ABSTRACT Smart cities are digitally advanced urban environments that are equipped with sensor networks to gather, share, and analyze extensive data across interconnected systems. Among various smart city applications, the intelligent transportation system represents one of the most critical and securityâsensitive domains. An intelligent transportation system relies heavily on continuous vehicular communication, a lowâlatency decisionâmaking process, as well as realâtime traffic monitoring. Existing Internet of Things security methods encounter significant computational overhead and limited scalability, making them unfit for realâtime applications. To address these issues, this paper proposes a novel security model, named Deep Residual Stacked Bidirectional Network. The proposed system is integrated into a blockchainâsupported hybrid system to ensure security and privacy for users and systems in smart cities. This enhanced DeepâLearning model combines the residual learning power with bidirectional long shortâterm memory layers. To effectively manage deeper networks, residual connections help mitigate the vanishing gradient problem, while bidirectional long shortâterm memory provides sequential dependencies in backward and forward directions. This allows the model to detect patterns in data, especially in security environments where data is highly dynamic and timeâsensitive. Four Internet of Thingsârelated datasets are used to evaluate the efficiency of the developed algorithm. These datasets offer various realâworld network traffic and attack scenarios that allow comprehensive performance evaluation of the proposed approach in comparison with existing methods. The test outcomes revealed that the blockchainâsupported proposed method outperforms traditional methods with an accuracy of 98.21%, specificity of 97.39%, and F1âscore of 97.46%.
Wisam Makki Alwash, Weam Husham Aljabbari, Muhammed Ali Aydın, Hasan H. Balık
Internet of Vehicles (IoV) intrusion detection systems (IDSs) require collaborative learning that preserves raw-data locality while producing independently checkable post-run evidence. This paper presents FL-BC-IDS, an evidence-native, privacy-aware hierarchical federated IDS in which vehicles train Differentially Private XGBoost models, roadside units perform deterministic admission and tree-bagging aggregation, and the GLOBAL stage forms an equal-weight ensemble over validated RSU models. Signed reports, privacy records, SHA-256/Poseidon commitments, scoped Groth16 proofs, reconstructable public inputs, and digest-pinned blockchain receipts provide a unified verification path. Across 10 seed-controlled runs, the mean ± SD accuracy/F1 values were 0.998021±0.000246/0.983597±0.002053 on CSE-CIC-IDS2018 and 0.999867±0.000152/0.999495±0.000579 on CICIoV2024. With thresholds fixed exclusively from development data, the strict held-out-attack macro recall was 0.8031 and 0.9090 on CSE-CIC-IDS2018 and CICIoV2024, respectively, indicating residual attack-specific generalization limitations; supervised rolling-origin temporal refresh on CSE-CIC-IDS2018 achieved 0.984788 pooled seen-attack recall at a 0.005700 test FPR. A controlled 20-vehicle, eight-round heterogeneity and participation stress test retained 0.998151 accuracy and 0.984782 F1-score. Verification rejected invalid or context-mismatched artifacts and independently checked modelâanchor consistency, RSU aggregation replay, commitments, and public inputs. The reported DP budgets are conditional learner-stage bounds for learner-input record instances, not end-to-end guarantees for original pre-preprocessing records.
Internet of Vehicles (IoV) security mechanisms often classify isolated messages or assign node-level trust scores, yet these decisions do not explain whether a malicious but authenticated event has distorted the intended evolution of traffic. This paper proposes IntentProv-IoV, a causally grounded provenance framework for traffic-intent preservation in V2X environments. Traffic intent is modeled as the short-horizon collective state expected under non-adversarial conditions, and deviation is measured between predicted and observed traffic states. The framework constructs temporal provenance graphs linking vehicles, roadside units (RSUs), cooperative perception outputs, prediction nodes, and traffic-control decisions. To remove the ambiguity of marginal contribution, node contribution is formalized as an interventional effect in a structural causal model and estimated through Monte Carlo counterfactual edge-weight attenuation, with a linear sensitivity fallback for real-time edge deployment. A calibrated composite score integrates anomaly evidence, traffic-intent deviation, trust risk, and provenance contribution. The evaluation design compares IntentProv-IoV with detection, trust, blockchain trust, graph anomaly, Granger causal, structural causal, and counterfactual GNN baselines and includes predictor sensitivity, adaptive adversaries, prediction noise, packet loss, trajectory-only real-data validation, and edge overhead. Simulation-scale results indicate improved attribution precision, stronger traffic-intent deviation reduction, and edge-suitable latency. By shifting V2X security from message-level detection to causally explainable traffic-intent assurance, IntentProv-IoV provides a more accountable security objective for cooperative vehicular systems.
Abstract Vehicle-to-everything (V2X) systems combine safety-relevant telemetry, wireless communication, distributed identity, collaborative learning, and long-lived cryptographic trust, creating security dependencies that are difficult to evaluate when each mechanism is studied in isolation. This paper presents OmniGuard V2X, a six-layer research prototype that integrates post-quantum key establishment and signatures, privacy commitments, decentralized identity, a permissioned tamper-evident ledger, federated-learning experimentation, anomaly hooks, and authenticated runtime services in a unified C++/Go/Python stack. The contribution is an assumption-aware validation model rather than a new cryptographic primitive. The supported native path uses real ML-KEM-512 and ML-DSA-44 operations, while classical Pedersen and Schnorr-style assumptions are explicitly excluded from end-to-end post-quantum claims. The prototype further implements encrypted persistent PQC identity material, stable key identifiers, guarded rotation, signed key-transition evidence, bounded historical signature verification, fail-closed provider selection, replay-aware local control, and authenticated rollback-state checks. A retained warm-start pipeline measurement is 5.34 ms in one prototype environment and is reported only as a descriptive local result. Existing anomaly and federated-learning experiments are classified as sanity checks because they do not yet support statistically defensible robustness metrics. The study shows how machine-readable security boundaries and evidence-aware claim control can improve the reproducibility and interpretability of multi-mechanism V2X security prototypes.
Roadside edge infrastructure is becoming an active execution layer in connected transportation. Roadside units, edge servers, and vehicular gateways not only relay safety messages, but also run local services and support traffic-control decisions. Once these nodes are compromised, data authentication, blockchain logging, or forensic evidence management cannot by itself guarantee service trustworthiness, because the node that senses, signs, forwards, or processes the information may already be running an unauthorized software stack. This paper presents RISE-CT, a runtime-integrity assurance and self-healing recovery framework for roadside edge infrastructure. RISE-CT models each node through a layered security-state graph covering hardware roots, boot chains, firmware images, runtime processes, key usage, and service status. It combines boot-time, periodic, and event-triggered attestation with runtime drift diagnosis to detect firmware deviation, process injection, abnormal key access, replayed evidence, and service-behavior changes. When the risk score exceeds policy thresholds, a risk-aware admission state machine moves the affected node into degraded, quarantined, or recovering states, and coordinates service migration, key renewal, firmware rollback, and re-attestation before safe re-admission. Seed-controlled emulation under firmware tampering, malicious OTA updates, runtime injection, key misuse, replayed attestation, and roadside-service hijacking shows that, under the evaluated emulation settings, RISE-CT reduces the representative detection delay to 0.98 s and service interruption to 0.82 s, while achieving a 0.94 re-admission success rate with controlled attestation overhead. The results suggest that runtime node integrity can provide a potential security mechanism for improving the trustworthiness of roadside infrastructure under the evaluated conditions.