Thanks to the great advancement of cognitive computing, artificial intelligence, big data, and the Internet of Things (IoT) technologies, the fusion of the physical and virtual worlds is changing people's lifestyles. Although the research and deployment of cyber-physical systems (CPSs) are notably promoted by cognitive computing, the reliability and large-scale application of CPSs are still significantly challenged by some security issues. Therefore, it is meaningful to clarify and address the weaknesses of current intrusion detection methods for CPSs and enhance the ability to identify, analyze, and predict to improve the performance of intrusion detection. In this article, we first propose a novel self-learning spatial distribution algorithm, named Euclidean distance-based between-class learning (EBC learning), which improves between-class learning by calculating the Euclidean distance (ED) among k-nearest neighbors of different classes. In addition, a cognitive computing-based intrusion detection method named border-line SMOTE and EBC learning based on random forest (BSBC-RF) is also proposed based on the EBC learning for industrial CPSs. The experimental results over a real industrial traffic dataset show that the proposed EBC learning has strong spatial constraint capability and can improve the prediction and recognition performance. Compared with the eight state-of-the-art methods, the proposed method has an ACC exceeding 99.5%, false alarm rate (FAR) less than 0.06%, and F1 close to 0.99, which is still superior to other ones.

The Neighbor Discovery Protocol (NDP) is one of the main protocols in the Internet Protocol version 6 (IPv6) suite, and it provides many basic functions for the normal operation of IPv6 in a local area network (LAN), such as address autoconfiguration and address resolution. However, it has many vulnerabilities that can be used by malicious nodes to launch attacks, because the NDP messages are easily spoofed without protection. Surrounding this problem, many solutions have been proposed for securing NDP, but these solutions either proposed new protocols that need to be supported by all nodes or built mechanisms that require the cooperation of all nodes, which is inevitable in the traditional distributed networks. Nevertheless, Software-Defined Networking (SDN) provides a new perspective to think about protecting NDP. In this paper, we proposed an SDN-based authentication mechanism to verify the identity of NDP packets transmitted in a LAN. Using the centralized control and programmability of SDN, it can effectively prevent the spoofing attacks and other derived attacks based on spoofing. In addition, this mechanism needs no additional protocol supporting or configuration at hosts and routers and does not introduce any dedicated devices.

Time-Sensitive Networking (TSN) can ensure deterministic communications for time-critical traffic, which plays a crucial role in various real-time scenarios. In this letter, we propose and study a neglected problem in TSN, named flow ordering problem, which provides a new perspective on improving the scheduling of large-scale TSN. Specifically, we formulate the flow ordering problem, look into its theoretical basis, and prove this problem is NP-hard. Furthermore, we propose a hybrid search algorithm to provide an optimized scheduling order. Simulation results verify the significant impact of the flow ordering problem on TSN scheduling and the effectiveness of our algorithm.