### C. Location Privacy Leakage

Privacy concerns may also focus on context information, such as the location of a sensor that initiates data communication. For one, alert communication originating from a patient's heart monitor in the medical IoT is enough for an adversary to infer that the patient suffers from a heart problem. Therefore, real-world applications must consider effective countermeasures against the disclosure of private information related to data and context, such as location.

The work in [265] provides an overview of the privacy issues of location found in mobile devices. Particular attention is paid to the current access-permission mechanisms used on the Android, iPhone, and Windows Mobile platforms. Actual privacy issues on mobile platforms should be inherited by IIoT and integrated with other static platforms. Integrating RFID objects into an IIoT setting enables context-aware digital representations of physical objects that possess autonomous sensing, communication, and interaction capabilities. Powerful adversaries can potentially monitor all communications, trace tags within a limited period, corrupt tags, and access side-channel information on the reader output. These privacy risks associated with RFID technology are centered on user tracking and localization, which can lead to the creation and exploitation of detailed user profiles [249]. Consequently, RFID systems must ensure anonymity even when the state of a tag has been exposed.

WSNs are another key underlying technology of the IoT network architecture, which exacerbates the privacy issue of location. WSN can sense the state of an object or monitor an event in the network, and then post a message in the system to notify connected people (or automatic reactive programs) about the event. Due to their self-organizing characteristics (and the uncontrollability of the environment), constraints (e.g., limited resources) and the wireless transmission medium, WSNs have inherent challenges in protecting the privacy that prevents existing techniques (such as public-key ciphers) from being directly transplanted into resource-constrained devices. This problem of location privacy has not been addressed effectively because it cannot be easily solved by encryption or authentication, and thus specific approaches are required, listed below.

Even without the ability to decrypt the transmitted data, an adversary can still compromise location information. This is particularly relevant in WSN, where transmission typically occurs hop-by-hop due to the limited transmission range of sensor nodes. By observing and analyzing traffic patterns between different hops, the adversary may determine the locations of the BS and data source, with the possibility of tracking them down. To address this challenge, context-oriented privacy protection aims to conceal the real traffic pattern [266], [267]. Various traffic pattern obfuscation methods have been suggested in the literature to protect the location of both the data source and the BS.

1) Location Privacy of Data Source: The problem of protecting the location information of the data source typically refers to the more general (and well-known in the literature) problem of the “Panda Hunter Game” [268], illustrated in

<figure><img src="image_9.png" /><figcaption>Fig. 8. The general *panda-hunter* model as a source location privacy-sensitive scenario in IIoT.</figcaption></figure>

Fig. 8. In this game, a large number of sensors (the circles in the figure) are used to detect pandas, and once the panda is detected, they transmit event messages to the sink (or BS) by multi-hop wireless communication. Simultaneously, a *panda-hunter* endeavors to locate the data source to track the panda. The defender's objective is twofold: first, to accurately gather information about the panda's movements for biological research, and second, to protect the location data from the panda hunters, who can intercept wireless communications between different sensor nodes but lack the decryption key for the payload data. The objective of the panda hunter is to compromise the location of the data source (and the panda) by analyzing transmitted traffic within the WSN. A local attacker, limited to monitoring traffic in a small local area, typically has two approaches to launch the attack: arbitrary location, the attacker selects a location within the network and stays there to monitor the traffic; proximity to BS, alternatively, the attacker may choose to position themselves near the BS with prior knowledge of its location.

The “Panda Hunter game” is a problem that can happen in other IIoT applications, such as monitoring patients and doctors in a hospital [269], and tracking friendly soldiers on the battlefield [270], to name a few. Similarly, VANETs integrate an OBU into the vehicle system, serving as a sensing layer node in the IIoT. As this node communicates with the roadside infrastructure and other vehicles, ensuring secure communication links and authentication become crucial requirements to guarantee security and privacy in VANETs. Consequently, the OBU requires additional modules to support information security, ensuring that user privacy is maintained at the same level as identity and location privacy.

In the past, several performance metrics for source security have been suggested [271]. One of these is the source's security time, i.e., the total number of packets the source can send out successfully before being intercepted by the adversary. Another metric is the likelihood that the adversary can find the source node in a certain amount of time. For a quantitative evaluation of the privacy of communication, these metrics are of crucial importance.
In what follows, we present five existing techniques to protect against possible disclosure of the location of the data source in WSNs: flooding, random walk, dummy injection, cross-layer routing, and limited node detectability.

a) *Data flooding mechanisms:* The basic concept of base-line flooding is that each sensor node broadcasts the data it receives from one neighbor to all other neighbors [268]. The main assumption behind this approach is that, when all sensors participate in the data transmission, it becomes challenging for an attacker to trace the transmission path back to the original data source. However, the effectiveness of baseline flooding in preserving privacy depends heavily on the number of nodes on the path between the data source and BS. If the path is short and an attacker detects the arrival of the first packet at the BS, they can infer that this packet follows the shortest path between the data source and the BS. Subsequently, the adversary can trace the data source back from the last forwarding sensor along the routing path to the data source. Despite its potential privacy benefits, baseline flooding has a significant drawback, the substantial amount of energy consumed throughout the network. This high energy consumption drastically reduces the overall lifetime of the WSN.

To this end, a modified instance, probabilistic flooding, has been proposed in which not all sensors are involved in forwarding data; instead, each node forwards a received packet with a predetermined probability [268]. This scheme can not only save significant energy but also effectively limit the adversary's ability to deterministically trace the data source. The disadvantage of probabilistic flooding is that it cannot guarantee the reception of data by the BS due to the random nature of the approach. To address these concerns about privacy and energy consumption, a routing method called Sink Toroidal Region (STaR) routing was introduced in [272]. Provides source location privacy through a two-phase routing protocol. In the first phase, the source node forwards the message to a random intermediate node, located in a pre-defined region around the sink node. We call this region the STaR, designed to be large enough to make it impractical for an adversary to monitor the entire region. The random intermediate node serves as a false source when forwarding the message to the sink node. In the second phase, the intermediate node forwards the message to the sink node using a single-path routing.

b) *Random walk mechanisms:* The goal of the “random walk” approach is to have packets following a random route through the network so that the path of a packet looks completely random to an attacker. An efficient version of the general random walk tailored to this problem is called Phantom Routing. The data first go through some steps of random walk from the data source and then is transmitted towards BS using a probabilistic flooding scheme. The use of random walks makes it difficult for the attacker to trace the routing path from the original data source. However, studies such as [273] and [274] have shown that the pure random walk approach is not statistically secure when it comes to protecting the location of the data source, as it tends to stay close to the actual data source.

In [273], an alternative method was introduced, known as the two-way greedy random walk (GROW) scheme. This approach begins by initiating a random path with a specified number of hops from the BS and sensors located along this path act as receptors. Subsequently, each source data packet is randomly forwarded until it reaches one of the receptors. Once the packet reaches a receptor, it is then forwarded back to the BS through the pre-established path. A Bloom filter is then used in GROW to avoid repeating cycles. Based on this concept, EDROW defines the parent nodes located closer to the BS [275]. Establishing a ring as the forwarding path presents a greater challenge for adversaries to trace back to the origin of sensor communication.

Furthermore, in [276], a secure and efficient Cost-Aware SEcure Routing (CASER) protocol is proposed, which is based on geographical considerations. The network is partitioned into smaller meshes as if they are different clusters. In each mesh, the node possessing the highest amount of residual energy is selected as the mesh head responsible for packet transmission. These mesh heads are aware of their position and residual energy, as well as the positions and residual energies of adjacent meshes. During packet forwarding, the CASER protocol employs a default strategy where the next-hop mesh is chosen to be the adjacent mesh closest to the BS with the highest energy level. However, to protect the privacy of the source location, instead of following the shortest path, a random walking mechanism is employed to create a routing path.

c) *Dummy injection mechanisms:* Fake data packets can be injected into the WSN to perturb the traffic patterns observed by potential adversaries, and thus protect the location of the data source. One such approach is the short-lived fake source routing, where each sensor has a predetermined probability of sending a fake packet. When a sensor node receives a fake packet, it is simply discarded. Although this strategy effectively perturbs the local traffic pattern visible to adversaries, it has certain limitations in relation to privacy protection. In many scenarios, to maintain energy efficiency within the WSN, the length of each path along which the fake data are forwarded is restricted to one hop only. This constraint allows adversaries to quickly identify these fake paths and exclude them from their considerations.

This version of dummy injection may prove ineffective against global adversaries capable of monitoring the transmission rate of individual sensor nodes, as they can distinguish nodes solely sending dummy data. To address this issue, a potential solution involves the global injection of dummy data while maintaining the same transmission rate for both real and dummy data. However, this approach can introduce substantial delays in actual data transmission. A possible countermeasure is presented in [277], proposing to follow a certain distribution of data transmission. As long as every sensor node adheres to this distribution, the delay in real data can be minimized, while preventing the adversary from identifying the actual traffic. Alternatively, two other schemes, Proxy-based Filtering Schemes (PFS) and Tree-based Filtering Schemes (TFS), can filter partial dummy data without compromising source privacy [278]. The entire network is divided into cells, and
the proxies take responsibility for transmitting real data from nearby cells while filtering out dummy data. The proxies filter all the dummy packets from the cells, buffer the real data, and then transmit the data packets at the same transmission rate, which includes the buffered real data and newly generated dummy data. Through this filtering process, a significant amount of dummy data is removed, leading to a substantial reduction in energy consumption for overhead communication. In [279], the authors proposed a source location protection protocol based on dynamic routing (SLPDR). In this solution, an initial node is randomly chosen from the network boundary, and then a dummy packet is transmitted to the sink along the shortest path. Every real packet takes a greedy route and then a directed route before reaching the sink. The network is divided into different rings, and dummy traffic is generated in the outer ring without significantly deteriorating the lifetime of the network. The real event packets are transmitted forward in a one-hop flooding pattern, and only the node on the greedy path will swap out the fake packet for the real one.

A similar approach is to choose one or more sensor nodes to mimic the behavior of real data sources [280]. A solution should balance the number of fake sources since more sources lead to more security but also to more power consumption in the WSN. Moreover, fake sources must convincingly emulate the behavior of actual data sources to avoid detection. These challenges are still viewed as open problems and dependent on the IoT scenario. Based on the same idea, the Resilient Timing Analysis Protocol (TARP) [281], proposes an approach called traffic mixing, where each node sends the same number of packets at the same rate, making it difficult for attackers to distinguish between real data and fake messages. One drawback of TARP is the need to transmit a considerable number of dummy packets even when there are relatively few real packets in the network.

To conceal the real packet with minimum energy consumption, fake packets with a low rate (FPLR) are the approach proposed in [282]. To obfuscate adversaries while transmitting fake packets at a low rate (and thus minimize the communication overhead), three schemes are proposed, namely Dummy Uniform Distribution (DUD), Dummy Adaptive Distribution (DAD), and Controlled Dummy Adaptive Distribution (CAD). In DUD, both real and fake packets are transmitted at the same constant rate. While this approach provides a certain level of security, it can lead to high energy consumption due to the continuous transmission of fake packets. In DAD, all nodes are initially set to a low constant transmission rate. Real packets on the network are assigned a higher transmission rate, while fake packets are assigned a lower transmission rate. This scheme improves performance and makes it difficult for eavesdroppers to distinguish between real and fake packets. Lastly, CAD incorporates packet loss considerations to further enhance the packet delivery ratio.

d) Cross-layer routing: In the cross-layer routing in WSNs, nodes use different layers of the communication protocol stack in different ways. Instead of relying only on the network layer to exchange messages about events, cross-layer routing also involves control messages from the Medium Access Control (MAC) layer. This deviation from the

standard network protocol stack is not uncommon in WSNs, and cross-layer optimizations are used to extend the battery life of the node and increase the network throughput [283]. In [284], nodes following the IEEE 802.15.4 standard (e.g., ZigBee, WirelessHART [285]) utilize beacon frames, typically employed for network maintenance, to exchange information about captured events. In this way, local adversaries, which usually monitor only network-level packets, can miss certain parts of the information exchange and fail to identify the true source of the data.

e) Limit node detectability: This class of solutions limits the transmit power of the nodes, making them harder to detect. For example, localisation by silencing [286] and lowering radio transmit power [287]. The first solution seeks to identify a local adversary present within the WSN by assuming that the nodes possess the capability to detect adversaries using vibration or infrared sensors. The detecting nodes inform the others and are the only nodes transmitting, while other nodes maintain silence when the adversary is inside their grid as much as possible.

