Authentication is becoming essential due to the expansion of the Internet of Things (IoT) applications in smart cities, supply chain, and healthcare. In the healthcare sector, hospitals use centralized server-based systems to manage user information and patient medical records. However, this approach may lead to scalability, interoperability, security and privacy challenges. To address these issues, this paper presents a blockchain-based multi-factor authentication (MFA) framework for IoT healthcare systems. The framework uses the Ethereum blockchain and smart contracts to improve authentication security and minimize unauthorized access risk. It also uses the InterPlanetary File System (IPFS) to securely and efficiently store sensitive medical data. Performance and security are evaluated to show the effectiveness, reliability, and feasibility of the proposed system.

This paper addresses the growing security challenges of smart card–based healthcare systems, which are increasingly targeted by attacks such as data tampering, authentication bypass, and malware injection. To overcome the limitations of isolated security mechanisms, we propose a unified security and privacy-preserving architecture that integrates smart cards, blockchain technology and artificial intelligence. In the proposed framework, smart cards provide secure authentication and controlled data access, while blockchain ensures decentralized integrity verification, immutability, and traceability of system interactions through smart contracts. An AI-based monitoring layer is introduced to detect anomalous behaviors in real time, enhancing the system’s resilience against cyber threats. To evaluate the effectiveness of the proposed approach, separate experimental assessments are conducted for the blockchain and AI layers. The blockchain layer is evaluated through smart-contract deployment and execution metrics, demonstrating low deployment and execution overhead. The AI component is assessed using Random Forest and XGBoost models for anomaly detection, achieving classification accuracy exceeding 99

Computer security hinges on accurate malware detection in Portable Executable (PE) files, as these files may harbor various malicious elements such as worms, trojans, ransomware, and viruses. This research explores four commonly used classification algorithms such as Support Vector Machine (SVM), and Logistic Regression (LR), followed by Decision Tree (DT) and Random Forest (RF), to assess their optimality towards malware detection from PE files. The optimality of a machine learning algorithm can depend on the information needs of the study, the level of data quality, and the capacity of physical resources in the research environment. Performance evaluations of the algorithms provide proficiency measures of their work through accuracy evaluations, built-in efficiency measurements, and interpretability capabilities. The paper discusses the algorithms, SVM and LR, together with DT and RF, and details information about their distinct characteristics in detecting, and classifying malware in PE files. This paper discusses the pros and cons of each algorithm, to help researchers and practitioners select the most appropriate approach for their unique information needs and operational parameters. These findings contribute to methodologies for detecting malware by indicating the merits and limitations of the machine-learning algorithms studied. Security analysts looking to explore the distinguishing features of SVM with LR and DT and RF can expect better results identifying malware embedded in PE files and subsequently enhancing the protection of their organizations’ computer systems.

The proliferation of Internet of Things (IoT) networks demands secure, scalable, and efficient data management. Multi-Zone DAG Blockchain (MZ-DAG) has emerged as a lightweight solution, distributing data across zones to improve performance in IoT environments. However, existing MZ-DAG Blockchain designs lack robust privacy and adaptive trust management, exposing the system to evolving threats. This paper enhances MZ-DAG by integrating Zero Trust principles into its core design. First, we embed Homomorphic Encryption (HE) into the MZ-DAG data pipeline, enabling encrypted data processing throughout the blockchain lifecycle. This ensures that even fog nodes and validators handle only ciphertext, achieving Zero Trust Privacy Preservation, where no intermediate component can access plaintext data. Second, we enhance the Proof-of-Authentication (PoAh) consensus by introducing a Trust-based Node Selection mechanism modeled as a Markov Decision Process (MDP). Node trust evolves dynamically based on observed behavior, and trustworthiness is continuously re-evaluated using entropy-based uncertainty analysis. This adaptive selection prevents static trust assumptions and enforces continuous verification, aligning with Zero Trust’s “never trust, always verify” principle. Together, these improvements strengthen privacy, security, and resilience without compromising the low latency and lightweight design essential for IoT. This work establishes a comprehensive Zero Trust Multi-Zone DAG Blockchain model tailored for secure and efficient IoT data management, providing a foundation for future zero trust architectures in distributed IoT environments.

