Due to the difficulty in predefining novel attack patterns and the scarcity of sufficient malicious training samples in specialized Internet of Things (IoT) scenarios, the focus of IoT intrusion detection researchers has shifted toward anomaly-based techniques like Autoencoder. These techniques detect attacks based on the degree of deviation and rely minimally on malicious samples. However, current machine learning (ML) and deep learning (DL) implementations lack explainability. Although some methods provide post-hoc interpretations, they are limited and partial, failing to reflect the entire decision-making process. To address this challenge, we investigate an explainable anomaly-based intrusion detection system (IDS) that translates the inference process of the Autoencoder into the high-fidelity allow-list rule library, thereby balancing the detection capability and interpretability. First, we assume that benign traffic follows a complex global distribution composed of several irrelevant local distributions. The clustering algorithm is performed in an extended feature space consisting of reconstruction loss and embeddings to decompose local distributions. Then, we deploy an approach based on Gradient Ascent to explore the boundary rules of each local distribution. The allow-list rule library that reflects Autoencoder’s inference process can be constructed by merging these boundary rules. Comprehensive evaluation experiments demonstrate that the extracted allow-list rule library accurately reproduces Autoencoder’s inference process and effectively detects IoT intrusions.

In response to the challenge of low accuracy in node trust evaluation due to the high dynamics of entry and exit of drone cluster nodes, we propose a hierarchical blockchain-based trust measurement method for drone cluster nodes. This method overcomes the difficulties related to trust inheritance for dynamic nodes, trust re-evaluation of dynamic clusters, and integrated trust calculation for drone nodes. By utilizing a multi-layer unmanned cluster blockchain for trusted historical data storage and verification, we achieve scalability in measuring intermittent trust across time intervals, ultimately improving the accuracy of trust measurement for drone cluster nodes. We design a resource-constrained multi-layer unmanned cluster blockchain architecture, optimize the computing power balance within the cluster, and establish a collaborative blockchain mechanism. Additionally, we construct a dynamic evaluation method for trust in drone nodes based on task perception, integrating and calculating the comprehensive trust of drone nodes. This approach addresses trusted sharing and circulation of task data and resolves the non-inheritability of historical data. Experimental simulations conducted using NS3 and MATLAB demonstrate the superior performance of our trust value measurement method for unmanned aerial vehicle cluster nodes in terms of accurate malicious node detection, resilience to trust value fluctuations, and low resource delay retention.

The frequent attacks show that no information system is absolutely safe and the security capabilities are relative. Security resilience becomes a complementary priority for improving information systems’ continuous service and security capabilities in the face of attacks such as unknown vulnerabilities and backdoors. Endogenous security defense technology has become an important research aspect to improve the security resilience of information systems. However, there are some limitations in the research of the information system security resilience evaluation model, such as lacking indexes to characterize the system security resilience under an attack environment. In this paper, a security resilience enhancement strategy based on dynamic defense is constructed to improve the security performance of the system through IP port hopping and attack surface conversion. For the adversarial behaviors of attackers and defenders, we propose a security resilience metric framework based on the evolution of attack and defense scenarios, which is evaluated using a resilient security evaluation model based on the fuzzy Choquet integral. In the model, the weights of evaluation indicators are calculated based on the DEMATEL method. The 2-addable fuzzy measures of each indicator are calculated secondarily. Then the security performance of the system is calculated using the fuzzy Choquet integral. Absorptive capacity, adaptive capacity, and resilience factor are proposed to better supervise the metric framework’s validity. Finally, four groups of control cases were created by building the Web service system after the endogenous security transformation as the experimental simulation scenario. Experimental simulation results show the superiority of the proposed metric model.

With the rapid development of intelligent connected vehicles (ICVs), their intelligent, remote, and high-speed mobility characteristics have led to an expansion of their attack surface, and thus an increase in security requirements. Consequently, security research for ICVs has become a current research focus. However, existing security risk monitoring measures lack linkage with attack behavior, and security defense strategies cannot fully and promptly respond to security risk levels and system vulnerabilities. Therefore, this paper proposes a security evaluation framework for ICVs based on attack chains. The framework focuses on the mechanism and steps of attack generation, evaluates the current risk level and degree of harm in a targeted manner, and maps appropriate security management measures according to the degree of harm. This security evaluation model integrates various defense mechanisms and resolves the mismatch between existing ICV security defense measures and security situations. The effectiveness of this model has been validated through experiments, and potential research directions in the future are discussed and analyzed.

As the Internet of Vehicles (IoV) rapidly gains popularity, the Controller Area Network (CAN) faces increasingly severe security threats. Most of the existing research on protecting the CAN bus has been based on artificial intelligence models, which require complex feature extraction and training processes and are too resource-intensive for deployment in resource-constrained CAN environments. To address these challenges, we propose a lightweight intrusion detection system based on locality-sensitive hashing that achieves efficient security protection without relying on complex machine learning and deep learning frameworks. We employ the Nilsimsa algorithm to compute hash digests of the data, using the similarity scores of these digests as anomaly scores to identify abnormal traffic. Evaluations show that our method achieves an accuracy of 98%, and tests of the system’s overhead confirm its suitability for deployment in resource-limited CAN scenarios.