More recent approaches incorporate a combination of directional antennas (DA), transmit power control, and information compression [288]. The use of directional antennas can have two benefits: first, it can decrease the likelihood that local attackers will find the packets and second, it can make it more difficult for them to monitor the network. Additionally, as the beam width of the directional antenna decreases, the difficulty of monitoring the network increases. The network has adopted transmit power control and information compression in an effort to further reduce its energy usage. The suggested scheme can effectively reduce an adversary's ability to overhear conversations while saving energy. Building on this foundation, an improvement called the Bypassing method based on Directional Transceivers (BDT) is introduced in [289]. To defend against backtracking attacks by eavesdropping, each node in the network is equipped with 4 directional transceivers. When a sensor node detects an attacker, it sends an acknowledgment message to alert its neighbors along the opposite direction of packet transmissions. Consequently, the nodes located outside the attacker's radio range initiate a new directional transmission to avoid the adversary.

2) Location Privacy of Base Station: Another critical issue for context-oriented privacy is preserving the location of the BS. The BS serves as a central hub for data collection and analysis and acts as a gateway between the WSN and external wireless or wired networks. Its importance lies in its role in coordinating the network's operations, and disrupting or isolating it could result in the malfunction of the entire network. In the following, we summarize the main privacy-preserving techniques for the location of the BS against local and global adversaries.

a) Local adversaries and defensive mechanisms: Protecting the location of the BS from local adversaries involves addressing two significant challenges: (i) Typically, the location information of the BS is contained in the data payload being transmitted, and (ii) Local adversaries can deduce the parent-child relationship (i.e., which node within two communicating nodes is closer to the BS) based on the
time interval between receiving and sending data at each
sensor. Using this information, the attacker can efficiently trace
the path of data transmission back to the BS. To overcome the
first challenge, payload confidentiality techniques can be used
to hide location information from attackers. However, for the
second problem, the literature proposes four main approaches
to mitigate the issue and enhance the privacy of the BS's
location.

*   *Changing data appearance by re-encryption* [290]. Similarly to anonymous routing systems used in traditional wired networks [291], packets in WSNs are re-encrypted hop by hop as they traverse the routing path. Changing the appearance of the data protects the disclosure of the location of the BS.

* Routing with multiple parents [292]. It is based on the introduction of a multi-parent system to balance the traffic load between parents and children. In this way, an attacker cannot easily determine which sensor is closer to BS. Since this scheme allows each sensor to randomly select one of its multiple parents for data transmission, it is also harder for the attacker to determine the location of BS by tracking the data transmission.

*   *Routing with random walk* [293]. This scheme divides the neighbors of a sensor into two lists according to the number of hops from the BS – nearer and farther lists. When the sensor sends data, it randomly selects a next-hop neighbor from the nearest list. While in the traditional random walk, the node sends to the parent with probability $p_r$ and randomly with probability $(1 - p_r)$, this approach can be considered as a special case with $p_r = 1/2$. On the one hand, this randomness reduces the probability of a successful analysis by the attacker. On the other hand, it delays the delivery of the data packet to the BS since it is possible to choose a node as the next hop that is further away from the sink. This increases energy consumption and there is no guarantee that the data packet will arrive at BS.

* De-correlating parent-child relationship by randomly selecting the sending time [290]. Since an attacker can figure out the parent-child relationship by the short time interval between sending data to a sensor and receiving data at its neighboring node, this relationship can be decorrelated. Specifically, the parent node and the child node send packets with a randomly drawn time interval from different time windows.

An alternative approach aims to improve the resilience of a
WSN after BS has been detected. For instance, in [294], the
authors propose a multiple BS scheme: If one BS is detected
and compromised, the other BSs can continue to collect data
and support the normal operations of the WSN. However, this
approach does not provide additional protection for the BSs
themselves and simply delays the threat from a local adversary
in identifying the location of the BSs.

b) *Global adversaries and defensive mechanisms:* Instead, a global adversary can monitor all traffic transmitted in the WSN, and the techniques mentioned above are ineffective. Due to the multi-hop scheme of WSNs (forced by the limited communication range of sensor nodes), nodes closer

to BS must forward data from more distant nodes in addition
to transmitting their data, resulting in a higher transmission
rate. An attacker can observe the traffic patterns of different
nodes throughout the network and easily identify the BS and
compromise the privacy of the context, or even manipulate
the sink node to prevent the proper functioning of the WSN.
Therefore, to protect against global attacks, it is necessary to
inject dummy traffic and/or dummy sensor nodes, for which
the following techniques have been proposed in the literature:

*   *Hiding traffic pattern by controlling transmission rate* [290]. Since WSNs exhibit asymmetric traffic flow, where sensors close to the BS feature a high transmission rate, this privacy-preserving technique proposes to maintain the same transmission rate among all sensors by controlling the delay of the actual data.
*   *Propagating dummy data* [292]. The proposed solution involves injecting fake packets to prevent an adversary from discerning the real data transmission pattern, assuming that an adversary cannot distinguish between real and fake data. When a sensor detects that its neighbor is transmitting a real packet, it generates a fake packet with probability $p_c$ and forwards it to another neighboring node. The solution incorporates two fractal propagation schemes. In the first scheme, $p_c$ decreases as the data forwarding rate increases. The second scheme aims to create the illusion of a high transmission rate area to mislead the adversary into believing that a particular sensor node serves as the BS. However, both approaches come with the drawback of increased energy consumption due to the introduction of fake data across the network. As a result, researchers need to strike a proper trade-off between the energy consumed and the level of privacy protection.

D. *Model Privacy Leakage*

A well-performing ML model usually relies on a large
volume of training data, which can be obtained thanks to IIoTs.
Such huge volumes of data raise serious privacy concerns
due to the risk of highly sensitive information leaking out. In
addition, evolving regulatory environments that increasingly
restrict access to and use of privacy-sensitive data pose a
major challenge in fully benefiting from ML for data-driven
applications. A trained ML model may also be vulnerable to
adversarial attacks such as membership, attribute, or property
inference attacks and model inversion attacks [37]. Therefore,
it seems that well-designed privacy-preserving ML solutions
are urgently needed for many new applications. There are
notable research efforts in both academia and industry to
integrate privacy-preserving techniques into ML pipelines or
specific algorithms or to develop architectures that guarantee
privacy.

FL comes with the potential for privacy preservation, in
which each IoT device collaboratively trains a global model
without the need to exchange private data. However, although
the fact that in FL systems, there is no share of data among the
participants can bring some privacy advantages, some other
considerations regard the remaining privacy risks (regarded
as vulnerabilities or weaknesses from multiple aspects). Thus, it appears that alternative strategies are required to protect user data and user privacy. For example, even if the data are anonymized, the collection of a few data attributes may allow re-identification of the patient in an e-health application [264]. Furthermore, Carlini et al. [295] have shown that it is possible to extract sensitive text patterns (e.g., a specific credit card number) from a recurrent neural network trained with user speech data. The model can also be manipulated by generating additional memories through gradient-ascent style attacks. In what follows, we provide a structural overview of current methods facing the privacy protection domain, that can be combined with FL or not.

## E. Countermeasures

Based on an analysis of concerns and existing protection models, in what follows, we identify the key challenges that underpin the IIoT ecosystem. The current data privacy-preserving IoT methods fall into five main categories: clustering-based methods, differential privacy and its extensions, lightweight cryptography, secure multi-party computation, and machine learning-based methods.

1) **Clustering-Based Methods:** These methods consider anonymity, dummy, generalization, and suppression via k-anonymity. A data collection is said to have the k-anonymity property if the information for each person contained in the collection cannot be distinguished from at least $k-1$ individuals whose information also appears in the dataset. Each attribute (column) of the dataset is categorized into an identifier, non-identifier, or quasi-identifier. The basic idea is to suppress the identifiers, such as names, allow the non-identifying values, and exploit the quasi-identifier attributes to preserve the data privacy by clustering these values and ensuring that every distinct combination of quasi-identifiers designates at least $k \in R$ records in any cluster. In this way, the probability of re-identification is $1/k$. A new model can be used to improve performance by guaranteeing a $l \in R$ diversity of records within this cluster, which can resist attacks with background knowledge to some extent. It should be noted that clustering-based methods require the distribution of the cluster to match that of the entire data set. Moreover, since k-anonymization does not include any randomization, attackers can still make inferences about data sets that may harm personal data, e.g., via down coding attack [296], and it is not considered a good method to anonymize high-dimensional datasets [297].

In [298], an attempt to further improve the resistance against attacks and to anonymize data streams on the fly. These types of method can be used to generalize and normalize quasi-identifiers and thereby defend sensitive information in the IIoT.

2) **Differential Privacy:** This class of methods has been a de-facto privacy model and attempts to defeat differential attacks [299]. It was originally formalized to offer statistical guarantees that aggregated released data would not disclose whether specific individuals are part of or absent from the dataset. In other words, differential privacy provides solid theoretical foundations for privacy protection by guaranteeing

that the difference between two adjacent datasets is not detected by statistical queries. Two datasets are considered adjacent or neighboring if their aggregated real-valued data representations contain an equal number of elements and differ in at most $m$ elements. The difference is measured using the Hamming distance, where in many cases, the value of $m$ is set to 1.

Given $\epsilon(\cdot)$ as a positive privacy budget function, $D_1$ and $D_2$ two datasets with an adjacent relationship, $M$ is a randomized algorithm that sanitizes the dataset, and such an algorithm $M$ is $\epsilon(\cdot)$-differential private on $D_1$ and $D_2$ if:

$$P[\mathcal{M}(D) \in \Omega] \leq e^{\epsilon(\cdot)} \times P[\mathcal{M}(D') \in \Omega],$$

where the probability space $\Omega$ is taken over the randomness used by $M$.

Differential privacy (DP) is widely used in IIoT applications to provide privacy protection while preserving statistical features, especially in smart communities and smart cities. Fog-based recommendation systems also use DP to hide the unique characteristics of individuals while simultaneously providing accurate recommendations. These mechanisms are probabilistic mapping functions that apply DP to the sensitive data or dataset $x$ to obtain a replacement for it. The replacement approach is based on the elaborately designed probabilistic mapping functions to ensure that the replacement of $x$ reveals the coarse-grained information about $x$ to some extent.

An improvement to this has been proposed in [300]. The author proposed a new definition of differential privacy based on the Rényi divergence. Rényi differential privacy is a strictly stronger privacy definition that offers an operationally convenient and quantitatively accurate way of tracking the cumulative loss of privacy throughout the execution of a separate differentially private mechanism and throughout many such mechanisms. In particular, Rényi differential privacy allows combining the intuitive and appealing concept of a privacy budget with the application of advanced composition theorems.

A more specific problem regards the sharing of unstructured data such as images, audio, videos, and texts between a data owner and untrusted third parties on social media, smart devices, and surveillance devices. Since these unstructured data may contain privacy-sensitive information or so-called personally identifiable information (PII), for example, faces, identities, license plates, voiceprints, and authorships, the data owner may obfuscate them and publish their coarse-grained versions to protect this PII from unintended disclosure and illegal use. Although several obfuscation methods have been proposed to protect this type of data, see, e.g., [301], [302], most of them suffer from many problems such as high computational overhead, inner attack, and nonprovable privacy. DP, when tailored to the specific input, can solve these problems by transforming unstructured data into vector representations through methods such as pixelization, singular value decomposition (SVD), bit vectorization, and word embedding, which aim to preserve the human perception of the unstructured data content as much as possible. After this precomputation process, the vectors are obfuscated in appropriate privacy
models, followed by the projection of the obfuscated vec-
tors back into the unstructured data space. For images, for
example, some simple box-blurring algorithms introduced in
the privacy-preserving Google Street View can protect human
faces and license plates [303], or a GAN -based method can
pinpoint head regions while protecting their naturalness [304].
To preserve the perceptual quality of noisy images, the model
proposed in [305] provides DP guarantees for the latent vector
representation of images. In particular, privacy budgets are
assigned to the different elements in the latent space according
to their weights, while the sensitivity is set to be within the
maximum observed bounds. Laplace noise is then derived and
added to the images in the semantic space before using GAN
to synthesize realistic-looking faces.

In video content, IBM took a pioneering role in the system-
atic study of privacy-preserving video surveillance with their
PeopleVision system [306]. To protect privacy in video con-
tent, sanitization schemes, such as blurring and pixelization,
were applied to regions of interest (ROIs) in individual images.
With increasing sophistication in privacy requirements, sen-
sitive information, including activities and places in videos,
also came under the purview of DP methods [307]. The
model proposed in [308], applies DP to the video privacy
domain by representing video data as pixels with the content
of 3-dimensional vectors in the RGB color model, where
adjacent inputs are defined as pairs of videos that differ in
all visual elements (e.g., people) incomplete videos. Pixels
are randomly sampled using DP before being classified into
different RGB categories. Subsequently, pixels in the most
frequent RGB categories are separately obfuscated using an
appropriate Laplacian noise scale. The remaining unselected
pixels are interpolated as a DP post-processing operation to
reconstruct the visual elements in the video, thereby preserving
privacy.

