The Manufacturing Message Specification (MMS) protocol is frequently used to automate processes in IEC 61850-based substations and smart-grid systems. However, it may be susceptible to a variety of cyber-attacks. A frequently used protection strategy is to deploy intrusion detection systems to monitor network traffic for anomalies. Conventional approaches to detecting anomalies require a large number of labeled samples and are therefore incompatible with high-dimensional time series data. This work proposes an anomaly detection method for high-dimensional sequences based on a bidirectional LSTM autoencoder. Additionally, a text-mining strategy based on a TF-IDF vectorizer and truncated SVD is presented for data preparation and feature extraction. The proposed data representation approach outperformed word embeddings (Doc2Vec) by better preserving critical domain-specific keywords in MMS traffic while reducing the complexity of model training. Unlike embeddings, which attempt to capture semantic relationships that may not exist in structured network protocols, TF-IDF focuses on token frequency and importance, making it more suitable for anomaly detection in MMS communications. To address the limitations of existing approaches that rely on labeled samples, the proposed model learns the properties and patterns of a large number of normal samples in an unsupervised manner. The results demonstrate that the proposed approach can learn potential features from high-dimensional time series data while maintaining a high True Positive Rate.

The exponential growth of Internet of Things (IoT) devices introduces significant security challenges due to their resource constraints and diverse attack surfaces. To address these issues, this paper proposes the Centralized Two-Tiered Tree-Based Intrusion Detection System (C2T-IDS), a lightweight framework designed for efficient and scalable threat detection in IoT networks. The system employs a hybrid edge-centralized architecture, where the first tier, deployed on edge gateways, performs real-time binary classification to detect anomalous traffic using optimized tree-based models. The second tier, hosted on a centralized server, conducts detailed multi-class classification to diagnose specific attack types using advanced ensemble methods. Evaluated on the realistic CIC-IoT-2023 dataset, C2T-IDS achieves a Macro F1-Score of up to 0.94 in detection and 0.80 in diagnosis, outperforming direct multi-class classification by 5–15%. With inference times as low as 6 milliseconds on edge devices, the framework demonstrates a practical balance between accuracy, efficiency, and deployability, offering a robust solution for securing resource-constrained IoT environments.

In this paper, we propose a new method for choosing the most suitable time-series classification method that can be applied to online gamma dose rate incidents. We referred to the historical incidents measured in the German Radiation Early Warning Network and clustered them into several classes before testing existing classification methods. This raises the research problem of the online classification of time-series data with varying scales and lengths. Referring to the state-of-the-art methods, we found that no specific classification method can fit our data all the time. This motivated us to introduce our own approach.

This paper aims to secure sensitive data generated by IoT devices by introducing a lightweight hybrid approach that combines steganography and cryptography. While classical cryptography offers confidentiality guarantees, the visibility of the produced ciphertexts keeps them at risk of traffic analysis, which could reveal communication patterns. Although some studies use Curve25519-based protocols, ECC paired with RDWT, or VLSB-based steganography, there is no complete approach that combines cryptographic and steganographic methods that is tailored to IoT devices. Our proposed scheme addresses this gap by integrating X25519 with Elligator 2 for efficient key exchange, using Ascon-AEAD128 for encryption, and finally hiding the encrypted payload within cover images using hybrid DWT-DCT steganography. When compared to similar hybrid approaches, our method achieves better performance, with results showing high imperceptibility, low computational overhead, and good resistance to noise. The cryptographic-steganographic combo adopted by our proposed framework improves confidentiality, integrity, and resistance to detection in resource-constrained IoT systems.

Federated, semi-supervised novelty detection is well suited for intrusion detection on resource-constrained Internet of Things (IoT) nodes: each device learns a model of benign traffic, shares only summary statistics, and does not transmit raw traffic samples. A previously published cross-layer federated detector, Baseline K-Means, showed that periodically merging worker statistics through a coordinator raises the detection rate, but it also exhibited a systematic side effect: after every merge, the precision decays, and the false-positive rate (FPR) climbs because the coordinator recomputes its threshold from streaming distances filtered by the closest observed anomaly, so tightens after every merge, flagging progressively more benign traffic; the threshold was also hand-tuned. We present AF-BKM, an Adaptive Federated Baseline K-Means that repairs the federated mechanism with two label-free, statistics-only enhancements, denoted as E1 and E2: (i) an adaptive decision threshold read from the benign Mahalanobis-distance distribution, requiring no manual percentile search and no attack labels (E1), and (ii) a robust, benignly anchored aggregation that blends worker means under quality weighting and outlier-worker filtering and recalibrates the threshold on a trusted benign anchor to a stable, anchor-referenced false-positive level, which a target-FPR rule can make operator-selectable instead of tightening it toward the nearest anomaly (E2). With MinMax scaling fit only on benign baseline data and non-IID federated streams on NSL-KDD, UNSW-NB15 and the N-BaIoT corpus of real traffic from commercial IoT devices, AF-BKM removes the merge-induced precision decay (the first-to-last-epoch precision change improves from $-0.134$ to $-0.002$ on NSL-KDD, from $-0.121$ to $-0.014$ on UNSW-NB15, and from $-0.170$ to $-0.009$ on N-BaIoT) and reduces the mean FPR by 30–$64\%$, depending on the dataset; all central improvements are significant across 10 seeds (Wilcoxon $p=0.002$, large effect sizes). AF-BKM preserves recall on NSL-KDD and N-BaIoT and, on the harder UNSW-NB15, exposes an explicit precision–recall trade-off through a benign target-FPR knob. In fp32, the deployed model serializes to $5.5$–52 KB, a packet is classified in 11–27 µs on a desktop CPU, and each merge round uploads a $d+3$-value summary (160–472 B) $94.6$–$98.3\%$ smaller than the same summary extended with the covariance upper triangle. A robustness study covering selected faulty-worker updates, contamination of the commissioning anchor, and detector-level white-box evasion reports the measured degradation patterns: fabricated threshold candidates have no direct path to the threshold, although a fabricated mean still reaches it indirectly through the blended centroid, and the anchor-referenced false-positive level remains stable under percent-level anchor contamination, while recall sensitivity is dataset-dependent and the evasion budget tracks the benign–attack margin of each dataset. We frame the contribution with a focused taxonomy that identifies merge-induced precision decay under non-IID workers as an open gap. Code is released for reproducibility.