2026· Computers, Materials & Continua· Vol 88, pp. 1-10· 0 citations· 29 references
TL;DR
A hierarchical edge-fog anomaly detection framework that integrates lightweight edge-level filtering with a fog-level Temporal Convolutional Network (TCN) detector, which suggests that hierarchical edge intelligence is a practical but calibration-sensitive direction for scalable anomaly monitoring in EV charging infrastructures.
Abstract
: The rapid growth of electric vehicle (EV) charging infrastructures has introduced new challenges in monitoring abnormal load behaviors under strict latency and resource constraints. Conventional anomaly detection approaches either rely on centralized processing or incur excessive false alarms, limiting their practical applicability in large-scale deployments. This paper proposes a hierarchical edge-fog anomaly detection framework that integrates lightweight edge-level filtering with a fog-level Temporal Convolutional Network (TCN) detector. The edge component suppresses non-informative patterns, while the fog layer performs temporal modeling on selectively forwarded data. This design enables controllable reduction of fog-level processing load. Under corrected end-to-end evaluation on real-world EV charging load data, the hierarchical pipeline should be interpreted as a system operating point rather than a uniformly superior detector. Relative to fog-only TCN-AE inference, the selected routing policy reduces fog workload by 34.9% and shortens average detection delay from 93.6 to 75.6 h, but increases false alarms per day from 0.88 to 7.29 and lowers F1 from 0.547 to 0.455. Sensitivity experiments over routing thresholds reveal a consistent trade-off among fog workload, alert burden, detection delay, and retained anomaly evidence. Additional routing diagnostics show that the primary source of performance degradation is information loss induced by filtering, rather than weakness of the fog detector on the forwarded subset. These findings suggest that hierarchical edge intelligence is a practical but calibration-sensitive direction for scalable anomaly monitoring in EV charging infrastructures.
Rapidly growing diversity of heterogeneous Software-Defined Internet of Things (SD-IoT) devices has created an increased vulnerability to high-rate volumetric distributed attacks, application-layer probing and bandwidth exhaustion. Traditional security architectures rely on centralized cloud-based Intrusion Detection Systems (IDS) causing considerable delays in processing, control-plane congestion and core-link bandwidth constraints. In order to solve those key issues, this paper proposes CoDPA (Cognitive Data-Plane Architecture), which presents a novel network architecture to mitigate network threats with built-in intelligence, sliding-window aggregation and adaptive policy enforcement using P4-programmable switches. One of the core elements of CoDPA is a novel approach called Confidence-Aware Decision Engine that converts behavioral metrics to policy enforcement decisions at line-rate without executing computational complex loop or floating point neural inference computations in hardware ALUs. CoDPA utilizes four customized modules for processing traffic, such as: Header Parser, Atomic SRAM register-based Feature Extractor, Sliding-Window Temporal Aggregator, and Confidence-Calibrated Match Action Evaluator. Based on the results of computing confidence scores mapped against calibrated thresholds stored in fast lookup tables, CoDPA performs dynamic orchestration of fine-grained actions such as: packet dropping for high-confidence threats; bandwidth throttling using token bucket for medium confidence anomalies; inspection tagging for out-of-line controller decision making; and line-rate forwarding for legitimated packets. Empirical experiments performed in hybrid emulated Mininet-WiFi and programmable testbeds have shown that CoDPA decreases end-to-end latency up to 90% during high-traffic peaks (up to 20,000 packets/second); saves up to 85.1% of core-link bandwidth; provides True Positive Rate (TPR) of 98.4% with False Positive Rate (FPR) of 1.8%; and mitigates attacks with latency of 1.2 milliseconds. Besides, CoDPA uses a light-weight hardware design (≤14% ALU utilization and 0.92 µs per-packet processing); provides 78.2% less carbon footprint and energy consumption than traditional IDS.
Resource-constrained IoT environments require security detection mechanisms that balance responsiveness, computational cost, and detection capability. This paper presents a utility-based decision framework for adaptive task placement of anomaly detection across local, edge, and cloud layers. Five operational metrics are formalised, covering latency and communication cost, energy cost, detection complexity, attack coverage, and context relevance, and integrated into a composite utility function that selects the most suitable processing layer for each incoming event. The framework incorporates confidence-modulated detection scoring and globally normalised context relevance to enable principled escalation of complex or uncertain events. A discrete-event simulation modelling a three-tier IoT architecture with nine attack categories demonstrates that the proposed balanced configuration achieves 97% of cloud-level detection quality while consuming 53% of its energy cost, outperforming all baseline strategies in composite utility. Per-class analysis confirms that the framework routes high-severity events to more capable layers while retaining simple traffic locally. The configurable weight vector further enables operators to navigate the efficiency–detection trade-off according to deployment requirements.
Ali A. Jaddoa, Hasanein Alharbi, Lata Nautiyal· International Conference on...· 0 citations
Gateway-resident intrusion detection can act before IoT traffic reaches cloud services, but early decisions are based on incomplete flow prefixes. This paper presents a reliability-aware edge–cloud framework that treats early detection as a sequential routing problem. At each checkpoint, a lightweight gated recurrent unit (GRU) maps causal packet-prefix features to a malicious-probability estimate. Temperature scaling, asymmetric benign and malicious thresholds, and an eight-packet minimum-evidence gate determine whether a flow exits locally, remains under observation, or is sent for cloud refinement. Short and unresolved flows are classified by regularized logistic regression using a compact 97-feature causal representation. The edge model contains 19,777 parameters, and each cloud submission carries 388 bytes of float32 features. The principal evaluation uses all 309 CIC-IoT-2023 PCAP files under four outer PCAP-disjoint folds, with separate edge-training, calibration, cloud-development, and final-test roles. Across 2,286,754 pooled out-of-fold flows with 88.54% malicious prevalence, the framework resolves 422,190 flows at the edge and routes 1,864,564 for cloud refinement, reducing cloud submissions by 18.46%. The final policy attains 4.47% FPR, 1.89% FNR, 96.82% balanced accuracy, and 98.76% F1 score. Observation-budget analysis identifies 32 packets as a corpus-specific compromise, whereas controlled delays in post-eight-packet information expose the limits of short-prefix detection. On the balanced CICIDS2017 test set, in-domain development attains 97.03% balanced accuracy; zero-shot transfer falls to 86.30%, and target-calibration-only adaptation improves it to 91.65%. Ablation results identify the minimum-evidence gate and cloud-refinement stage as the main reliability controls. Benign false alarms, delayed post-eight-packet information, cross-dataset shift, and scenario/file-level labels remain the principal limitations.
