The exponential development of Internet of Things (IoT) devices has significantly improved exposure to cyber threats, which threaten both network stability and the security of Over-the-Air updates (OTA) firmware updates. Existing security mechanisms often struggle with limited scalability, privacy concerns, and insufficient real-time detection capabilities across heterogeneous IoT environments. To overcome these challenges, the present studyproposes a novel software-defined networking security framework integrating federated deep learning for collaborative attack classification and OTA protection. The Multi-expertdual stream heterogeneous Federated learning-based Convolutional Transformer (MFCT) model achieves accurate classification while preserving data privacy at edge gateways. Encrypted model aggregation and secure cloud storage are implemented using Homomorphic Adaptive Elliptic Curve Cryptography (HA-ECC), allowing computations on encrypted data and safeguarding sensitive information. Furthermore, feature selection is optimized via the Adaptive Projection-iTerative-Methods-based Optimizer (APTMO), enhancing model efficiency. To improve transparency and trust, Local Interpretable Model-Agnostic Explanations (LIME) are employed, providing human-understandable insights into model predictions. The proposed MFCT model demonstrates strong and reliable performance, achieving encryption and decryption times of 1.2–3.0 s and 1.2–1.8 s, respectively, OTA integrity of approximately 97.8
Failures in microservice systems can produce correlated symptoms across services, motivating the study of structural information for root-cause localization alongside anomaly-based approaches. We study service-level localization from multivariate monitoring metrics under known fault-onset and metric-to-service mapping assumptions. Existing temporal and multilayer ranking methods rarely use relation-estimation reliability to control node-level information exchange between contemporaneous and lagged evidence. We propose Decoupled Multiplex Causal Ranking (DeCoR) and its core algorithm, Regime-aware Innovation Causal Estimation with Confidence-aware Multiplex Coupling (RICE-CM). RICE-CM derives both evidence types from a shared dynamics model fitted to the pre-fault normal segment. It aggregates edge confidence scores into node reliability, applies nonuniform diagonal coupling between same-metric replicas, and ranks services through reverse PageRank on a supra-adjacency matrix. We evaluated RICE-CM on a 300-case subset drawn from three RCAEval datasets: Sock Shop 1 (SS1), Sock Shop 2 (SS2), and Online Boutique (OB). With dataset-specific coupling settings selected on the same benchmark cases, it achieved Avg@5 scores of 0.6000, 0.7040, and 0.4864 on SS1, SS2, and OB, respectively. It achieved the highest Avg@5 among the evaluated methods on all three datasets and exceeded RUN on OB by 0.0288, while requiring approximately 1/33 of RUN’s runtime per case. Compared with RICE-only, RICE-CM improved Avg@5 by 0.0640, 0.0704, and 0.0624, respectively. Paired tests supported these gains on SS1 and SS2 after Holm correction, but not on OB. Against fixed-coupling RICE-MX, the gains were 0.0720, 0.0400, and 0.0336, respectively, with a Holm-adjusted p value of 0.0456 on each dataset. Positive observed gains over RICE-only occurred across all 12 dataset-fault-type combinations, whereas the coupling-parameter sweep showed dataset-dependent sensitivity. These results support node-reliability-driven nonuniform coupling over fixed coupling within the evaluated benchmarks and task assumptions.
With the rapid development of Internet technology, distributed denial-of-service (DDoS) attacks have become one of the major threats in cybersecurity. DDoS attack data typically exhibit large-scale, sparse and class-imbalanced characteristics. A large amount of redundant and irrelevant features not only increases the computational cost of the detection model but also affects the recognition performance of the attack traffic. Regarding the feature selection problem in DDoS attack detection, a mathematical curve TSO feature selection algorithm (ASTSO-STF) was proposed based on a decaying perturbation dynamic transfer function. The basic S-shaped, V-shaped and U-shaped transfer functions are respectively combined with three random walk models: Lévy flight, Brownian motion and tangent flight, and a dynamically changing attenuation coefficient is introduced to enhance the exploration and development ability of the algorithm in the feature space. Secondly, the original trochoid search trajectory of TSO is replaced with eight mathematical curves with different geometric characteristics for comparison. Through different search trajectories, the feature space search ability of the algorithm is enhanced and finally, the ASTSO-STF based on the Archimedean spiral is constructed. To verify the effectiveness of the proposed method, experiments are conducted on 9 large-scale sparse datasets with different dynamic transfer functions and mathematical curve search mechanisms, and 2.5
With the rapid development of cloud-edge industrial Internet of Things, massive sensor and device data are continuously generated at distributed edge clients, while cloud-hosted large language models provide new opportunities for collaborative intelligence and high-level decision support. However, directly uploading industrial data to the cloud may cause privacy leakage, and deploying large models on resource-constrained edge devices is impractical due to high computational and communication costs. To address these challenges, this paper proposes an LLM-assisted federated Bayesian dynamic graph attention network for privacy-preserving graph learning in industrial IoT. In the proposed framework, the Bayesian dynamic graph attention network serves as a lightweight edge-side small model to capture complex relationships among sensors and devices, while the cloud-side LLM acts as a collaborative coordinator that analyzes non-sensitive training statistics and provides high-level guidance for federated optimization. The coordination mechanism is model-agnostic and does not rely on a specific LLM architecture, allowing general-purpose instruction-following LLMs to be integrated as plug-and-play cloud coordinators. Bayesian inference is introduced to model parameter uncertainty through prior and posterior distributions, and a dynamic attention mechanism is used to adaptively learn heterogeneous device relationships. In addition, differential privacy is incorporated into the transmission of model updates to protect sensitive industrial information. Experimental results on multiple graph datasets demonstrate that the proposed method improves federated graph learning performance while maintaining privacy and supporting cloud-edge collaborative intelligence.
The widespread adoption of Internet of Things (IoT) technologies in healthcare has led to the continuous generation of Electronic Health Records (EHRs) that are often outsourced to cloud storage. While cloud platforms offer scalability and availability, they introduce significant challenges in enforcing fine-grained access control, preserving policy privacy, and supporting efficient public auditing over large volumes of IoT-generated data. Existing solutions mainly focus on access authorization and provide limited support for scalable and privacy-preserving auditing. This paper proposes SEC-HIoT, a secure and efficient access control framework for IoT-based EHR systems. Rather than attempting to remove bilinear pairings from ciphertext-policy attribute-based encryption (CP-ABE), which the recent cryptanalysis of pairing-free constructions shows to be unsafe, SEC-HIoT confines them: encryption performs no pairing at all, and the pairings needed for decryption are executed by the fog against a blinded transformation key, so no pairing is ever computed on a resource-constrained device. To protect access policies, the scheme employs a secret-keyed attribute encoding mechanism that achieves attribute-label hiding against dictionary attacks, and the same encoding makes the construction usable over efficient asymmetric pairings. User revocation is handled by a lightweight perturbable mechanism that updates only the ciphertext blinding component and the keys of users who remain authorised, leaving the encrypted payload untouched. For auditing, SEC-HIoT combines Bloom filter–based indexing with Merkle tree verification to enable fast record lookup and lightweight integrity checking, while a blockchain-backed randomized signature mechanism supports both public auditing and owner-resolvable accountability without exposing signer identities. Security analysis establishes confidentiality, unforgeability, attribute-label hiding, and backward secrecy under revocation. A working implementation shows that the device-side decryption cost is independent of policy size at ≈ 2.3 ms, a 261× reduction over the non-outsourced path at fifty attributes, that the IoT device performs no public-key operation during ingest, and that revoking a user costs a single group exponentiation per record instead of re-encryption.
