Wireless Sensor Networks (WSNs) technology is extensively utilized in various applications necessitating monitoring and control functionalities. Nonetheless, some unresolved difficulties impede its effective deployment, primarily related to security concerns. This study investigates and analyzes the parameter sensitivity of the Susceptible-Exposed1-Exposed2-Infected-Recovered (SE _1 E _2 IR) model, derived from the classical Susceptible-Exposed-Infected-Recovered (SEIR) epidemic theory and used for the early detection of multi-malware activities in WSNs. In this model, two exposed states have been considered based on the assumption of two different types of malware attacks in the network. The primary SE _1 E _2 IR model develops a mechanism for the earlier detection of malware attack incidents in WSNs. The model is structured upon a system of ordinary differential equations. The basic reproduction number is also determined as a crucial factor for characterizing malware propagation within the network. It can be helpful to identify the circumstances in which the network remains almost safe or the risk of a malware outbreak. This work offers a fundamental comprehension of sensitivity analysis for the epidemic SE _1 E _2 IR model. Furthermore, it examines the efficacy of the parameters and analyzes the impact of different model parameters on malware spread in WSNs. Then, an analytical comparison of the suggested model with existing models is presented. Numerical simulations are run in MATLAB to augment the theoretical analyses.

Network Anomaly Detection (NAD) has emerged as one of the most effective approaches for timely identifying network-based cyberattacks, offering clear advantages over traditional signature-based intrusion detection systems. The integration of advanced machine learning (ML) techniques can further enhance the adaptability and automation of detection mechanisms, improving their capacity to identify evolving and polymorphic threats. This study evaluates several supervised detection schemes employing ensemble-based ML models, specifically, bagging, boosting, and stacking, to assess their relative strengths and limitations. The analysis aims to develop novel architectures that exploit ensemble learning’s capacity to combine diverse models, thereby improving detection performance even under highly imbalanced data conditions. Experimental results indicate that ensemble methods based on decision tree weak learners, such as Random Forest and XGBoost, achieve superior performance compared to both conventional classifiers and stacked ensembles, effectively reducing variance through bagging, mitigating bias via boosting, and enhancing overall prediction accuracy.

Many Ethereum smart contracts rely on block attributes such as block.timestamp or blockhash to generate random numbers for applications like lotteries and games. However, these values are predictable and miner-manipulable, creating the Bad Randomness vulnerability (SWC-120) that has led to real-world exploits. Current detection tools identify only simple patterns and fail to verify whether protective modifiers actually guard vulnerable code. A major obstacle to improving these tools is the lack of large, accurately labeled datasets. This paper presents a benchmark dataset of 1,752 Ethereum smart contracts with validated Bad Randomness vulnerabilities. We developed a five-phase methodology comprising keyword filtering, pattern matching with 58 regular expressions, risk classification, function-level validation, and context analysis. The function-level validation revealed that 49

The growing adoption of Internet of Things (IoT) technologies has led to a proliferation of smart devices capable of sensing and processing data locally. However, the limited computational, memory, and energy resources of such devices make the deployment of conventional deep learning models impractical. Tiny Machine Learning (TinyML) enables the execution of lightweight models directly on microcontrollers, but the heterogeneity of IoT devices naturally implies the use of different model sizes to maximize performance on each device. However, this introduces significant challenges for distributed learning frameworks such as Federated Learning (FL), which are typically employed in this context. This paper proposes a FL architecture specifically designed for TinyML on heterogeneous devices. The approach maximizes resource utilization by allowing each client to train a model whose size matches its hardware constraints: larger devices employ expanded models, while smaller ones use pruned or compact versions. A central server aggregates the heterogeneous models through either parameter averaging over shared substructures or knowledge distillation, enabling the construction of a unified global model without requiring identical architectures. Preliminary experiments on the MNIST dataset demonstrate that the proposed framework can effectively train and aggregate models of different sizes while maintaining competitive accuracy, thereby providing a practical solution for FL in resource-constrained IoT environments.

