Yaokai Feng

Denial-of-Service (DoS) attacks remain one of the most dangerous threats in modern Internet environments. They aim to overwhelm networks, servers, or online services with massive volumes of traffic, and maintaining service availability is a core pillar of cybersecurity. More importantly, DoS attack techniques continue to evolve. However, traditional intrusion detection systems (IDS) trained on fixed attack categories struggle to identify previously unknown DoS attack types and cannot dynamically incorporate newly emerging classes. To address this challenge, this study proposes a stage-wise network intrusion detection framework that integrates unknown attack detection, attack discovery, and class-incremental learning into a unified pipeline. The framework consists of three stages. First, an autoencoder-based anomaly detection approach is used to separate potential unknown DoS attack samples from known classes. Second, a clustering-and-merging strategy is applied to the detected unknown DoS samples to discover emerging attack clusters with similar structural characteristics. Third, the classifier architecture is expanded for each newly discovered cluster through a class-incremental learning mechanism, enabling the continual incorporation of new attack classes while maintaining stable detection performance on previously learned classes. Experimental results on the DoS category of the NSL-KDD dataset demonstrate that the proposed stage-wise framework can effectively isolate samples of unknown DoS attacks, accurately aggregate emerging attack clusters, and incrementally integrate newly discovered attack classes without significantly degrading recognition performance on previously learned classes. These results confirm the capability of the proposed framework to handle progressively emerging unknown DoS attacks.

Effective supply chain traceability is indispensable for ensuring food safety, which is a significant social issue. Traditional traceability systems are mostly based on centralized databases, relying on a single entity or organization and facing problems such as insufficient transparency and the risk of data tampering. To address these issues, many studies have adopted blockchain technology, which offers advantages such as decentralization and immutability. However, challenges such as data credibility and insufficient protection of private data remain. This study proposes a multi-channel architecture based on Blockchain (Hyperledger Fabric in this study), in which data is partitioned and managed across dedicated channels to strengthen the protection of sensitive information. Furthermore, a trust and incentive design is implemented, featuring a trust-value calculation function and a reward–penalty mechanism that encourage participants to upload more truthful data and improve the reliability of data before it is recorded on the blockchain. In this paper, the design and implementation of the proposed system are explained in detail, and its performance is examined using Hyperledger Caliper, a blockchain performance benchmark framework. Functional evaluations indicate that the proposed system can be correctly implemented and that it correctly supports supply chain traceability, trust- and incentive-related, privacy protecting and other functions as designed, while performance evaluations indicate that it can maintain stable performance under higher workloads, suggesting that the proposed approach is practical and applicable to food supply chain traceability scenarios.

The rapid growth of the Internet of Vehicles (IoV) requires secure, efficient, and reliable data exchanges among multiple stakeholders. Traditional centralized database systems can hardly address the challenges associated with data privacy, integrity, and scalability in this decentralized ecosystem. In this paper, we propose a Hyperledger Fabric-Based Multi-Channel Structure to overcome these limitations. By leveraging the blockchain architecture, the system ensures data confidentiality and integrity by segregating data into exclusive channels and enabling different organizations to collaborate. Cross-channel communication ensures security when data are interacted with. Chaincodes automate transactions and enhance trust between participants. Our functional tests and performance tests by using Hyperledger Caliper verified the effectiveness of the system in real-world scenarios, highlighting its advantages over traditional systems in terms of decentralization, transparency, and security. Future work will focus on enhancing the user experience and integrating the system with edge computing. Eventually, attempts will be made to operationalize it in real-world environments.

The rapid growth of the Internet of Vehicles (IoV) requires secure, efficient, and reliable data exchanges among multiple stakeholders. Traditional centralized database systems can hardly address the challenges associated with data privacy, integrity and scalability in this decentralized ecosystem. In this paper, we propose a Hyperledger Fabric-Based Multi-Channel Structure to overcome these limitations. By leveraging the blockchain architecture, the system ensures data confidentiality and integrity by segregating data into exclusive channels and enabling different organizations to collaborate. Cross-channel communication ensures security when data is interacted with. Chaincodes automate transactions and enhance trust between participants. Our test verified the effectiveness of the system in real-world scenarios, highlighting its advantages over traditional systems in terms of decentralization, transparency and security. Future work will focus on enhancing the user experience and integrating the system with edge computing. Eventually, attempts will be made to operationalize it in real-world environments.

