As mission requirements continue to expand, the ability to communicate between unmanned aerial vehicles (UAVs) has become increasingly vital. However, security has also become a critical issue. UAVs typically operate in open wireless communication networks, which are highly susceptible to various attacks and pose significant threats to the overall security of UAV systems. Therefore, it is imperative to develop robust security protocols. Existing authentication schemes, while effective in ensuring security, mainly focus on lightweight design. However, the session keys between UAVs are generated with the assistance of the ground station. Should the communication link between the drone and the ground station come under attack, the session keys between drones cannot be updated. To address this issue, we propose the anti-fallback security framework (AFSF). This framework, based on a lightweight design philosophy, ensures UAV anonymity and effectively counters threats such as desynchronization attacks and replay attacks. AFSF is specifically designed to secure communications between UAVs. Through formal proof, verification using the Scyther tool, and cryptographic analysis, we have conducted a comprehensive security evaluation of AFSF. The results demonstrate that AFSF is highly effective in withstanding a variety of security attacks. Moreover, we compared AFSF with two state-of-the-art existing schemes in terms of computational overhead, communication overhead, and energy consumption. The computational overhead of the proposed solution is 11.4 mu s, the communication overhead is 18 mu s, and the energy consumption is 7.04 mu j. The findings indicate that AFSF outperforms the others in both resource consumption and security.

To address the increasing threats targeting Internet of Things (IoT) networks, the development of IoT Intrusion Detection Systems (IDS) has accelerated in recent years. However, existing IDSs often rely on manually labeled data and lack explainability, limiting their adaptability and practical deployment. This paper proposes an Explainable and Adaptive Internet of Things Intrusion Detection System (EADL-IDS) that combines a Denoising Convolutional Autoencoder (DCAE) for unsupervised binary anomaly detection with Large Language Models (LLMs) for multi-class attack interpretation via Retrieval-Augmented Generation (RAG). Compared to prior machine learning and deep learning based IDSs, EADL-IDS eliminates the need for labeled data while achieving higher detection accuracy. Unlike conventional LLM-based IDSs, it integrates a more effective Deep Neural Network (DNN) backbone and structured knowledge retrieval to improve explainability and reduce inference delay. Experiments on the Network Security Laboratory - Knowledge Discovery and Data Mining (NSL-KDD), Canadian Institute for Cybersecurity Internet of Things 2023 (CIC-IoT-2023), and Army Cyber Institute Internet of Things Network Traffic Dataset 2023 (ACI-IoT-2023) datasets show that EADL-IDS achieves over 95% binary accuracy and over 85% multi-class accuracy without supervision, offering a scalable and robust solution for IoT security.

Distributed cooperative tracking control has emerged as a pivotal research focus in multi-agent systems, particularly for platoon control applications where its decentralized architecture offers significant advantages over centralized approaches. However, the direct exchange of sensitive data between agents raises critical privacy risks, hindering its broader adoption across safety-critical applications. This paper presents a privacy-preserving cooperative tracking framework that rigorously maintains bounded coupling errors, which is a crucial requirement for collision avoidance in vehicular platoons. Departing from conventional methods that compromise privacy through explicit state sharing for error mitigation, our proposed algorithm achieves dual objectives: maintaining prescribed error constraints while preserving agent state confidentiality in directed communication networks with time-varying interaction weights. We establish sufficient conditions for achieving cooperative-tracking consensus with predefined error constraints and characterize the quantitative relationship between the asymptotic convergence rate and control gain parameters. Furthermore, we analyse the privacy-preserving performance against internal and external adversaries, demonstrating that the probability of an adversary inferring states within a finite neighborhood of ground-truth values can be rendered arbitrarily small, even while adversaries retain access to identical communication data streams. This extends classical initial-state privacy to the entire operational timeline under time-varying directed topologies. Numerical examples including an application of cooperative adaptive cruise control demonstrate our proposed algorithm’s efficacy.