Trust evaluation has become a major challenge in the quickly developing Internet of Things (IoT) environment because of the vulnerabilities and security hazards associated with networked devices. To overcome these obstacles, this study offers a novel approach for evaluating trust that uses IOTA Tangle technology. By decentralizing the trust evaluation process, our approach reduces the risks related to centralized solutions, including privacy violations and single points of failure. To offer a thorough and reliable trust evaluation, this study combines direct and indirect trust measures. Moreover, we incorporate IOTA-based trust metrics to evaluate a node’s trust based on its activity in creating and validating IOTA transactions. The proposed framework ensures data integrity and secrecy by implementing immutable, secure storage for trust scores on IOTA. This ensures that no node transmits a wrong trust score for itself. The results show that the proposed scheme is efficient compared to recent literature, achieving up to +3.5% higher malicious node detection accuracy, up to 93% improvement in throughput, 40% reduction in energy consumption, and up to 24% lower end-to-end delay across various network sizes and adversarial conditions. Our contributions improve the scalability, security, and dependability of trust assessment processes in Internet of Things networks, providing a strong solution to the prevailing issues in current centralized trust models.

The proliferation of Internet of Things (IoT) swarms—comprising billions of low-end interconnected embedded devices—has transformed industrial automation, smart homes, and agriculture. However, these swarms are highly susceptible to firmware anomalies that can propagate across nodes, posing serious security threats. To address this, we propose a novel Remote Attestation (RA) framework for real-time firmware verification, leveraging Relational Graph Neural Networks (RGNNs) to model the graph-like structure of IoT swarms and capture complex inter-node dependencies. Unlike conventional Graph Neural Networks (GNNs), RGNNs incorporate edge types (e.g., Prompt, Sensor Data, Processed Signal), enabling finer-grained detection of propagation dynamics. The proposed method uses runtime Static Random Access Memory (SRAM) data to detect malicious firmware and its effects without requiring access to firmware binaries. Experimental results demonstrate that the framework achieves 99.94% accuracy and a 99.85% anomaly detection rate in a 4-node swarm (Swarm-1), and 100.00% accuracy with complete anomaly detection in a 6-node swarm (Swarm-2). Moreover, the method proves resilient against noise, dropped responses, and trace replay attacks, offering a robust and scalable solution for securing IoT swarms.

As IoT networks continue to grow at a rapid pace, there's an increasing need for security models that can stay lightweight without sacrificing resilience. Most existing blockchain based intrusion detection systems make two problematic assumptions: they treat trust as static, and they rely on centralized data collection. Both of these clashes with the practical constraints of IoT environments and create exploitable vulnerabilities. In this paper, we propose a Federated Multi-Zone DAG Blockchain that brings together federated learning and Zero Trust principles. The key idea is to train intrusion detection models locally either at the IoT device level or at fog nodes so that only model updates get shared across the network, not the raw data itself. These updates are then recorded and verified in the blockchain using a lightweight Proof-of-Authentication consensus. This means no node ever gets permanent trusted status, instead, all actions undergo continuous validation. This federated, Zero Trust approach has several benefits. It keeps data private, cuts down on communication costs, and can adapt on the fly when nodes get compromised. By building both the learning and verification processes directly into the multi-zone DAG structure, our framework manages to improve privacy, scalability, and energy efficiency all at once. The result is a decentralized defense system that can keep up with the evolving threat landscape in IoT environments.

