The rapid proliferation of the Internet of Things has intensified demand for robust privacy-preserving machine learning mechanisms to safeguard sensitive data generated by large-scale, heterogeneous, and resource-constrained devices. Unlike centralized environments, IoT ecosystems are inherently decentralized, bandwidth-limited, and latency-sensitive, exposing privacy risks across sensing, communication, and distributed training pipelines. These characteristics render conventional anonymization and centralized protection strategies insufficient for practical deployments. This survey presents a comprehensive IoT-centric, cross-paradigm analysis of privacy-preserving machine learning. We introduce a structured taxonomy spanning perturbation-based mechanisms such as differential privacy, distributed paradigms such as federated learning, cryptographic approaches including homomorphic encryption and secure multiparty computation, and generative synthesis techniques based on generative adversarial networks. For each paradigm, we examine formal privacy guarantees, computational and communication complexity, scalability under heterogeneous device participation, and resilience against threats including membership inference, model inversion, gradient leakage, and adversarial manipulation. We further analyze deployment constraints in wireless IoT environments, highlighting trade-offs between privacy, communication overhead, model convergence, and system efficiency within next-generation mobile architectures. We also consolidate evaluation methodologies, summarize representative datasets and open-source frameworks, and identify open challenges including hybrid privacy integration, energy-aware learning, privacy-preserving large language models, and quantum-resilient machine learning.

Federated Learning (FL) enables multiple users to collaboratively train a machine learning model without sharing raw data, making it suitable for privacy-sensitive applications. However, local model or weight updates can still leak sensitive information. Secure aggregation protocols mitigate this risk by ensuring that only the aggregated updates are revealed. Among these, single-setup protocols, where key generation and exchange occur only once, are the most efficient due to reduced communication and computation overhead. However, existing single-setup protocols often lack support for dynamic user participation and do not provide strong privacy guarantees such as forward and backward secrecy. In this paper, we propose a new secure aggregation protocol that requires only one setup operation for the entire FL training and allows new users to join or leave at any round. It employs lightweight symmetric homomorphic encryption with a key negation technique to efficiently mask updates, without user-to-user communication – unlike the existing protocols. To defend against model inconsistency attacks, we introduce a simple verification mechanism using message authentication codes (MACs). Our protocol is the first to combine forward/backward secrecy, dropout resilience, and model integrity verification in a single-setup design. We provide formal security proofs and implement an end-to-end prototype, which source code has been released. Our experimental results show that our protocol reduces user-side computation by approximately 99

Agriculture Technology (AgTech) integrates various technologies, devices, protocols, and computational paradigms to improve agricultural processes. Big data, artificial intelligence, the Internet of Things (IoT), cloud and edge computing are applied to provide capabilities for collecting, transmitting, storing, processing, and analyzing agricultural data. Large amounts of data are gathered from multiple sources and processed in real time, enabling more effective decision-making. Data can be used to automate processes, resulting in savings on farm labor. To obtain the benefits of AgTech, data trustworthiness is essential and cyber resilience is required. Security flaws may result in farming equipment and processes being interrupted or inoperable, with significant revenue and capital losses. It is important for farmers to identify and respond to cyber incidents. Several existing works have attempted to classify AgTech technologies. However, most existing classifications are based on a limited set of characteristics and only focus on communication technologies in use or provide generic adversarial scenarios. There are real risks to data trustworthiness that impact on digital agriculture, and many of these risks are yet to be addressed. It is critical to understand the building blocks and possible components to be considered in a future security framework and their capabilities for satisfying the data confidentiality, quality, authenticity, and integrity requirements. This paper proposes a taxonomy to enable a consistent means of classifying the technologies that form the backbone of AgTech and outline the building blocks of data trustworthiness. This taxonomy consists of seven main criteria that recognize the technologies and systems (used to enable the movement of data at different stages) in terms of how it operates, its features, its benefits, and its limitations. Understanding the taxonomy enables effective implementation of anomaly detection and cryptographic methods to ensure data trustworthiness. Efficient AgTech with no security represents a serious risk to long-term sustainable smart farming and food security. Further, this paper outlines the integration of post-quantum cryptography with AgTech. The usefulness of the proposed taxonomy is demonstrated using two different types of case study related to the design and implementation of a modular security framework in real-world scenarios. The paper also identifies and discusses other important factors that impact data trustworthiness.

