Computer Science and Mathematics

Abstract: Vehicular Ad-hoc Networks (VANETs) present significant challenges that are gradually being addressed by the research community. Vehicle-to-vehicle communication is one area requiring improvement, particularly regarding link connectivity between vehicles. Routing protocols used in these networks can be significantly enhanced through the application of artificial intelligence techniques, such as fuzzy logic controllers. The three types of fuzzy controllers address measurement uncertainty with increasing sophistication, ranging from the simplest (Type-1) to the most advanced (Type-3). VANETs are characterized by mobility patterns that introduce considerable uncertainty in various aspects, such as route lifetime. This article presents three fuzzy decision systems (one of each type) sharing the same rules and input parameters. The objective is to determine whether the complexity of these networks justifies the use of more complex systems. Simulation results show that the system based on Type-3 controllers yields the best performance, confirming their potential to improve routing in VANETs.

Abstract: The increasing reliance on cloud storage across sectors has made the protection of sensitive data a critical concern especially as advances in quantum computing threaten to break traditional public-key cryptographic systems. This growing vulnerability raises urgent questions about how to secure digital assets in a post-quantum future. To address this challenge, this study aims to design, implement, and evaluate a hybrid encryption framework that combines symmetric encryption for data confidentiality with quantum-resistant public-key algorithms for key management and digital signatures. The objective was to develop a secure and practical solution that can be readily adopted using open-source tools. The system was built in a Linux-based virtual environment using an S3-compatible object storage platform, integrated with quantum-safe cryptographic libraries, and automated through scripting. Performance testing was conducted using files ranging from 100 MB to 1 GB, with metrics such as encryption and decryption time, CPU usage, upload/download latency, and internet throughput analyzed. The results showed that while quantum-safe operations added some overhead, even large files could be securely processed in under two minutes with stable system performance and no data corruption. These findings confirm that hybrid encryption models can be deployed today without specialized hardware, offering a forward-compatible and robust approach to cloud security. This work contributes a tested and reproducible framework for early adoption of quantum-safe cryptography in real-world cloud environments.

Abstract: Most existing encrypted-traffic classification methods treat each traffic flow as an independent sample, overlooking the relationships shared by similar flows. This can amplify within-class variation and increase overlap between classes, particularly when their distinguishing characteristics are subtle and labeled data are limited. To address this problem, we propose PGCL-CG, a prototype-guided semi-supervised graph contrastive learning framework. We represent flow-level statistical features as a sparse, weighted k-nearest-neighbor graph and use GraphSAGE to aggregate information from neighboring flows and to capture their underlying structural relationships. The encoder is pretrained using self-supervised graph contrastive learning to obtain stable representations. We use a student-teacher architecture to produce more stable pseudo-labels and apply hierarchical density-based spatial clustering to filter out low-confidence assignments. We conduct extensive experiments on the two open datasets, demonstrating that PGCL-CG outperforms competitive baselines and remains robust even when only a small fraction of labels (e.g., 20% or 40%) is available.

Abstract: Checking whether an operational technology (OT) network satisfies a segmentation standard takes four to six weeks by hand: passive monitoring for an asset inventory, then a manual check against firewall rules. The gap is sharpest in water and wastewater, facing a December 31, 2026 deadline for Emergency Response Plans under the America's Water Infrastructure Act (AWIA), where the Cybersecurity and Infrastructure Security Agency (CISA) finds inadequate boundary protection is its most common weakness. We built CrossCheck, a tool that answers it from evidence an operator already has: flow data and whatever policy governs it, inline rules or an access list. From those inputs it checks three of the four elements in CISA's Cross-Sector Cybersecurity Performance Goal 3.I, Network Segmentation: boundary devices between segments, inter-segment traffic tight enough to contain a breach, and physical isolation where required. On a small, hand-built set, CrossCheck caught every planted violation and correctly flagged insufficient evidence; a keyword baseline for manual practice missed a real violation and guessed rather than admit it didn't know. Asset classification and the standard's contextual exception clause are out of scope; the design generalizes beyond water and wastewater to any OT sector built around VLAN segments behind a boundary device.

