The rapid growth of intelligent sensing capabilities and super computation power in 6G mobile communication systems has facilitated their application in diverse domains such as smart health, smart factories, and the industrial Internet of Things. Integrated Sensing and Communication (ISAC), as a core technology, has merged with artificial intelligence (AI) to enable intelligent connectivity, leading to a paradigm shift in traditional communication modes. This paper presents a visionary design for an ISAC-oriented unified IoT architecture that integrates software-defined communication and super-intelligent agents. By leveraging dynamic adaptability, self-learning, and optimization, the ISAC system can intelligently and flexibly respond to evolving requirements and environments. The architecture is redefined into three layers: the hardware layer, the omniscient layer, and the application layer. Furthermore, a retrospective survey of ISAC technology development over the past decade is conducted, highlighting new design principles for AI-empowered networks and multi-modals that support “intelligent connectivity" across various application scenarios and reinforce the security of ISAC. This paper categorizes the related works according to the different layer structures of the proposed architecture, and some important physical and machine learning models are introduced. Additionally, we summarize the current technological bottlenecks associated with ISAC and propose future research directions and potential solutions that lay the foundation for the future development of secure and intelligent communication networks.

While much effort has been made to detect and measure the privacy leakage caused by the advertising (ad) libraries integrated in mobile applications, analytics libraries, which are also widely used in mobile apps have not been systematically studied for their privacy risks. Different from ad libraries, the main function of analytics libraries is to collect users' in-app actions. Hence, by design analytics libraries are more likely to leak users' private information. In this work, we study what information is collected by the analytics libraries integrated in popular Android apps. We design and implement a framework called “Alde”. Given an app, Alde employs both static analysis and dynamic analysis to detect the users' in-app actions collected by analytics libraries. We also study what private information can be leaked by the apps that use the same analytics library. Moreover, we analyze apps' privacy policies to see whether app developers have notified the users that their in-app action data is collected by analytics libraries. Finally, we select eight widely used analytics libraries to study and apply our method to 300 popular apps downloaded from both Chinese app markets and Google play. Our experimental results show that some apps indeed leak users' personal information through analytics libraries even though their genuine purposes of using analytics services are legal. To mitigate such threats, we have developed an app named “ALManager” that leverages the Xposed framework to manage analytics libraries in other apps.

Are Federated Learning (FL) systems free from backdoor poisoning with the arsenal of various defense strategies deployed? This is an intriguing problem with significant practical implications regarding the utility of FL services. Despite the recent flourish of poisoning-resilient FL methods, our study shows that carefully tuning the collusion between malicious participants can minimize the trigger-induced bias of the poisoned local model from the poison-free one, which plays the key role in delivering stealthy backdoor attacks and circumventing a wide spectrum of state-of-the-art defense methods in FL. In our work, we instantiate the attack strategy by proposing a distributed backdoor attack method, namely Cerberus Poisoning (CerP). It jointly tunes the backdoor trigger and controls the poisoned model changes on each malicious participant to achieve a stealthy yet successful backdoor attack against a wide spectrum of defensive mechanisms of federated learning techniques. Our extensive study on 3 large-scale benchmark datasets and 13 mainstream defensive mechanisms confirms that Cerberus Poisoning raises a significantly severe threat to the integrity and security of federated learning practices, regardless of the flourish of robust Federated Learning methods.

The blockchain cross-chain is a significant technology for inter-chain interconnection and value transfer among different blockchain networks. Cross-chain overcomes the “information island” problem of the closed blockchain network and is increasingly applied to multiple critical areas such as finance and the internet of things (IoT). Blockchain can be divided into three main categories of blockchain networks: public blockchains, private blockchains, and consortium blockchains. However, there are differences in block structures, consensus mechanisms, and complex working mechanisms among heterogeneous blockchains. The fragility of the cross-chain system itself makes the cross-chain system face some potential security and privacy threats. This paper discusses security defects on the cross-chain implementation mechanism, and discusses the impact of the structural features of blockchain networks on cross-chain security. In terms of cross-chain intercommunication, a cross-chain attack can be divided into a multi-chain combination attack, native chain attack, and inter-chain attack diffusion. Then various security threats and attack paths faced by the cross-chain system are analyzed. At last, the corresponding security defense methods of cross-chain security threats and future research directions for cross-chain applications are put forward.

In vehicular ad-hoc networks (VANET), federated learning enables vehicles to collaboratively train a global model for intelligent transportation without sharing their local data. However, due to dynamic network structure and unreliable wireless communication of VANET, various potential risks (e.g., identity privacy leakage, data privacy inference, model integrity compromise, and data manipulation) undermine the trustworthiness of intermediate model parameters necessary for building the global model. While existing cryptography techniques and differential privacy provide provable security paradigms, the practicality of secure federated learning in VANET is hindered in terms of training efficiency and model performance. Therefore, developing a secure and efficient federated learning in VANET remains a challenge. In this work, we propose a privacy-enhanced and efficient authentication protocol for federated learning in VANET, called FedComm. Unlike existing solutions, FedComm addresses the above challenge through user anonymity. First, FedComm enables vehicles to participate in training with unlinkable pseudonyms, ensuring both privacy preservation and efficient collaboration. Second, FedComm incorporates an efficient authentication protocol to guarantee the authenticity and integrity of model parameters originated from anonymous vehicles. Finally, FedComm accurately identifies and completely eliminates malicious vehicles in anonymous communication. Security analysis and verification with ProVerif demonstrate that FedComm enhances privacy and reliability of intermediate model parameters. Experimental results show that FedComm reduces the overhead of proof generation and verification by 67.38% and 67.39%, respectively, compared with the state-of-the-art authentication protocols used in federated learning.