Adversarial attacks are a growing threat to the security of network management and control applications making use of artificial intelligence and deep learning techniques. In recent years there has been an increase in the use of adversarial attacks to deceive network traffic classifiers and anomaly detection systems, which are used to iden tify and classify the traffic flows traversing a network and recognize among them the occurrence of malicious or anomalous behaviors. The goal of such attacks is to appropriately perturb the network traffic in a way that evades the system detection capabilities by preventing the proper identification and classification of the involved flows. In this paper, we propose a novel defense solution, named Inter-Layer Autoencoder-based architecture, for fighting evasion attacks targeting Network Intrusion Detection Systems based on Deep Learning. The proposed method can be integrated with any neural classifier and anomaly detector without any need for re-training pro cedures. Moreover, the suggested approach is universally applicable as it doesn't necessitate prior knowledge of the specific attack, making it effective against a broad spectrum of attack types. The results from experiments, conducted by training a target model on the UNSW-NB15 dataset and deriving from it functionality-preserving adversarial attacks demonstrate that the suggested mechanism exhibits strong resilience. Indeed, under the con sidered threat model and functionality constraints, all adversarial samples derived from the UNSW-NB15 dataset were recognized, outperforming the foremost defense methods currently present in the state-of-the-art.

Nowadays, Wireless Sensor Network (WSN) technology is widely used in many applications requiring distributed monitoring and control capabilities. When large WSN infrastructures are involved, the diffusion of malware among nodes becomes a critical issue, requiring a clear understanding of propagation dynamics to guarantee timely countermeasures. By considering that fractional-order models demonstrated to be particularly effective in forecasting the dynamics of complex real-life processes, this study improves the Susceptible-Exposed1-Exposed2-Infected-Recovered (SE _1 E _2 IR) model, derived from the traditional SEIR epidemic theory and used for the early detection of multi-malware activities in WSNs. In particular, a fractional SE _1 E _2 IR epidemic model has been formulated to explain the propagation of multiple malware infections according to a more versatile and realistic view. The model is structured upon a system of fractional differential equations. The basic reproduction number is also determined as a crucial factor for characterizing malware propagation within the network. The model’s free and endemic equilibrium points are calculated, and the stability of the equilibrium points is investigated to find requirements for preventing continuous malware propagation in WSNs. To complement the theoretical analyses, MATLAB is used to perform numerical simulations.

Log files keep track of everything that happens when services are used, and looking through them is important for finding any threats or problems that might come up because of mistakes. This paper looks at different cutting-edge ways to find log anomalies and presents a new one called LADDM (Log Anomaly Detection as a Docker Microservice). LADDM was made with a focus on the importance of logs at the enterprise level. To see how well it works, a synthetic dataset simulating enterprise logs was made. The solution is set up in a Dockerized environment, which makes sure it runs on its own and doesn’t depend on any other services. This approach not only highlights the importance of efficient log analysis in safeguarding enterprise operations but also demonstrates the practicality and scalability of containerized solutions in addressing security challenges.

This work designs and implements several convolutional variational autoencoder (CVAE) architectures augmented with squeeze-and-excitation and Convolutional Block attention modules placed at various depths and locations in the encoderdecoder pipeline, in order to evaluate the impact of these elements on semi-supervised network anomaly detection performance, together with their computational burden. The main goal is to understand whether these architectural modules meaningfully enhance CVAE-based anomaly detection capabilities in realistic settings and what is their most favorable combination for achieving the best results. We hope that this systematic testing effort can contribute to the advancement of practical utilization of attention functions in network security monitoring.

Artificial intelligence is increasingly used in cybersecurity for anomaly detection, behavioral modeling, and automated defense. However, the reproducibility of AI-based cybersecurity experiments depends not only on model code and datasets, but also on the infrastructure used to generate security data. In cloud-native environments, reverse proxies, storage backends, monitoring pipelines, timeout policies, and network configurations can shape traffic behavior and introduce hidden biases into detection models. This paper presents local-lab, an Infrastructure as Code-based architecture for building isolated and repeatable cloud-native security testbeds. The platform uses OpenTofu and libvirt to instantiate a stack composed of Nextcloud, a Caddy reverse proxy, MinIO object storage, and a monitoring pipeline based on Netdata, Prometheus, and Grafana. We use this environment to execute controlled Slow HTTP Denial-of-Service attacks, collect packet-level and system-level telemetry, construct the labeled SLOWDOS-2025 dataset, and evaluate neural detection models, including multilayer perceptrons, long short-term memory networks, and autoencoder-based configurations. The results show that the proposed infrastructure supports controlled observation of SlowDoS behavior across multiple layers and provides a structured setting for evaluating AI-based detection models. Beyond classification performance, the main contribution of this work is to treat the experimental infrastructure itself as a version-controlled scientific artifact, improving transparency, repeatability, and comparability in AI-driven cybersecurity research.