Abstract: We present DQ-(5,11), a dealer-based (5,11) threshold quantum secret sharing (QSS) scheme where any 5 of the 11 participants can find a dealer's secret and 4 or fewer get nothing about it. A key point is that, due to the Cleve-Gottesman-Lo no-cloning bound, there is only a (k,n) threshold scheme for any quantum secret if n < 2k. Since 11≥10, is a (5,11) quantity, the threshold scheme is impossible for quantum secrets, and in any (5,11) quantum secret sharing scheme there is a classical secret that is encrypted in a way that is protected by quantum communication. DQ-(5,11) is a combination of Shamir's polynomial sharing over GF₁₃ and a single-qudit reconstruction in dimension d=13. Each of the five cooperating participants in DQ-(5,11) performs one phase operation with the share of the quantum secret and a zero-sum mask so that the intermediate states will not have any partial sum. Decoy qudits from two mutually unbiased bases detect eavesdropping, and a dealer-published commitment lets participants check the reconstructed value. We achieve correctness of all 462 subsets of the network, information-theoretic secrecy against coalitions of up to four insiders and a requirement for the success of intercept-resend attacks to be (d+1)/2d)^m for m decoys (8.6×10^-9) for m=30). We use numerical data to verify the deterministic reconstruction for all 2,310 runs and show the effect of depolarizing noise (79.1% success at 5% noise at each stage) and channel loss. Furthermore, we compare our orbital-angular-momentum and time-bin qudit model to Trojan-horse countermeasures and other schemes.

Abstract: This paper investigates whether JA4+ fingerprint decomposition improves passive identification of Internet of Things (IoT) devices in encrypted network environments, without incorporating payload inspection or active probing techniques. As TLS encryption and privacy-preserving mechanisms such as Encrypted Client Hello reduce the visibility of application-layer metadata, traditional payload- and domain-based identification techniques become less effective. JA4+ fingerprints provide an alternative approach by extracting observable characteristics from TLS handshakes, certificates, and transport-layer metadata without requiring traffic decryption. The proposed methodology evaluates different JA4+ fingerprint combinations for IoT device identification using traffic traces from the CICIoT2023 dataset, with additional validation on the UNSW-IoTraffic dataset. Traffic traces were processed with Zeek to extract the JA4+ fingerprint family, which was evaluated using dictionary-based classification, Random Forest, and Categorical Boosting models. Compact fingerprint representations were compared with decomposed protocol-level features to determine whether feature decomposition improves classification performance or enhances interpretability. Experimental results show that JA4+ fingerprints enable accurate IoT device identification using only passive encrypted traffic metadata. On CICIoT2023, the complete JA4+* configuration achieved a Macro F1-score of 0.8095 with both RF and CatBoost, although this result was obtained on a smaller subset of connections due to fingerprint availability. On the independent UNSW-IoTraffic dataset, CatBoost achieved a Macro F1-score of 0.9995 with both compact and decomposed representations. Overall, decomposed representations did not provide a consistent predictive advantage over compact fingerprints, although they remained valuable for interpretability and feature-level analysis. These findings indicate that compact JA4+ fingerprints can preserve the discriminative information required for IoT device identification without requiring protocol-level decomposition when predictive performance is the primary objective. The results highlight the potential of JA4+ fingerprinting for scalable IoT security monitoring under increasingly encrypted network conditions.

Abstract: Internet of Things (IoT) devices need key agreement that is authenticated, forward-secret and cheap enough to run on a microcontroller. In our earlier work, a genetic-algorithm (GA)-optimised chaotic logistic map was used on an ESP32 to generate AES-256 keys. That study covered only symmetric encryption, and because the generator is deterministic, its output cannot act as a per-session secret. This paper builds a three-layer authenticated key exchange around it. Ed25519 signatures under pinned identity keys authenticate the two nodes, ephemeral X25519 keys seeded from hardware entropy provide session secrecy and forward secrecy, and the chaotic key serves as a pre-shared configuration credential checked with HMAC-SHA256. The session key is derived with HKDF-SHA256 over a transcript hash that covers both messages and both identities, and each side confirms it before the handshake ends. We implemented the protocol with wolfSSL 5.8.4 on two ESP32 DevKit V1 boards communicating over ESP-NOW. All 1,000 hardware handshakes reached confirmed key agreement (95% Clopper–Pearson interval 99.63–100%), the 2,000 ephemeral public keys were all distinct, and all 500 attack attempts across five scenarios were rejected, including every attempt that used chaotic parameters off by 10⁶. A handshake took 3,290.79 ms on average, most of it⁻ spent on Ed25519 verification (748.40 ms), while the chaotic layer added only 0.69 ms. We also describe an entropy-seeding defect in the Arduino build of wolfSSL, which made every “fresh” key identical across devices, and the fix we applied.

