@misc{LehnigerLangendoerfer, author = {Lehniger, Kai and Langend{\"o}rfer, Peter}, title = {Investigating compact shadow stacks for the Xtensa LX architecture}, series = {2025 14th Mediterranean Conference on Embedded Computing (MECO)}, journal = {2025 14th Mediterranean Conference on Embedded Computing (MECO)}, publisher = {IEEE}, address = {Piscataway, NJ}, isbn = {979-8-3315-1341-2}, doi = {10.1109/MECO66322.2025.11049161}, pages = {1 -- 6}, abstract = {This paper presents a compact shadow stack implementation for the Xtensa LX architecture, implemented for an ESP32 microcontroller. The implementation is done by changing the register window exception handlers in the FreeRTOS operating system. In a second implementation the shadow stack was extended to all register values, not just return addresses. This not only increases security but also performance, reducing the overhead from 17.220\% to 13.529\%, in the worst-case-scenario. The paper also suggests future improvements that could decrease the overhead even further.}, language = {en} } @misc{AlsabbaghSayeghKimetal., author = {Alsabbagh, Wael and Sayegh, Bahij and Kim, Chaerin and Langendorfer, Peter}, title = {FeatNet-IDS : anomaly detection based-features for industrial internet of things systems}, series = {2025 Silicon Valley Cybersecurity Conference (SVCC)}, journal = {2025 Silicon Valley Cybersecurity Conference (SVCC)}, publisher = {IEEE}, address = {Piscataway, NJ}, isbn = {979-8-3315-3429-5}, doi = {10.1109/SVCC65277.2025.11133650}, pages = {1 -- 8}, abstract = {Anomaly detection is critical for securing Industrial Internet of Things (IIoT) systems against evolving cyber threats. This paper introduces FeatNet-IDS, an enhanced Intrusion Detection System (IDS) for MQTT-based IIoT environments. FeatNet- IDS combines advanced feature selection and machine learning techniques to improve anomaly detection accuracy, efficiency, and interpretability. Evaluated on a domain-specific dataset of MQTT-related attacks, including control logic injection, the framework achieves 92.3\% accuracy, 91.5\% F1-score, and 96.8\% ROC AUC, with a low false alarm rate of 2.73\%. By emphasizing feature stability and importance, FeatNet-IDS outperforms or matches state-of-the-art methods, demonstrating robustness and transparency. Practical deployment implications are discussed, with future work addressing dataset expansion, hyperparameter tuning, and advanced ensemble approaches. The dataset and framework codes are publicly available to support further research.}, language = {en} } @misc{AlsabbaghUrregoLangendoerfer, author = {Alsabbagh, Wael and Urrego, Diego and Langend{\"o}rfer, Peter}, title = {Smart traps for smart systems : scalable honeynets for IIoT cybersecurity}, series = {2025 34th International Conference on Computer Communications and Networks (ICCCN)}, journal = {2025 34th International Conference on Computer Communications and Networks (ICCCN)}, publisher = {IEEE}, address = {Piscataway, NJ}, isbn = {979-8-3315-0898-2}, doi = {10.1109/ICCCN65249.2025.11133761}, pages = {1 -- 6}, abstract = {Honeypots serve as decoy systems that attract and monitor intruders, offering insights into their behavior. When interconnected, these honeypots form honeynets, simulating high-value environments to engage attackers and facilitate deeper analysis. However, in Industrial Internet of Things (IIoT) networks, deploying honeypots presents challenges such as static configurations, lack of network context, and difficulties in scaling.In this paper, we introduce TrapNet, a scalable, lightweight honeynet framework specifically designed for IIoT environments. TrapNet combines compact, on-site honeypots with large-scale, adaptive honeynets deployed on fog and cloud infrastructures using microservices. This approach enables fast deployment, scalability, and flexibility, providing an effective solution for IIoT cybersecurity. Our experimental results show that TrapNet efficiently detects intrusions while maintaining low resource overhead. Additionally, all code and configurations used in this study are publicly available, fostering further research and innovation in honeynet design and IIoT security.}, language = {en} } @misc{YenerBrzozowskiChitauroetal., author = {Yener, Onur and Brzozowski, Marcin and Chitauro, Ronald and Langend{\"o}rfer, Peter}, title = {Pushing the limits of 5G private networks : a practical examination of network stressors}, series = {2025 International Conference on Computing, Networking and Communications (ICNC)}, journal = {2025 International Conference on Computing, Networking and Communications (ICNC)}, publisher = {IEEE}, address = {Piscataway, NJ}, isbn = {979-8-3315-2096-0}, doi = {10.1109/ICNC64010.2025.10993913}, pages = {752 -- 756}, abstract = {The adoption of 5G private networks is revolutionizing industrial connectivity, yet it brings numerous challenges that need addressing to ensure safety and reliability. Our research utilizes an OpenAirInterface (OAI) based 5G testbed to explore and mitigate these challenges. We particularly focus on stressors such as jamming to evaluate network resilience. Our methodology involves setting up a comprehensive testbed, collecting data under various stress conditions, and implementing solutions. Initial findings demonstrate that small environmental changes and structural interferences significantly impact network performance. We observed that indoor variables and uplink communication pose substantial challenges, underscoring the need for advanced algorithms to detect and mitigate jamming attacks in dynamic scenarios. Our results highlight the importance of real-time spectrum analysis and adaptive network management in maintaining optimal performance. This study aims to contribute to the development of robust, resilient 5G networks suitable for complex industrial environments.