There is a growing need for intelligent adaptive approaches because traditional Intrusion Detection Systems (IDS) are insufficient in the face of new cybersecurity threats. As the artificial intelligence technology becomes ever so powerful, deep learning-based techniques provide excellent ways to increase the power of intrinsic IDSs. Custom deep learning models are then built and trained to enhance the metrics of intrusion detection, specifically DNNs and CNNs. Whereas traditional methods directly use libraries to deep learning algorithms, we approach model construction from the base up for dataset specific fine-tuning. It also allows for better detection accuracy and process efficiency. The experimental results validate that our models perform comparably with popular IDS solutions and provide the advantages of a customized deep learning solution. We further emphasize the benefit of bespoke models in cybersecurity by using deep learning architectures that have been specifically tailored for intrusion detection. The positive impact of our specialized approach on threat detection highlights the necessity for model customization to improve IDS performance.

As Android malware grows increasingly sophisticated, traditional detection methods struggle to keep pace, creating an urgent need for robust, interpretable, and real-time solutions to safeguard mobile ecosystems. This study introduces YoloMal-XAI, a novel deep learning framework that transforms Android application files into RGB image representations by mapping DEX (Dalvik Executable), Manifest.xml, and Resources.arsc files to distinct color channels. Evaluated on the CICMalDroid2020 dataset using YOLO11 pretrained classification models, YoloMal-XAI achieves 99.87% accuracy in binary classification and 99.56% in multi-class classification (Adware, Banking, Riskware, SMS, and Benign). Compared to ResNet-50, GoogLeNet, and MobileNetV2, YOLO11 offers competitive accuracy with at least 7× faster training over 100 epochs. Against YOLOv8, YOLO11 achieves comparable or superior accuracy while reducing training time by up to 3.5×. Cross-corpus validation using Drebin and CICAndMal2017 further confirms the model’s generalization capability on previously unseen malware. An ablation study highlights the value of integrating DEX, Manifest, and Resources components, with the full RGB configuration consistently delivering the best performance. Explainable AI (XAI) techniques—Grad-CAM, Grad-CAM++, Eigen-CAM, and HiRes-CAM—are employed to interpret model decisions, revealing the DEX segment as the most influential component. These results establish YoloMal-XAI as a scalable, efficient, and interpretable framework for Android malware detection, with strong potential for future deployment on resource-constrained mobile devices.

In the modern era, the use of blockchain technology has been growing rapidly, where Ethereum smart contracts play an important role in securing decentralized application systems. However, these smart contracts are also susceptible to a large number of vulnerabilities, which pose significant threats to intelligent systems and IoT applications, leading to data breaches and financial losses. Traditional detection techniques, such as manual analysis and static automated tools, suffer from high false positives and undetected security vulnerabilities. To address these problems, this paper proposes an Artificial Intelligence (AI)-based security framework that integrates Generative Adversarial Network (GAN)-based feature selection and deep learning techniques to classify and detect malware attacks on smart contract execution in the blockchain decentralized network. After an exhaustive pre-processing phase yielding a dataset of 40,000 malware and benign samples, the proposed model is evaluated and compared with related studies on the basis of a number of performance metrics including training accuracy, training loss, and classification metrics (accuracy, precision, recall, and F1-score). Our combined approach achieved a remarkable accuracy of 97.6%, demonstrating its effectiveness in detecting malware and protecting blockchain systems.

The increase of Android malware, coupled with the growing sophistication of obfuscation techniques, underscores the critical need for advanced detection mechanisms. An innovative method is introdcued that converts essential APK components—namely, classes.dex (Dalvik executable), AndroidManifest.xml (manifest and configuration files), and resources.arsc (compiled resources)—into grayscale images. Incremental feature fusion is then applied to integrate both individual and combined components, allowing a comprehensive assessment of their impact on detection performance. The CICMalDroid 2020 dataset was employed to evaluate multiple convolutional neural network (CNN) architectures, with ResNet50 achieving the best results. The model attained an accuracy of 98.83%, a precision of 99.27%, and a recall of 99.15%, demonstrating the effectiveness of feature integration and deep learning techniques in overcoming obfuscation challenges and offering a robust solution for real-world Android malware detection systems.