The potential ability to increase the capacity and safety on roads, as well as fuel economy gains, has made vehicle platooning an appealing prospect. However, its use is yet to be widespread, partially due to the security concerns about its communication network inside and outside of the platoon. These platoons and the communications that govern their operation may be susceptible to various cyber-attacks such as Denial-of-Service (DoS), Replay, Man-in-the-Middle (MitM), and particularly, Sybil attacks. In this article, we briefly explain how these cyber-attacks come about, and what efforts have been made by recent research to counter these attacks against platoons. Succinctly, we propose a platoon management scheme by a multi-blockchain approach that is efficient yet resistant to the threats of these cyber-attacks. The scheme’s security functionality shall be investigated. Subsequently, it benchmarks well against the other platoon management approaches covered, boasting a lower computational cost, average message read time, and average execution time by about 13

Despite the widespread implementation of various intrusion detection systems (IDSs) in industrial cyber-physical systems (CPS), significant challenges persist, including class imbalance, detection paradox, privacy gap, and arbitrary aggregation. To address these challenges, this article proposes a novel Transformer-based detection with federated privacy-collaborative IDS (TDFP-CIDS) for industrial CPS. First, a Transformer-enhanced external classifier generative adversarial network is designed with Wasserstein distance constraints and label conditioning to stabilize gradient descent, achieving robust semi-supervised classification for class-imbalanced industrial traffic. Second, a hierarchical out-of-distribution detection protocol is proposed to decouple known attack classification and zero-day attack identification into two cascaded stages, resolving the feature entanglement defect of existing single-stage detection frameworks. Third, an adaptive local differential privacy mechanism is integrated into gradient updates to achieve provable privacy guarantees while maintaining detection accuracy. Finally, a decentralized federated distillation scheme is developed to enable architecture-agnostic collaborative training across heterogeneous industrial nodes, realizing the deep integration of knowledge distillation and federated learning without exchanging raw traffic data or model parameters. Experimental results on a real-world industrial CPS dataset show that TDFP-CIDS outperforms state-of-the-art IDS solutions with exceptional detection performance for sparse rare attacks and zero-day attacks.

To address the security and scalability issues of cross-domain authentication in the IIoT, this paper proposes a lightweight protocol based on blockchain and the Chebyshev chaotic map. The protocol achieves efficient, PKI-less key negotiation through a hybrid trust framework and the Chebyshev map, and adopts a global Merkle tree commitment mechanism to reduce on-chain storage to a constant level, thereby breaking through the scalability bottleneck. Simultaneously, it integrates three-factor authentication using password, biometrics, and device factors, and designs a "validate-then-access" workflow to resist DDoS attacks. Formal verification and performance analysis show that the scheme surpasses existing protocols in terms of both security and efficiency, making it suitable for large-scale cross-domain IIoT environments.

Vehicular Ad Hoc Networks (VANETs) play a critical role in enabling communication among intelligent vehicles, yet their dynamic and decentralized nature makes them highly vulnerable to cyber-attacks. Traditional Intrusion Detection Systems (IDSs) provide limited defense against these evolving threats, as they rely on static rules or machine learning (ML) models that lack the capacity for real-time updates. The Incremental Lifetime Learning IDS (ILL-IDS) was introduced to address this limitation by enabling adaptive learning of new attack types. However, ILL-IDS depends heavily on large volumes of high-quality labeled data, making the model update process costly and labor-intensive. In response, this study proposes the Automatic Incremental Lifetime Learning IDS (AILL-IDS), a novel IDS framework that significantly reduces the need for labeled data through incremental semi-supervised learning. This approach not only enables AILL-IDS to detect unknown attacks and adapt its model dynamically with minimal labeled data but also ensures continuous detection during the model update process, enhancing both speed and accuracy in threat detection. Experimental results demonstrate that AILL-IDS achieves a high detection rate of 0.97 and an average F1 score of 0.90, using only 5.5% labeled data, thereby offering an efficient and scalable solution for securing VANETs against emerging cyber threats.

As a data-centric next-generation network architecture, Named Data Networking (NDN) exhibits inherent compatibility with the distributed nature of the Internet of Things (IoT) through its name-based routing mechanism. However, existing signature schemes for NDN-IoT face dual challenges: resource-constrained IoT terminals struggle with certificate management and computationally intensive bilinear pairings under traditional Public Key Infrastructure (PKI), while NDN routers require low-latency batch verification for high-speed data forwarding. To address these issues, this study proposes ECAE, an efficient certificateless aggregate signature scheme based on elliptic curve cryptography (ECC). ECAE introduces a partial private key distribution mechanism in key generation, enabling the authentication of identity by a Key Generation Center (KGC) for terminal devices. It leverages ECC and universal hash functions to construct an aggregate verification model that eliminates bilinear pairing operations and reduces communication overhead. Security analysis formally proves that ECAE resists forgery, replay, and man-in-the-middle attacks under the random oracle model. Experimental results demonstrate substantial efficiency gains: total computation overhead is reduced by up to 46.18%, and communication overhead is reduced by 55.56% compared to state-of-the-art schemes. This lightweight yet robust framework offers a trusted and scalable verification solution for NDN-IoT environments.