In the case of *text* content, privacy is of utmost importance,
especially when it involves sensitive information such as
health conditions, locations, and personal lifestyle preferences.
DP offers a valuable solution in this context. Textual data
can be transformed into high-dimensional vectors using word
embedding models such as GloVe, FastText, and word2vec.
These vectors are then perturbed with noise vectors sampled
from probabilistic distributions. The resulting noisy real-
numbered vectors are projected back to their closest words
in the embedding model through a discretization operation,
considering the discrete nature of textual data. The pioneering
solution presented in [309] applies Hamming distance-based
privacy (a traditional DP method) in the text privacy domain.
It primarily focuses on concealing the term-frequency-related
distributions in the bag-of-words embeddings. This is achieved
by employing the exponential mechanism, which randomizes
discrete terms into sets of candidate terms with associ-
ated probabilities. These probabilities are determined by a
similarity metric between input and potential output terms.
The similarity function is constructed as a composition
of cosine similarity and Bigram overlap variables. Other
methods, such as Earth Mover's Privacy [310], Euclidean
Privacy [311], and Hyperbolic Privacy [312], can further
enhance utility in differentially private vector embedding,

leading to better privacy preservation mechanisms for text
content.

Currently, a rich set of work has introduced utility-enhanced
mechanisms for structured data, exploring various privacy
requirements for data with varying sensitivity levels [313].
However, future work is still needed for new rich data
generated by IIoT, such as VR, gaze maps on eye tracking
 heatmaps, and temporal-related eye movement features. For
example, while DP guarantees that attackers cannot obtain
additional information by including or excluding an element,
it cannot prevent attackers from gaining knowledge with
publicly released data itself. Although other privacy protec-
tion methods, such as blurring of image data, have been
shown to be vulnerable to DL attacks [314], it is necessary
to investigate the privacy guarantees of DP in mitigating
DL-based re-identification attacks theoretically or practically.
Inference attacks pose significant privacy risks to DP-protected
data [315], and it may be of importance to integrate some
other methods to enhance privacy in the design of DP privacy
methods.

To this end, DP finds profitable applications even in the
context of *FL*, a type of distributed machine learning that
aims to protect clients’ private data from exposure to adver-
saries. Since recent articles have pointed out how private
information can still be divulged by analyzing client-uploaded
parameters in FL, for example, weights trained in deep neural
networks [316], DP can be applied, for example, by adding
artificial noise to the parameters on the client side before
aggregation [317]. In their proposed solution NbAFL, they
quantified the trade-off between convergence performance and
privacy level. Improved convergence performance results in
a lower protection level, while increasing the number of
clients participating in FL enhances convergence performance
at a fixed privacy level. The authors also investigate the
optimal number of aggregation rounds for a given protection
level, which they demonstrate to exist. DP-based noise can
be incorporated into the model input, gradients, and loss
functions [318], [319], where in [319] the authors suggest
a protocol to introduce Gaussian-based noise to the out-
put of each base model. However, their defensive tactics
are limited to safeguarding categorical features. The authors
of [320] applied locally differential private algorithms for
meta-learning, providing provable learning guarantees in con-
vex settings. Meta-learning techniques leverage the shared
knowledge gained from individual learning tasks to facilitate
learning similar unseen tasks and can be applied to FL
with personalization. Furthermore, DP combined with model
compression algorithms can reduce communication overhead
in FL while maintaining privacy benefits [321].

In the context of blockchain systems, achieving client-
level differential privacy can be accomplished by having each
client locally add a certain amount of Gaussian noise after
performing local gradient descent steps. Once the model is
updated, it is submitted to the blockchain. To also protect the
model from the public, the aggregated global model stored on
the blockchain can be encrypted using a decryption key that
is exclusively possessed by participating clients. To enable FL
with this approach, the work in [322] proposed storing only the
pointer of the global updates on the blockchain, while using
a distributed hash table to store the actual data. This strategy
ensures efficient block generation, allowing for decentralized
privacy protection while preventing single-point failures.

3) *Encryption and Homomorphic Encryption:* It is one of the most important privacy protection tools, as it provides the most secure protection for point-to-point data transmission. The advantage of encryption is that it provides the highest data benefit among all privacy mechanisms because it can output the original data. However, this technique presents some disadvantages. First, it is not easy to implement appropriate access control. Second, the original data are fully disclosed if the ciphers become decrypted. Third, efficiency. Since huge amounts of data are generated and transmitted every second in the IIoT systems and attackers can launch eavesdropping attacks during the data transmission process, traditional cryptography methods cannot efficiently solve this problem due to the large scale of the IIoT. To this end, lightweight encryption methods are proposed to partially solve the efficiency problem and to ensure secure communication and data transmission among multiple and cross-layer (cascade) networks. Similarly, lightweight ABE can be used to provide evidence against attacks, especially collusion attacks. Finally, lightweight searchable encryption can be used to solve problems with query-based searchable content.

Current privacy-enhancing technologies for RFID technologies include limiting the distance between the reader and deactivating tags, minimalist cryptography, tag renaming and deactivation, access control, and re-encryption. It is suggested that the readers perform cryptographic calculations and store the results in tags using minimal cryptography. To prevent eavesdroppers from receiving different encrypted tag signals at different times, the reader can re-encrypt the tag with a different key and write it into its memory [323].

However, most IIoT devices are designed to be lightweight and small in size, and encryption methods must also be lightweight. In [324], the authors proposed a lightweight IBE scheme for smart homes, where public keys are just identity strings and no digital certificate is required. This approach is called the stateful IBE scheme. This solution separates the encryption process into key encryption and data encryption, emphasizing the latter because key encryption produces ciphertexts that are larger than those produced by data encryption.

In recent years, significant research efforts have been dedicated to HE algorithms, a type of encryption that enables computations to be performed on encrypted data without the need for prior decryption [325], [326], [327], [328]. HE allows computation over encrypted data, including multiplication (mul), addition (add), and constant-multiplication (cmul), and the decrypted result corresponds to the outcome of the operations as if they were performed on plaintext. However, although this is extremely important in IIoT, the computationally expensive traditional data encryption way (in terms of time and resources) cannot meet the privacy needs in IIoT environments.

The authors of [329] introduced a communication-efficient
secure query scheme in a fog environment to ensure privacy

for both the data user (e.g., application) and the data owner
(e.g., an IoT device) using HE. Similarly, [327] presented a
lightweight privacy protection protocol for data owners, third-
party cloud servers, and data users. The solution is based on
labeled HE, where each piece of encrypted data is associated
with a unique label that is shared. This approach reduces
the computational cost, eliminating the need for data users
(applications) to perform expensive evaluations of the resulting
ciphertexts.

An efficient privacy-preserving data aggregation method for FL is EPPDA [182], which can covertly aggregate user-trained models without revealing the user model and relies on secret sharing to resist reverse attacks. Utilizing homomorphisms for secret sharing protects user privacy, consumes less computational and communication resources than practical alternatives, and provides tolerable fault tolerance in case the user disconnects. Specifically designed for healthcare data, PRCL [330] is a resource-efficient and privacy-conscious protocol for collaborative learning. The model, a neural network, was divided into three parts in PRLC. The first and last parts are trained on the client side, while the middle (and heavier) part is outsourced to be trained on cloud servers. To effectively perform gradient aggregation in the ciphertext context, the training data is perturbed by adding Gaussian noise before the model is trained on the client side. Additionally, packets are secured using HE. The simulation results demonstrate that PRCL (the proposed method) achieves precision comparable to other state-of-the-art techniques while reducing local training overhead by offloading the intermediate computation to a cloud server. The confidentiality of the data is preserved, as an attacker can only access the perturbed data due to the added noise, while the plaintext gradient remains inaccessible to the cloud.

4) *Secure Multi-Party Computation:* Secure Multi-Party Computation (SMPC) is a generic cryptographic primitive that allows distributed parties to jointly compute arbitrary functionality without disclosing their confidential inputs and outputs [331]. SMPC is known to be thousands of times faster than fully implemented HE in typical applications. Moreover, different from differential privacy, which focuses on privacy guarantees for the entire constructed model, SMPC focuses on the privacy of intermediate steps in the computation. SMPC addresses the problem of cooperatively computing the private data of multiple participants securely in a distributed IIoT computing environment. In the SMPC scenario, two or more parties that have private inputs want to use those inputs to jointly compute some functionality. Each participant in this task must achieve its own unique goal and nothing else to ensure security. This is achieved by dividing the computation into multiple subtasks and distributing them among the parties who perform their computations locally on their data and share only the results of these computations, in a way that preserves privacy. “Functionality” is a broad term that can refer to almost any cryptographic task, including encryption, authentication, zero-knowledge proofs, commitment schemes, oblivious transfer, and other protocols that are not cryptographic (i.e., application-oriented tasks include contract signing, electronic voting, machine learning, genomic data processing, and so on).
In the field of cryptography, it can be said that SMPC is the most fundamental and all-encompassing theoretical research topic. Any cryptographic task that involves multiple parties can be considered an SMPC task.

MiniONN [332] and DeepSecure [333] for example, employ SMPC and homographic encryption and work with the existing pre-trained DNN models without changing the DNN training or the DNN structure. Although there are several techniques for creating generic SMPC protocols, they are currently very computationally intensive, making SMPC still impractical. To achieve a more computationally efficient SMPC, recent work has focused on developing secure techniques to offload the most expensive parts of computational tasks to the cloud. Rather than simply treating the cloud as a trusted party, these outsourced protocols seek to take advantage of the cloud for computation without exposing any input or output values. Cloud-assisted SMPC provides a unique but effective way to make general SMPC protocols usable and scalable by allowing parties to securely outsource their computations to a cloud provider, improving the runtime efficiency of SMPC protocols [334].

The combination of cloud computing and HE leads to the development of cloud-assisted SMPC protocols [335], [336]. In these protocols, participants engage in a computational task, encrypting their data using a full HE scheme and uploading the resulting ciphertexts to the cloud. The cloud then performs computations on these ciphertexts and returns the resulting ciphertexts. The level of privacy achieved depends on the security of the underlying HE process, and no participant should directly possess the secret key to the HE procedure. The challenge therefore lies in decrypting the result of the computation. The study presented in [337] addresses this problem by distributing the secret key among all participants. In this cloud-assisted SMPC protocol, all participants must generate the system parameters, including the secret keys, public keys, and evaluation keys, for each computation.

It can be observed that if applied to the context of ML applications, is very similar to FL, as both can be used to protect privacy. However, they have different methods to achieve this. FL is a more specific collaborative learning technique where each party trains the model on their local data and only sends updates to a central server. SMPC, on the other hand, divides the computation into multiple sub-tasks and distributes them among the parties, who perform their computations locally on their data and share only the results of these computations with each other in a way that preserves privacy. In [338], the focus was on the evaluation of secure functions for power-limited devices, such as mobile phones. They introduced a concept called “outsourced oblivious transfer” that allows mobile devices to delegate the task of garbled key transfer to a cloud server.

SMPC can be used to protect both data and trained models in a two-party environment. In this scenario, a cloud server (referred to as Bob) owns a dataset and trains a model using a specific ML algorithm. For proprietary reasons, Bob does not want to share this model with other companies. On the other hand, a user (Alice) is looking for personalized services based on her own data while ensuring that her private data remain confidential. This situation lends itself well to the application of a classic SMPC protocol: Alice enters her private data, and Bob enters the model. After the protocol is executed, Bob learns nothing about Alice's data, and Alice learns as little as possible about Bob's model [339].

However, in this field, the adoption of secure SMPC is hampered by the absence of flexible software frameworks “speak the language” from machine learning researchers and engineers. CrypTen [340] is a recent solution to foster the adoption of secure SMPC in ML. In particular, CrypTen exposes popular secure SMPC primitives via abstractions that are common in modern IIoT frameworks, such as tensor computations, automatic differentiation, and modular neural networks.

In an attempt to secure FL, it can be combined with SMPC, along with HE and DP, and can work as follows: After locally training a model on their data, users send the weights (parameters) of their model to the server using an encryption scheme that allows the server to perform computations on the encrypted data; in such a way, the server can compute a weighted average of all the encrypted weights received from users, but cannot discover the original weights for any user. In solutions that used “only” DP, the server would know the noisy private weights of each user. As proposed in [341], which combines SMPC and DP, the noisy weights sent to the server are also encrypted so that the server can only calculate the result and cannot infer anything about even the noisy weights of any particular user. By doing so, the system becomes fully private. Other approaches combining SMPC and DP, e.g., [342], [343], propose that each client chooses his/her local differential private noise. Unlike other sources, in [341] the differentially private noise for each party is unknown to the party and is generated in a distributed manner from other parties. In particular, the combination of SMPC and DP has also found applicability in finance, with guarantees of privacy and acceptable precision [344].