In recent years, with the development of the Internet of Things and distributed computing, the “server-edge device” architecture has been widely deployed. This study focuses on leveraging autoencoder technology to address the binary classification problem in network intrusion detection, aiming to develop a lightweight model suitable for edge devices. Traditional intrusion detection models face two main challenges when directly ported to edge devices: inadequate computational resources to support large-scale models and the need to improve the accuracy of simpler models. To tackle these issues, this research utilizes the Extreme Learning Machine for its efficient training speed and compact model size to implement autoencoders. Two improvements over the latest related work are proposed: First, to improve data purity and ultimately enhance detection performance, the data are partitioned into multiple regions based on the prediction results of these autoencoders. Second, autoencoder characteristics are leveraged to further investigate the data within each region. We used the public dataset NSL-KDD to test the behavior of the proposed mechanism. The experimental results show that when dealing with multi-class attacks, the model’s performance was significantly improved, and the accuracy and F1-Score were improved by 3.5% and 2.9%, respectively, maintaining its lightweight nature.

In recent years, with the development of the Internet of Things and distributed computing, the "server-edge device" architecture has been widely deployed. This study focuses on leveraging autoencoder technology to address the binary classification problem in network intrusion detection, aiming to develop a lightweight model suitable for edge devices. Traditional intrusion detection models face two main challenges when directly ported to edge devices: inadequate computational resources to support large-scale models and the need to improve the accuracy of simpler models. To tackle these issues, this research utilizes Extreme Learning Machine for its efficient training speed and compact model size to implement autoencoders. Two improvements over the latest related work are proposed: First, to improve data purity and ultimately enhance detection performance, this study partitions the data into multiple regions based on the prediction results of these autoencoders. Second, leveraging autoencoder characteristics to investigate further the data within each region. We used the public dataset NSL-KDD to test the behavior of the proposed mechanism. The experimental results show that when dealing with multi-class attacks, the model's performance was significantly improved, the accuracy and the F1-score are improved by 3.5% and 2.9%, respectively maintaining its lightweight nature.

Cyber attack detection technology plays a vital role today, since cyber attacks have been causing great harm and loss to organizations and individuals. Feature selection is a necessary step for many cyber-attack detection systems, because it can reduce training costs, improve detection performance, and make the detection system lightweight. Many techniques related to feature selection for cyber attack detection have been proposed, and each technique has advantages and disadvantages. Determining which technology should be selected is a challenging problem for many researchers and system developers, and although there have been several survey papers on feature selection techniques in the field of cyber security, most of them try to be all-encompassing and are too general, making it difficult for readers to grasp the concrete and comprehensive image of the methods. In this paper, we survey the filter-based feature selection technique in detail and comprehensively for the first time. The filter-based technique is one popular kind of feature selection technique and is widely used in both research and application. In addition to general descriptions of this kind of method, we also explain in detail search algorithms and relevance measures, which are two necessary technical elements commonly used in the filter-based technique.

With the rapid development and popularization of Internet of Things (IoT) devices, an increasing number of cyber-attacks are targeting such devices. It was said that most of the attacks in IoT environments are botnet-based attacks. Many security weaknesses still exist on the IoT devices because most of them have not enough memory and computational resource for robust security mechanisms. Moreover, many existing rule-based detection systems can be circumvented by attackers. In this study, we proposed a machine learning (ML)-based botnet attack detection framework with sequential detection architecture. An efficient feature selection approach is adopted to implement a lightweight detection system with a high performance. The overall detection performance achieves around 99% for the botnet attack detection using three different ML algorithms, including artificial neural network (ANN), J48 decision tree, and Naïve Bayes. The experiment result indicates that the proposed architecture can effectively detect botnet-based attacks, and also can be extended with corresponding sub-engines for new kinds of attacks.