Internet of Medical Things (IoMT) and Machine Learning (ML) have become increasingly popular in healthcare. Wearable tiny medical devices can collect and transmit personal health-related data. However, applying ML-driven IoT in healthcare presents several challenges, especially in remote patient monitoring: (i) latency and privacy issues can hinder the transmission of sensitive medical data; (ii) it could require the correlation of multiple and heterogeneous data collected by different medical devices; and (iii) the limited resources of ultra-low-power wearable devices prevent the implementation of complex ML models directly on-board. On the other hand, Federated Learning (FL) and TinyML can address these limitations by enabling collaborative model training across distributed IoMT-edge resource-constrained microcontroller unit (MCU) based devices, allowing local data processing and improving latency and energy efficiency. However, traditional FL mainly handles unimodal data, limiting its direct applicability to several real-world IoT healthcare scenarios. This work proposes a Cross-Modal Federated TinyML (TinyCFL) implementation for MCU-based medical devices, which employs an intermediate multimodal distributed data fusion approach. Data from different modalities are independently processed on different tiny devices to extract features, which are then fused for healthcare tasks that require cross-modal reasoning. The proposed approach is evaluated by using the “UP-Fall detection” dataset, which is used in balanced, unbalanced, and Participant-Wise distribution scenarios. The proposed approach has been designed to be deployed in a distributed IoT-edge scenario. A prototype of the proposed TinyCFL approach based on resource-constrained MCUs has also been implemented.

Multimodal online federated learning (MOFL) relies on accurate temporal alignment across heterogeneous data streams to enable effective cross-modal fusion. In this paper, we investigate temporal desynchronization as a practical adversarial attack surface in such systems. We show that even small temporal shifts between modalities can disrupt cross-modal alignment, leading to degraded model performance and increased attack effectiveness. Unlike traditional poisoning attacks, the proposed approach operates at the synchronization level, making it subtle and difficult to detect. We conduct experiments under both untargeted and label-conditioned (targeted) attack settings to comprehensively evaluate the impact of temporal misalignment. To mitigate this vulnerability, we propose a lightweight Cross-Client Consistency Scoring Mechanism (CCCSM) that reweights client updates based on their similarity during server-side aggregation. Experimental results on the UP-Fall dataset demonstrate that (i) the impact of the attack increases with the magnitude of temporal misalignment and (ii) the attack is more severe under targeted settings. For perturbation strength k=5 , the overall F1-score drops from 95.6 k=5 , while maintaining performance close to the clean baseline. These findings highlight the importance of synchronization in MOFL and the need for synchronization-aware defenses in real-world deployments.

In recent years, deep learning technologies have experienced significant advancements, especially in the computer vision area. However, their success depends heavily on the availability of vast amounts of labeled data, introducing several data-gathering issues. To cope with these limitations, we use Federated Self-Supervised Learning (FedSSL), a framework that integrates Self-Supervised Learning (SSL) with Federated Learning (FL). FedSSL uses unlabeled data to enhance model performance and generalization without compromising data privacy. Despite its advantages, our research reveals vulnerabilities in FedSSL, such as susceptibility to model poisoning attacks. We introduce a Blockchain-based defense method for FedSSL (BCH-FedSSL) to face this risk, which incorporates blockchain technology to decentralize model aggregation, ensuring data integrity and transparency. Experimental results conducted under IID data distributions using the CIFAR-10, CIFAR-100, and Fashion-MNIST datasets demonstrate that BCH-FedSSL's effectiveness in maintaining model accuracy and robustness under adversarial conditions. The proposed method achieved, in the presence of a poisoning attack, a 30% performance improvement on CIFAR-10, a 27% on CIFAR-100, and a 31% on Fashion-MNIST. This study highlights the potential of combining blockchain with federated learning to create secure, scalable, and efficient decentralized learning systems.