Chameleon [345] and Gazelle [346] are two works that attempt to choose between the above-mentioned cryptographic techniques (homomorphic encryption and SMPC) based on their computation and communication tradeoffs. Specifically, Gazelle carefully examines the tradeoffs between HE (characterized by high computation and low communication) and SMPC (involving low computation and high communication) and selects the suitable technique for each scenario accordingly. Additionally, Gazelle accelerates the training process by efficiently implementing cryptographic primitives, resulting in low runtime latency and communication costs, as evident from their research outcomes.

To improve scalability and reduce the communication overhead introduced by SMPC, i.e., all parties generate and exchange secret shares of private data with all other parties, the work in [347] proposed a two-phase SMPC-enabled FL framework. Instead of having every member generate and exchange secret shares of data across all members' lists, it proceeds to elect a subset of FL members as the model aggregation committee members out of the whole membership list. The elected committee uses SMPC to aggregate the local models of all FL parties. The 2-phase SMPC introduces a hierarchical
<figure><img src="image_10.png" /><figcaption>Fig. 9. ML-based privacy protection schemes.</figcaption></figure>

structure, i.e., there is a need for fewer secret shares to be exchanged for privacy-preserving model aggregation. In [348], instead of applying SMPC over the entire local models for secure aggregation, it is presented a partially encrypted SMPC solution by encrypting critical parts of model parameters (gradients) that are vulnerable to privacy-preserving attacks. In particular, only the first layer of local models is encrypted with the SMPC strategy, while the rest are sent directly to the centralized server. This approach can significantly reduce the extra computation and communication overhead of SMPC while inheriting SMPC benefits in both privacy-preserving and model accuracy perspectives.

5) *Machine Learning-Based Methods:* In IIoT scenarios, both the complexity and volume of data are growing. The traditional security measures described previously can not cover all cases, and it becomes harder for common users and even data curators to comprehend the risk, choose the right schema, and manage their privacy. ML and data mining methods can be utilized in both attack and defense of privacy preservation [349]. In terms of defense, such methods are widely employed in Cyber-physical social systems (CPSSs) to extract features of specific objects or people in social media and provide long-term privacy protection. Instead, in terms of attacks, ML seems more applicable due to its ability to learn, e.g., to extract features of individuals and make predictions, which is not only harmful at present but also causes damage over time.

Regarding defense, ML has been introduced to enhance privacy protection during the past few years, where the proposed efforts include several aspects (as shown in Fig. 9):

* *Privacy Risk Assessment and Prediction.* The objective is to detect and anticipate the user's privacy risk during the "access" and "sharing" processes. As shown in Fig. 9a, ML is leveraged to evaluate both the input and output data streams, enabling the identification of potential risks that should be considered to implement a proper privacy protection scheme.

* *Personal Privacy Management Assistant.* This includes managing and evaluating user preferences and privacy policies, as shown in Fig. 9b.

* *Private Data Release.* Publish datasets with a guarantee of privacy, a practice commonly performed by data curators rather than individual users (Fig. 9c).

In the *privacy risk assessment and prediction* methods, ML can help prevent the loss of sensitive information when the user only accesses the application (passively collected

information by malicious attackers) or shares it on social networks (actively shared information). For example, in predicting privacy risks on websites and applications, a browser extension has been proposed in [350]. This extension collects information on the websites visited by users and provides feedback to users about the privacy quality of the website based on ML. To detect and identify websites that may be malicious and risk users' privacy, a Bayesian classifier-based method has been presented in [351]. The suggested method analyzes online reviews to determine whether they are trustworthy or not. The solution in [352] rates the privacy risks associated with applications using an SVM classifier. The results show that over 90% accuracy can be achieved in identifying privacy risks. The use of ML to analyze the privacy risks posed by mobile applications has been taken into consideration in [353]. Modern ML techniques can assist in identifying sensitive information when sharing data, enabling users to protect their personal information effectively. In [354], an ML model is proposed, capable of classifying photos based on the visual content features and the metadata of the images, evaluating the sensitivity level, and making decisions considering the past choices of users. *iPrivacy* [355] uses ML to automate this process. It identifies privacy-sensitive objects in images and categorizes them accordingly. According to the classification, *iPrivacy* alerts users to objects that should be suppressed or masked before sharing due to privacy concerns. In addition, the tool provides privacy setting recommendations based on user preferences and shared images. In [356], an ML method is proposed to automatically identify bystanders using only the visual information available in an image.

Methods involving a *Personal Privacy Management Assistant* aim to assist users in effectively managing and customizing their privacy preferences in an automated way. ML methods for privacy management can be broadly categorized into two groups: (i) privacy policy assessment and (ii) user preference prediction and management. In the case of software and Web applications, vendor privacy policies are often written using complex jargon, leading many readers to accept these policies without fully comprehending their implications. Methods falling under the first category aid users in making informed decisions about their privacy choices. The authors of [357] explored the automatic detection of vague content within privacy policies, by exploiting GANs to assess and characterize the vagueness of sentences. Methods in the second class take into account that each user has a different sensitivity and preference for privacy. Early studies have found
that users' privacy preferences are related to some statistical and environmental parameters, e.g., the context of applications [358], [359]. ML can predict user privacy preferences and make privacy management decisions, as in [360] or in the Visual Privacy Advisor [361] method.

Private data release is an important process in IIoT applications, e.g., health data from medical centers. A commonly used mechanism for the release of private data is obfuscation through the addition of noise to the original dataset, such as via ML and GANs [362], [363]. The main idea behind these approaches is that the data curator trains a deep generative model with the original data in a differentially private manner and then publishes the synthetic dataset generated by the model. The data curator may also decide to publish the deep-generative model, which may lead to an unlimited amount of synthetic data. Thus, data analysis can be performed on synthetic data instead of the real data of individuals to maintain privacy. An alternative approach to generate synthetic patient data based on GANs and autoencoders is proposed in [364]. The performance of the proposed generative model is also evaluated by comparing the synthetic patient records it generates with real data. In [365], GANs are used to generate artificial data that retain the statistical properties of the real data while reducing the risk of information disclosure. In [366], statistical similarity was demonstrated between the synthetic table data generated and the original data. Finally, we can observe that this approach is not associated with the drawbacks associated with other traditional anonymization methods, such as the risk of background knowledge or the potential linkage of data to other external sources.

At the same time, ML can be used as an attack tool in addition to being a privacy protection tool, where the main ML attack models include *re-identification attacks* and *inference attacks*. In *re-identification attacks*, the adversary re-identifies a certain individual using images, videos, or geolocation information. Recent advances in DL-based models have made face recognition techniques accurate [367], [368]. In addition, simple schemes based on obfuscation no longer work effectively [369], [370].

In *inference attacks*, the adversary utilizes ML classifiers to analyze publicly available data and deduce user private attributes, such as place of residence, occupation, hobbies, and political views [371]. Other solutions have detected the age of people [372] and car license plates [373] from ordinary or even obfuscated images. To defend against these attacks, the idea is to exploit the weaknesses and limitations of ML methods through adversarial machine learning. These methods share the approach of providing the ML attacking models with some well-designed inputs called “adversarial examples” [374]. Preliminary work in [375] discovered that overlaying the original image with imperceptible noise would lead DNNs to misclassify it. The main reason why neural networks are prone to negative examples is related to the linear nature of neural networks. In [376], the space between adversaries and DNNs itself comes from ML techniques. Adversarial examples demonstrate transferability, which means that if they can fool one model, they often possess the ability to deceive another model with different parameters and architectures [375]. Based

on this idea of adversarial examples, the work in [377] has proposed an algorithm based on a faster RCNN framework that fools automatic detection in images. For medical text, the solution in [378] generates a privacy-preserving shareable representation for a de-identification classifier. The work in [379] employs adversarial examples in ML systems to prevent the identification of sensitive information from images, while [380] enables de-identification of faces by using adversarial perturbations. Recent work showed that by changing only one pixel, it was possible to fool the DL algorithms [381]. The perturbation exploits differential evolution (DE) and, because of the inherent features of DE, can fool more types of DL models. Moreover, the authors of [37] proposed a Federated Blending model, called F-BIDS, in order to further protect the privacy of existing ML-based IDS. In contrast to the classical FL approaches, the federated meta-classifier is trained on the meta-data (composite data) instead of user-sensitive data to further enhance privacy.

## F. Lessons Learned

From the state-of-the-art methods presented to protect user privacy in the IIoT, we can see that many attacks are possible in IIoT applications. Given the specificity of the scenario, WSNs pose critical challenges, the solutions of which are also specific and detailed in Section V-C. Therefore, attention must be paid when dealing with sensitive information to preserve user privacy. FL is an initial attempt to preserve data privacy, but it is unsatisfactory. To this end, this section presents a multitude of approaches that can be used to prevent personal data leakage and that can be combined with FL. Recent research has proposed lightweight encryption, for example, via differential privacy or secure multi-party computation, and ML-assisted privacy protection to protect both models and data. For instance, a generative neural network to create artificial datasets is a viable approach that opens up a new area of study for privacy protection, particularly for unstructured data such as images and videos. Of equal importance is the study of defense mechanisms against ML-based privacy attacks. Although this area is still in its early stages, it is expected to fly in the future, given the widespread use of AI techniques in next-generation networks. The current standard technique in this field is adversarial examples/perturbations. In conclusion, we believe that the study of attack techniques will facilitate the development of more sophisticated defensive mechanisms.

# VI. CHALLENGES AND FUTURE DIRECTIONS

As discussed above, IIoT networks play an increasingly significant role in our lives in the presence of many applications. Despite its advantages, IIoT network development still faces some critical problems related to security and privacy. Furthermore, it also faces some research challenges in terms of resource management, fairness issues, economic issues, and IIoT in future wireless networks that need to be considered. Here, we further analyze and provide several possible solutions to these challenges.
## A. Resource Management in IIoT

The convergence of future IIoT networks will face challenges to not only IoT network deployments but also ML models. From this perspective, we find that the following issues need to be carefully considered.

**Heterogeneity:** There is a wide range of IoT systems (e.g., WSN, smart homes, industrial factories, remote healthcare, intelligent transport, smart city, smart grid, smart agriculture, etc.) and each consists of distinct IoT components with different processing capabilities, storage capacities, and power requirements. Therefore, it is necessary to standardize the resource management protocol in such networks to meet various requirements. In response to that, several protocols are now available for IoT devices, such as IPv6 over low-power wireless personal area networks, REST environments restricted by the IETF, restricted application protocol, and protocol mappings [382]. However, it is a fact that these current protocols are independent of each other and add complexity to resource-constrained IoT devices. Thus, new resource management solutions should be able to ensure interoperability with different devices and protocols.

**Scalability:** IIoT networks are projected to grow significantly in the coming years, which drives not only the massive proliferation of intelligent IoT devices/users/applications, but also large amounts of non-IID data. In order to handle these issues, the introduction of new types of integrated learning frameworks must have scalable features in response to different deployment scenarios. FedLab, a lightweight open-source framework based on FL algorithm effectiveness and communication efficiency, was proposed in [383] with the ability to add functional modules, such as unsupervised learning, semi-supervised learning, transfer learning, etc.

**Dynamic Nature:** IoT networks are dynamic since apparatuses join and leave the network frequently. Therefore, management solutions must be able to adapt to these changes and ensure the efficient use of all resources. Possible is to use token-based authentication [186], [187].

**Security:** IoT devices are frequently susceptible to attacks, and thus, current efforts are focused on deploying learning models on the device to perform multiple tasks: classification, detection, and data encryption. As IoT devices have limited resource capabilities, the use of these solutions can lead to data synchronization delays and high power consumption during learning/training tasks. To address these issues, optimizing/developing and realizing cooperative learning models and/or incorporating BCT becomes a possible solution [384]. Adopting one of the four cryptographic techniques applied in ISO/IEC 29192 [237] combined with a lightweight learning model during data encryption [239] is beneficial to enhance user information security and privacy during the aggregation process of encryption and authentication attributes into IoT data. Furthermore, dividing IoT data into hard and homomorphic verifiable tags and verifying them through blockchain transactions is also essential to prevent the cloud event of hardware or software damage.