This paper proposes a lightweight Three-Layer Convolutional Neural Network(3L-CNN) based physical layer authentication (PLA) method for mobile edge computing-enabled IoT (MEC-IoT) networks. A novel channel state information (CSI) processing architecture is established where real and imaginary components are transformed into two-channel images with 64x64 resolution for network inputs. Two data augmentation techniques, Average Data Augmentation (ADA) and Exponentially Weighted Average(EWA) are developed, to enhance temporal correlation preservation and mobility pattern extraction in mobile scenarios, effectively mitigating training data scarcity for mobile devices. The core 3L-CNN architecture remains streamlined, employing progressive feature extraction through three convolutional layers with 64x8, 32x16, and 6x32 configurations, optimized by a hybrid loss function combining 50% Negative Log-Likelihood and 50% Cross-Entropy to refine classification boundaries. The architecture demonstrates 99% authentication accuracy for 10 devices configuration and maintains 96.6% accuracy for 30 devices respectively. It also exhibits superior robustness with 95% accuracy at 0 dB SNR. This lightweight solution achieves comparable performance to complex models while reducing training time by 66%, making it suitable for resource-constrained mobile edge computing-enabled IoT applications.

As a core enabler of the emerging low-altitude economy, UAV networks face significant security risks during operation, including malicious node infiltration and data tampering. Existing trust management schemes suffer from deficiencies such as strong reliance on infrastructure, insufficient capability for multi-dimensional trust evaluation, and vulnerability to collusion attacks. To address these issues, this paper proposes a group decision-making (GDM)-enabled dynamic trust management method, termed GDM-DTM, for low-altitude UAV networks. GDM-DTM comprises four core parts: Subjective Consistency Evaluation, Objective Consistency Evaluation, Global Consistency Evaluation, and Self-Proof Consistency Evaluation. Furthermore, the method integrates a Dynamic Trust Adjustment Mechanism with multi-attribute trust computation, enabling efficient trust evaluation independent of ground infrastructure and thereby facilitating effective malicious UAV detection. The experimental results demonstrate that under identical conditions with a malicious node ratio of 30%, GDM-DTM achieves an accuracy of 85.04% and an F-score of 91.66%. Compared to the current state-of-the-art methods, this represents an improvement of 6.04 percentage points in accuracy and 3.71 percentage points in F-score.

In this paper, we propose a dynamic trajectory-based adaptive scheduling medium access control (DTAS-MAC) protocol, which aims to illustrate where the AUV should hover to receive data and how the AUV should interact with sensor nodes in AUV-assisted underwater data collection. While cruising in the sea, the AUV wakes up sensor nodes with data transmission demands and obtains their real-time status information through message exchanges. Then, the AUV dynamically determines a hovering point to receive data from the sensor nodes with the goal of maximizing data collection efficiency. Movement energy consumption, hovering energy consumption, and the number of error-free packets received by the AUV are considered in the data collection efficiency model. To reduce packet collisions and improve channel utilization, a scheduling-based mechanism is proposed to organize data transmission from sensor nodes. When scheduling sensor nodes to send data to the AUV, the transmission priority is assigned based on their upload urgency. The experimental results verify the effectiveness of the DTAS-MAC protocol in improving data collection efficiency and throughput, while reducing data loss.

The rapid progression of the Internet of Things (IoT) technology enables its application across various sectors. However, IoT devices typically acquire inadequate computing power and user interfaces, making them susceptible to security threats. One significant risk to cloud networks is Distributed Denial-of-Service (DoS) attacks, where attackers aim to overcome a target system with excessive data and requests. Among these, low-rate DoS (LR-DoS) attacks present a particular challenge to detection. By sending bursts of attacks at irregular intervals, LR-DoS significantly degrades the targeted system’s Quality of Service (QoS). The low-rate nature of these attacks confuses their detection, as they frequently trigger congestion control mechanisms, leading to significant instability in IoT systems. Therefore, to detect the LR-DoS attack, an innovative deep-learning model has been developed for this research work. The standard dataset is utilized to collect the required data. Further, the deep feature extraction process is executed using the Residual Autoencoder with Sparse Attention (ResAE-SA), which helps derive the significant feature required for detection. Ultimately, the Adaptive Dense Recurrent Neural Network (ADRNN) is implemented to detect LR-DoS effectively. To enhance the detection process, the parameters present in the ADRNN are optimized using the Renovated Random Attribute-based Fennec Fox Optimization (RRA-FFA). The proposed optimization reduces the False Discovery Rate and False Positive Rate, maximizing the Matthews Correlation Coefficient from 23, 70.8, 76.2, 84.28 in Dataset 1 and 70.28, 73.8, 74.1, 82.6 in Dataset 2 on EPC-ADRNN, DPO-ADRNN, GTO-ADRNN, FFA-ADRNN respectively to 95.8 on Dataset 1 and 91.7 on Dataset 2 in proposed model. At batch size 4, the accuracy of the designed RRA-FFA-ADRNN model progressed by 9.2% to GTO-ADRNN, 11.6% to EFC-ADRNN, 10.9% to DPO-ADRNN, and 4% to FFA-ADRNN for Dataset 1. The accuracy of the proposed RRA-FFA-ADRNN is boosted by 12.9%, 9.09%, 11.6%, and 10.9% over FFCNN, SVM, RNN, and DRNN, using Dataset 2, showing a better improvement in accuracy with that of the proposed RRA-FFA-ADRNN model with 95.7% using Dataset 1 and 94.1% with Dataset 2, which is better than the existing baseline models.