Internet of Things (IoT) networks are susceptible to intrusions, and intrusion detection is a challenging task due to the lack of labeled attack data, the non-stationary property of benign traffic, and the emergence of new attack variants. In order to address these challenges, this paper introduces ConFID (Conformal One-Class Framework for Unsupervised Zero-Day Intrusion Detection in IoT Networks), a one-class detection framework trained only on benign traffic and incorporating three synergistic mechanisms: a hierarchical autoencoder with a temporally aware regularization objective, a multi-layer Mahalanobis scoring mechanism estimated via the Ledoit-Wolf shrinkage procedure, and a conformal calibration stage that provides a finite-sample, distribution-free guarantee that the False Positive Rate (FPR) will not exceed any user-defined level α. On the large-scale benchmark CIC-IoT-2023, with more than 46 million flows in 33 attack categories, collected from 105 real IoT devices, the framework obtains an AUROC of 0.9921 and an F1 score of 0.9406, matching or outperforming Isolation Forest, One-Class SVM, Deep SVDD, Simple Autoencoder, and a flat Mahalanobis baseline in all evaluation metrics. ConFID has a comparable detection rate to standard baselines, but the difference is that it formally guarantees the FPR, which is not provided by any existing unsupervised Intrusion Detection System baselines. The conformal guarantee is validated empirically, as the realized FPRs match the target level within 0.008 over a wide range of operating points. The leave-one-attack-out zero-day protocol achieves near-perfect detection on Mirai-based attacks, while spoofing-type threats with flow-level signatures resembling legitimate traffic remain a challenge for all evaluated methods.

As global dependence on renewable energy intensifies, accurate water-level forecasts are essential for reliable power generation, reservoir management, and flood mitigation in hydroelectric power plants. However, existing models struggle to capture the nonlinear dynamics of hydrological time series without extensive manual tuning. We propose a novel end-to-end fully autonomous forecasting workflow that combines the Time-series Dense Encoder architecture with the Non-dominated Sorting Genetic Algorithm III. Our method reduces tuning time from weeks to similar to 17 h while concurrently analyzing hyperparameter importance through functional ANOVA, providing actionable insight for practitioners. Evaluation on three real-world datasets that span large, medium, and small storage capacities shows that the proposed model outperforms several state-of-the-art machine learning methods across all evaluated scenarios, and improves forecasting accuracy by up to 44.16% over the baseline implementation. Furthermore, due to its adaptable design, our workflow can seamlessly adjust to various forecasting tasks and datasets with no manual intervention, highlighting the effectiveness and practicality of our proposed methodology for enhancing water level forecasting accuracy.

The widespread of Internet of Things (IoT) devices has introduced significant cyber security challenges, requiring robust and efficient Intrusion Detection Systems (IDSs) tailored for IoT-edge environments. In this context, on-board training has emerged as a valuable approach for enabling online learning of IoT-edge smart devices, useful for model refining with on-field data, as well as reducing concept drift and data privacy violations. On the other hand, collecting a large set of representative on-field attack samples could be very complex or infeasible, particularly in critical application domains. Moreover, the collected samples are often uneven data distribution, known as imbalanced datasets. Therefore, appropriate neural network models trainable with reduced and imbalanced datasets should be used. In this paper, a performance assessment of a Siamese Neural Network (SNN)-based IDS deployed on a tiny Microcontroller Unit (MCU) is presented. The detection system is trained using both a custom IoT dataset and the widely used TON_IoT dataset in order to assess its ability to detect anomalous traffic patterns indicative of IoT-edge attacks. Accuracy and latency are analyzed to ensure practical applicability. The results highlight that the SNN-based IDS achieves a high detection rate with limited and imbalanced training data, demonstrating its effectiveness in securing IoT-edge environments under resource constraints.

The Vehicular Ad-hoc Network (VANET) is emerging as a new networking/communication model that offers remarkable approaches for controlling and managing vehicular traffic. In this scenario, Virtual traffic light (VTL) techniques, advanced navigation support, and fleet management facilities attempt to handle traffic management and control concerns by leveraging vehicular network communication paradigms. The most important communication models in vehicular networks are characterized as vehicle-to-everything (V2X) communications technology. In V2X communications, security issues, and related countermeasures are crucial, as they are in other wireless technologies. Our survey provides a systematic overview of various research directions by highlighting and investigating the most critical V2X security issues and related countermeasures. First, we discuss the points mentioned in the previous papers, including the architecture, main characteristics, and communication models of the V2X networks. Furthermore, some of the most significant applications of these mission-critical networks reported in the published papers and the main security challenges and requirements will be highlighted. We also arrange corresponding (existing) resources, to investigate different solutions for securing V2X communications. Finally, a few suggestions for future research related to V2X security challenges are presented. In general, this article reviews and summarizes the studies of the last ten years. This survey will help make it easier for scholars studying V2X communication security and related fields to keep track of the academic frontier, by offering a sufficiently clear landscape and a roadmap.