## B. Learning Model Design in IIoT

Exploiting secure learning frameworks for IoT networks is a pivotal mission. However, the participation of different applications and network scales leads to different requirements in designing the complexity and memory of the learning models. Modern ML methods, such as DNNs, demand advanced hardware solutions such as high-power graphic processing units and tensor process units, particularly when dealing with high-dimensional data, large-size inputs, and low-latency constraints. Without these hardware solutions, achieving optimal performance and accuracy in ML tasks can be challenging. Thus, building lightweight learning models is a critical task for future IIoTs.

To hit this goal, we recognize that three following factors should be taken into account when deploying learning models for future IIoT networks:

* **Model size:** This refers to the amount of memory or storage used in terms of bytes, kilobytes, or megabytes. The size of the model determines the load time, transmission cost, and energy consumption of the model needed to complete the learning process. Thus, reducing the size of the model leads to reduced memory or storage costs while improving the efficiency and portability of the model.

* **Model complexity:** This factor showcases the amount of computation or arithmetic operations that the model performs, such as floating-point operations, multiply-accumulate operations, or tera operations per second. Thus, a lower model complexity can reduce the computational burden and improve the speed and performance of the model.

* **Model accuracy:** This factor is the cornerstone of a model's success in completing a given task or dataset while determining its confidence and usability. Model accuracy can be evaluated using metrics such as accuracy, precision, recall, F1-score, or mean average precision.

It is evident that there is a trade-off between the factors mentioned above. While increasing the model size can help the learning model execute faster, it also leads to higher computational costs. Similarly, to attain high accuracy in the learning model, one needs both a larger model size and a complex learning algorithm. Until now, there has been no universal standard for so-called lightweight learning models. Nevertheless, there are some possible criteria to reduce the model size and complexity for lightweight ML models.

1) Using the quantization technique can reduce the precision or bit-width of the model parameters, such as weights and activations, from floating-point numbers to integers or binary numbers. This yields a smaller usage of the memory and computation requirements for the model, as well as the data transmission cost [385].

2) Using the pruning technique can eliminate redundant or insignificant parameters of a model, such as weights or neurons, that are of low importance and contribute to the overall output of the model. This can significantly reduce the size and complexity of the model, and overfit [386].
3) Using a compression technique, such as coding, clustering, or hashing, can reduce the model size or complexity by exploiting the redundancy or similarity in the model parameters. This can reduce the memory and storage overhead, as well as the cost of data transmission [387].

4) The use of a distillation technique helps transfer the knowledge or functionality of a large or complex model (teacher) to a small or simple model (student), by training the student model to mimic the output or behavior of the teacher model. This reduces the size and complexity of the model while preserving the accuracy or performance of the model [388].

5) Using the hyper-parameter tuning optimization approaches enables us to obtain the best possible model architecture for a given task or dataset, including the ideal number of layers, neurons, or connections that can achieve the optimal balance between model size, complexity, and accuracy. This approach can reduce the size and complexity of the model while simultaneously increasing its performance and efficiency [389].

### C. Fairness in IIoT

The interplay between large-scale IoT, cloud demand, emerging learning solutions, and BCT has also raised another challenge related to fairness issues.

First, ensuring that each IoT device, application, or user receives a fair portion of communication resources (e.g., computing capacity, storage, energy, and bandwidth) is a critical task but challenging due to numerous factors (i.e., infrastructure, communication protocols, goals, network restrictions, and management policies) [390]. To address this problem, a possible solution is to distribute decision-making resources to the edge network while considering the use of the FL method and decentralized BCT [391].

Second, the collection of inefficient IoT data can lead to uncertain predictions, faulty decisions, or biases. Especially in e-health applications, even small gender-imbalanced patient datasets can result in misdiagnosis or improper treatment suggestions. Therefore, the development of a fairness-aware learning process is a critical task and there are some possible solutions as follows:

* **Data augmentation:** Generate new data from existing data by employing transformations (i.e., rotation, scaling, or flipping) to expand the size of the dataset as well as their diversity, potentially improving its balance [392].

* **Data weighting:** Each dataset requires the assignment of weights to distinct samples in order to balance the spread of characteristics, features, and classes by using techniques such as oversampling or undersampling [393].

* **Transfer learning:** To narrow the consequences of data imbalance on the learning process, knowledge models must be transferred from pre-trained models to new ones, such as learning from a smaller and more balanced dataset [394].

* **Fairness metrics:** Use metrics such as equal opportunity or disparate impact to measure the fairness of the model predictions, thus guiding the selection of appropriate learning techniques [395].

Thirdly, the consensus blockchain mechanism used to solve the trust and security issues in IIoT data sharing often creates a significant disparity in computing power as well as the diverse requirements of IIoT applications, posing two fairness factors:

* **Mining:** IoT nodes-devices may not have an equal opportunity to announce a new block compared to edge/cloud nodes due to limited resources and computing ability. Additionally, selfish mining attacks from edge/cloud nodes could result in unfairness in the mining process.

* **Transaction processing:** IIoT applications may need to ensure fair transaction processing, which involves packing transactions in a desired order, such as first-in-first-out or prioritizing transactions with the highest fees.

To address these concerns, a potential solution is to adopt FruitChain's characteristics and perform a probability analysis of transaction processing effectiveness while using an Euclidean distance-based measure to assess fairness [396].

Lastly, the centralized approach for data-intensive applications lacks marketing fairness for IoT users (who sell their data) and third-party buyers. To deal with such challenges, a possible solution in [397] suggested three steps: 1) Establish a set of supervising nodes to form an efficient consortium blockchain that acts as a transparent and trusted "controller" for cloud-based data marketing; 2) Manage anonymous logins for data owners using distributed and open-threshold release of credentials to ensure confidentiality and privacy; and 3) Provide financial incentives and succinct "commitments" of reliable behavior based on the on/off-chain communication among the data owner, third party, and cloud server.

### D. Economic Issues in IIoT

Another possible challenge is the economic issues in IIoT networks. The first issue is the cost associated with "deploying and maintaining the infrastructure". This includes the costs related to hardware installation (e.g., sensors, gateways and other devices), software, and connectivity [398]. In addition, when the network evolves into a larger scale or complex environment, it also requires considerable expenditures to keep the network operational for an extended period of time. Additionally, automating many routine tasks by learning solutions may result in job displacement or replacement, which can have a negative impact on the workforce, especially in industries [407]. The second issue is the cost of security. The risk of cyber attacks and data breaches increases in tandem with an increasing number of connected devices [399]. To provide a robust security mechanism, additional investment in infrastructure can increase the cost of learning, training, testing, and operating new learning frameworks. The third issue is data ownership and privacy. The massive sharing of IoT data generated by the IIoT network among different entities increases the need for efficient management mechanisms to control data ownership and protect sensitive user information [247]. The fourth issue is the standards and interoperability. As intelligent IoT networks involve many different devices and technologies, a unified standard [400] to ensure that these devices can communicate with each other effectively; otherwise, the development and
<table><caption>TABLE VII
SUMMARY OF CHALLENGES AND FUTURE DIRECTIONS FOR IIoT</caption><thead><tr><td>Challenge in IIoT</td><td>Description</td><td>Possible solution</td></tr></thead><tbody><tr><td>Resource management</td><td><ul><li><b>Heterogeneity:</b> The diversity of IIoT systems and their corresponding devices, users, and applications.</li><li><b>Scalability:</b> The new types of integrated learning framework must meet the diverse deployment scenarios.</li><li><b>Dynamic Nature:</b> IoT apparatuses frequently join and leave the network frequently.</li><li><b>Security:</b> IoT devices with limited resource capacity.</li></ul></td><td><ul><li>Adoption of lightweight protocols [382].</li><li>Development of a lightweight open-source framework: FedLab [383].</li><li>Applying token-based authentication [186], [187].</li><li>Optimizing/developing/realizing cooperative learning models and/or incorporating BCT [384]; Adoption of cryptographic techniques in ISO/IEC 29192 [237] combined with a lightweight learning model during data encryption [239].</li></ul></td></tr><tr><td>Learning Model Design</td><td>When designing learning models, three following factors should be taken into account:<ul><li><b>Model size:</b> The amount of memory or storage usage.</li><li><b>Model complexity:</b> The amount of usage of computation or arithmetic operations.</li><li><b>Model complexity:</b> The confidence and usability of the output generated by the learning representatives.</li></ul></td><td><ul><li>Using the quantization technique to reduce the precision or bit width of the model parameters [385].</li><li>Using the pruning technique to eliminate redundant or insignificant parameters of a model [386].</li><li>Using a compression technique to reduce model size or complexity [387].</li><li>Using the distillation technique to transfer the knowledge or functionality of a large or complex model (teacher) to a small or simple model (student) [388].</li><li>Using hyperparameter tuning optimization approaches to obtain the best possible model architecture for a given task or dataset [389].</li></ul></td></tr><tr><td>Fairness issues</td><td><ul><li><b>Resource allocation:</b> Ensure that each IoT device, application, or user receives equitable communication resources.</li><li><b>Learning process:</b> Develop a fairness-sensitive learning process.</li><li><b>Blockchain consensus:</b> Equal opportunity between IoT nodes/devices and edge/cloud nodes when releasing a new block and guaranteeing fair transaction processing per IIoT application.</li><li><b>Data marketing:</b> Guarantee fair marketing of data-intensive applications between IoT users (who sell their data) and third-party buyers.</li></ul></td><td><ul><li>Distribute decision-making resources to the edge network while considering the use of the FL method and decentralized BCT [391].</li><li>Adoption techniques for data augmentation [392], data weighting [393], transfer learning [394], and fairness metrics [395].</li><li>Adopt FruitChain's characteristics and perform a probability analysis of transaction processing effectiveness using a Euclidean distance-based measure to assess fairness [396].</li><li>Apply three steps in [397]: 1) establish a transparent and trusted "controller" for cloud-based data marketing; 2) distribute and open-threshold release of credentials to ensure confidentiality and privacy; and 3) provide financial incentives and succinct "commitments" of reliable behavior.</li></ul></td></tr><tr><td>Economic issues</td><td><ul><li><b>Deploying and maintaining the infrastructure:</b> Costs related to hardware installation (e.g. sensors, gateways, and other devices), software, and connectivity, as well as network maintenance over a long period of time [398].</li><li><b>Cost of security:</b> Additional infrastructure investment to reduce the risks of cyberattacks and data breaches, as well as the additional costs of learning, training, testing and operating new learning frameworks [399].</li><li><b>Data ownership and privacy:</b> Complex IoT data generated by multiple entities require efficient management mechanisms [247].</li><li><b>Standards and interoperability:</b> The existence of many different devices and technologies requires a unified standard to ensure that these devices can communicate with each other effectively [400].</li></ul></td><td></td></tr><tr><td>Future mobile networks</td><td>The interplay between the mobile network and Metaverse environments causes:<ul><li>New privacy concerns related to the use of collected user data characteristics for personalized advertising.</li><li>New hardware designs for accessing Metaverse environments.</li></ul></td><td><ul><li>Adoption of Generative AI with</li><li>Ethereum blockchain-based deep recurrent neural networks [401].</li><li>Transformer-based model [402] or DL-based model [403].</li></ul></td></tr><tr><td>Model drift</td><td><ul><li><b>Data Variability:</b> The drift of the model lies in the changes in the patterns and statistical properties of the underlying data over time.</li><li><b>Adaptability:</b> Predictive models must be able to adapt to new data patterns.</li></ul></td><td><ul><li>Online learning algorithms, can continuously assimilate and adapt to new data and offer a robust solution to the mutable patterns observed within IIoT environments [404].</li><li>Ensemble learning helps to evolving data landscapes [405].</li><li>Machine unlearning enables the selective removal or "forgetting" of data that may no longer be relevant or that could introduce biases or vulnerabilities [406].</li></ul></td></tr></tbody></table>

adoption of intelligent IoT networks could be slowed or hindered [408].

## E. IIoT in Future Networks

IIoT is critical in enabling numerous intelligent services and applications in several vertical domains. However, continuous

advances in AI techniques and IoT technologies require that IIoT be further investigated in future 6G networks, particularly IIoT integration with new technologies and computing paradigms in 6G systems. "Metaverse", a lived picture of potential AI visions in wireless communication networks [409], has recently received considerable attention
in standardizing the future and advanced mobile network of 5G [410]. It drives the sustainable evolution of edge intelligence and infrastructure layers [411] and presents environmentally friendly networking solutions within the Metaverse [412]. Nevertheless, all these works share a common aspect, which is the rising privacy concerns related to the utilization of collected user data characteristics for personalized advertising. These characteristics include facial features, eye movements, voice patterns, and other biometric information, along with real-time location and environmental data. In particular, new hardware designs for accessing Metaverse environments generate new security challenges, for example, extracting/tracing users' fingerprints to forge passwords. To cope with such problems, "Generative AI", also known as AI-generated content, has recently been recognized as a particularly efficient approach to detect cyber threats in 6G-allowed IoT networks with the combination of transformer-based model [402] and DL model [403] as well as the Ethereum blockchain with RNN model [401]. However, these current methods still consume a significant amount of time and energy to achieve an overall detection accuracy of around 95%, indicating the effectiveness of Generative AI in real-world applications.