As a security extension of DNS, DNSSEC is critical to the reliable translation of domain names to IP addresses. This reliability - i.e., authenticity and integrity of translated responses in DNSSEC is underpinned through digital signatures. However, the evolution of Quantum Computers has put conventional digital signatures on the brink of compromise. Given this, NIST has recently selected candidates for post-quantum digital signatures that can run on conventional computers but withstand the attacks conducted using the Quantum Computers. However, since these post-quantum digital signatures are in their infancy, simply replacing the pre-quantum digital signatures schemes with postquantum candidates in DNSSEC is deemed a risk until the postquantum candidates are fully analyzed for security. Given this, herein, we investigate the possibility of using Double-Signatures in DNSSEC, combining a post-quantum digital signature and a classic one. The rationale is that double-signatures will offer protection against quantum threats on conventional signature schemes as well as unknown non-quantum attacks on postquantum signature schemes, hence even if one fails the other provides security guarantees. To accomplish this, we built a functional testbed using Docker and Docker networks and leveraged the modified source code of commercial-grade DNSSEC software BIND9 for generating and verifying double-signatures in DNSSEC resolution. Through a comprehensive empirical analysis, we show the efficacy of Double-Signed DNSSEC (in terms of performance) with an insignificant overhead. Hence, this article provides an analysis-based evidence advocating the implementation of double-signed DNSSEC until the Cryptographically Relevant Quantum Computer (CRQC) is fully realized.

Smart environments are increasingly equipped with interconnected digital systems to manage access and physical security. However, traditional authentication methods, typically restricted to static checkpoints, fail to provide persistent assurance once entry is granted, leaving facilities vulnerable to credential misuse, tailgating, and unauthorised movement. This paper presents the Continuous Authentication Platform (CAP), a modular, multi-modal framework developed within the RAAISE project to enable continuous and context-aware verification across dynamic facility zones. CAP integrates heterogeneous off-the-shelf sensors, including NFC, RFID, biometric, motion, and WiFi positioning units, which collectively support persistent user tracking and real-time access enforcement. The platform’s architecture couples distributed sensing and edge processing with a centralised intelligence layer for event correlation and policy-driven decision-making. A live testbed deployment at Deakin University was used to evaluate CAP’s performance under realistic operational conditions. Results from functional trials demonstrate CAP’s ability to detect credential misuse, prevent tailgating, and maintain authentication continuity with sub-second responsiveness. These findings underscore CAP’s potential as a scalable, privacy-aligned foundation for next-generation smart facility security systems.

Digital agriculture [agriculture technology (AgTech)] applies emerging technologies, such as the Internet of Things, sensors, and artificial intelligence, to collect, transmit, and process information related to agricultural enterprises. Potential benefits of AgTech are improved productivity, supply chain efficiency, food safety, and the sustainable use of natural resources, contributing to the resilience of farming practices. While the benefits of AgTech use are clear, cyber risks are introduced with this technology that require effective management. Farmers need confidence that the data gained through the use of AgTech are trustworthy (accurate, reliable, and authentic). Data trustworthiness is critical for quality data-informed decision making. Poor quality data may impact agricultural production and negate any potential benefits gained. This article outlines risks related to data trustworthiness for a diverse audience, including those with an agricultural background and/or a technical background in communication and network security, and for the end users (i.e., farmers). This article also discusses the threats associated with AgTech and provides six scenarios that identify potential cyberthreat actors, possible motivations, attack vectors, compromised security goals, and the impact on farm businesses.

