The advancement of autonomous driving technology has brought significant benefits to modern transportation systems. However, individual autonomous vehicles face challenges such as limited perception range and insufficient autonomous capabilities. Cooperative groups of autonomous vehicles, enabled by advanced communication technologies, can enhance traffic efficiency through information exchange. Existing research primarily focuses on centralized autonomous vehicle groups, where the leading node suffers from weak resilience and high computational load, making it difficult to maintain group collaboration over time. To address these issues, this article proposes a decentralized formation and self-adaptation method for autonomous vehicle social groups based on consensus resistance in closed scenes. First, we introduce consensus resistance as a metric to evaluate social group and member consistency, and develop a decentralized formation approach. Second, we present a self-adaption model for autonomous vehicle social groups, incorporating four evolutionary events: 1) expansion; 2) merging; 3) reduction; and 4) splitting, to ensure the stability of moving social groups. Simulation results demonstrate the proposed method effectively constructs social groups in both real-world and simulated environments, exhibiting robust consistency throughout the self-adaption process.

The growing use of deep learning in intrusion detection systems (IDS) has increased the need for explainable IDS (X-IDS). Current X-IDS research mainly relies on local surrogate models and their explanations are limited due to the complex features of network traffic. In contrast, counterfactual explanations improve interpretability by contrasting “why P rather than Q”, avoiding complex absolute explanations. In this paper, we outline the theoretical value of counterfactual explanations in X-IDS, and propose a two-stage search method for generating counterfactuals. Moreover, we also propose a submodular pick method for counterfactual explanations that provides diverse explanation instances, aiming to interpret the entire model rather than individual samples. Experimental results demonstrate that our proposed method achieves an 80% improvement in fidelity and is 100 times more computationally efficient compared with LIME within the X-IDS domain.

The existing fraud detection methods present limitations such as imbalanced data, incorrect identification of fraudulent cases, limited applicability to different scenarios, and difficulties processing data in real-time. This paper proposes an ensemble machine-learning model for detecting fraud in credit card transactions. It also integrates the Synthetic Minority Oversampling Technique (SMOTE) with Edited Nearest Neighbor (ENN) to address the problem of the imbalanced datasets. The experimental results show that our approach performs better than the existing methods. Therefore, it will establish an essential framework for the ongoing investigations in developing more robust and flexible systems for fraud detection.

As smart healthcare services rapidly evolve, ensuring user privacy has become a critical concern. While prior research has focused extensively on technical solutions, the user perspective on privacy protection remains underexplored. This study addresses that gap by examining how users perceive both technical and organizational privacy protection measures across four smart healthcare service types: wearable devices, mobile health apps, telehealth platforms, and medicine delivery systems. Through qualitative survey, the study uncovers a duality in user perceptions. Positive perceptions relate to multi-layer technical safeguards, regulatory oversight (e.g., General Data Protection Regulation (GDPR), Health Insurance Portability and Accountability Act (HIPAA), and proactive provider practices, such as transparent privacy policies and breach responses. On the other hand, negative perceptions center on lack of transparency, limited user control, forced consent to privacy terms, and both cognitive and operational barriers to engaging with privacy features. These findings reveal a critical imbalance in user-provider power dynamics and call for user-centric privacy strategies that balance protection with usability. The study contributes to theoretical advancements in privacy calculus, Technology Acceptance Model (TAM), and Unified Theory of Acceptance and Use of Technology (UTAUT) by refining constructs, such as perceived control, facilitating conditions, and transparency. Practical recommendations are offered to guide more inclusive, adaptable, and empowering privacy solutions in smart healthcare contexts.

Intrusion detection based on Federated Learning has been proven to be an effective method to address security risks in the Internet of Things (IoT). However, it faces challenges in dealing with non-independent and identically distributed (non-IID) data and poisoning attacks in IoT. To address these challenges, we propose an IDS approach named Clustering and Defending Against Poisoning Attacks (CDPA). Through clustering, CDPA not only alleviates the challenges of non-IID data, but also reframes the defense against poisoning attacks as one under nearly IID conditions. CDPA uses a novel federated clustering method to ensure that malicious clients are grouped without leaking additional information, and it adaptively selects the number of clusters. Moreover, CDPA proposes a novel federated aggregation algorithm specifically designed to address the previously overlooked challenge of high malicious client ratios within clusters - a vulnerability particularly exacerbated in cluster-based training scenarios. Extensive experiments demonstrate that CDPA can effectively handle non-IID data and defend against poisoning attacks, achieving a performance gain of approximately 20% over the baseline.

