A Multi-Layer Adaptive Security Approach for Overcoming Security Challenges in Software-Defined and Data Center Networks

Quantum-resilient secure key distribution and deep adaptive intelligence for hybrid IIoT-SDN network defense

APATCP: programmable multi-controller framework for real-time detection and mitigation of complex TCP flooding attacks in SD-IoT networks

The exponential growth of the Internet of Things (IoT) has magnified vulnerability to Distributed Denial-of-Service (DDoS) threats, particularly advanced TCP flooding attacks that exploit protocol weaknesses to disrupt services and overwhelm constrained devices. Existing Software-Defined Networking (SDN) defenses often suffer from scalability bottlenecks, high controller overhead, and limited adaptability to evolving traffic dynamics. To overcome these challenges, this paper proposes APATCP, a P4-enabled, multi-controller SD-IoT framework for real-time adaptive detection and mitigation of TCP flooding. APATCP integrates four coordinated modules: Adaptive Collaborative Intrusion Defense (ACID) for decentralized intelligence sharing; Dynamic Traffic Anomaly Mitigation (DTAM) for adaptive thresholding and flow isolation; Dynamic Threat-Adaptive Classifier (DTAC), which leverages 24 P4-extracted features and an adaptive weighted ensemble classifier for complex multi-type attack classification; and FlowGuard-AP, a context-aware mitigation engine with dynamic response strategies. Evaluation across three IoT-centric datasets—CICIoT2024, Edge-IIoTset, and ToN_IoT—demonstrates superior performance, with APATCP achieving 99.3–99.98% accuracy, 98.2–99.5% recall, F1-scores up to 99.2%, and false positive rates as low as 0.4%. In binary classification, it consistently outperformed baselines such as LightGBM (97.5–97.8%) and XGBoost (96.7–97.1%). In multi-class evaluations spanning eight adversarial scenarios—including burst floods, hybrid multi-vector campaigns, and stealthy microbursts—the framework maintained > 98% accuracy while remaining operationally stable. Live emulations confirmed resilience under > 100k packets/s attack rates, keeping CPU load below 30%, packet loss under 2%, and end-to-end latency below 100 ms, while restoring throughput to over 95% of baseline within seconds. These results establish APATCP as a scalable, adaptive, and resource-efficient framework that delivers high detection accuracy, low overhead, and robust mitigation, ensuring reliable defense for next-generation SD-IoT infrastructures against increasingly sophisticated TCP flooding threats.

Security Assurance in 5G-Advanced (3GPP Release 18): Protecting Edge Computing, Network Automation, and Non-Public Networks

5G-Advanced (3GPP Release 18) architectural changes include multi-access edge computing (MEC) architectural changes, network automation, and non-public networks (NPNs). It is important to note that even though these advancements provide substantial performance advantages, they destroy fixed-perimeter security models, providing a distributed attack surface. The use of current security assessment strategies, which are usually non-fluid and isolated, is inadequate to offer the required runtime security health assurance needed in such fluid environments. This study presents a new security assurance framework (SAF) that would be used to provide ongoing evidence-based protection on core, edge, and private network domains. This framework employs a four-layer architecture, including monitoring, analytics (LM), policy engine, and enforcement, to convert security periodically audited to a dynamic threat-control-metric evidence chain. A 96% attack detection rate and a 99.8% reduction in response time (with a mean of 20.1 s) are proven by validation on an emulated 5G-Advanced testbed (approximating Release 18 features using Open5GS (v2.7.2 Rel-17, community developed, Seoul, Republic of Korea and custom extensions) based on a design science research (DSR) paradigm. Although the overhead (13% CPU, 21.4% memory) is manageable, the findings prove that all-time, multi-domain assurance is crucial to the healthy functioning of 5G-Advanced and is a key roadmap to autonomous 6G security.

Evaluation Framework for Cross-Layer Intrusion Detection Based on ML Approaches

Internet of Things networks evolve as a rapidly growing field for security threats, such as Denial-of-Service cross-layer attacks, due to their heterogeneous and resource-constrained environment. Intrusion detection systems (IDSs) serve as a vital defense mechanism in modern cybersecurity. However, the adoption of such a system, especially one that adopts a cross-layer strategy, requires a standardized, multifaceted evaluation framework that accounts for both detection capability and operational overhead. To address these challenges, we proposed a modular weight-based framework that evaluates cross-layer Machine Learning (ML) IDS across multiple dimensions, namely, detection effectiveness and generalizability, data quality, and attack coverage and practical deployability. We then applied this framework to the state-of-the-art cross-layer ML IDSs identified through the PRISMA framework. This proof-of-concept application illustrates how current evaluation practices generate disparate, fragmented results, while also highlighting the limitations inherent in retrospective literature-based scoring.

Zero-Trust Architecture for Securing IoT Edge Networks Against Advanced Persistent Threats

The rapid expansion of Internet of Things (IoT) edge networks has introduced significant cybersecurity challenges due to the increasing number of resource-constrained devices operating outside traditional security perimeters. Conventional perimeter-based defenses are inadequate against Advanced Persistent Threats (APTs), which exploit compromised edge devices through stealthy, multi-stage attacks involving reconnaissance, lateral movement, command-and-control communication, and data exfiltration. This study presents Edge-ZTA, a lightweight Zero-Trust Architecture specifically designed for securing Industrial IoT edge environments. The proposed framework integrates three complementary components: dynamic device identity verification based on trusted attestation and behavioral fingerprinting, continuous behavioral monitoring using a Federated Deep Autoencoder for privacy-preserving anomaly detection, and Software-Defined Networking (SDN)-based dynamic micro-segmentation for real-time isolation of compromised devices. A comprehensive hybrid experimental testbed comprising physical edge devices, virtualized nodes, and 500,000 network flow records derived from benchmark cybersecurity datasets was developed to evaluate the proposed architecture under realistic APT scenarios. Experimental results demonstrated a weighted macro-average F1-score of 97.1%, with detection rates of 98.9%, 97.9%, 96.8%, and 95.9% for reconnaissance, lateral movement, command-and-control, and exfiltration attacks, respectively. Furthermore, the decentralized edge-based policy decision mechanism maintained end-to-end latency below 50 ms, while CPU utilization remained below 17%, confirming the framework's suitability for resource-constrained IoT deployments. Scalability experiments involving up to 500 edge nodes further verified stable detection accuracy and predictable latency under heterogeneous operating conditions. These findings demonstrate that Edge-ZTA provides an efficient, privacy-preserving, and scalable cybersecurity framework capable of mitigating sophisticated multi-stage cyberattacks while satisfying the stringent performance requirements of next-generation Industrial IoT infrastructures.

Mitigating Security Challenges in 5G Wireless Networks

An AI-assisted, cross-layer security orchestration framework that integrates epoch-wise telemetry with ML-based risk estimation and formalizes mitigation as a Constrained Markov Decision Process (CMDP), and empirical evidence that adaptive mitigation can reduce security risk without sacrificing service guarantees is provided.