Abstract: UAV, mounted aerial base stations offer remarkable deployment flexibility for 6G Non Terrestrial Networks (NTNs), yet their hovering energy demands present a critical sustainability bottleneck, particularly as network topologies continuously evolve in practice. As a first step, we develop MARL-ESA (Energy-Saving Adaptation), a Multi Agent Reinforcement Learning (MARL) framework achieving 48% energy savings in static UAV assisted heterogeneous networks (HetNets) compared with always-on operation through centralized training with decentralized execution (CTDE). However, MARL-ESA remains inherently topology specific, requiring over 1500 retraining episodes whenever UAV positions or traffic patterns change. To overcome this limitation, we propose Meta-MARL-ESA, a meta reinforcement learning extension that enables zero shot generalization across unseen network configurations. The problem is formulated as a Decentralized Partially Observable Markov Decision Process (Dec-POMDP) over a task distribution τ∼p(T), with a permutation invariant Graph Neural Network (GNN) policy trained via Model Agnostic Meta Learning (MAML). Simulation results demonstrate that Meta-MARL-ESA achieves 12× faster convergence on new topologies, preserves 82% of optimal performance in zero shot deployment, improves energy efficiency (EE) by 21.5% over converged baselines in out of distribution (OOD) scenarios, and recovers to 98% of optimal performance within 8 decision epochs during dynamic UAV repositioning events.

Abstract: Scientific AI can retrieve, synthesize, and reuse claims far faster than any researcher can inspect them. The problem is that provenance is often preserved more faithfully than evidential strength. Weak, biased, or fabricated findings may therefore move through training corpora, retrieval pipelines, and knowledge graphs without the methodological context that should constrain their interpretation. We argue that machine-readable knowledge should be built around layered evidence records rather than papers or extracted sentences alone. These records should retain source text, study design, population, controls, uncertainty, causal status, independent validation, and correction history. The central challenge is not only whether AI can read more literature, but whether it can retain why one claim deserves more confidence than another.

Abstract: Smart water metering requires low-power, large-scale communication that existing LPWAN solutions do not fully address: the single-hop topology of LoRaWAN needs dense gateway deployments in urban environments, and cellular alternatives incur subscription costs and higher energy consumption. This paper presents a multi-hop LoRa protocol for smart water metering that exploits the static topology and uplink-dominated traffic of this application to simplify the protocol design. Each node selects its relay through a lightweight message exchange and a cost function that combines hop count, relay load and link quality, using only local information, so that the network forms a tree rooted at the gateway. Overhearing the relay retransmission replaces dedicated acknowledgement packets on the relayed hops. The cost function coefficients were tuned by Bayesian optimization for networks of up to 100 nodes, and the best configuration depends on network size. Compared with a shortest-hop (BFS) baseline, the mean peak relay load settles at about 12 clients for 40 to 100 nodes, a reduction of up to 71%, for an average hop-count increase of up to 13%. The transmit energy of the busiest relay falls by up to 69%, although its daily consumption remains dominated by reception. The evaluation covers the topology produced by relay selection and the resulting analytical energy budget.

