The security issue impacting the Internet-of-Things (IoT) paradigm has recently attracted significant attention from the research community. To this end, several surveys were put forward addressing various IoT-centric topics, including intrusion detection systems, threat modeling, and emerging technologies. In contrast, in this paper, we exclusively focus on the ever-evolving IoT vulnerabilities. In this context, we initially provide a comprehensive classification of state-of-the-art surveys, which address various dimensions of the IoT paradigm. This aims at facilitating IoT research endeavors by amalgamating, comparing, and contrasting dispersed research contributions. Subsequently, we provide a unique taxonomy, which sheds the light on IoT vulnerabilities, their attack vectors, impacts on numerous security objectives, attacks which exploit such vulnerabilities, corresponding remediation methodologies and currently offered operational cyber security capabilities to infer and monitor such weaknesses. This aims at providing the reader with a multidimensional research perspective related to IoT vulnerabilities, including their technical details and consequences, which is postulated to be leveraged for remediation objectives. Additionally, motivated by the lack of empirical (and malicious) data related to the IoT paradigm, this paper also presents a first look on Internet-scale IoT exploitations by drawing upon more than 1.2 GB of macroscopic, passive measurements’ data. This aims at practically highlighting the severity of the IoT problem, while providing operational situational awareness capabilities, which undoubtedly would aid in the mitigation task, at large. Insightful findings, inferences and outcomes in addition to open challenges and research problems are also disclosed in this paper, which we hope would pave the way for future research endeavors addressing theoretical and empirical aspects related to the imperative topic of IoT security.

Human operators play a key role in the reliable operation of critical infrastructures. However, human operators may take actions that are far from optimum. This can be due to various factors affecting the operators' performance in time-sensitive and critical situations such as reacting to contingencies with significant monetary and social impacts. In this paper, an analytic framework is proposed based on Markov chains for modeling the dynamics of cascading failures in power grids. The model captures the effects of operators' behavior quantified by the probability of human error under various circumstances. In particular, the observations from historical data and information obtained from interviews with power-system operators are utilized to develop the model as well as identify its parameters. In light of the proposed model, the noncritical regions of power-system's operating characteristics with human-factor considerations are characterized under which the probability of large cascading failures is minimized.

Science and engineering applications are now generating data at an unprecedented rate. From large facilities such as the Large Hadron Collider to portable DNA sequencing devices, these instruments can produce hundreds of terabytes in short periods of time. Researchers and other professionals rely on networks to transfer data between sensing locations, instruments, data storage devices, and computing systems. While general-purpose networks, also referred to as enterprise networks, are capable of transporting basic data such as emails and web content, they face numerous challenges when transferring terabyte-and petabyte-scale data. At best, transfers of science data on these networks may last days or even weeks. In response to this challenge, the Science Demilitarized Zone (Science DMZ) has been proposed. The Science DMZ is a network or a portion of a network designed to facilitate the transfer of big science data. The main elements of the Science DMZ include: i) specialized end devices, referred to as data transfer nodes (DTNs), built for sending/receiving data at a high speed over wide area networks; ii) high-throughput, friction-free paths connecting DTNs, instruments, storage devices, and computing systems; iii) performance measurement devices to monitor end-to-end paths over multiple domains; and iv) security policies and enforcement mechanisms tailored for high-performance environments. Despite the increasingly important role of Science DMZs, the literature is still missing a guideline to provide researchers and other professionals with the knowledge to broaden the understanding and development of Science DMZs. This article addresses this gap by presenting a comprehensive tutorial on Science DMZs. The tutorial reviews fundamental network concepts that have a large impact on Science DMZs, such as router architecture, TCP attributes, and operational security. Then, the tutorial delves into protocols and devices at different layers, from the physical cyberinfrastructure to application-layer tools and security appliances, that must be carefully considered for the optimal operation of Science DMZs. The article also contrasts Science DMZs with general-purpose networks, and presents empirical results and use cases applicable to current and future Science DMZs.

Network function virtualization (NFV) technology enables service providers to implement software-based network processing functionalities on standard computing servers (nodes). As such, this approach mandates the need for mapping virtual network functions (VNFs) in service function chains (SFCs) on these nodes for incoming service requests. Now traditional VNF mapping schemes use cloud nodes for its abundant available resources, at the detriment of prolonged network delays. Alternative schemes use fog nodes that return reduced delays, at the detriment of limited resources. Hence in this work, a novel SFC provisioning scheme is proposed for a hybrid fog-cloud architecture of various resources. The architecture is composed of a single fog and single cloud layer, in order to accommodate both delay-sensitive and delay-tolerant requirements for large number of incoming requests, respectively. This scheme yields a tradeoff between standalone cloud and fog solutions when implemented on the proposed hybrid architecture, in terms of the number of satisfied requests, network delay, resources consumption, energy consumption, and realization cost at large traffic volumes. The proposed scheme achieves 15-40% higher traffic capacity than fog solutions, 21-43% reduced delay, 45-52% less energy consumption levels and 28-30% less cost as compared to cloud solutions.

Network function virtualization (NFV) technologies are being rapidly adopted across many enterprise and service provider networks to help replace costly, proprietary hardware systems. This paradigm runs virtual “softwarized” networking functions on low-cost off-the-shelf servers and can be used to construct highly-customized service function chains (SFC) for clients. NFV also offers many advantages at the network edge, and hence newer studies have started to look at SFC deployment in specialized fog computing domains, i.e., to support clients with stringent delay and localized contextual service needs. As these trends accelerate, there is a growing need to further address service survivability in these settings, particularly for clients with stringent/rapid failure recovery requirements. Hence this paper presents novel “on-demand” heuristic solutions and batch sorting methodologies for SFC service mapping and protection in fog domains. These schemes take into account key end-user client and operator concerns, including service delay, bandwidth, and node/link resource parameters.