## F. Model Drift in IIoT Networks

The evolving and dynamic nature of the data streams within the IIoT ecosystem inherently produces unpredictable behaviors at various levels of urban equipment and devices. This unpredictability is mainly due to concept drift, a phenomenon that was first identified by Schlimmer et al. in 1986 [413]. Concept drift reflects the inevitable changes in the statistical distributions of IoT data streams, which can be triggered by natural processes like the gradual wear and tear of urban infrastructure, or by unnatural events such as equipment failures or security breaches. Such changes challenge the static nature of traditional predictive models, as the ground truth on which these models were initially trained gradually becomes misaligned with new data. This misalignment leads to a reduced statistical similarity between historical data streams and current observations, necessitating adjustments in the models' classification and clustering boundaries to accommodate the dynamic, non-static nature of IoT environments.

Addressing these challenges necessitates the adoption of advanced methodologies, such as online learning, ensemble learning, and adaptive ML techniques [414]. Online learning algorithms, characterized by their ability to continuously assimilate and adapt to new data, offer a robust solution to the mutable patterns observed within IIoT environments [404]. These algorithms proactively adjust to emerging data trends, thus efficiently counteracting the effects of concept drift. Furthermore, ensemble learning strategies have been identified as particularly effective in managing concept drift [415]. By dynamically modifying the composition of the ensemble in response to changing data landscapes, these methods improve the resilience of the model [405]. Moreover, adaptive ML techniques, also known as machine unlearning, enable the selective removal or "forgetting" of data that may no longer be

relevant or that could introduce biases or vulnerabilities [406]. In addition, if data-sharing agreements change, it enables network operators to selectively remove the influence of their data. Therefore, the machine unlearning approach not only helps maintain the model's accuracy and relevance in the face of non-stationary data but also enhances privacy and security by allowing for the dynamic adjustment of the model to exclude potentially compromised data. Together, these strategies underscore a forward-thinking approach to maintaining the accuracy and reliability of predictive models in the face of the inherent variability of the IIoT.

## VII. CONCLUSION

In this article, we conducted a comprehensive survey on the convergence of IoT and AI through an extensive investigation of the applications, security, and privacy issues of IIoT. A number of important application domains have been presented and analyzed, including IIoT-based smart healthcare, IIoT-based smart grid, IIoT-based smart transportation, and IIoT-based smart industry. We have then discussed several crucial security issues existing in IIoT systems and applications, from network attacks and confidentiality to integrity and intrusion. In addition, privacy concerns have been considered and investigated in three main domains, namely, data privacy leakage, location privacy leakage, and model privacy leakage. The lessons learned from our holistic discussion have been also summarized and provided. Several interesting research challenges have been identified in IIoT, along with potential solutions to stimulate further research in the interesting area of IIoT.

## ACKNOWLEDGMENT

The paper reflects the authors' views, and the Commission is not responsible for any use that may be made of the information it contains.

## REFERENCES

[1] A. Bröring et al., "IntelliIoT: Intelligent IoT environments," in Proc. 5th Glob. IoT Summit, 2022, pp. 55–68.

[2] C. Zhang, "Intelligent Internet of Things service based on artificial intelligence technology," in Proc. IEEE 2nd Int. Conf. Big Data, Artif. Intell. Internet Things Eng. (ICBAIE), 2021, pp. 731–734.

[3] Z. Zhou, X. Chen, E. Li, L. Zeng, K. Luo, and J. Zhang, "Edge intelligence: Paving the last mile of artificial intelligence with edge computing," Proc. IEEE, vol. 107, no. 8, pp. 1738–1762, 2019.

[4] A. M. Elbir, B. Soner, S. Çöleri, D. Gündüz, and M. Bennis, "Federated learning in vehicular networks," in Proc. IEEE Int. Mediterr. Conf. Commun. Netw. (MeditCom), 2022, pp. 72–77.

[5] K. A. Nagaty, "IoT commercial and industrial applications and AI-powered IoT," in Frontiers of Quality Electronic Design (QED) AI, IoT and Hardware Security. Cham, Switzerland: Springer, 2023, pp. 465–500.

[6] J. Lin, W. Yu, N. Zhang, X. Yang, H. Zhang, and W. Zhao, "A survey on Internet of Things: Architecture, enabling technologies, security and privacy, and applications," IEEE Internet Things J., vol. 4, no. 5, pp. 1125–1142, Oct. 2017.

[7] M. A. Al-Garadi, A. Mohamed, A. K. Al-Ali, X. Du, I. Ali, and M. Guizani, "A survey of machine and deep learning methods for Internet of Things (IoT) security," IEEE Commun. Surveys Tuts., vol. 22, no. 3, pp. 1646–1685, 3rd Quart., 2020.

[8] F. Samie, L. Bauer, and J. Henkel, "From cloud down to things: An overview of machine learning in Internet of Things," IEEE Internet Things J., vol. 6, no. 3, pp. 4921–4934, Jun. 2019.
[9] M. Amiri-Zarandi, R. A. Dara, and E. Fraser, "A survey of machine learning-based solutions to protect privacy in the Internet of Things," *Comput. Secur.*, vol. 96, Sep. 2020, Art. no. 101921.

[10] A. Jamalipour and S. Murali, "A taxonomy of machine-learning-based intrusion detection systems for the Internet of Things: A survey," *IEEE Internet Things J.*, vol. 9, no. 12, pp. 9444-9466, Jun. 2022.

[11] W. Chen, X. Qiu, T. Cai, H.-N. Dai, Z. Zheng, and Y. Zhang, "Deep reinforcement learning for Internet of Things: A comprehensive survey," *IEEE Commun. Surveys Tuts.*, vol. 23, no. 3, pp. 1659-1692, 3rd Quart., 2021.

[12] L. Lei, Y. Tan, K. Zheng, S. Liu, K. Zhang, and X. Shen, "Deep reinforcement learning for autonomous Internet of Things: Model, applications and challenges," *IEEE Commun. Surveys Tuts.*, vol. 22, no. 3, pp. 1722-1760, 3rd Quart., 2020.

[13] H. Wu, H. Han, X. Wang, and S. Sun, "Research on artificial intelligence enhancing Internet of Things security: A survey," *IEEE Access*, vol. 8, pp. 153826-153848, 2020.

[14] N. Koroniotis, N. Moustafa, and E. Sitnikova, "Forensics and deep learning mechanisms for botnets in Internet of Things: A survey of challenges and solutions," *IEEE Access*, vol. 7, pp. 61764-61785, 2019.

[15] R. A. Khalil, N. Saeed, M. Masood, Y. M. Fard, M.-S. Alouini, and T. Y. Al-Naffouri, "Deep learning in the industrial Internet of Things: Potentials, challenges, and emerging applications," *IEEE Internet Things J.*, vol. 8, no. 14, pp. 11016-11040, Jul. 2021.

[16] S. U. Amin and M. S. Hossain, "Edge intelligence and Internet of Things in healthcare: A survey," *IEEE Access*, vol. 9, pp. 45-59, 2020.

[17] M. A. Ferrag et al., "Edge learning for 6G-enabled Internet of Things: A comprehensive survey of vulnerabilities, datasets, and defenses," *2023, arXiv:2306.10309*.

[18] S. J. Russell, *Artificial Intelligence a Modern Approach*. London, U.K.: Pearson Educ., Inc., 2010.

[19] M. I. Jordan and T. M. Mitchell, "Machine learning: Trends, perspectives, and prospects," *Science*, vol. 349, no. 6245, pp. 255-260, 2015.

[20] O. Auèdi, K. Piamrat, and B. Parrein, "Intelligent traffic management in next-generation networks," *Future Internet*, vol. 14, no. 2, p. 44, 2022.

[21] Y. Bengio, A. Courville, and P. Vincent, "Representation learning: A review and new perspectives," *IEEE Trans. Pattern Anal. Mach. Intell.*, vol. 35, no. 8, pp. 1798-1828, Aug. 2013.

[22] I. Goodfellow, Y. Bengio, and A. Courville, *Deep Learning*. Cambridge, MA, USA: MIT Press, 2016.

[23] R. S. Sutton, A. G. Barto, *Introduction to Reinforcement Learning*, vol. 135. Cambridge, MA, USA: MIT Press, 1998.

[24] A. Sacco, M. Flocco, F. Esposito, and G. Marchetto, "Partially oblivious congestion control for the Internet via reinforcement learning," *IEEE Trans. Netw. Service Manag.*, vol. 20, no. 2, pp. 1644-1659, Jun. 2023.

[25] H. Kokkonen et al., "Autonomy and intelligence in the computing continuum: Challenges, enablers, and future directions for orchestration," *2022, arXiv:2205.01423*.

[26] D. C. Nguyen, M. Ding, P. N. Pathirana, A. Seneviratne, J. Li, and H. V. Poor, "Federated learning for Internet of Things: A comprehensive survey," *IEEE Commun. Surveys Tuts.*, vol. 23, no. 3, pp. 1622-1658, 3rd Quart., 2021.

[27] M. Le, T. Huynh-The, T. Do-Duy, T.-H. Vu, W.-J. Hwang, and Q.-V. Pham, "Applications of distributed machine learning for the Internet-of-Things: A comprehensive survey," *2023, arXiv:2310.10549*.

[28] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, "Communication-efficient learning of deep networks from decentralized data," in *Proc. 20th Int. Conf. Artif. Intell. Statist.*, 2017, pp. 1273-1282.

[29] J. Konečný, H. B. McMahan, D. Ramage, and P. Richtárik, "Federated optimization: Distributed machine learning for on-device intelligence," *2016, arXiv:1610.02527*.

[30] W. Y. B. Lim et al., "Federated learning in mobile edge networks: A comprehensive survey," *IEEE Commun. Surveys Tuts.*, vol. 22, no. 3, pp. 2031-2063, 3rd Quart., 2020.

[31] O. Auèdi, K. Piamrat, G. Muller, and K. Singh, "Federated semisupervised learning for attack detection in industrial Internet of Things," *IEEE Trans. Ind. Informat.*, vol. 19, no. 1, pp. 286-295, Jan. 2023.

[32] S. Feng and H. Yu, "Multi-participant multi-class vertical federated learning," *2020, arXiv:2001.11154*.

[33] Y. Liu, Y. Kang, C. Xing, T. Chen, and Q. Yang, "A secure federated transfer learning framework," *IEEE Intell. Syst.*, vol. 35, no. 4, pp. 70-82, Jul./Aug. 2020.

[34] M. Mohammadi, A. Al-Fuqaha, S. Sorour, and M. Guizani, "Deep learning for IoT big data and streaming analytics: A survey," *IEEE Commun. Surveys Tuts.*, vol. 20, no. 4, pp. 2923-2960, 4th Quart., 2018.

[35] M. Le, D. T. Hoang, D. N. Nguyen, W.-J. Hwang, and Q.-V. Pham, "Wirelessly powered federated learning networks: Joint power transfer, data sensing, model training, and resource allocation," *IEEE Internet Things J.*, early access, Oct. 13, 2023, doi: 10.1109/JIOT.2023.3324151.

[36] R. Zhong, X. Liu, Y. Liu, and Y. Chen, "Multi-agent reinforcement learning in NOMA-aided UAV networks for cellular offloading," *IEEE Trans. Wireless Commun.*, vol. 21, no. 3, pp. 1498-1512, Mar. 2022.

[37] O. Auèdi and K. Piamrat, "F-BIDS: Federated-blending based intrusion detection system," *Pervasive Mobile Comput.*, vol. 89, Feb. 2023, Art. no. 101750.

[38] O. Auèdi, "Towards a scalable and energy-efficient framework for industrial cloud-edge-IoT continuum," *IEEE Internet Things Mag.*, 2024, preprint.

[39] A. Al-Fuqaha, M. Guizani, M. Mohammadi, M. Aledhari, and M. Ayyash, "Internet of Things: A survey on enabling technologies, protocols, and applications," *IEEE Commun. Surveys Tuts.*, vol. 17, no. 4, pp. 2347-2376, 4th Quart., 2015.

[40] A. Walinjkar and J. Woods, "Personalized wearable systems for real-time ECG classification and healthcare interoperability: Real-time ECG classification and FHIR interoperability," in *Proc. Internet Technol. Appl. (ITA)*, 2017, pp. 9-14.