The rapid expansion of the Internet of Medical Things (IoMT) has heightened concerns about the security of interconnected medical devices and patient data privacy. Authentication protocols are vital in IoMT, ensuring that entities verify their identities before data exchange to protect privacy and confidentiality. Recent advancements have focused on enhancing privacy and security within IoMT, emphasizing the need for robust solutions. In this paper, we propose a quantum-resilient mutual authentication protocol to preserve privacy between doctors and servers, utilizing Ring Learning with Errors (RLWE) and Boneh-Boyen signatures. Our protocol is validated using Scyther verification to ensure resilience against vulnerabilities and security attacks, thereby maintaining the integrity and confidentiality of sensitive data. Additionally, we confirm the correctness of the protocol's logic using BAN Logic. Performance evaluations demonstrate that our protocol is efficient, with lower computational and communication costs compared to existing solutions.

Unmanned aerial vehicles (UAVs) are widely used in commercial activities due to their low cost and high efficiency. However, many unscrupulous activities have taken advantage of the open nature of civil navigation messages to implement Global Navigation Satellite System (GNSS) spoofing attacks on UAVs, resulting in major security risks for UAVs. In order to cope with spoofing attacks, a navigation message authentication (NMA) scheme has been proposed to protect navigation messages. However, the mainstream NMA schemes have defects of a single authentication process and large time overhead. Furthermore, these schemes depend on digital certificates to update the key. In the event that the UAV is disconnected from the certificate authority, it will be unable to update the key in an appropriate manner, which will consequently affect subsequent authentication.To solve the above problems, this paper proposes a hybrid authentication scheme based on BeiDou-III navigation system (BDS-III), which combines Navigation Message Authentication (NMA) and timed efficient stream loss-tolerant authentication (TESLA) to achieve a triple authentication of signatures, TESLA keys, and message authentication code (MAC). Then, the SM2 signature algorithm is modified to reduce the authentication time overhead. Finally, the stability of the key update process is enhanced by storing the public key in the navigation message and broadcasting it by satellite. Experimental verification shows that the proposed scheme can effectively resist replay attacks and generative spoofing attacks, while guaranteeing the security. The authentication error rate of the proposed scheme can meet the demand of less than 10(-3) when it is lower than the average carrier-to-noise ratio of 7dBHz. The time between authentications (TBA) is 15.11 seconds. The unpredictable symbol rate (USR) is 16.8% which is a better performance compared with same kind of scheme.

Massive machine type communication (mMTC) is one of the important parts of the fifth-generation (5G) cellular wireless network. In order to meet the security requirements of 5G wireless networks, 3GPP has introduced an authentication and key agreement (AKA) protocol named 5G-AKA; however, it is still inefficient for the mMTC scenario where numerous devices attempt to connect to the network simultaneously. In this paper, we propose a new group-based AKA protocol, which authenticates multiple MTC devices (MTCDs) simultaneously while maintaining consistency with the 5G-AKA framework to ensure security. Specifically, we design a group authentication and key negotiation algorithm based on the challenge-response mechanism used in 5G-AKA protocol and dynamically managed group members to facilitate group authentication. This approach effectively reduces the volume of interactive messages, alleviates signaling congestion, and simultaneously completes key negotiation for multiple MTCDs. The ability of the proposed protocol against significant malicious attacks has been rigorously validated by the deviation of BAN logic and formally verified by the Random Oracle Model (ROM) and the Scyther tool, highlighting its robust security attributes. Extensive simulation experimental results have demonstrated the security, efficiency, and effectiveness of proposed protocol.

