The convenience of wireless communication has led to its widespread adoption across various application scenarios. However, existing Physical Layer Authentication (PLA) schemes still have limitations in terms of adaptability. This paper introduces a novel method based on key-less channel-based authentication framework designed to enhance PLA performance under different mobility patterns. Our method combines the sliding window with a model based on a siamese neural network, enabling a fully connected neural network classifier to effectively distinguish between legitimate transmitters and potential attackers, achieving an accuracy of 97.91%. Experiments conducted in various environments demonstrate the robustness and high performance of the proposed method, making it well-suited for deployment in time-varying environments with high-security demands and resource constraints.

The growing digitalization of Industrial Control Systems (ICSs) presents both significant benefits and security challenges, especially for small and medium-sized factories with limited resources. Effective anomaly detection is essential to safeguard these facilities and prevent costly disruptions. Although current research has advanced anomaly detection, it is still challenging for algorithms to be capable of effectively balancing the interplay between training speed, computational cost, and accuracy while simultaneously exhibiting robust stability and adaptability. This gap often leaves small and medium-sized factories without efficient solutions. To address these issues, this work introduces a deep belief network-based boosting adversarial autoencoder termed DBN-BAAE, a novel lightweight anomaly detection mechanism based on boosting adversarial learning. The proposed lightweight mechanism saves computational overhead, enhances autoencoder training stability with an improved deep belief network (DBN) for pre-training, boosts encoder expression through ensemble learning, achieves high detection accuracy via an adversarial decoder, and employs a dynamic threshold to enhance adaptability and reduce the need for retraining. Experiments reveal that the mechanism not only achieves an F1 score of 0.82, surpassing the best baseline by 1%, but also accelerates training speed by 2.2 times, demonstrating its effectiveness and efficiency in ICS environments, particularly for small and medium-sized factories.

IoT-based applications require effective anonymous authentication and key agreement (AKA) protocols to secure data and protect user privacy due to open communication channels and sensitive data. While AKA protocols for these applications have been extensively studied, achieving anonymity remains a challenge. AKA schemes using one-time pseudonyms face resynchronization issues after desynchronization attacks, and the high computational overhead of bilinear pairing and public key encryption limits its applicability. Existing schemes also lack essential security features, causing issues such as vulnerability to ephemeral secret leakage attacks and key compromise impersonation. To address these issues, we propose two novel AKA schemes, PUAKA and RCAKA, designed for different IoT traffic patterns. PUAKA improves end device anonymity in the periodic update pattern by updating one-time pseudonyms with authenticated session keys. RCAKA, for the remote control pattern, ensures anonymity while reducing communication and computation costs using shared signatures and temporary random numbers. A key contribution of RCAKA is its ability to resynchronize end devices with incomplete data in the periodic update pattern, supporting continued authentication. Both protocols’ security is proven under the Real-or-Random model. The performance comparison results show that the proposed protocols exceed existing solutions in security features and communication costs while reducing computational overhead by 32% to 50%.

Internet of Things (IoT) user authentication protocols enable secure authentication and session key negotiation between users and IoT devices via an intermediate server, allowing users to access sensor data or control devices remotely. However, the existing IoT user authentication schemes often assume that the servers (registration center and intermediate servers) are fully trusted, overlooking the potential risk of insider attackers. Moreover, most of the existing schemes lack critical security properties, such as resistance to ephemeral secret leakage attacks and offline password guessing attacks, and they are unable to provide perfect forward security. Furthermore, with the rapid growth regarding IoT devices, the servers must manage a large number of users and device connections, making the performance of the authentication scheme heavily reliant on the server’s computational capacity, thereby impacting the system’s scalability and efficiency. The design of security protocols is based on the underlying security model, and the current IoT user authentication models fail to cover crucial threats like insider attacks and ephemeral secret leakage. To overcome these limitations, we propose a new security model, IoT-3eCK, which assumes semi-trusted servers and strengthens the adversary model to better meet the IoT authentication requirements. Based on this model, we design an efficient protocol that ensures user passwords, biometric data, and long-term keys are protected from insider users during registration, mitigating insider attacks. The protocol also integrates dynamic pseudo-identity anonymous authentication and ECC key exchange to satisfy the security properties. The performance analysis shows that, compared to the existing schemes, the new protocol reduces the communication costs by over 23% and the computational overhead by more than 22%, with a particularly significant reduction of over 95% in the computational overhead at the intermediate server. Furthermore, the security of the protocol is rigorously demonstrated using the random oracle model and verified with automated tools, further confirming its security and reliability.

Deep learning (DL)-based physical-layer authentication (PLA) has shown promising performance in industrial Internet of Things (IIoT) scenarios. Existing methods formulate PLA as a single multiclassification task with a static training dataset and implicitly assume the training and authentication data are drawn from the same distribution. However, user mobility over time in mobile IIoT leads to a temporal distribution shift in channel impulse response (CIR), severely degrading authentication performance. To address this challenge, we propose a temporal meta-metric learning method for PLA (TMML-PLA), a temporal meta-metric learning method that reformulates multiuser PLA as a sequence of temporal few-shot classification tasks based on the intrinsic temporal correlation characteristic of CIR. When new CIR samples require authentication, the model dynamically constructs a task using a small set of the most recent CIR samples of each user as the support set to ensure distributional consistency. A temporal meta-metric learning scheme based on the prototypical network (ProtoNet) is introduced to tackle these tasks under evolving CIR distributions, and a temporal decay mechanism is designed to emphasize recent training samples. Experiments on a real-world IIoT dataset demonstrate that TMML-PLA significantly improves both accuracy and robustness. For instance, when the number of users is 15, and the authenticating CIR samples increase over time, TMML-PLA maintains stable accuracy from 88.20% to 85.75% while the DL-based ResNet drops sharply from 83.93% to 46.95%, confirming its robustness and accuracy in mobile IIoT scenarios.

Fuzz testing has been recognized as a potent methodology for uncovering vulnerabilities in industrial control systems (ICS). In this work, we proposed a novel probabilistic mutation fuzz testing model named FMutator. FMutator is innovatively designed to augment the diversity of test cases in ICS fuzz testing and enhance the efficiency of vulnerability detection. FMutator integrates the principles of probabilistic mutation with capabilities of a bidirectional long short-term memory network. Experiments demonstrate that FMutator can autonomously learn mutation probabilities for each data field, effectively eliminating the necessity for prior protocol-specific knowledge. When benchmarked against traditional genetic mutation and contemporary deep learning algorithms, FMutator shows superior proficiency, particularly in terms of recognition rate and diversity of generated test cases. Experiments show that FMutator's test case recognition rate exceeds 80% across different sample sizes, highlighting FMutator's efficacy in enhancing ICS security, and marks a significant advancement in fuzz testing methodologies.