Abstract: Cybersecurity incidents can disrupt voltage regulation even when controller inputs pass basic validity checks. This study evaluates their effects and the conditions for effective local backup regulation in a reference 110/15 kV substation. A balanced AC power flow model is coupled with a discrete on-load tap changer (OLTC) model. The system comprises two 25 MVA transformers, six feeders and 18 load buses. Two control architectures and four protection strategies are compared using a 6990-trial protocol, including series with 30 random realizations per variant. In the main incident matrix, voltage-band violations occurred in 9 of 225 unprotected incident trials per architecture. Strategies R1 and R2 prevented these violations; R2 reduced tap changes by 43.1% relative to R1. With the same detector, backup regulation R2 reduced voltage-profile degradation compared with command blocking R2B. For telemetry delays up to 8 s, the mean paired difference in the increase in integrated voltage deviation was −91.946 p.u.·s (95% confidence interval: [−98.756, −85.136] p.u.·s). However, brief recurring anomalies could trigger alarms without activating backup regulation, while similar errors in both measurement channels remained undetected. Protection assessment therefore requires joint analysis of detection, response timing and retained regulation capability, accounting for backup-channel trustworthiness.

Abstract: Software-Defined Internet of Things (SD-IoT) security requires not only anomaly detection but also reliable diagnosis and safe recovery. This paper proposes CausalHeal, a self-supervised and causality-aware framework that integrates nominal anomaly modelling, causal root-cause localization, validity-aware cross-dataset transfer, and guarded autonomous remediation. Public-data experiments on CICIoT2023, ToN_IoT, Edge-IIoTset, and InSDN show that detection performance is dataset dependent, with CausalHeal achieving its strongest mean F1 of 0.906 on CICIoT2023 while classical baselines remain competitive on other datasets. Bidirectional transfer between ToN_IoT and InSDN fails the predefined label-free validity criteria in all reproducibility runs, causing CausalHeal to abstain rather than issue unsupported predictions. In a synchronized controlled benchmark, CausalHeal achieves an anomaly-detection F1 of 0.823 and root-cause Top-1 and Top-3 accuracies of 0.370 and 0.803, respectively. Guarded remediation reduces the unsafe-intervention rate from 32.7% under unguarded execution to approximately 0.6% through selective autonomy, verification, and rollback. These results position CausalHeal as a validity-aware and safety-constrained framework for trustworthy SD-IoT diagnosis and self-healing.

Abstract: Vehicular Ad-Hoc Networks (VANETs) face rapid topology changes, intermittent connectivity, and density-dependent contention. Conventional reactive protocols such as Ad hoc On-demand Distance Vector (AODV) discover routes on demand but do not explicitly favor relays with compatible motion. This paper presents FlockHocNet, a decentralized reactive VANET routing protocol that maps the flocking rules of cohesion, alignment, and separation to relay suitability. Each vehicle derives a local flocking score from one-hop position and velocity, propagates the weakest score along route requests, and combines this bottleneck with link, latency, and hop-quality terms during route selection. FlockHocNet also integrates flocking-aware request prioritization, provisional fast replies, guarded backup routes, link-layer feedback, Link Expiration Time prediction, and two-hop local repair. The protocol is implemented in ns-3.46.1 and evaluated against AODV using 600 paired simulations on two real OpenStreetMap road graphs in Montreal, with SUMO-generated mobility, five network sizes, and 30 paired seeds per size and environment. At 100 vehicles, FlockHocNet improves mean packet delivery ratio by 8.04% on the highway and 17.98% in the urban scenario; urban normalized routing load decreases by 58.28%. The results show that flocking compatibility is most effective when sufficient relay diversity exists, while sparse networks expose an overhead-reliability trade-off.

Abstract: The paper proposes, implements, and tests a neural-network method based on orthogonal Laguerre polynomials for the numerical solution of the Cauchy problem for a singular nonlinear Lane--Emden equation with a variable-order fractional derivative. Such equations rarely admit analytical solutions, while classical finite-difference schemes struggle with the singularity near zero and the nonlocal character of the fractional derivative. The approximate solution is expanded in modified Laguerre polynomials shifted to the initial point, so the Cauchy initial conditions are satisfied exactly. The network has one trainable linear layer; nonlinearity is provided by the polynomial basis. The weights are found by minimizing a loss function containing the equation residual at collocation points, a weight factor improving accuracy near the singularity, and regularization limiting weight growth. Training uses Adam with an adaptive learning-rate scheduler and early stopping. Implementation is in Python with PyTorch. A vectorized tensor version accelerates computations by about thirty times compared with the loop version. On test problems with known solutions, the maximum absolute error reaches about five ten-thousandths; for a numerical reference, about five thousandths; in a stress test, about three hundredths. It is promising for singular variable-order fractional differential equations and can be parallelized on central and graphics processors.

