Olga Torstensson

Artificial intelligence (AI)-native sixth-generation (6G) networks are expected to rely on agents in different administrative domains that coordinate policies, model versions and access rights through shared state. A permissioned ledger can anchor this state, but an edge agent can act on an update only when its own read node returns it. We use this verified state visibility, measured at the controlled read nodes, as both the service objective and the learning signal for block-pacing control in a permissioned Avalanche layer-one (L1) chain. The predictive components—gradient-boosted quantile regression with a split-conformal bound—are established; the contribution is the signal against which they are trained and checked. In simulated 6 h episodes with non-stationary load and transport degradations, a risk-aware controller that respects the rate limit of Avalanche Community Proposal 226 (ACP-226) reduced validator central processing unit (CPU) load by about 18% relative to static 250 ms pacing at a service-level objective (SLO) violation rate of about 2%. Trained on transaction receipts instead, the same controller violated the objective in about two of three windows. A reactive rule driven by verified reads performed comparably, so the gain stems from the learning signal rather than from learning-based control. In a case study, verified reads exposed an injected calibration fault online. All results are simulated.

Critical-infrastructure protection must distinguish the detection capability of artificial intelligence (AI) from its permission to act on physical processes. This article proposes Risk-Driven Deployment and Forensic Readiness for Critical Infrastructure (RDFR-CI), an action-specific framework that adds the consequence of an incorrect defensive action and execution constraints to a published AI security operations center model. A weighted score of threat exposure, detection gap, AI-specific risk, forensic-readiness risk, and consequence assigns a provisional authority level; safety, availability, forensic, AI-assurance, and human-authorization gates can only restrict it, and demonstrably prohibited actions are stopped first. A consequence-driven score floor imposes an authority ceiling, and delegation is scoped. Under joint perturbation of inputs, weights, and band boundaries, 25 of 30 synthetic scenarios retain their final authority level with probability ≥0.90. On three releases of the hardware-in-the-loop (HIL)-based Augmented Industrial Control System (ICS) Security (HAI) dataset (128 held-out attack episodes) and, with pre-specified predictions, the BATADAL water-network benchmark, the detection gap or the assurance gate limited autonomous execution to the Shadow/restricted level in 13 of 15 settings. Simulated defensive actions showed that an incorrect action’s consequence depends on the action and the asset. Exposure, AI-specific risk, forensic readiness, policy parameters, and field outcomes remain unvalidated.

Cloud integration can be economically attractive yet operationally unsuitable when dependent services exchange traffic over constrained network paths. This study develops a network-aware extension of a time-dependent, three-objective integration model and specifies a cognitive architecture for admitting, deferring, or escalating Pareto-based decisions. Strategic portfolio selection is separated from operational routing; infrastructure and service-dependency graphs connect both levels. The central mechanism evaluates whether the recommended action remains consistent across explicitly defined uncertainty scenarios, while independently checking service constraints, telemetry quality, authorization, and execution budgets. Numerical evidence is separated into an established synthetic portfolio benchmark, an independent reconstruction from its published inputs, and new deterministic network and admission-rule fixtures. Enumeration of the 18-system benchmark confirms 83,657 feasible portfolios and 446 nondominated solutions. Reanalysis of 30 paired run records preserves the original qualitative trade-off: a reference-direction NSGA-III-type baseline improves IGD+ and exact-front coverage, whereas NSGA-II uses less recorded CPU time. This comparison is a secondary reanalysis of offline optimizer records, not a measurement of real-time performance. A new three-service, two-route fixture contains 16 configurations, of which three satisfy the network-aware requirements; an additive compromise using the default route violates the specified end-to-end delay bound. A seeded stress test over 2547 synthetic instances, built from three service-dependency graph families on networks of two or three parallel logical routes between a local and a cloud domain, with traffic shifts, congestion, and route failures, reproduces this effect beyond the single fixture. A nine-scenario admission test yields recommendation agreement of 2/3, correctly withholding an automatic action at a threshold of 0.8, while a narrowed three-scenario set yields full agreement. These are deterministic model-based checks, not measured improvements in a deployed network; no trained predictor, emulation, or closed-loop controller is evaluated. The contribution is therefore formal and computational: an auditable connection between portfolio optimization, service dependencies, and decision-specific uncertainty. A separately identified evaluation protocol defines the learning, telemetry, ablation, and real-traffic evidence still required to establish closed-loop effectiveness.

