Real-time traffic signal acquisition and network transmission are essential components of intelligent transportation systems, facilitating real-time traffic monitoring, management, and analysis in urban environments. In this paper, we introduce a comprehensive system that incorporates live traffic signal acquisition, real-time data processing, and secure network transmission through a combination of hardware and software modules, called LIDATS. LIDATS stands for Live Intersection Data Acquisition for Traffic Simulators. The design and implementation of our system are detailed, encompassing signal acquisition hardware as well as a software platform that is used specifically for real-time data processing. The performance evaluation of our system was conducted by simulation in the lab, demonstrating its capability to reliably capture and transmit data in real time, and to effectively extract the relevant information from noisy and complex traffic data. Supporting a variety of intelligent transportation applications, such as real-time traffic flow management, intelligent traffic signal control, and predictive traffic analysis, our system enables remote data analysis and decisionmaking, providing valuable insights and enhancing the traffic efficiency while reducing the congestion in urban environments.

VANET is a type of Ad hoc network that enables the communication between vehicles and roadside units. It provides a broad range of applications, such as blind crossing, accident avoidance, protection, interactive route planning, traffic situation monitoring in real-time, etc. These applications are required to be very secure to achieve a reliable service and provide safety for drivers. This paper sheds light on three different types of attacks (Sybil Attack, Jamming Attack, Timing Attack) that can critically affect the vehicular ad hoc network environment. Furthermore, we present techniques that can overcome these attacks.

Log poisoning is a cyber-attack where adversaries manipulate systems’ log files to conceal their activities or execute malicious codes. This paper presents a thorough examination of log poisoning attacks, with a focus on demonstrating methodologies applied to prevalent Internet of Things (IoT) platforms, such as the Raspberry Pi. We introduce a novel technique that circumvents the Linux-based devices system’s protective mechanisms which truncate malicious injected code in sensitive log files. Furthermore, a novel persistence technique that allows the attacker to maintain a persistent connection with the Linux-based target device was introduced. Moreover, we propose an evasive technique that enables adversaries to effectively conceal their log poisoning attacks by executing them through encrypted tunnels using a virtual private network (VPN). Through Intrusion Modes and Criticality Analysis (IMECA), we analyze the severity and potential impact of these attacks and propose mitigation strategies to avoid the occurrence of such attacks in order to maintain the confidentiality, integrity, and reliability of IoT ecosystems. As a further step to counteract the threat, we designed a Python script that detects and mitigates log poisoning attacks, specifically against malicious codes that are injected into logs without requiring the log file to be set as executable.

Process injection techniques on Windows appli-cations are considered a serious threat to software security specialists. The attackers use these techniques to exploit the targeted program or process and take advantage of it by injecting a malicious process within the address space of the hosted process. Such attacks could be carried out using the so-called reverse engineering realm” the code caves”. For that reason, detecting these code caves in a particular application/program is deemed crucial to prevent the adversary from exploiting the programs through them. Code caves are simply a sequence of null bytes inside the executable program. They form due to the unuse of uninitialized variables. This paper presents a tool that can detect code caves in Windows programs by disassembling the program and looking for the code caves inside it; additionally, the tool will also eliminate those code caves without affecting the program’s functionality. The tool has proven reliable and accurate when tested on various types of programs under the Windows operating system.

Intelligent traffic signal controllers are increasingly connected to simulation, monitoring, and remote-management interfaces, expanding the cyber-physical attack surface of urban transportation infrastructure. This article presents GuardBox, a multimodal anomaly detection framework that monitors controller behavior, traffic command patterns, and cabinet sensor telemetry to detect attacks against signal-control logic. GuardBox combines a long short-term memory autoencoder for behavioral anomaly detection with a random forest classifier for attack-family attribution. The system is evaluated in a Simulation of Urban MObility (SUMO) testbed using 375 held-out scenarios spanning four attack families and normal operating conditions: timing manipulation, replay attack, physical intrusion, and combined cyber-physical attack. Because each attack family is injected by an explicit signature rule, the classes are separable by construction: in this controlled testbed GuardBox flags timing manipulation, replay, and combined attacks in every scenario of their classes (100%, 100%, and 100%), detects physical intrusion in 61/75 of cases (81%, an intermittent cabinet-sensor observability limit), and produces a 0% (0/75) false-positive rate on normal operation. Attribution is compared against classical classifiers (SVM, XGBoost, MLP, logistic regression) and deep-learning models (a 1D-CNN and a GRU network), and the detector against unsupervised baselines on the same telemetry; the pipeline is evaluated across three intersection topologies and under sensor noise and benign non-attack conditions. These near-perfect rates should be read as evidence that the injected signatures are separable in feature space rather than as a claim of field-level generalization. Denial-of-service flooding manifests outside the current telemetry and is therefore treated as out of scope.