Abstract: QR-code attendance offers a low-cost way to digitise presence records, yet a visible code alone does not establish that the resulting attendance transaction is fresh, attributable to an authorised participant, or delivered reliably over a constrained network. This paper analyses the security and scalability of QR-code in RPL-based low-power IoT networks using Contiki-NG/Cooja. The proposed architecture models the attendance process after QR-code scanning and combines token validation, attendance-rule checking, and server-side duplicate tracking with an IEEE 802.15.4 low-power communication stack using IPv6 over Low-Power Wireless Personal Area Networks (6LoWPAN), RPL Lite, Carrier-Sense Multiple Access (CSMA), and the User Datagram Protocol (UDP). The security claim is intentionally limited to the behaviour demonstrated in the experiments. The study evaluates the rejection of exact replayed attendance transactions, while confidentiality, cryptographic source authentication, protection of routing control traffic, and resistance to physical device compromise remain outside the scope of the current implementation. Three recorded network scales (5, 20, and 50 motes) are evaluated using packet delivery ratio (PDR), packet loss, average end-to-end delay, attendance success rate (ASR), and replay rejection. At the largest evaluated scale, PDR is 91.7%, average delay is 37 ms, and ASR is 89.4%. Across all scenarios, 38 of 38 injected replay transactions are rejected; the corresponding two-sided exact 95% binomial confidence interval is 90.75–100%, which avoids interpreting the observed 100% rate as a universal guarantee. Cross-metric analysis shows that the reduction in ASR closely follows the reduction in PDR as the network grows. A formal acceptance predicate and attack-surface analysis clarify why exact replay is rejected and where the baseline remains vulnerable to QR cloning, message modification, node impersonation, routing attacks, and device compromise. The study therefore provides a bounded security and scalability result for an attendance application carried by an RPL low-power network, together with a deployment-oriented path toward authenticated payloads, secure enrolment, routing defence, repeated-run statistics, direct energy measurement, and hardware validation.

Abstract: The sixth-generation (6G) networks are required to support scalable and low-latency traffic management due to emerging Internet of Things (IoT) applications. This paper proposes a traffic control framework in 6G IoT networks that integrates hybrid deep learning–based traffic prediction with prediction-driven deep reinforcement learning (DRL). A hybrid spatio-temporal deep learning model combining convolutional, recurrent, attention, and ensemble components captures complex IoT traffic dynamics. Unlike existing loosely coupled prediction–RL approaches, the predicted traffic demand is explicitly embedded into the RL state representation, enabling proactive and coordinated optimization of clustering, routing, and wireless resource allocation. NS-3 simulations with up to 1000 IoT nodes show that the proposed predictor achieves a Root Mean Square Error (RMSE) of 0.0079, outperforming LSTM, GRU, and CNN–GRU baselines. Furthermore, the prediction-driven DRL framework reduces end-to-end delays by 31% and improves throughput by 28% compared to DRL-only optimization, while also enhancing packet delivery ratio and energy efficiency. These results demonstrate that tightly integrating traffic prediction with reinforcement learning enhances proactive traffic control in large-scale 6G IoT networks.