Smart meters (SMs) are a cornerstone of the smart grid, generating high-resolution electricity consumption data that enables load forecasting, grid optimisation, and advanced analytics. However, the fine-grained nature of this data introduces significant privacy risks, potentially revealing sensitive information such as user identities, daily routines, and occupancy patterns. Existing privacy-preserving techniques often face challenges in balancing data utility with privacy protection. To address these limitations, we propose a novel method for generating Differentially Private (DP) synthetic SM data using a Transformer-based Conditional GAN (CGAN). Our approach ensures strong privacy guarantees while preserving the utility necessary for critical downstream tasks such as load forecasting and energy optimisation. Comprehensive experiments validate the effectiveness of our method, demonstrating up to 82% stronger privacy protection compared to standard DP-only mechanisms. It also achieves a 35% improvement in load forecasting utility over synthetic data generated by prior Transformer-based CGAN models and 66.7% higher utility compared to DP-synthetic data produced by existing DP-GAN methods. In addition, our approach increases robustness against adversarial attacks by 28% relative to models trained on real SM data. These results highlight the potential of our approach to support privacy-preserving analytics in the smart grid without compromising performance.

Agriculture technology (AgTech) applies emerging technologies, such as the Internet of Things (IoT), sensors, and artificial intelligence to collect, transmit, and process information related to agricultural enterprises. AgTech solutions involve many interconnected systems, each with a range of security vulnerabilities that may impact data trustworthiness. To engage AgTech effectively, a framework is necessary for providing assurances that data used for decision making can be trusted. This article introduces a novel framework “AgTrust” that provides a cohesive solution for enabling trust in farming ecosystems. This includes assurances of data integrity, data quality, and data provenance supported by anomaly detection, quantum-safe encryption, authentication, and the underlying key-management mechanisms. The AgTrust framework is a modular design, intended for flexibility to enable implementation in a range of context and to meet the challenges of a rapidly evolving threat landscape using appropriate security mechanisms to ensure data trustworthiness. The modules providing various security functions can be adapted to future-proof the AgTech development and can be applied to other IoT or smart-device-based networks. The AgTrust framework specifies the functionality required across various layers and services and coordinates interactions between functions. Four case study examples related to the implementation of the AgTrust framework in real-world scenarios are presented and discussed.

Accurate energy load forecasting is essential for optimising power systems across buildings, cities, and smart grids. Recently, large language models (LLMs) have shown remarkable capability in capturing complex temporal patterns in energy consumption data, outperforming both traditional and deep learning techniques. However, their reliance on detailed smart meter (SM) data poses significant privacy risks, as such fine-grained information is susceptible to inference attacks. To overcome these challenges, we introduce Privacy-Preserving Time-LLM, an innovative forecasting framework that combines LLM architectures with SM data encoded via Differentially Private Bloom Filters (DP-BF). This encoding safeguards sensitive consumption data while preserving high predictive performance. Designed for secure cloud deployment, the framework reduces privacy risks associated with honest-but-curious service providers. It employs Low-Rank Adaptation (LoRA) for efficient fine-tuning and utilises Rotary Position Embedding (RoPE) to model temporal dependencies without accessing raw time-series inputs. We benchmark our approach against the widely used differentially private training method DP-SGD. Experimental results demonstrate that the Time-LLM trained on DP-BF-Encoded SM data consistently outperforms its DP-SGD counterpart, reducing forecasting error by approximately 29% on average, highlighting an improved balance between privacy and utility. Compared to a state-of-the-art CNN baseline, our method achieves nearly 52% better forecasting accuracy on DP-BF-Encoded data while maintaining up to 99% membership privacy. Moreover, under adversarial attacks, models trained with DP-BF-Encoding show over 80% reduced vulnerability relative to models trained on raw data, significantly enhancing robustness and stability. To the best of our knowledge, this is the first differentially private LLM-based framework for energy load forecasting using DP-BF-Encoding. It opens new possibilities for privacy-preserving analytics in smart grid environments, with extensibility to other time-series applications such as occupancy detection and demand disaggregation.