Early-warning research for approaching small unmanned aerial vehicles (sUAVs) requires more than isolated images, sounds, or radio-frequency traces. A reusable resource must connect event context, synchronized observations, evidence strength, media quality, provenance, privacy treatment, and leakage-resistant evaluation units. This Data Descriptor presents uavews 0.1.0-rehearsal, an openly deposited software-and-data record that implements such a model and exercises it end-to-end on a fixed-seed synthetic corpus. The record is a rehearsal of dataset formation and validation, not a measurement campaign. It contains 180 synthetic events—90 controlled-flight simulations, 26 verified observations, 14 weak observations, and 50 hard negatives—together with 4119 analysis windows, 102 source profiles, 971 observations, 391 media objects (214 audio, 121 image, and 56 video objects), and 7242 released labels. The nominal synthetic coverage spans 30 generalized locations in three site groups from 1 April to 15 May 2025. Six canonical Parquet tables, five evaluation manifests, a machine-readable data dictionary, DataCite and PROV-O metadata, an RO-Crate description, validation outputs, source media bytes, and SHA-256 manifests are supplied. The versioned Python pipeline implements ten ordered stages, five reported equations, configurable quality gates, de-identification checks, near-duplicate grouping, and event-, location-, time-, source-, and hard-negative-aware splits. Validation of the rehearsal produced 100% schema and checksum pass rates, median and fifth-percentile completeness of 1.0, synchronization median/p95/max of 3.671/42.184/340.344 ms, exact and near-duplicate rates of 0.512% and 9.463%, cross-modal consistency of 89.88%, and Krippendorff’s alpha of 0.324 for vehicle presence. Seven of eleven release gates passed; the four failures deliberately expose properties that a real release would have to repair or adjudicate. The deposit includes 54 test functions but this article does not claim that the suite was independently executed during manuscript preparation. The accompanying field-trial calculations are planning assumptions, not observations. One of them, the reduced-design sortie count of 7200, omits the configured altitude and background factors and is reported as a known defect of the deposited code rather than as a usable experimental design. The record therefore provides a transparent, executable instrument for designing and auditing a future empirical dataset without representing synthetic values as measured performance.

Security Operations Centers increasingly use artificial intelligence to rank alerts, summarize evidence, and automate repetitive response actions. However, AI-enabled security operations can also create new risks for incident response and digital forensic reliability, including false-negative prioritization, model drift, hallucinated explanations, prompt injection, automation bias, unsafe SOAR actions, and evidence contamination. This article proposes a risk-driven deployment and forensic readiness framework for AI-enabled Security Operations Centers. The framework combines Monte Carlo loss simulation, detector threshold analysis, analyst queueing, model-drift monitoring, and evidence-preserving governance controls. It explicitly separates evidence, recommendation, and action so that AI can accelerate triage while preserving source artifacts, provenance, audit trails, and chain-of-custody information needed for incident reconstruction. Illustrative simulation results show a mean annualized loss expectancy of USD 1.70 M, a 95% Value-at-Risk of USD 3.85 M and a 99% Value-at-Risk of USD 6.29 M, a detector ROC-AUC of 0.942 and PR-AUC of 0.750 with precision 0.719, recall 0.650 and F1 0.683 at the selected decision threshold of 1.873, a manual triage workload reduction of about 38%, and a reduction in mean time to respond (MTTR, defined throughout as mean time to respond rather than mean time to resolution) from about 44 to 26 min under controlled assumptions. The results are demonstration outputs rather than universal benchmarks. The main contribution is a reproducible governance method for deciding when AI reduces SOC risk, when it transfers risk, and when forensic readiness requires human approval, evidence preservation, or automation rollback.