The Internet of Things (IoT) demands robust mechanisms for secure communication and trust establishment among connected devices. Traditional Public Key Infrastructure (PKI) solutions face limitations in scalability, centralization and single points of failure. These limitations hinder their effectiveness in dynamic IoT environments. To address these challenges, this paper introduces a new decentralized authentication protocol for secure identity management and data exchange in IoT, called ISIF (IOTA-Assisted Self-Sovereign Identity Framework). This framework is based on Self-Sovereign Identity (SSI) principles and leverages Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) to enable mutual authentication without relying on centralized authorities. DIDs ensure decentralized identity management and VCs provide verifiable context-specific claims. This dual-layer approach enables robust and attribute-based authentication, which reduces the risk of unauthorized access and improving interoperability in decentralized IoT environments. ISIF employs the IOTA Tangle as a distributed ledger to manage and verify DIDs and VCs. This offers a decentralized, immutable record that supports efficient and tamper-resistant identity management. ISIF ensures that all interactions within the IoT network are securely authenticated and resilient to tampering. The experimental results show that the framework maintains efficient DID generation and VC issuance times even as network size scales, overcoming the bottlenecks inherent in PKI-based systems. Experimental results demonstrate that ISIF maintains efficient DID generation and VC issuance, even as network size scales. Experimental results show that DID generation time increases from 1.85 ms (for 50 nodes) to 10.81 ms (for 250 nodes), while VC issuance time ranges from 2.66 ms to 13.21 ms. Similarly, VC verification time increases from 3.54 ms to 22.27 ms as the network scales. Despite these increases, the overall end-to-end (E2E) delay remains low (0.16–0.33 ms), ensuring efficient real-time authentication. These findings confirm ISIF’s feasibility for large-scale IoT authentication without performance degradation. Furthermore, the IOTA Tangle’s performance in handling varied payload sizes affirms its suitability for managing block generation and retrieval in IoT, ensuring practical processing times that uphold security and decentralization.

The growing scale and complexity of IoT (Internet of Things) networks demand robust security models that provide both secure identity authentication and reliable trust evaluation. While Self-Sovereign Identity (SSI) enables decentralized and user-centric authentication, ensuring the continuous trustworthiness of participating nodes remains a challenge. This paper presents a unified framework that combines SSI-based decentralized authentication with IOTA-ledger-assisted trust evaluation to provide an integrated security architecture for IoT systems. The proposed architecture guarantees that only authenticated nodes can participate in the network while continuously assessing their behavior and trustworthiness through immutable and tamper-resistant trust scores. Our approach is, to the best of our knowledge, the first to unify SSI-based authentication with IOTA-assisted trust evaluation, offering a holistic IoT security framework.

Despite its advances, face recognition (FR) technology confronts significant challenges, especially in adverse conditions such as varying lighting, facial expressions, poses, and aging effects, which necessitate the development of more robust and accurate recognition algorithms. The importance of face recognition for social robotics lies in its ability to facilitate personalized and secure interactions, enhancing the robot’s social engagement and functionality. This research introduces a novel FR methodology integrating statistical learning and shallow neural networks to refine facial feature representation and recognition. Our approach, which combines a Sparse Auto-Encoder with Exponential Discriminant Analysis, is evaluated across renowned face databases (GT, AR, LFW), demonstrating superior recognition rates and outperforming existing state-of-the-art techniques. Specifically, our system achieved recognition accuracy of 91.94

Given the increasing volume and sophistication of cyber-attacks, there has always been a need for improved and adaptive real-time intrusion detection systems. Machine learning algorithms have presented a promising approach for enhancing their capabilities. This research has focused on investigating the impact of different dimensionality reduction approaches on performance, and we have chosen to work with both Batch PCA and Incremental PCA alongside Logistic Regression, SVM, and Decision Tree classifiers. We started this work by applying machine learning algorithms directly on pre-processed data, then applied the same algorithms on the reduced data. Our results have yielded an accuracy of 98.61% and an F1-score of 98.64% with a prediction time of only 0.09 s using Incremental PCA with Decision Tree. We also have obtained an accuracy of 98.44% and an F1-score of 98.47% with a prediction time of 0.04 s from Batch PCA with SVM, and an accuracy of 98.47% and an F1-score of 98.51% with a prediction time of 0.05 s from Incremental PCA with Logistic Regression. The findings demonstrate that Incremental PCA offers near real-time IDS deployment in large networks.

