Jul 2026· IEEE International Conference on Consumer Electronics· pp. 607-612· 1 citation· 17 references
Abstract
The integration of Software-Defined Networking (SDN) with large-scale Internet of Things (IoT) deployments enhances network programmability and visibility, yet it also introduces new security risks across emerging edge cloud computing environments. Deep Learning (DL) based autonomous anomaly detection (AAD) has emerged as a key defence mechanism for securing distributed and edge-enabled IoT infrastructures. Despite their effectiveness, the vulnerability of these DL models to adversarial attacks in SDN-IoT contexts remains underexplored, particularly in edge-cloud AI deployments, where models may operate across distributed infrastructures. This paper presents a comprehensive adversarial analysis of three representative DL architectures, CNN, LSTM, and AE-LSTM, evaluated across three diverse datasets: CICIDS2017, InSDN, and CICIoT2023. We investigate both data-level evasion attacks (FGSM, PGD) under white-box conditions and model-level threats via a noisebased Data Free Model Extraction (DFME) attack under realistic black-box conditions. Results reveal that minor perturbations can severely degrade detection performance, while DFME successfully reconstructs high-fidelity surrogate models without access to training data. These findings highlight significant integrity and confidentiality risks for AI-driven intrusion detection systems deployed across the edge-cloud continuum and emphasise the need for adversarially robust DL defences for distributed AAD systems in SDN-IoT networks.
With the proliferation of Internet of Things (IoT), critical infrastructures such as smart cities, industrial automation, precision healthcare, and intelligent transportation have seen a significant shift in their security landscape. As these critical infrastructures are increasingly depending on OneM2M standards for interoperability and scalable service management, they are simultaneously presenting a larger and more structured attack surface. One of the most serious and realistic threats in such scenarios is black-box adversarial attacks, in which an attacker can compromise Machine Learning (ML) and Deep Learning (DL)-based intrusion detection systems (IDS) without having prior knowledge of the ML/DL model's architecture, parameters, and training data. To mitigate such a critical challenge, we propose a multi-stage framework specific to OneM2M-based IoT networks that can effectively counter transfer-based and query-based black-box adversarial attacks. Our framework's effectiveness will be tested on a dataset of 1.25 million labeled network flows collected from Azure IoT Hub-based IoT devices over a 10-day period. We will test the robustness of our framework against three adversarial attacks: FGSM with $\varepsilon=0.05$, PGD with 40 iterations and step size 0.01, and C&W with L2 optimization and 1,000 iterations. The proposed pipeline consists of four different mechanisms: (1) adversarial training with the use of mixed clean and adversarial samples, (2) traffic sanitization to minimize malicious and/or suspicious traffic flows before processing by the Common Service Entity (CSE), (3) the use of a black-box adversarial detector based on feature transformation, and (4) the use of an ensemble-based IDS to make use of the results of the Random Forest, XGBoost, MLP, and 1D-CNN-based IDSs via majority voting. The experimental results show that the proposed Ensemble + multi-defense configuration results in 98.1% accuracy, 98.3% TPR, and 1.7% FNR. Most notably, the proposed Ensemble + multi-defense configuration results in an ASR of 11.2%, which is down by 86% compared to the 82.3% ASR achieved by the baseline IDS. Notably, the proposed framework results in limited overheads in terms of RTT (increased by 8 ms), CPU (increased by 17%), and RAM (increased by 1.6 GB).
