With the explosive growth of Internet of Things devices and massive data produced at the edge of the network, the traditional centralized cloud computing model has come to a bottleneck due to the bandwidth limitation and resources constraint. Therefore, edge computing, which enables storing and processing data at the edge of the network, has emerged as a promising technology in recent years. However, the unique features of edge computing, such as content perception, real-time computing, and parallel processing, has also introduced several new challenges in the field of data security and privacy-preserving, which are also the key concerns of the other prevailing computing paradigms, such as cloud computing, mobile cloud computing, and fog computing. Despites its importance, there still lacks a survey on the recent research advance of data security and privacy-preserving in the field of edge computing. In this paper, we present a comprehensive analysis of the data security and privacy threats, protection technologies, and countermeasures inherent in edge computing. Specifically, we first make an overview of edge computing, including forming factors, definition, architecture, and several essential applications. Next, a detailed analysis of data security and privacy requirements, challenges, and mechanisms in edge computing are presented. Then, the cryptography-based technologies for solving data security and privacy issues are summarized. The state-of-the-art data security and privacy solutions in edge-related paradigms are also surveyed. Finally, we propose several open research directions of data security in the field of edge computing.

Edge computing is a key enabling technology that meets continuously increasing requirements for the intelligent Internet of Things (IoT) applications. To cope with the increasing privacy leakages of machine learning while benefiting from unbalanced data distributions, federated learning has been wildly adopted as a novel intelligent edge computing framework with localized training mechanism. However, recent studies found that the federated learning framework exhibits inherent vulnerabilities on active attacks, and poisoning attack is one of the most powerful and secluded attacks where the functionalities of the global model could be damaged through attackers well-crafted local updates. In this paper, we give a comprehensive exploration of the poisoning attack mechanisms in the context of federated learning. We first present a poison data generation method, named Data_Gen, based on the generative adversarial networks (GAN). This method mainly relies upon the iteratively updated global model parameters to regenerate samples of interested victims. Secondly, we further propose a novel generative poisoning attack model, named PoisonGAN, against the federated learning framework. This model utilizes the designed Data_Gen method to efficiently reduce the attack assumptions, and make attacks feasible in practice. We finally evaluate our data generation and attack models by implementing two-types of typical poisoning attack strategies, label-flipping and backdoor, on a federated learning prototype. The experimental results demonstrate that these two attack models are effective in federated learning.

Phishing scams are one of Ethereum's most representative security risks that can defraud many transactions in a short period and severely threaten network security. Existing deep learning-based phishing scam detection methods mainly rely on constructing static transaction graphs which are assumed to be accessible before model training. However, static methods that have a high false positive rate to detect newly generated phishing scams by adding this newly generated data to existing algorithms for execution, due to new accounts and transactions constantly appearing in the real-world Ethereum network. Therefore, this paper, for the first time, proposes a novel evolve-based phishing scams detection method (named GrabPhisher) that extracts temporal features of accounts and captures information about the dynamic topology of the graph as it evolves. Specifically, GrabPhisher can build the evolutionary pattern of accounts trading on Ethereum as a diffusion network graph in continuous time. It can continue to capture new transaction features based on existing transactions, which facilitates the identification of phishing accounts. Additionally, we implement GrabPhisher on the real-world Ethereum phishing scams datasets. Extensive experimental results demonstrate that GrabPhisher can effectively extract dynamic temporal features and outperform state-of-the-art methods (95% Recall, and 88% F1-score).

The emergence of new machine learning methods has led to their widespread application across various domains, significantly advancing the field of artificial intelligence. However, the process of training and inferring machine learning models relies on vast amounts of data, which often includes sensitive private information. Consequently, the privacy and security of machine learning have encountered significant challenges. Several studies have demonstrated the vulnerability of machine learning to privacy inference attacks, but they often focus on specific scenarios, leaving a gap in understanding the broader picture. We provide a comprehensive review of privacy attacks in machine learning, focusing on two scenarios: centralized learning and federated learning. This paper begins by presenting the architectures of both centralized learning and federated learning, along with their respective application scenarios. It then conducts a comprehensive review and categorization of related inference attacks, providing a detailed analysis of the different stages involved in these attacks. Moreover, the paper thoroughly describes and compares the existing defense methods. Finally, the paper concludes by highlighting open questions and potential future research directions, aiming to contribute to the ongoing competition between privacy attackers and defenders.

Edge computing is envisioned to be a powerful platform that provides efficient data storage and computation services in smart IoT systems. In this data-intensive architecture, protecting user-side data privacy is one of the most critical concerns to prevent privacy leakage from any other untrusted entities. Aiming to resist this concern, lots of privacy-preserving data aggregation (PPDA) schemes have been proposed for various cloud-enabled IoT applications. However, due to the resource-constraint nature of smart IoT devices, the conventional PPDA solutions, in terms of both privacy and performance requirements, are unsuitable in edge computing. To address this challenge, we propose a lightweight and verifiable privacy-preserving data aggregation scheme, named LVPDA, for the edge computing enabled IoT system, where the Paillier homomorphic encryption method and online/offline signature technique are combined to ensure the privacy-preserving and integrity verification during the data aggregation process. Detailed security analysis indicates that LVPDA is existentially unforgeable under the chosen message attack (EU-CMA) and the data integrity can be guaranteed with formal proof under q-Strong Diffie-Hellman (q-SDH) assumptions. Compared with other PPDA methods, our scheme can achieve lightweight privacy-preserving data aggregation in terms of less computational complexity and communication overhead.