The Internet of Things (IoT) devices are increasingly used across sectors like smart homes and industrial automation. To assess the security of such devices, consider their firmware. This paper provides an overview of methods for extracting firmware from IoT gadgets, with a specific focus on this field. The study discusses hardware-based techniques as well as software-based ones for extracting firmware. Direct entry into the memory or storage units of a device is among the examples of how hardware-based methods work, e.g., soldering onto flash chips or using JTAG interfaces. Conversely, an approach may use communication channels already present on the target system, like debug interfaces or firmware update mechanisms. We delve into the intricacies of each method, discussing their advantages, limitations, and potential risks. Additionally, we highlight the importance of legal and ethical considerations when extracting firmware from IoT devices.

With internet connectivity's dynamic development and network communication escalating, an upward trend in advanced threats and cyber attack crimes is being witnessed, targeting sensitive data and critical systems. As the number of connected devices continues to increase, more opportunities are provided for malicious actors to exploit these vulnerabilities. Therefore, the attack surface expanded, particularly within the Internet of Things (IoT), reinforcing the necessity to design a suitable and adaptable security model for protecting data and minimizing the damage caused by network system intrusions and attacks. Machine learning is a swift and flexible way to develop a cybersecurity model. Clustering and other unsupervised learning techniques are frequently used to find hidden patterns or anomalies without needing labeled data. Still, they are limited in accurately distinguishing between normal and malicious behaviors, particularly when dealing with emerging attacks (such as zero-day attacks). This paper provides a hybrid semi-supervised classification-based clustering approach model to distinguish malicious emerging cyber-attacks. Initially, unsupervised clustering methods were implemented to group related data points and find underlying patterns to the reduced data dimensionality under Principal Component Analysis (PCA). Then, the pseudo-labels generated by clustering were used in supervised tasks with a Support Vector Machine (SVM) for classification. The experiments have been carried out on two IoT datasets, namely MQTTset and IoTID20, and the results confirm that the hybrid strategy is a viable and effective approach to dealing with IoT security issues in complicated and real-world situations.

The Internet of Things (IoT) has become increasingly susceptible to cyber attacks, making it crucial to have strong detection mechanisms. This paper looks at using adversarial machine learning to boost IoT security. We implemented and evaluated Feedforward Neural Networks (FNN) and Long Short-Term Memory (LSTM) models on the Bot-IoT dataset for binary and multi-class classification tasks. We then evaluated how these models perform under Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) adversarial attacks. Our results show high accuracy in detecting attacks under normal conditions. However, the models showed major weaknesses when faced with adversarial examples. This study highlights the urgent need for building adversarially robust machine learning models for IoT security. It also gives insights into how different model architectures perform against various attack intensities.

In recent years, the healthcare sector has faced growing challenges in managing patient data securely and efficiently, especially when it comes to data privacy and the way information is shared across healthcare providers. A number of digital solutions have been proposed over time, but more recently, blockchain has started to gain serious interest. Its structure allows data to remain intact and traceable, while also offering a strong layer of security. This paper explores how blockchain based smart contract might be used alongside smart cards to offer a more robust system for protecting patient information. Smart cards bring in a physical barrier that helps limit access to only those who are authorized, while blockchain makes it much harder to tamper with information or centralize control. The suggested method demonstrates how the decentralized and immutable nature of blockchain, combined with the physical authentication provided by smart cards and the automation of smart contracts improve data security and restrict unauthorized access. The proposed framework is evaluated through smart contract deployment and testing on both the Hardhat local network and the Celo public testnet. The results confirm the practicality and efficiency of the solution and support its potential for real world application in secure healthcare data management.

This extended abstract aims at snapshotting the progress on reviewing the NTFS time information from a tampering perspective and detection efforts. We describe how we elected a small set of research papers for a review study and how we identified research patterns and gaps that remains to be fulfilled.