[41] J. Hong and J. Yoon, "Multivariate time-series classification of sleep patterns using a hybrid deep learning architecture," in *Proc. IEEE 19th Int. Conf. e-Health Netw., Appl. Services (Healthcom)*, 2017, pp. 1-6.

[42] G. Matar, J.-M. Lina, J. Carrier, A. Riley, and G. Kaddoum, "Internet of Things in sleep monitoring: An application for posture recognition using supervised learning," in *Proc. IEEE 18th Int. Conf. e-Health Netw., Appl. Services (Healthcom)*, 2016, pp. 1-6.

[43] M. Zeng et al., "Convolutional neural networks for human activity recognition using mobile sensors," in *Proc. 6th Int. Conf. Mobile Comput., Appl. Services*, 2014, pp. 197-205.

[44] J. Yang, M. N. Nguyen, P. P. San, X. L. Li, and S. Krishnaswamy, "Deep convolutional neural networks on multichannel time series for human activity recognition," in *Proc. 24th Int. Joint Conf. Artif. Intell. (ICAI)*, 2015, pp. 3995-4001.

[45] M. Panwar et al., "CNN based approach for activity recognition using a wrist-worn accelerometer," in *Proc. 39th Annu. Int. Conf. IEEE Eng. Med. Biol. Soc. (EMBC)*, 2017, pp. 2438-2441.

[46] X. Cheng, L. Zhang, Y. Tang, Y. Liu, H. Wu, and J. He, "Real-time human activity recognition using conditionally parametrized convolutions on mobile and wearable devices," *IEEE Sensors J.*, vol. 22, no. 6, pp. 5889-5901, Mar. 2022.

[47] F. J. Ordóñez and D. Roggen, "Deep convolutional and LSTM recurrent neural networks for multimodal wearable activity recognition," *Sensors*, vol. 16, no. 1, p. 115, 2016.

[48] B. C. Drolet, J. S. Marwaha, B. Hyatt, P. E. Blazar, and S. D. Lifchez, "Electronic communication of protected health information: Privacy, security, and HIPAA compliance," *J. Hand Surg.*, vol. 42, no. 6, pp. 411-416, 2017.

[49] O. Auèdi, A. Sacco, K. Piamrat, and G. Marchetto, "Handling privacy-sensitive medical data with federated learning: Challenges and future directions," *IEEE J. Biomed. Health Inform.*, vol. 27, no. 2, pp. 790-803, 2022.

[50] S. Zehtabian, S. Khodadadeh, L. Bölöni, and D. Turgut, "Privacy-preserving learning of human activity predictors in smart environments," in *Proc. IEEE Conf. Comput. Commun.*, 2021, pp. 1-10.

[51] R. Presotto, "Semi-supervised methodologies to tackle the annotated data scarcity problem in the field of HAR," in *Proc. 22nd IEEE Int. Conf. Mobile Data Manage. (MDM)*, 2021, pp. 269-271.

[52] Y. Zhao, H. Liu, H. Li, P. Barnaghi, and H. Haddadi, "Semi-supervised federated learning for activity recognition," *2020, arXiv:2011.00851*.

[53] C. Bettini, G. Civitarese, and R. Presotto, "Personalized semi-supervised federated learning for human activity recognition," *2021, arXiv:2104.08094*.

[54] Q. Wu, K. He, and X. Chen, "Personalized federated learning for intelligent IoT applications: A cloud-edge based framework," *IEEE Open J. Comput. Soc.*, vol. 1, pp. 35-44, May 2020.

[55] A. Imteaj and M. H. Amini, "FedPARL: Client activity and resource-oriented lightweight federated learning model for resource-constrained heterogeneous IoT environment," *Front. Commun. Netw.*, vol. 2, p. 10, Apr. 2021.
[56] T. Shaik et al., “FedStack: Personalized activity monitoring using stacked federated learning,” *Knowl.-Based Syst.*, vol. 257, Dec. 2022, Art. no. 109929.

[57] Q.-V. Pham, D. C. Nguyen, T. Huynh-The, W.-J. Hwang, and P. N. Pathirana, “Artificial intelligence (AI) and big data for coronavirus (COVID-19) pandemic: A survey on the state-of-the-arts,” *IEEE Access*, vol. 8, p. 130820–130839, 2020.

[58] F. Shi et al., “Review of artificial intelligence techniques in imaging data acquisition, segmentation, and diagnosis for COVID-19,” *IEEE Rev. Biomed. Eng.*, vol. 14, pp. 4–15, Apr. 2020.

[59] M. Barstugan, U. Ozkaya, and S. Ozturk, “Coronavirus (COVID-19) classification using CT images by machine learning methods,” 2020, arXiv:2003.09424.

[60] C. Zheng et al., “Deep learning-based detection for COVID-19 from chest CT using weak label,” *MedRxiv*, Preprint, 2020.

[61] A. Narin, C. Kaya, and Z. Pamuk, “Automatic detection of coronavirus disease (COVID-19) using X-ray images and deep convolutional neural networks,” *Pattern Anal. Appl.*, vol. 24, no. 3, pp. 1207–1220, 2021.

[62] J. P. Cohen, P. Morrison, and L. Dao, “COVID-19 image data collection,” arXiv:2003.11597, 2020.

[63] I. D. Apostolopoulos and T. A. Mpesiana, “COVID-19: Automatic detection from X-ray images Utilizing transfer learning with convolutional neural networks,” *Phys. Eng. Sci. Med.*, vol. 43, no. 2, pp. 635–640, 2020.

[64] Y. Pathak, P. K. Shukla, A. Tiwari, S. Stalin, and S. Singh, “Deep transfer learning based classification model for COVID-19 disease,” *IRBM*, vol. 43, no. 2, pp. 87–92, 2020.

[65] I. Feki, S. Ammar, Y. Kessentini, and K. Muhammad, “Federated learning for COVID-19 screening from chest X-ray images,” *Appl. Soft Comput.*, vol. 106, Jul. 2021, Art. no. 107330.

[66] R. Wang, J. Xu, Y. Ma, M. Talha, M. S. Al-Rakhami, and A. Ghoneim, “Auxiliary diagnosis of COVID-19 based on 5G-enabled federated learning,” *IEEE Netw.*, vol. 35, no. 3, pp. 14–20, May/Jun. 2021.

[67] W. Zhang et al., “Dynamic-fusion-based federated learning for COVID-19 detection,” *IEEE Internet Things J.*, vol. 8, no. 21, pp. 15884–15891, Nov. 2021.

[68] O. A. Sarumi, O. Aouedi, and L. J. Muhammad, “Potential of deep learning algorithms in mitigating the spread of COVID-19,” in *Understanding COVID-19: The Role of Computational Intelligence*. Cham, Switzerland: Springer, 2022, pp. 225–244.

[69] M. Alazab, A. Awajan, A. Mesleh, A. Abraham, V. Jatana, and S. Alhyari, “COVID-19 prediction and detection using deep learning,” *Int. J. Comput. Inf. Syst. Ind. Manage. Appl.*, vol. 12, pp. 168–181, Jan. 2020.

[70] D. Syed, A. Zainab, A. Ghrayeb, S. S. Refaat, H. Abu-Rub, and O. Bouhali, “Smart grid big data analytics: Survey of technologies, techniques, and applications,” *IEEE Access*, vol. 9, pp. 59564–59585, 2020.

[71] T. Baumeister, *Literature Review on Smart Grid Cyber Security*, Collaborat. Softw. Develop. Lab., Univ. Hawaii, Honolulu, HI, USA, vol. 650, 2010.

[72] S. S. Reka and T. Dragicevic, “Future effectual role of energy delivery: A comprehensive review of Internet of Things and smart grid,” *Renew. Sustain. Energy Rev.*, vol. 91, pp. 90–108, Aug. 2018.

[73] W. Ahmed et al., “Machine learning based energy management model for smart grid and renewable energy districts,” *IEEE Access*, vol. 8, pp. 185059–185078, 2020.

[74] M. Alazab, S. Khan, S. S. R. Krishnan, Q.-V. Pham, M. P. K. Reddy, and T. R. Gadekallu, “A multidirectional LSTM model for predicting the stability of a smart grid,” *IEEE Access*, vol. 8, pp. 85454–85463, 2020.

[75] S. Zhai, X. Jin, L. Wei, H. Luo, and M. Cao, “Dynamic federated learning for GMEC with time-varying wireless link,” *IEEE Access*, vol. 9, pp. 10400–10412, 2021.

[76] H. Cao, S. Liu, R. Zhao, and X. Xiong, “IFed: A novel federated learning framework for local differential privacy in power Internet of Things,” *Int. J. Distrib. Sensor Netw.*, vol. 16, no. 5, 2020, Art. no. 1550147720919698.

[77] Z. Su et al., “Secure and efficient federated learning for smart grid with edge-cloud collaboration,” *IEEE Trans. Ind. Informat.*, vol. 18, no. 2, pp. 1333–1344, Feb. 2022.

[78] Y. L. Tun, K. Thar, C. M. Thwal, and C. S. Hong, “Federated learning based energy demand prediction with clustered aggregation,” in *Proc. IEEE Int. Conf. Big Data Smart Comput. (BigComp)*, 2021, pp. 164–167.

[79] L. Zhao, T. Dai, Z. Qiao, P. Sun, J. Hao, and Y. Yang, “Application of artificial intelligence to wastewater treatment: A bibliometric analysis and systematic review of technology, economy, management, and wastewater reuse,” *Process Saf. Environ. Prot.*, vol. 133, pp. 169–182, Jan. 2020.

[80] X. Hou et al., “Machine-learning-aided mission-critical Internet of Underwater Things,” *IEEE Netw.*, vol. 35, no. 4, pp. 160–166, Jul./Aug. 2021.

[81] J. Ktari, T. Frikha, M. Hamdi, H. Elmannai, and H. Hmam, “Lightweight AI framework for industry 4.0 case study: Water meter recognition,” *Big Data Cogn. Comput.*, vol. 6, no. 3, p. 72, 2022.

[82] S.-S. Baek, J. Pyo, and J. A. Chun, “Prediction of water level and water quality using a CNN-LSTM combined deep learning approach,” *Water*, vol. 12, no. 12, p. 3399, 2020.

[83] M. Saraiva, É. Protas, M. Salgado, and C. Souza Jr., “Automatic mapping of center pivot irrigation systems from satellite images using deep learning,” *Remote Sens.*, vol. 12, no. 3, p. 558, 2020.

[84] Y. Wang, J. Zhou, K. Chen, Y. Wang, and L. Liu, “Water quality prediction method based on LSTM neural network,” in *Proc. 12th Int. Conf. Intell. Syst. Knowl. Eng. (ISKE)*, 2017, pp. 1–5.

[85] D. V. V. Prasad et al., “Analysis and prediction of water quality using deep learning and auto deep learning techniques,” *Sci. Total Environ.*, vol. 821, May 2022, Art. no. 153311.

[86] N. Victor et al., “Federated learning for IoUT: Concepts, applications, challenges and opportunities,” 2022, arXiv:2207.13976.

[87] H. Zhao et al., “Federated meta learning enhanced acoustic radio cooperative framework for ocean of things underwater acoustic communications,” 2021, arXiv:2105.13296.

[88] V. Balali, A. Ashouri Rad, and M. Golparvar-Fard, “Detection, classification, and mapping of U.S. traffic signs using Google street view images for roadway inventory management,” *Vis. Eng.*, vol. 3, pp. 1–18, Nov. 2015.

[89] F. Zaklouta and B. Stanciuvescu, “Real-time traffic-sign recognition using tree classifiers,” *IEEE Trans. Intell. Transp. Syst.*, vol. 13, no. 4, pp. 1507–1514, Dec. 2012.

[90] Y. Chen, W. Xu, J. Zuo, and K. Yang, “The fire recognition algorithm using dynamic feature fusion and IV-SVM classifier,” *Clust. Comput.*, vol. 22, pp. 7665–7675, May 2019.

[91] D. Tabernik and D. Skočaj, “Deep learning for large-scale traffic-sign detection and recognition,” *IEEE Trans. Intell. Transp. Syst.*, vol. 21, no. 4, pp. 1427–1440, Apr. 2020.

[92] T. Yang, X. Long, A. K. Sangaiah, Z. Zheng, and C. Tong, “Deep detection network for real-life traffic sign in vehicular networks,” *Comput. Netw.*, vol. 136, pp. 95–104, May 2018.