Integrated Modular Avionics (IMA) integrates safety-critical functions on shared computing and network resources, creating coupling channels through which a local fault may escalate into a catastrophic system-level scenario. This study develops a graph-based fractional-order model for cascade escalation in IMA architectures with communication delays and reconfiguration failures. The architecture is represented as a weighted directed graph of core processing modules, network switches, and remote data concentrators, where each node carries functional degradation and queue-backlog states. The proposed delayed Caputo fractional-order dynamics incorporate degradation propagation, backlog spillover, mixed-criticality priority conflict, and a state-dependent reconfiguration-failure mechanism. We establish well-posedness and positive invariance of the feasible state domain, derive a sufficient cascade threshold that separates a delay-independent, globally Mittag–Leffler stable nominal regime from a supercritical regime in which bistability and catastrophic attractors may occur, and characterize delay-induced oscillatory instability together with a memory-stabilization effect. Numerical experiments on a synthetic 22-node IMA configuration show fault absorption below the threshold, reconfiguration-contained cascades under sufficient supervisory capacity, and global escalation when reconfiguration collapses under load. The results indicate that backlog growth is an early warning signal and that maintaining the cascade threshold below unity while provisioning reconfiguration capacity above the tipping point can support safer reconfiguration-policy design in certifiable avionics.

This article presents practical aspects of correlating Wi-Fi wireless network radio events with cyber events collected by Security Information and Event Management (SIEM) systems, aiming to form a unified incident with spatial attribution and asset context for critical information infrastructure (CII). A unified radio monitoring event schema has been developed that includes source identifiers, RFC 3339 timestamps, radio channel parameters, aggregated frame statistics, source coordinate estimates, and confidence scores. The article describes event enrichment procedures involving zone-of-responsibility mapping, asset criticality assessment, enforcement of applicable access policies, accumulated incident history analysis, and cross-referencing with network access control (NAC) logs, authentication systems, NetFlow/IPFIX network flows, and IDS/IPS alerts. A set of correlation rules has been formulated for rogue AP, evil twin, and deauthentication attack scenarios, where the spatial factor serves as a constraining condition to reduce false positive rates and accelerate the routing of tactical response teams. SOAR playbooks are proposed to automate evidence package formation, responsible party notification, response SLA monitoring, and action logging for audit purposes. It is demonstrated that the proposed integration reduces the mean time to detect (MTTD) and mean time to respond (MTTR) while enhancing incident manageability in protected CII networks. Requirements for APIs and exchange formats are formulated that ensure compatibility with common SIEM and SOAR platforms without modifying their core.

This paper presents a method for detecting False Data Injection (FDI) attacks in Smart Grid state estimation systems based on a Long Short-Term Memory (LSTM) autoencoder. FDI attacks can bypass traditional bad-data detection algorithms based on χ²-statistics and pose a direct threat to accurate state estimation. The proposed method combines passive PMU/WAMS telemetry monitoring with an LSTM autoencoder model for anomaly detection in state vector time series of cyber-physical systems. The theoretical model was evaluated on the open-source HIL-based Augmented ICS (HAI) Security Dataset and synthetic FDI attack scenarios modeled on the IEEE 14-Bus topology. Simulated results demonstrate a detection accuracy of 97.3%, an F1-score of 0.961, and detection latency below 3 seconds at a false alarm rate under 2.1%. The proposed approach outperforms baseline methods (SVM, Random Forest, standalone Autoencoder). The scientific novelty lies in applying an adaptive reconstruction error threshold for the LSTM autoencoder that accounts for temporal dependencies in PMU telemetry measurements, thereby enhancing robustness against intentional evasion.