Siraj Azam, Farheen Naaz, Mikail Mohammed Salim· Electronics· 0 citations
This paper presents the Adaptive Confidence-Gated Ensemble (ACGE) framework for Network Intrusion Detection Systems (NIDSs) in resource-heterogeneous fog-IoT deployments. No single algorithmic paradigm simultaneously achieves high minority-class detection accuracy, sub-millisecond inference latency, and generalization across heterogeneous IoT traffic at resource-constrained fog-IoT nodes. To address this challenge, ACGE integrates a Sequence Transformer Encoder with LightGBM via a learned and sample-adaptive gating network trained on inter-model error complementarity, formally specified within a three-mode tiered deployment architecture. Both models execute in parallel for every sample; the gating network assigns transformer-dominant weight (α ≈ 1) to 18% of samples where attention-based processing yields the greatest architectural advantage. Under true parallel inference, ACGE latency is 1.45 ms (bounded by the transformer); the measured wall-clock latency under CPU-GPU pipeline parallelism is 1.52 ms. The framework is evaluated under 5-fold stratified cross-validation with McNemar’s significance testing on IoTID20 (primary IoT benchmark) and NSL-KDD (reproducibility anchor) and validated through zero-shot transfer on CICIoT2023 and Edge-IIoTset. Notably, the Sequence Transformer Encoder and ACGE process L = 5 consecutive flow records per decision, providing five times the information available to single-flow baseline models; approximately 57% of the transformer’s performance advantage is attributable to architectural design rather than extended input access. On IoTID20 multiclass classification, ACGE is the only evaluated configuration yielding a negative accuracy-to-macro-F1 gap (−0.51 pp), reaching 99.12 ± 0.03% accuracy and 98.67 ± 0.08% balanced accuracy, demonstrating genuine minority-class improvement. LightGBM achieves the optimal fog-tier profile (0.97 ms latency, concept drift sensitivity of −0.53 pp over three months). On Edge-IIoTset zero-shot transfer, ACGE achieves 93.89% binary accuracy and 85.78% multiclass macro-F1. Ransomware detection (12.34–66.34% F1 across all models) is identified as the primary capability gap; targeted data collection, few-shot adaptation, and federated learning are recommended as the most critical future directions. All inter-paradigm performance differences are reported as the mean ± SD and verified by McNemar’s test with Bonferroni correction.
Anomaly detection in vehicular networks focuses on cybersecurity, leaving physical traffic-flow anomalies at urban intersections underserved by IoT sensing. This paper benchmarks anomaly detection on five days of hourly vehicle counts from four consecutive signalized intersections in Kuwait City, with a vehicle-to-infrastructure (V2I) latency feasibility analysis. Anomalies are synthetically injected because verified incident labels are unavailable; scores reflect detectability under the injection protocol rather than validated incident detection. Across ten injection seeds, CUSUM is the most accurate (mean F1 0.945, perfect precision on every seed), Isolation Forest attains the highest recall (0.955), and the LSTM-AE reaches F1 0.347; on misaligned anomaly classes, the margin narrows, and the LSTM-AE matches CUSUM on gradual drift. A corridor rule localizes detected corridor anomalies (9/9, conditional on detection). Hourly aggregation alone imposes an expected 1800 s detection delay, over 130 times the 13.5 s V2I budget at 80 km/h. A sub-second Tier-1 edge detector, evaluated in traffic-calibrated simulation, detects surges within budget (median 6.8 to 9.1 s, robust to signal-cycle platooning), whereas flow-cutoff detection requires roughly 21 s and overnight hours remain a blind spot. Results support a two-tier edge-cloud design and provide, to our knowledge, the first such benchmark on real Gulf-region corridor count data.
Yousef AlSaqabi· Italian National Conference...· 0 citations
Urban Internet of Thing (IoT) networks face severe reliability threats from diverse wireless interference, including jamming and spoofing, which are difficult to detect and localize in multipath-rich environments. Existing schemes often suffer from high false alarms, poor generalization, and low localization accuracy. This article presents an end–edge–cloud interference detection and localization framework integrating zero-shot detection, game-theoretic collaborative sensing, and GNN-based localization. Experiments on a city-scale prototype show that the system achieves 98.5% detection accuracy with recall of 96.7%, while reducing false alarms to 3.2%. The proposed graph neural network (GNN) reduces median localization error to 12.3 m, significantly outperforming baseline methods. Furthermore, the architecture reduces energy consumption by nearly 40% compared with cloud-only designs and maintains end-to-end latency under 120 ms. These results demonstrate that the proposed system enables robust, real-time interference awareness for large-scale IoT deployments, paving the way toward resilient 6G smart cities.
Qian Wang, Kai Cheng, Hong Mei et al.· IEEE Internet of Things Jour...· 0 citations