As the number of smart devices increases dramatically in industrial IoT (IIoT) systems, a large amount of privacy-sensitive data could be generated in manufacturing operations, and more message authentication operations need to be performed. Meanwhile, the processing of such data has to meet stringent requirements on communication latency, reliability, and security. However, the resource constraint in the IIoT systems prevents legacy resource-intensive security measures from being used directly in the systems. To address the massive data security issue with the consideration of the limitations of resource-constrained devices, we propose a new batch message authentication protocol supported by edge computing. Specifically, we propose to offload message authentication operations to the edge servers to reduce the authentication burden on the devices. Meanwhile, the protocol uses certificateless aggregate signatures to verify the legitimacy of messages in large batches, significantly reducing signaling overhead and avoiding key escrow. The proposed protocol has been formally verified by using Scyther tool, which demonstrates its capacity against major typical malicious attacks. Furthermore, the performance evaluation results show that the proposed protocol is efficient in terms of computational and communication costs.

The UAV-assisted Air-Ground-Sea (AGS) communication, due to its flexibility and extensive coverage, provides robust support for maritime trade and rescue services. However, in the complex network environment of the Internet of Vessels, AGS presents significant security challenges, such as unauthorized access that leads to data breaches. The Authentication and Key Agreement (AKA) protocols can verify the identities of legitimate users to ensure secure data access. Nonetheless, the current AKA protocols designed for AGS have security vulnerabilities and face password security risks from eCK adversaries. Thus, they fail to guarantee the secure operation of AKA. This paper designs a robust and efficient authentication and key agreement protocol to preserve the security of authentication, passwords, and session keys, i.e., (Elliptic curve cryptography and Hash-chain)-based AKA, EHAKA. Furthermore, security analysis shows the robustness of the proposed scheme in securing AKA. Performance evaluation indicates that the proposed EHAKA outperforms the SOTA methods in terms of efficiency. Notably, compared with the average computational cost of protocols proposed by Ever, Nyangaresi, Miao, and Khan, the computational cost of EHAKA has been significantly reduced by up to 86.14%.

In recent years, advancements in Unmanned Aerial Vehicle (UAV) technology have led to the emergence of the Internet of Drones (IoD), further enhanced by the capabilities of 5th generation mobile network (5G). UAVs are widely used in various applications, such as disaster assessment, material delivery, and environmental monitoring, due to their flexibility. However, operating in insecure open environments presents significant risks, making it crucial to complete tasks without exposing sensitive information to attackers or unauthorized users. Additionally, the communication range between UAVs and ground stations is often limited, and if a UAV flies beyond this range, the likelihood of mission failure increases substantially. To address these challenges, we propose a UAV-assisted Authentication Protocol (UAP) based on Physical Unclonable Functions (PUFs), leveraging 5G to enable secure relay communication between UAVs and ground stations. We provide formal proof of the protocol's logical correctness and perform cryptanalysis, demonstrating that it effectively resists various security threats, including masquerade and replay attacks. Furthermore, we evaluate the resilience of UAP against multiple security vulnerabilities using the Scyther tool. Finally, we compare our protocol with existing authentication methods in terms of application scenarios, security features, and both computational and communication overhead. We have performed simulations on a Raspberry Pi. The experiments show that UAP has a computational overhead of 0.0826 ms and a communication overhead of 0.0408 ms. The application scenarios and security features of UAP are also considered, making it a solution for UAV applications.

Named Data Networking (NDN) aims to establish an efficient content delivery architecture. In NDN, secure and effective identity authentication schemes ensure secure communication between producers and routers. Currently, there is no feasible solution to perform identity authentication of mobile producers in NDNs. Identity authentication schemes in other networks are either weak in security or performance, such as privacy leakage, difficulty to establish cross-domain trust, and long handover delays, and are not fully adaptable to the security requirements of NDNs. Additionally, the mobility of producers was not fully considered in the initial design of NDNs. This paper first revises the structure of packets and routers to support the identity authentication and mobility of producers. On this basis, this paper proposes a secure and efficient certificateless ECC-based producer identity authentication scheme (CL-BPA), which includes initial authentication and re-authentication, aimed at achieving rapid switch authentication and integrating blockchain to solve single-point failure issues. Using the Canetti and Krawczyk (CK) adversarial model and informal security analysis, the proposed CL-BPA scheme is demonstrated to be resistant to anonymity attacks, identity forgery attacks, and man-in-the-middle attacks. The performance analysis demonstrates that the proposed CL-BPA scheme exhibits excellent capabilities in terms of computation delay, communication cost, smart contract execution time, average response delay, and throughput.