This paper presents the design and implementation of a testbed for evaluating continuous authentication systems in pervasive smart environments. The testbed integrates diverse sensors, a gateway for real-time data aggregation, and a Continuous Authentication Platform (CAP) to enable robust user verification, dynamic authorization, and enhanced access control. Key components, setup processes, and evaluation scenarios are discussed, demonstrating the framework’s adaptability to evolving security requirements and its potential for scalable deployment.

Automated source code vulnerability detection using code graphs has seen major improvements in recent years, however one critical, but oft-overlooked, element of this problem is producing embeddings for graph nodes. Before graph-based classifiers can be used for vulnerability detection, the nodes in the graph must first be given vector representations. Graphlearning models propagate information from these embeddings through the graph before classification, and so the initial states of these embeddings are vital for all subsequent learning. While a variety of solutions to this problem have been proposed in existing literature, this is typically not the focus of these works. We propose a novel node embedding strategy for graph-based vulnerability discovery, which takes advantage of richly-learned information about the code contained in each node. We also implement and test several existing node embedding strategies, comparing them to each other and our new strategy under a standard graph-learning architecture. We find that our strategy outperforms existing methods by 10.47-50.70%.

DNSSEC, a DNS security extension, is essential to accurately translating domain names to IP addresses. Digital signatures provide the foundation for this reliable translation; however, the evolution of 'Quantum Computers' has made traditional digital signatures vulnerable. In light of this, NIST has recently selected potential post-quantum digital signatures that can operate on conventional computers and resist attacks made with Quantum Computers. Since these post-quantum digital signatures are still in their early stages of development, replacing pre-quantum digital signature schemes in DNSSEC with post-quantum candidates is risky until the post-quantum candidates have undergone a thorough security analysis. Given this, herein, we investigate the viability of employing 'Double-Signatures' in DNSSEC, combining a post-quantum digital signature and a classic one. The rationale is that double-signatures will offer protection against quantum threats on conventional signature schemes as well as unknown non-quantum attacks on post-quantum signature schemes, hence even if one fails, the other provides security guarantees. However, the inclusion of two signatures in the DNSSEC response message doesn't bode well with the maximum allowed size of DNSSEC responses (i.e., 1232B, a limitation enforced by the MTU of physical links). To counter this issue, we leverage a way to do application-layer fragmentation of DNSSEC responses with two signatures. We implement our solution on top of OQS-BIND and, through experiments, show that the addition of two signatures in DNSSEC and application-layer fragmentation of all relevant resource records and their reassembly does not have a substantial impact on the efficiency of the resolution process and thus is suitable for the interim period at least until the quantum computers are fully realized.

Quantum computing is emerging as a significant threat to information protected by widely used cryptographic systems. Cryptographic methods, once deemed secure for decades, are now at risk of being compromised, posing a massive threat to the security of sensitive data and communications across enterprises worldwide. As a result, there is an urgent need to migrate to quantum-resistant cryptographic systems. This is no simple task. Migrating to a quantum-safe state is a complex process, and many organisations lack the in-house expertise to navigate this transition without guidance. In this paper, we present a comprehensive framework designed to assist enterprises with this migration. Our framework outlines essential steps involved in the cryptographic migration process, and leverages existing organisational inventories. The framework facilitates the efficient identification of cryptographic assets and can be integrated with other enterprise frameworks smoothly. To underscore its practicality and effectiveness, we have incorporated case studies that utilise graph-theoretic techniques to pinpoint and assess cryptographic dependencies. This is useful in prioritising crypto-systems for replacement.