}, language = {en} } @misc{PidvalnyiKostenkoSudakovetal., author = {Pidvalnyi, Illia and Kostenko, Anna and Sudakov, Oleksandr and Isaev, Dmytro and Maximyuk, Oleksandr and Krishtal, Oleg and Iegorova, Olena and Kabin, Ievgen and Dyka, Zoya and Ortmann, Steffen and Langend{\"o}rfer, Peter}, title = {Classification of epileptic seizures by simple machine learning techniques : application to animals' electroencephalography signals}, series = {IEEE access}, volume = {13}, journal = {IEEE access}, publisher = {Institute of Electrical and Electronics Engineers (IEEE)}, address = {Piscataway, NJ}, issn = {2169-3536}, doi = {10.1109/ACCESS.2025.3527866}, pages = {8951 -- 8962}, abstract = {Detection and prediction of the onset of seizures are among the most challenging problems in epilepsy diagnostics and treatment. Small electronic devices capable of doing that will improve the quality of life for epilepsy patients while also open new opportunities for pharmacological intervention. This paper presents a novel approach using machine learning techniques to detect seizures onset using intracranial electroencephalography (EEG) signals. The proposed approach was tested on intracranial EEG data recorded in rats with pilocarpine model of temporal lobe epilepsy. A principal component analysis was applied for feature selection before using a support vector machine for the detection of seizures. Hjorth's parameters and Daubechies discrete wavelet transform coefficients were found to be the most informative features of EEG data. We found that the support vector machine approach had a classification sensitivity of 90\% and a specificity of 74\% for detecting ictal episodes. Changing the epoch parameter from one to twenty-one seconds results in changing the redistribution of principal components' values to 10\% but does not affect the classification result. Support vector machines are accessible and convenient methods for classification that have achieved promising classification quality, and are rather lightweight compared to other machine learning methods. So we suggest their future use in mobile devices for early epileptic seizure and preictal episode detection.}, language = {en} } @misc{AftowiczFritscherLehnigeretal., author = {Aftowicz, Marcin and Fritscher, Markus and Lehniger, Kai and Wenger, Christian and Langend{\"o}rfer, Peter and Brzozowski, Marcin}, title = {Hardware-friendly Nystr{\"o}m approximation for water treatment anomaly detection}, series = {IECON 2024 - 50th Annual Conference of the IEEE Industrial Electronics Society : proceedings}, journal = {IECON 2024 - 50th Annual Conference of the IEEE Industrial Electronics Society : proceedings}, publisher = {Institute of Electrical and Electronics Engineers (IEEE)}, address = {Piscataway, NJ}, isbn = {978-1-6654-6454-3}, doi = {10.1109/IECON55916.2024.10905880}, pages = {1 -- 7}, abstract = {This paper presents an approach to accelerate One-Class Support Vector Machines (SVM) using a hardware-friendly kernel that doesn't rely on multiplication operations, thus adaptable to hardware platforms. Leveraging Nystr{\"o}m approximation, we implemented a pipeline and compared its performance against a software implementation using libsvm. Furthermore, we evaluated the efficiency of our approach by deploying it on an FPGA. Our experiments, conducted on the SWaT dataset, demonstrate a 50x speedup using the FPGA implementation, achieving a classification time of 21 microseconds per instance. Importantly, we find no degradation in performance, as measured by the f-score of the attack class in the test set. This study explores the potential of hardware acceleration in optimizing anomaly detection systems for real-time applications.}, language = {en} } @misc{LehnigerLangendorfer, author = {Lehniger, Kai and Langendorfer, Peter}, title = {Elevating parallel shadow stack concepts for architectures with register windows}, series = {IEEE transactions on dependable and secure computing}, journal = {IEEE transactions on dependable and secure computing}, publisher = {Institute of Electrical and Electronics Engineers (IEEE)}, address = {Piscataway, NJ}, issn = {1545-5971}, doi = {10.1109/TDSC.2025.3604556}, pages = {1 -- 18}, abstract = {Register windows are a processor feature that was originally developed to reduce the frequency for register spilling. This paper investigates how this mechanism can be used to implement a parallel shadow stack to protect return addresses from being corrupted. Furthermore, multiple improvements based on properties directly following the usage of register windows are proposed. Different configurations of parallel shadow stacks are evaluated based on prototype implementations on an ESP32 microcontroller and tested with different benchmarks. Performance overheads below 0.01\% for CoreMark, below 3\% for the worst case in MbedsTLS, and a worst case scenario of 22.153\% for a recursive function show that our concepts are able to be efficiently developed even for embedded devices like the ESP32.}, language = {en} }