The increasing digitization and interconnection of Industrial Control Systems (ICS) to the Internet render them susceptible to cyber attacks. Thus, a major line of research focuses on the design of reactive security solutions in the form of industrial intrusion detection systems, which aim to detect anomalies in a normal system operation. However, a crucial prerequisite for the accurate detection and localization of anomalies is the identification of typical traffic patterns that are exclusive to characterize the normal ICS behavior. Unlike previous work focusing on complex and protocol-dependent models, for characterizing ICS network traffic, in this work we propose simple, easy deployable, and effective rules for determining whether ICS network traffic, unlike traditional IT networks, remains stable over time. The main advantage of our rules is that they can be used to estimate the time required to identify the most dominant ICS traffic patterns in a given ICS. We show the efficacy of our rules by analyzing multiple ICS datasets with different industrial network protocols.
Most Internet of Things (IoT) devices rely on batteries with operational lifetimes of only a few years, resulting in high maintenance costs and significant environmental impact from battery waste. Energy harvesting (EH) combined with supercapacitor-based energy storage has emerged as a promising alternative, enabling longer-lived and more sustainable IoT systems. However, the design and deployment of such battery-free systems remain challenging due to their complexity and perceived unreliability. To overcome these barriers, we present Flute, a plug-and-play (PnP), battery-free IoT platform designed for remote sensing applications. Flute integrates energy harvesting, supercapacitor storage, and NB-IoT connectivity to enable autonomous long-term operation. In this paper, we demonstrate Flute’s capabilities through a contactless waterlevel sensing application, highlighting its potential to simplify the development and deployment of sustainable IoT systems.
Configuration vulnerabilities have emerged as a critical challenge in securing complex information systems. Unlike traditional software bugs, these vulnerabilities originate from insecure system settings in components such as databases, web servers, and cloud environments. Common misconfigurations such as using default credentials, enabling skip-grant-tables=1, or setting bind-address=0.0.0.0 can significantly compromise security, leading to issues like unauthorized access (CWE-287) and unintended public network exposure (CWE-284). Despite progress in automated vulnerability scanning and patch management, configuration-related issues remain inadequately addressed due to their contextual dependencies and the limitations of conventional tools in interpreting system semantics.In this work, we present MisConfAI, a transformer-driven framework for automated detection of configuration vulnerabilities. MisConfAI first models syntactic variations and lexical deviations in configuration files, then maps risky settings to known vulnerability classes (e.g., CWE) and compliance standards such as the CIS Benchmarks. We evaluate its efficacy across multiple pre-trained language models, including BERT, CodeBERT, RoBERTa, ELECTRA, and XLNet. To ensure operational fidelity, the framework is coupled with a dynamic analysis layer that provisions containerized testbeds via Docker to replicate real-world deployment environments.
Improving uplink communication reliability in dense LoRaWAN deployments remains a challenge, particularly under the constraints of standard compliance.In this paper, we evaluate the performance of three representative channel access mechanisms: Slotted ALOHA, Slotted ALOHA with CSMA, and TDMA, implemented using LoRaWAN Class B end-devices and the built-in synchronization service to ensure full compliance with the LoRaWAN specification. Based on ns-3 simulations, we assess the impact of network size and downlink ACKs from confirmed uplink packets on packet success ratio and energy consumption.Results show that S-ALOHA and S-ALOHA/CSMA do not consistently outperform pure ALOHA in practice, contrary to theoretical expectations. Moreover, while TDMA eliminates collisions in unconfirmed traffic, it performs poorly with confirmed traffic. Our findings highlight the difficulty of enhancing LoRaWAN through time slotted channel access without compromising standard compliance, particularly given the overhead of synchronization mechanisms.
The automotive industry’s shift to zonal Electrical/Electronic (E/E) architectures introduces new lateral movement pathways for multi-stage cyberattacks, posing significant end-user risks. Modeling these “automotive kill chains” is challenging due to the lack of a standardized framework for adversary tactics. This paper presents a methodology that integrates the Automotive Threat Matrix (ATM) with the ISO/SAE 21434 Threat Analysis and Risk Assessment (TARA) process to systematically construct and analyze attack paths. Based on this analysis, we propose the Automotive Kill Chain Correlation (AKCC), a dynamic threat response framework that correlates security alerts along modeled attack paths for high-confidence detection. Applying the methodology to a representative zonal architecture reveals systemic vulnerabilities and enables the design of targeted, stateful countermeasures. The practical utility of this approach is validated through a qualitative survey of industry experts, who confirmed it significantly simplifies and clarifies attack path analysis.