Abstract: Mapping host activity to the MITRE ATT&CK framework usually needs manual work or a cloud-hosted large language model, which raises privacy and cost concerns for small organisations that cannot send their logs off-host. We ask whether a small language model (SLM), running locally and without fine-tuning, can classify Linux auditd records at the technique level of MITRE ATT&CK. We built a deterministic cascade that captures, filters, scores, and aggregates auditd events into session narratives, discarding most records before any model call. Only these narratives reach a quantised SLM (Qwen 2.5 7B, served by Ollama). Candidate techniques are calibrated only on public sources (MITRE ATT&CK, GTFOBins, Sigma), never on the evaluation data. We evaluated the full pipeline on the CAM-LDS dataset, across 29 attack variants, with deterministic and reproducible model outputs under a fixed seed and a temperature of zero. The system reaches a macro-averaged incident-level F1 of 54.2%. Per-variant scores range from 19% to 78%, driven by how much of the attack auditd can observe: scripted attacks leave few visible events, while interactive ones expose far more. An initial pilot with Phi-3 Mini 3.8B produced invalid, hallucinated technique IDs and missed obvious techniques, motivating the switch to Qwen 2.5 7B, which gives the best accuracy–latency trade-off. Our central finding is where the loss happens: the deterministic cascade preserves almost all of the observable on-host activity, so the binding constraints are downstream. The model under-confirms techniques it is given 71% of missed techniques were already available to it and over-broad signatures, not hallucinations, cause most false positives. A local, fine-tuning-free SLM gives a usable technique-level baseline; the ceiling is the model and the catalogue, not the filtering stage.

Abstract: Radio frequency (RF) for wireless systems is widely installed across applications such as mobile communications, maritime networks, smart factors, and smart homes because of their easy setup compared to wired system. Nevertheless, potential health concerns associated with RF waves exposure have driven interest in optical camera communication (OCC) using visible light as a safer alternative. Concurrently, artificial intelligence (AI) is transforming automation and complex problem-solving across IoT, smart farming, and smart home ecosystems. In this study, we propose a Camera On–Off Keying (C-OOK) scheme that incorporates YOLO26n for multi-user, which supports for light source detection and tracking, along with a Denoising AutoEncoder (DAE) algorithm to assist the decoding process in long-range and mobile environments. This approach improves a traditional C-OOK by supporting multi-user simultaneously, increasing distances, and lowering bit error rate (BER). Experimental results demonstrate reliable communication up to 25 meters considering mobile environment.

Abstract: Digital twins deployed in edge IoT environments require timely state updates while operating under limited communication and computational resources. This study proposes a task-aware method for managing digital twin state updates by jointly selecting the state component, update detail level, and processing location under explicit resource budgets. The method uses a one-step heuristic that ranks feasible update candidates according to expected quality gain, task-dependent importance, staleness, and normalized network and computation cost. It was evaluated on a physical ESP32-based IoT testbed using a common 180-cycle reference trace, with 179 cycles used for comparison across six adaptive scenarios and six baseline scenarios. Under the normal budget, the proposed method reduced average network and computation costs by 5.26% and 11.02%, respectively, compared with periodic and freshness-based baselines. Under the limited event-monitoring profile, the reductions were 3.97% and 10.38%, while maintaining a maximum temperature and humidity staleness of one cycle. Under the critical event-monitoring budget, prolonged starvation of temperature and humidity was observed, revealing a limitation of the current heuristic. The results show that the method provides task-dependent resource reallocation rather than universal improvement across all metrics.

Abstract: Artificial-intelligence supercomputers concentrate high-value training data, model weights, credentials, accelerators, and orchestration services behind extremely fast local networks. Their security problem differs from that of a conventional office LAN because several fabrics coexist: out-of-band management, in-band services, storage, and high-performance compute communication. This survey synthesizes standards, government guidance, vendor reference architectures, and peer-reviewed systems-security research to examine how those fabrics change the attack surface. The review finds that segmentation, zero-trust access, strong device and workload identity, encrypted management, secure firmware, and independent recovery paths form a consistent baseline. However, high-performance mechanisms such as InfiniBand and Remote Direct Memory Access create residual risks because isolation identifiers are not necessarily cryptographic protections, one-sided operations can bypass host processing, and monitoring at accelerator-fabric rates is difficult. The paper proposes a cross-plane control model that binds job identity to network authorization and data provenance, then identifies research priorities in line-rate cryptography, revocable RDMA capabilities, DPU assurance, AI-aware telemetry, and disruption-tolerant containment. The resulting view treats LAN security as a property of the complete AI workload lifecycle rather than as a perimeter firewall problem.