presents a compact and explainable binary IDS for DDoS traffic detection based on an Adaptive Neuro-Fuzzy Inference System (ANFIS) designed for IIoT edge environments. The model operates on a six-feature flow representation and aims to balance detection performance with interpretability and lightweight inference. The proposed approach is evaluated using flow-based traffic derived from the TON_IoT dataset together with an additional NFStream-based proprietary dataset. The ANFIS model is compared with a Mamdani fuzzy system and a multilayer perceptron (MLP) baseline. On the held-out test set, the proposed model achieves an F1-score of 0.904 and an AUC-ROC of 0.972 while maintaining sub-millisecond CPU inference latency, demonstrating suitability for real-time deployment on resource-constrained IIoT gateways. These results indicate that ANFIS-based models can provide an effective balance between detection accuracy, interpretability, and computational efficiency for explainable DDoS intrusion detection at the IIoT edge.
This work presents a microcontroller-based system for detecting Denial-of-Service (DoS) attacks in IoT environments using edge AI. A Random Forest classification model is designed, trained, and evaluated to identify DoS traffic patterns in network flows. The trained model is integrated into an M5Stack LLM630 Compute Kit (AX630C), where network flows are processed in real time using the NFStream framework. Only flows targeting the microcontroller are analyzed and classified locally, enabling on-device detection of malicious activity. Experimental validation is performed in a controlled network environment where both benign and malicious traffic are generated to evaluate the system’s real-time detection capabilities. The results demonstrate that the proposed approach enables efficient DoS detection on a resource-constrained embedded device, highlighting the potential of edge-based machine learning techniques for improving the security of IoT systems.
This paper presents HFIF, a Hybrid Forensic Investigation Framework that unifies modern mobile incidents detection into a case-oriented pipeline to provide reports of existing malware usage and activity. The framework offers three main contributions: an engine of non-root real-device dynamic analysis, which is based on Frida Gadget injection and ADB port forwarding to provide runtime instrumentation without privileged access; a custom artifact acquisition (Memlite) with an 8-step procedure of constrained memory-adjacent artifact collection and analysis based on the feature taxonomies and empirical frequency distributions of DREBIN, DroidAPIMiner, and Kapratwar et al.; and finally a YARA-based baseline scanning to identify malicious potential, as well as to distinguish between legitimate and harmful applications. All the above contributions are working together to generate explainable artefact-associated forensic reports that could be incorporated in structured investigative procedures. We evaluated HFIF on a calibration set 200 real Android applications (100 benign and 100 adware samples) being run on a physical non-rooted device and compare its performance to that of a VirusTotal majority-vote baseline. The results showed a preliminary F1-score of 0.9950 for a calibrated set, while also displayed the advantages of adding the runtime memory acquisition and the dynamic analysis as opposed to just static analysis. To assess the generalization of the approach, we also applied the same weights to an extended validation set of 1992 APKs showing that for the specific targeted types of data, our model is still able to detect correctly the same characteristics that it was trained upon. On this validation set, HFIF achieves a precision of 0.998 (1 false positive across 996 benign samples), an overall recall of 0.588, with a recall of 0.848 for banking trojans and 0.935 for riskware, showing a good performance when detecting destructive and impactful malware, yielding an ROC-AUC of 0.762. We analyse the recall limitation as an inherent consequence of the framework’s conservative, high-precision triage design and characterise which malware categories are most affected.
The rapid adoption of low-cost IoT devices in domestic environments has increased the attack surface of residential networks, particularly in devices that combine cloud connectivity with locally exposed APIs. This paper experimentally evaluates the feasibility of a replay attack against a commercial smart plug (Meross MSS210) in a controlled environment replicating a real home network. Using a Raspberry Pi configured as a WiFi access point and traffic capture node, local HTTP communications between the mobile application and the device were intercepted and analyzed. Results show that previously captured control messages can be retransmitted successfully under the evaluated laboratory conditions, achieving consistent success without noticeable delay. Despite including timestamp and signature fields, the protocol does not effectively prevent message reuse. Finally, we discuss mitigation strategies at both the protocol and network configuration levels, underscoring the necessity of robust freshness assurance to secure the connected home.
Performing computations on encrypted data by first decrypting it causes security flaws. Fully Homomorphic Encryption (FHE) algorithms enable computations on encrypted data without decryption, overcoming the limitations of traditional schemes. This study analyzes the van Dijk-Gentry-Halevi-Vaikuntanathan (DGHV) scheme and Batch DGHV schemes, comparing their efficiency in encrypting ℓ -bit messages. Our analysis indicates that Batch DGHV achieves superior efficiency over the original DGHV when the message length ℓ satisfies ℓ≤λ ^3/2 , where λ denotes the security parameter. In cloud computing, this is significant for processing high-dimensional data or aggregating multiple encrypted messages. For messages of length (ℓ + s) where ℓ + s > λ ^3/2 , we propose a hybrid approach: applying Batch DGHV to the initial ℓ bits and the original DGHV to the remaining s bits. This partitioned strategy optimizes computational efficiency compared to the exclusive use of a single scheme. These findings demonstrate that selecting between original and Batch DGHV must be informed by both asymptotic bounds and specific message lengths to balance computational overhead and data throughput in secure cloud environments.