The digitisation of agriculture, integral to Agriculture 4.0, has brought significant benefits while simultaneously escalating cybersecurity risks. With the rapid adoption of smart farming technologies and infrastructure, the agricultural sector has become an attractive target for cyberattacks. This paper presents a systematic literature review that assesses the applicability of existing cyber threat intelligence (CTI) techniques within smart farming infrastructures (SFIs). We develop a comprehensive taxonomy of CTI techniques and sources, specifically tailored to the SFI context, addressing the unique cyber threat challenges in this domain. A crucial finding of our review is the identified need for a virtual Chief Information Security Officer (vCISO) in smart agriculture. While the concept of a vCISO is not yet established in the agricultural sector, our study highlights its potential significance. The implementation of a vCISO could play a pivotal role in enhancing cybersecurity measures by offering strategic guidance, developing robust security protocols, and facilitating real-time threat analysis and response strategies. This approach is critical for safeguarding the food supply chain against the evolving landscape of cyber threats. Our research underscores the importance of integrating a vCISO framework into smart farming practices as a vital step towards strengthening cybersecurity. This is essential for protecting the agriculture sector in the era of digital transformation, ensuring the resilience and sustainability of the food supply chain against emerging cyber risks.

AI systems, in particular with deep learning techniques, have demonstrated superior performance for various real-world applications. Given the need for tailored optimization in specific scenarios, as well as the concerns related to the exploits of subsurface vulnerabilities, a more comprehensive and in-depth testing AI system becomes a pivotal topic. We have seen the emergence of testing tools in real-world applications that aim to expand testing capabilities. However, they often concentrate on ad-hoc tasks, rendering them unsuitable for simultaneously testing multiple aspects or components. Furthermore, trustworthiness issues arising from adversarial attacks and the challenge of interpreting deep learning models pose new challenges for developing more comprehensive and in-depth AI system testing tools. In this study, we design and implement a testing tool, , to comprehensively and effectively evaluate AI systems. The tool extensively assesses multiple measurements towards adversarial robustness, model interpretability, and performs neuron analysis. The feasibility of the proposed testing tool is thoroughly validated across various modalities, including image classification, object detection, and text classification. Extensive experiments demonstrate that is the state-of-the-art tool for a comprehensive assessment of the robustness and trustworthiness of AI systems. Our research sheds light on a general solution for AI systems testing landscape.

As the integration of digital technologies with Industrial Control Systems (ICS) and Operational Technology (OT) continues to deepen, these systems increasingly become targets for sophisticated cyber attacks. These attacks not only threaten the operational integrity but also pose significant risks to national security and public safety. In this paper, we provide insights into the value of ICS/OT security solutions that are based on Identity and Access Management (IAM). Beginning with presenting an abstraction model for typical ICS/OT attacks, the paper systematically outlines the main stages of an attack and the corresponding vectors employed by adversaries. Drawing from the MITRE ATT&CK framework tailored for ICS, the paper quantifies the extent to which IAM-based mitigation approaches can strengthen defense-in-depth mechanisms against cyber threats targeting ICS/OT environments. Our findings show that there are modern attack vectors that can only be mitigated through robust IAM solutions. Moreover, we found that while advanced techniques such as firewall and gateway-based intelligent threat detection play a significant role in safeguarding I CS/OT, they are insufficient on their own to address several attack vectors in ICS/OT environments.

The virtual dimension called `Cyberspace' built on internet technologies has served people's daily lives for decades. Now it offers advanced services and connected experiences with the developing pervasive computing technologies that digitise, collect, and analyse users' activity data. This changes how user information gets collected and impacts user privacy at traditional cyberspace gateways, including the devices carried by users for daily use. This work investigates the impacts and surveys privacy concerns caused by this data collection, namely identity tracking from browsing activities, user input data disclosure, data accessibility in mobile devices, security of delicate data transmission, privacy in participating sensing, and identity privacy in opportunistic networks. Each of the surveyed privacy concerns is discussed in a well-defined scope according to the impacts mentioned above. Existing countermeasures are also surveyed and discussed, which identifies corresponding research gaps. To complete the perspectives, three complex open problems, namely trajectory privacy, privacy in smart metering, and involuntary privacy leakage with ambient intelligence, are briefly discussed for future research directions before a succinct conclusion to our survey at the end.