The paper investigates whether machine learning models for IoT intrusion detection truly learn attack patterns or rely on dataset shortcuts. Using the CyberFlowIoT-GICAP benchmark, the authors evaluate four learning paradigms across different feature sets and split strategies, finding that performance is largely driven by feature representation and that tree-based models can exploit temporal artifacts. The study also highlights asymmetric attack detectability and proposes a four-point protocol checklist for realistic evaluation.
By Uday Shankar Roy, Mahbuba Jahan Minu
arXiv:2605.02346v2 Announce Type: replace-cross
Abstract: Operational technology (OT) devices run safety-critical physical processes, yet their security testing remains manual and expert-intensive. A...
By Adel ElZemity, Budi Arief, Shujun Li, George Oikonomou, James Pope
arXiv:2608. 11802v1 Announce Type: cross Abstract: Methods to increase the resilience of systems to cyber-attacks become increasingly important.
By Martin Sachenbacher, Martin Leucker, Alexander Weiss, Aliyu Tanko Ali
arXiv:2608. 05548v1 Announce Type: cross Abstract: Modern vehicles rely on the Controller Area Network (CAN) bus, whose design prioritizes low cost and real-time performance but provides no message authentication or encryption.
By Chandan Hegde, Mukundh R Reddy
arXiv:2606. 14987v1 Announce Type: cross Abstract: Internet of Things (IoT) and Cyber-physical systems (CPS) increasingly rely on continual learning (CL) to adapt to evolving environments, device heterogeneity, and concept drift, thereby improving overall utility.
By Oxana Salish, Kuniyilh S
arXiv:2606. 18599v1 Announce Type: cross Abstract: The Controller Area Network (CAN) protocol is the primary communication standard for Electronic Control Units (ECUs) in modern vehicles, but its lack of encryption and authentication exposes it to a range of security threats.
By Qiqi Liu, Runhan Song, Lei Cui, Heng Zhang, Yuyan Sun, Limin Sun