Pointer arithmetic remains a common source of memory safety issues in C/C++ programs, potentially enabling out-of-bounds (OOB) accesses and unsafe pointer reinterprets. In this work, we present a lightweight static analysis pass implemented in LLVM that identifies selected high risk pointer manipulation patterns directly in LLVM intermediate representation (IR). By operating at the IR level, the pass can be integrated into compiler pipelines and multiple different architectures, including embedded firmware compiled through LLVM. The analysis presented in this paper focuses on two categories of pointer operations: (i) definite constant OOB accesses through load, store, atomic operations, getelementptr, or memory intrinsics (memset, memcpy, etc.), and (ii) dereferenced pointers produced by inttoptr, including cases arising from definite truncating roundtrips via ptrtoint → inttoptr. We evaluate the pass on synthetic microbenchmarks, widely used open-source projects, and an embedded workload compiled with an LLVM-based RL78 toolchain. The pass presented in this paper successfully identifies a small number of potentially safety-relevant pointer arithmetic patterns while introducing minimal compilation time overhead.
This paper presents a cybersecurity audit of the Unitree Go2 quadruped robot, analyzing hardware interfaces, network services, and communication protocols to identify vulnerabilities threatening confidentiality, integrity, and availability. Using penetration-testing methodology adapted for cyber-physical systems, we performed information gathering, vulnerability analysis, and controlled exploitation in an isolated laboratory. Critical issues include unauthenticated video streaming, weak SSH protection, unencrypted SDK channels, and exposed physical ports. Findings are scored using CVSS v3.1 with practical mitigation strategies. Comparative analysis with the Unitree A1 reveals persistent systemic security weaknesses across product generations, suggesting fundamental gaps in the manufacturer’s secure development lifecycle. Therefore, these factors should be carefully considered before deploying this type of robot in applications involving human interaction or substantial economic costs, including industrial and primary-sector environments.
Curve5453 and Curve6071 are Montgomery curves over the primes 2^545-3 and 2^607-1 , providing 271- and 302-bit classical security, respectively. Their TMVP-based field multiplication in 10-limb representation costs 77 multiplications. We reduce this to 60 for Curve5453 ( 22% fewer) using a 9-limb radix- 2^61 representation, and to 54 for Curve6071 ( 30% fewer) using a 12-limb radix- 2^51 representation with hierarchical block-level TMVP. Choosing the limb count to produce 3 × 3 Toeplitz blocks aligns the structure with the size-3 TMVP formula, computing each block product in 6 multiplications rather than 9. Portable C implementations benchmarked on ARM64 and x86-64 confirm speedups of up to 16% in field multiplication and 13% in scalar multiplication. On ARM64, Curve5453 reaches 90.6% of OpenSSL’s assembly-optimized NIST P-521 ECDH throughput with 12 additional bits of classical security, and Curve6071 delivers 302-bit classical security at 80.8% of P-521’s throughput.
The rapid integration of Large Language Models (LLMs) into public-facing infrastructures has drastically expanded the digital attack surface, introducing severe cognitive vulnerabilities such as Prompt Injection. To establish an empirical baseline of this threat, we conducted a black-box red teaming audit of 14 conversational agents deployed within the Spain Living Lab smart tourism ecosystem, revealing a critical Attack Success Rate (ASR) of 55.6
The expansion of cryptocurrency ecosystems has facilitated a surge in illicit financial activity, with billions linked annually to money laundering. Cryptocurrency mixing services represent a key component of this landscape, as they obscure transaction trails by redistributing assets across multiple addresses and introducing intentional delays. These mechanisms hinder forensic transparency by complicating the link between the origin and destination of funds. This study investigates transaction-level patterns consistent with mixer-like activity on the Bitcoin blockchain. We propose a set of interpretable heuristics based on temporal dynamics, transaction balance characteristics, and fee-related effects, including structured delays, residual balances, balance depletion, and fee shrinkage. These heuristics are evaluated against a historical dataset of over 5 million transactions spanning 2011 to 2021. This longitudinal analysis focuses on addresses associated with Bitcoin Fog to characterize behavioral alignment with known mixer operations across different market phases. The results demonstrate a high degree of behavioral alignment between the proposed heuristics and the structural logic of known mixers, identifying distinct operational signatures in the transaction flow. Consequently, the approach should be interpreted as identifying indicative patterns rather than providing definitive detection. Overall, the findings highlight the potential of simple, interpretable heuristics for exploratory blockchain analysis and as a complementary tool for forensic investigations.
