The proliferation of IoT services has spurred a surge in network attacks, heightening cybersecurity concerns. Essential to network defense, intrusion detection and prevention systems (IDPSs) identify malicious activities, including denial of service (DoS), distributed denial of service (DDoS), botnet, brute force, infiltration, and Heartbleed. This study focuses on leveraging unsupervised learning for training detection models to counter these threats effectively. The proposed method utilizes basic autoencoders (bAEs) for dimensionality reduction and encompasses a three-stage detection model: one-class support vector machine (OCSVM) and deep autoencoder (dAE) attack detection, complemented by density-based spatial clustering of applications with noise (DBSCAN) for attack clustering. Accurately delineated clusters aid in mapping attack tactics. The MITRE ATT&CK framework establishes a “Cyber Threat Repository”, cataloging attacks and tactics, enabling immediate response based on priority. Leveraging preprocessed and unlabeled normal network traffic data, this approach enables the identification of novel attacks while mitigating the impact of imbalanced training data on model performance. The autoencoder method utilizes reconstruction error, OCSVM employs a kernel function to establish a hyperplane for anomaly detection, while DBSCAN employs a density-based approach to identify clusters, manage noise, accommodate diverse shapes, automatically determining cluster count, ensuring scalability, and minimizing false positives and false negatives. Evaluated on standard datasets such as CIC-IDS2017 and CSECIC-IDS2018, the proposed model outperforms existing state of art methods. Our approach achieves accuracies exceeding 98% for the two datasets, thus confirming its efficacy and effectiveness for application in efficient intrusion detection systems.
13 September 2025 in Indonesian Journal of Electrical Engineering and Informatics (IJEEI)
The advent of Cloud-Fog-Edge computing has transformed distributed data processing by performing computation closer to end devices. Due to resource constraints at edge nodes and the dynamic nature of fog-assisted communication, secure and efficient group key distribution and batch verification in such decentralized systems remain a major challenge. Many existing protocols based on Chinese remainder theorem (CRT) use straightforward scalar product with no non-linear transformation to mask the group key and hence fail to provide semantic security. Others suffer from architectural overhead since they require distinct and independent sets of moduli equations with multiple mathematical structures for different network layers, which increases computing overhead, limits scalability and synchronization delays during frequent node leave/join. To mitigate these challenges, this paper proposes a unified distributed CRT-based protocol for Cloud-Fog-Edge environments. Our protocol introduces a non-linear two-factor encryption logic, by incorporating a unique secret parameter for every edge node and breaks the algebraic linearity of the CRT. Additionally, our protocol uses a single set of moduli equations across Cloud-Fog-Edge networks which drastically reduces computation and storage costs at the fog layer. Our protocol achieves O(1) efficiency for rekeying. Formal security analysis using ProVerif and ROR model demonstrates that our protocol has considerable security advantages. To prove its practicality, an ESP32-based simulation on Wokwi is used to verifies the correctness of group key distribution, retrieval, and batch message verification. The performance analysis findings show that our protocol outperforms others in computation cost, communication cost, security and applicability for resource-constrained Cloud-Fog-Edge computing networks.
The advent of cloud–fog–edge computing has transformed distributed data processing by performing computation closer to end devices. Due to resource constraints at edge nodes and the dynamic nature of fog-assisted communication, secure and efficient group key distribution and batch verification in such decentralized systems remain a major challenge. Many existing protocols based on Chinese remainder theorem (CRT) use a straightforward scalar product to mask the group key and hence fail in multifactor security. Others suffer from architectural overhead since they require distinct and independent sets of moduli equations with multiple mathematical structures for different network layers, which increases computing overhead, limits scalability and delays synchronization during frequent node leave/join. To mitigate these challenges, this paper proposes a unified distributed CRT-based protocol for cloud–fog–edge environments. Our protocol introduces a two-factor modular key masking mechanism by incorporating a unique secret parameter for every edge node to strengthen group key protection and enhance the overall robustness of the key distribution mechanism. Additionally, our protocol uses a single set of moduli equations across cloud–fog–edge networks, which drastically reduces computation and storage costs at the fog layer. Our protocol achieves (1) efficiency for rekeying. Formal security analysis using ProVerif and the ROR model demonstrates that our protocol has considerable security advantages. To prove its practicality, an ESP32-based simulation on Wokwi is used to verify the correctness of group key distribution, retrieval, and batch message verification. The performance analysis findings show that our protocol outperforms others in computation cost, communication cost, security and applicability for resource-constrained cloud–fog–edge computing networks.