Hamza Jamiri, A. Zyane· International Conference on...· 0 citations
Cybersecurity is a fundamental requirement for protecting wearable devices used in healthcare Internet of Things (H-IoT) systems. Security failures in these resource-constrained systems directly compromise patient safety. Physiological data and network traffic are frequent targets of cyberattacks in H-IoT environments. To address these risks, deep learning-based cybersecurity mechanisms for H-IoT often involve complex architectures with large parameter counts. Existing datasets are also rarely assessed for quality, limiting their applicability. However, this research addresses these challenges by developing multiple realistic datasets and proposing lightweight deep learning models, namely the Temporal Convolutional Network (TCN) and Residual TCN (Res-TCN), for H-IoT. It includes two binary classification datasets for Distributed Denial of Service (DDoS) attacks and a multiclass dataset representing Selective Forwarding (SF), Man-in-the-Middle (MITM), and DDoS attacks. The datasets UL-ECE-MQTT-DDoS-H-IoT2025 and UL-ECE-UDP-DDoS-H-IoT2025 are generated in Cooja and ns-3 to capture transmission behaviours and protocol variations. The third dataset, UL-ECE-MultiAttack-H-IoT2025, integrates physiological and network features to represent multiple cyber threats in H-IoT. Building on this, the TCN model is designed to detect and mitigate DDoS attacks over the MQTT and UDP-based datasets. It incorporates a monitoring frequency-based detection mechanism and a dynamic threshold-based mitigation strategy. To enable edge deployment, the model is quantised and converted into TensorFlow Lite (TFLite) for real-time DDoS detection on Raspberry Pi 4, achieving low latency and power-efficient operation in H-IoT. This thesis establishes a deep learning-based cybersecurity defence mechanism encompassing realistic dataset generation, lightweight model design, and edge deployment for securing H-IoT systems.
A Distributed Denial of Service (DDoS) attack can be launched using the vast number of edge connected devices in Software Defined AIoT systems. The shortage of modern labeled training data makes centralized defenses ineffective, while privacy concerns restrict sharing sensitive traffic information. To address these challenges, this work proposes a decentralized defense framework for AIoT based on a trustworthy Federated Learning (FL) architecture. The framework integrates three key components. First, a secure multiparty computation based aggregation scheme enables privacy preserving exchange of local model updates while remaining robust to outliers. Second, a horizontal cooperation based mitigation mechanism reduces packet loss and limits attack impact on legitimate traffic. Third, a semi supervised FL based anomaly detection strategy leverages a small number of labeled outliers to accurately identify attack classes while reducing false alarms. Experiments conducted on real world datasets, including CICIDS2017 and InSDN, show that the proposed approach significantly outperforms state of the art SDN based protection systems in accuracy and efficiency. The study further examines FL enabled by Software Defined Networking as a paradigm that improves security and reduces training time without degrading learning performance. However, SDN assisted FL introduces new vulnerabilities, particularly DDoS attacks targeting the SDN control plane and disrupting model parameter exchanges. To mitigate this risk, a contrastive learning based detector using a two layer deep neural architecture is introduced. The LSTM SVM achieves 99.75 percent accuracy and 99.80 percent recall, while the CNN BiGRU reaches 99.36 percent accuracy and 99.55 percent recall in practical deployments scenarios.
P. Parthasarathi, Sasikala Dhamodaran, K. Shree et al.· International journal of sof...· 0 citations
The rapid expansion of the Internet of Things (IoT) has enabled pervasive connectivity and intelligent automation across multiple sectors, while simultaneously exposing networks to significant security vulnerabilities. Among these vulnerabilities, Distributed Denial-of-Service (DDoS) attacks remain one of the most critical threats due to their scalability, persistence, and effectiveness against resource‑constrained IoT devices. This paper presents a comprehensive literature review of DDoS detection and mitigation techniques in IoT environments, emphasizing traditional methods, machine learning, deep learning, and ensemble-based approaches. The review is structured into four major sections: the IoT and DDoS threat landscape; traditional and machine learning-based detection techniques; deep learning and ensemble approaches; and open challenges with future research directions. By synthesizing existing studies, this paper provides a coherent academic foundation for the design of adaptive, scalable, and intelligent IoT security frameworks.
Solanke Oluwole, Alao Olujimi D, Akande Oyebola· International Journal Of Eng...· 0 citations
This review paper critically examines the integration of Artificial Intelligence (AI) and Machine Learning (ML) techniques to enhance information security within Cloud-IoT networks, focusing on hybrid Deep Learning models (CNN-LSTM), predictive analytics, and automated threat response mechanisms.
R. Saravanakumar, V.Anuratha, M.Elamparithi· International journal of com...· 0 citations
A constraint-aware adversarially robust Internet of Things (IoT) traffic classification system with protocol validity, device behavior consistency, and manifold-aware training and evaluation is presented, demonstrating improved robustness, realism, and deployability compared to existing approaches.
