Simone Soderi

The extended Berkeley Packet Filter (eBPF) has emerged as a powerful mechanism for extending kernel functionality. It enables observability, security monitoring, and network control. The reliability of this system depends on a pipeline encompassing compilation, static verification, and in-kernel execution. Each of these stages depends on some safety constraints and operational assumptions. We start by explaining this pipeline from a security standpoint, with an emphasis on the coherence of its elements’ security assumptions. Building on this, we present a review of the existing methods for identifying security flaws and the proposed techniques in the literature for strengthening the eBPF ecosystem. Our review indicates that fuzz testing is the most prevalent and effective approach for identifying both bugs and vulnerabiliies. Furthermore, modifications of prior attacks offer targeted insights into high-impact weaknesses. A comparison with publicly disclosed Common Vulnerabilities and Exposures (CVEs) reveals a significant misalignment between academic focus and real-world failure patterns. Specifically, maps and helpers subsystems account for some of the most present vulnerabilities but receive limited attention in published research. Additionally, we have categorized the existing defensive proposals, with notable trends identified in memory isolation, verifier redesign, and runtime hardening. These findings underscore structural gaps in the current literature and motivate the development of more integrated approaches.

Hybrid Wireless Body Area Networks (HyWBANs) are revolutionizing healthcare by integrating joint sensing and communication capabilities. However, this advancement introduces critical security challenges, as attackers can exploit sensing channels to intercept sensitive medical data. This paper introduces Secrecy Energy Efficiency (SEE) as a new performance metric for hybrid radio-optical wireless networks, enabling a quantitative assessment of secure communication under power-constrained conditions. We formulate and solve optimization problems to maximize the optical secrecy rate and SEE. We extend this analysis to a joint allocation framework for Ultra Wideband (UWB) and Near-Infrared (NIR) channels. Our approach leverages Sequential Fractional Programming (SFP), which enables to tackle the non-convex SEE maximization problem by a sequence of convex problems, addressing secure transmissions’ inherent non-convexity and fractional nature with intentional jamming. Based on lab-based in-body measurements through porcine tissue and on radio and optical average synthetic phantoms, numerical evaluations demonstrate that the NIR link can achieve approximately 3 b/Hz/Joule in SEE. Further, we show that optimal power allocation significantly outperforms random allocation methods, highlighting the potential of this approach for mission-critical healthcare applications. These findings provide a robust foundation for designing next-generation, low-power medical communication systems that balance security requirements with stringent energy constraints.

The rapid proliferation of the Internet of Things (IoT) and edge computing devices calls for solutions that deliver low latency, energy efficiency, and robust security-often challenging goals to balance simultaneously. This paper introduces a novel nanoservice-based framework that dynamically adapts to changing demands while achieving sustainable and secure edge operations. By breaking down functionalities into specialized and narrowly scoped nanoservices that are requested only as needed and eliminated when idle, the approach significantly reduces latency and energy usage compared to conventional, more static methods. Moreover, integrating a Zero-Trust Architecture (ZTA) ensures that every component-computational or security-related-is continuously verified and restricted through strict access controls and micro-segmentation. This framework's adaptability extends uniformly to all nanoservices, including those providing security features, thereby maintaining strong protective measures even as workloads and network conditions evolve. Experimental evaluations on IoT devices under varying workloads demonstrate that the proposed approach significantly reduces energy consumption and latency while maintaining security and scalability. These results underscore the potential for an integrated, flexible model that simultaneously addresses energy efficiency, performance, and security-an essential trifecta in future edge computing environments.

Hybrid Wireless Body Area Networks (HyWBANs) hold significant promise for advancing in-body communication systems in healthcare. In this work, we propose a novel dual-modality framework that integrates Ultra Wideband (UWB) radio communications with Near-Infrared (NIR) optical wireless communication to enhance the performance of Wireless Body Area Networks (WBANs). UWB provides reliable deep-tissue connectivity, while NIR offers a low-power solution for shallow-layer data exchange under Line-of-Sight (LOS) conditions. We present extensive measurement campaigns using biological tissues and synthetic phantoms to characterize the performance of each modality independently, thereby establishing a comprehensive baseline for future integration. Our experimental results, which we have validated by using a propagation model, aim to provide the academic community with accurate data on which to build hybrid systems with increased communication reliability and adaptability under controlled conditions. Moreover, we discuss potential applications and outline decision criteria for dynamic mode selection based on real-time service requirements and environmental factors. This study lays the baseline for future research to develop a unified hybrid system that can adaptively optimize performance to meet the evolving demands of innovative healthcare.

Resource constraints pose a significant cybersecurity threat to IoT smart devices, making them vulnerable to various attacks, including those targeting energy and memory. This study underscores the need for innovative security measures due to resource-related incidents in smart devices. In this paper, we conduct an extensive statistical analysis of cyberattack detection algorithms under resource constraints to identify the most efficient one. Our research involves a comparative analysis of various algorithms, including those from our previous work. We specifically compare a lightweight algorithm for detecting resource-constrained cyberattacks with another designed for the same purpose. The latter employs TinyML for detection. In addition to the comprehensive evaluation of the proposed algorithms, we introduced a novel detection method for resource-constrained attacks. This method involves analyzing protocol data and categorizing the final data packet as normal or attacked. The attacked data is further analyzed in terms of the memory and energy consumption of the devices to determine whether it is an energy or memory attack or another form of malicious activity. We compare the suggested algorithm performance using four evaluation metrics: accuracy, PoD, PoFA, and PoM. The proposed dynamic techniques dynamically select the classifier with the best results for detecting attacks, ensuring optimal performance even within resource-constrained IoT environments. The results indicate that the proposed algorithms outperform the existing works with accuracy for algorithms with TinyML and without TinyML of 99.3\%, 98.2\%, a probability of detection of 99.4\%, 97.3\%, a probability of false alarm of 1.23\%, 1.64\%, a probability of misdetection of 1.64\%, 1.46 respectively. In contrast, the accuracy of the novel detection mechanism exceeds 99.5\% for RF and 97\% for SVM.