Penetration testing (pentesting), a proactive defensive practice for identifying vulnerabilities and supporting cybersecurity management, has traditionally been conducted manually due to its heavy reliance on specialized knowledge of human experts. In this paper, we propose PT-ISQL, an automated PenTesting approach based on Inverse Soft-Q Learning (ISQL), an imitation learning algorithm that enables efficient policy learning from expert demonstrations. PT-ISQL trains an agent to take optimal actions when interacting with the pentesting environment by effectively mimicking expert behavior. Our evaluation shows that PT-ISQL achieves high performance using significantly fewer expert demonstrations compared with generative adversarial imitation learning approaches. Furthermore, it demonstrates faster convergence, improved stability, and reduced training overhead. These results suggest that PT-ISQL is a promising and practical solution for scalable, automated penetration testing.

It is generally agreed that logs are necessary for understanding cyberattacks post-incident. However, little is known about what specific information logs should contain to be forensically helpful. This uncertainty, combined with the fact that conventional logs are often not designed with security in mind, often results in logs with too much or too little information. Events in one log are also often challenging to correlate with events in other logs. Most previous research has focused on preserving, filtering, and interpreting logs, rather than addressing what should be logged in the first place. This paper explores logging sufficiency through the lens of Digital Forensic Readiness, and highlights the absence of causal information in conventional logs. To address this gap, we propose a novel logging system leveraging “gretel numbers” to track causal information—such as attacker movement—across multiple applications in a tamper-resistant manner. A prototype, implemented using the Extended Berkeley Packet Filter (EBPF) and an Nginx web server, shows that causality tracking imposes minimal resource overhead, though log size management remains critical for scalability.

Attribute-based encryption (ABE) has been used to provide data confidentiality and fine-grained access control in the Internet of Vehicles (IoV). However, the attributes of vehicles in IoV might change frequently due to the movements of vehicles. Thus, the invalid attributes need to be revoked in time and efficiently to ensure the security of the system. In this paper, we propose a data-sharing scheme based on ABE for IoV. By using a binary tree and attribute version keys, flexible revocation can be achieved for IoV. Moreover, the ciphertext can be stored on clouds, and the distribution and revocation of attribute keys can be realized by distributed attribute authorities. We performed the security analysis and proved the security of the proposed scheme. The results showed that the proposed scheme has lower average computing overhead in terms of attribute revocations compared with other schemes based on ABE, and can satisfy the performance requirement of data sharing for IoV.

Sharing data among vehicles is one of the most important ways to provide safety-related and value-added services to connected vehicles. Nevertheless, access to the shared data must be controlled to prevent the exposure of users' privacy and data leakage or corruption. Attribute-based encryption (ABE) can provide data confidentiality and fine-grained access control. However, the complex and dynamic driving environment of vehicles may cause the attributes of vehicles to change frequently, and thus put a huge burden on the attribute management of the system or degrade the security of the system. In this paper, we propose a secure data sharing method by using ABE and blockchain for Internet of Vehicles. By using ABE, the data owner can stipulate the policy of the data access control based on the attributes of vehicles. The trusted authority is replaced by blockchain, which reduces the burden and solved the problem of single point failure of the trusted authority and increases the transparency of the whole system. An adaptive attribute revocation method is used to balance the revocation time and system cost. Moreover, the shared data are stored in a distributed Inter-Planetary File System (IPFS) to improve the efficiency and security of the data sharing system. The test results show that the proposed method can well satisfy the performance requirement of secure data sharing for Internet of Vehicles.

The Internet of Things (IoT) connects smart devices to enable various intelligent services. The deployment of IoT encounters several challenges, such as difficulties in controlling and managing IoT applications and networks, problems in programming existing IoT devices, long service provisioning time, underused resources, as well as complexity, isolation and scalability, among others. One fundamental concern is that current IoT networks lack flexibility and intelligence. A network-wide flexible control and management are missing in IoT networks. In addition, huge numbers of devices and large amounts of data are involved in IoT, but none of them have been tuned for supporting network management and control. In this paper, we argue that Software-defined Networking (SDN) together with the data generated by IoT applications can enhance the control and management of IoT in terms of flexibility and intelligence. We present a review for the evolution of SDN and IoT and analyze the benefits and challenges brought by the integration of SDN and IoT with the help of IoT data. We discuss the perspectives of knowledge-driven SDN for IoT through a new IoT architecture and illustrate how to realize Industry IoT by using the architecture. We also highlight the challenges and future research works toward realizing IoT with the knowledge-driven SDN.