[93] Á. Arcos-García, J. A. Alvarez-Garcia, and L. M. Soria-Morillo, “Deep neural network for traffic sign recognition systems: An analysis of spatial transformers and stochastic optimisation methods,” *Neural Netw.*, vol. 99, pp. 158–165, Mar. 2018.

[94] J. Zhang, W. Wang, C. Lu, J. Wang, and A. K. Sangaiah, “Lightweight deep network for traffic sign classification,” *Ann. Telecommun.*, vol. 75, pp. 369–379, Aug. 2020.

[95] K. Xie et al., “Efficient federated learning with spike neural networks for traffic sign recognition,” *IEEE Trans. Veh. Technol.*, vol. 71, no. 9, pp. 9980–9992, Sep. 2022.

[96] “The growth of electric vehicles.” Accessed: Apr. 14, 2023. [Online]. Available: https://www.cnbc.com/2018/05/30/electric-vehicles-will-grow-from-3-million-to-125-million-by-2030-iea.html

[97] M. Majidpour, C. Qiu, P. Chu, R. Gadh, and H. R. Pota, “Fast prediction for sparse time series: Demand forecast of EV charging stations for cell phone applications,” *IEEE Trans. Ind. Informat.*, vol. 11, no. 1, pp. 242–250, Feb. 2015.

[98] Y. M. Saputra, D. T. Hoang, D. N. Nguyen, E. Dutkiewicz, M. D. Mueck, and S. Srikanteswara, “Energy demand prediction with federated learning for electric vehicle networks,” in *Proc. IEEE Glob. Commun. Conf. (GLOBECOM)*, 2019, pp. 1–6.

[99] A. Chiş, J. Lundén, and V. Koivunen, “Reinforcement learning-based plug-in electric vehicle charging with forecasted price,” *IEEE Trans. Veh. Technol.*, vol. 66, no. 5, pp. 3674–3684, May 2017.

[100] H. Jahangir, S. S. Gougheri, B. Vatandoust, M. A. Golkar, A. Ahmadian, and A. Hajizadeh, “Plug-in electric vehicle Behavior modeling in energy market: A novel deep learning-based approach with clustering technique,” *IEEE Trans. Smart Grid*, vol. 11, no. 6, pp. 4738–4748, Nov. 2020.

[101] L. Liu, Z. Xi, K. Zhu, R. Wang, and E. Hossain, “Mobile charging station placements in Internet of Electric Vehicles: A federated learning approach,” *IEEE Trans. Intell. Transp. Syst.*, vol. 23, no. 12, pp. 24561–24577, Dec. 2022.
[102] J. Shi, F. Qiao, Q. Li, L. Yu, and Y. Hu, "Application and evaluation of the reinforcement learning approach to eco-driving at intersections under infrastructure-to-vehicle communications," *Transp. Res. Rec.*, vol. 2672, no. 25, pp. 89-98, 2018.

[103] M. Wegener, L. Koch, M. Eisenbarth, and J. Andert, "Automated eco-driving in urban scenarios using deep reinforcement learning," *Transp. Res. Part C, Emerg. Technol.*, vol. 126, May 2021, Art. no. 102967.

[104] A. Pozzi, S. Bae, Y. Choi, F. Borrelli, D. M. Raimondo, and S. Moura, "Ecological velocity planning through signalized intersections: A deep reinforcement learning approach," in *Proc. 59th IEEE Conf. Decis. Control (CDC)*, 2020, pp. 245-252.

[105] H. Yuan and G. Li, "A survey of traffic prediction: From spatio-temporal data to intelligent transportation," *Data Sci. Eng.*, vol. 6, pp. 63-85, Jan. 2021.

[106] P. Cai, Y. Wang, G. Lu, P. Chen, C. Ding, and J. Sun, "A spatiotemporal correlative k-nearest neighbor model for short-term traffic multistep forecasting," *Transp. Res. Part C, Emerg. Technol.*, vol. 62, pp. 21-34, Jan. 2016.

[107] U. Johansson, H. Boström, T. Löfström, and H. Linusson, "Regression conformal prediction with random forests," *Mach. Learn.*, vol. 97, pp. 155-176, Jul. 2014.

[108] P. Lara-Benítez, M. Carranza-García, and J. C. Riquelme, "An experimental review on deep learning architectures for time series forecasting," *Int. J. Neural Syst.*, vol. 31, no. 3, 2021, Art. no. 2130001.

[109] S. Sun, H. Wu, and L. Xiang, "City-wide traffic flow forecasting using a deep convolutional neural network," *Sensors*, vol. 20, no. 2, p. 421, 2020.

[110] W. Zhao, Y. Gao, T. Ji, X. Wan, F. Ye, and G. Bai, "Deep temporal convolutional networks for short-term traffic flow forecasting," *IEEE Access*, vol. 7, pp. 114496-114507, 2019.

[111] T. N. Kipf and M. Welling, "Semi-supervised classification with graph convolutional networks," 2016, arXiv:1609.02907.

[112] Y. Li, R. Yu, C. Shahabi, and Y. Liu, "Diffusion convolutional recurrent neural network: Data-driven traffic forecasting," 2017, arXiv:1707.01926.

[113] Z. Wu, S. Pan, G. Long, J. Jiang, and C. Zhang, "Graph waveNet for deep spatial-temporal graph modeling," 2019, arXiv:1906.00121.

[114] K. Guo et al., "Optimized graph convolution recurrent neural network for traffic prediction," *IEEE Trans. Intell. Transp. Syst.*, vol. 22, no. 2, pp. 1138-1149, Feb. 2021.

[115] C. Zheng, X. Fan, C. Wang, and J. Qi, "GMAN: A graph multi-attention network for traffic prediction," in *Proc. AAAI Conf. Artif. Intell.*, vol. 34, 2020, pp. 1234-1241.

[116] Z. Li et al., "A hybrid deep learning approach with GCN and LSTM for traffic flow prediction," in *Proc. IEEE Intell. Transp. Syst. Conf. (ITSC)*, 2019, pp. 1929-1933.

[117] L. Wang, X. Geng, X. Ma, F. Liu, and Q. Yang, "Crowd flow prediction by deep spatio-temporal transfer learning," 2018, arXiv:1802.00386.

[118] Y. Liu, J. James, J. Kang, D. Niyato, and S. Zhang, "Privacy-preserving traffic flow prediction: A federated learning approach," *IEEE Internet Things J.*, vol. 7, no. 8, pp. 7751-7763, Aug. 2020.

[119] X. Yuan et al., "FedSTN: Graph representation driven federated learning for edge computing enabled urban traffic flow prediction," *IEEE Trans. Intell. Transp. Syst.*, vol. 24, no. 8, pp. 8738-8748, Aug. 2023.

[120] C. Zhang, S. Zhang, J. James, and S. Yu, "FASTGNN: A topological information protected federated learning approach for traffic speed forecasting," *IEEE Trans. Ind. Informat.*, vol. 17, no. 12, pp. 8464-8474, Dec. 2021.

[121] R. F. Atallah, C. M. Assi, and J. Y. Yu, "A reinforcement learning technique for optimizing downlink scheduling in an energy-limited vehicular network," *IEEE Trans. Veh. Technol.*, vol. 66, no. 6, pp. 4592-4601, Jun. 2017.

[122] M. Yan, G. Feng, J. Zhou, and S. Qin, "Smart multi-RAT access based on multiagent reinforcement learning," *IEEE Trans. Veh. Technol.*, vol. 67, no. 5, pp. 4539-4551, May 2018.

[123] Z. Ge, Z. Song, S. X. Ding, and B. Huang, "Data mining and analytics in the process industry: The role of machine learning," *IEEE Access*, vol. 5, pp. 20590-20616, 2017.

[124] P. K. R. Maddikunta et al., "Industry 5.0: A survey on enabling technologies and potential applications," *J. Ind. Inf. Integr.*, vol. 26, Mar. 2022, Art. no. 100257.

[125] D. P. Penumuru, S. Muthuswamy, and P. Karumbu, "Identification and classification of materials using machine vision and machine learning in the context of industry 4.0," *J. Intell. Manuf.*, vol. 31, no. 5, pp. 1229-1241, 2020.

[126] I. S. Candanedo, E. H. Nieves, S. R. González, M. T. S. Martín, and A. G. Briones, "Machine learning predictive model for industry 4.0," in *Proc. 13th Int. Conf. Knowl. Manage. Org. (KMO)*, 2018, pp. 501-510.

[127] M. Calabrese et al., "SOPHIA: An event-based IoT and machine learning architecture for predictive maintenance in industry 4.0," *Information*, vol. 11, no. 4, p. 202, 2020.

[128] B. Bajic, I. Cosic, M. Lazarevic, N. Sremcev, and A. Rikalovic, "Machine learning techniques for smart manufacturing: Applications and challenges in industry 4.0," *Int. J. Ind. Eng. Manag.*, vol. 29, p. 18, Oct. 2018.

[129] M. Miškuf and I. Zolotová, "Comparison between multi-class classifiers and deep learning with focus on industry 4.0," in *Proc. Cybern. Inform. (KI)*, 2016, pp. 1-5.

[130] H. Subakti and J.-R. Jiang, "Indoor augmented reality using deep learning for industry 4.0 smart factories," in *Proc. IEEE 42nd Annu. Comput. Softw. Appl. Conf. (COMPSAC)*, vol. 2, 2018, pp. 63-68.

[131] M. Mozaffar et al., "Data-driven prediction of the high-dimensional thermal history in directed energy deposition processes via recurrent neural networks," *Manuf. Lett.*, vol. 18, pp. 35-39, Oct. 2018.

[132] J. Francis and L. Bian, "Deep learning for distortion prediction in laser-based additive manufacturing using big data," *Manuf. Lett.*, vol. 20, pp. 10-14, Apr. 2019.

[133] Z. Cao, P. Zhou, R. Li, S. Huang, and D. Wu, "Multiagent deep reinforcement learning for joint multichannel access and task offloading of mobile-edge computing in industry 4.0," *IEEE Internet Things J.*, vol. 7, no. 7, pp. 6201-6213, Jul. 2020.

[134] S. Messaoud, A. Bradai, O. B. Ahmed, P. T. A. Quang, M. Atri, and M. S. Hossain, "Deep federated Q-learning-based network slicing for industrial IoT," *IEEE Trans. Ind. Informat.*, vol. 17, no. 8, pp. 5572-5582, Aug. 2021.

[135] Y. Qu, S. R. Pokhrel, S. Garg, L. Gao, and Y. Xiang, "A blockchained federated learning framework for cognitive computing in industry 4.0 networks," *IEEE Trans. Ind. Informat.*, vol. 17, no. 4, pp. 2964-2973, Apr. 2021.

[136] P. C. M. Arachchige, P. Bertok, I. Khalil, D. Liu, S. Camtepe, and M. Atiquzzaman, "A trustworthy privacy preserving framework for machine learning in industrial IoT systems," *IEEE Trans. Ind. Informat.*, vol. 16, no. 9, pp. 6092-6102, Sep. 2020.

[137] M. Mozaffar, S. Liao, H. Lin, K. Ehmann, and J. Cao, "Geometry-agnostic data-driven thermal modeling of additive manufacturing processes using graph neural networks," *Addit. Manuf.*, vol. 48, Dec. 2021, Art. no. 102449.

[138] G. Dong et al., "Graph neural networks in IoT: A survey," *ACM Trans. Sens. Netw.*, vol. 19, no. 2, pp. 1-50, 2023.

[139] L. Zhou et al., "Graph neural networks for decentralized multi-robot target tracking," in *Proc. IEEE Int. Symp. Saf., Secur., Rescue Robot. (SSRR)*, 2022, pp. 195-202.

[140] I. Kapelyukh and E. Johns, "My house, my rules: Learning tidying preferences with graph neural networks," in *Proc. Conf. Robot Learn.*, 2022, pp. 740-749.

[141] X. Ruan, D. Ren, X. Zhu, and J. Huang, "Mobile robot navigation based on deep reinforcement learning," in *Proc. Chin. Control Decis. Conf. (CCDC)*, 2019, pp. 6174-6178.

[142] B. Liu, L. Wang, M. Liu, and C.-Z. Xu, "Federated imitation learning: A novel framework for cloud robotic systems with heterogeneous sensor data," *IEEE Robot. Autom. Lett.*, vol. 5, no. 2, pp. 3509-3516, Apr. 2020.

[143] B. Liu, L. Wang, and M. Liu, "Lifelong federated reinforcement learning: A learning architecture for navigation in cloud robotic systems," *IEEE Robot. Autom. Lett.*, vol. 4, no. 4, pp. 4555-4562, Oct. 2019.

[144] Q.-V. Pham et al., "A survey of multi-access edge computing in 5G and beyond: Fundamentals, technology integration, and state-of-the-art?" in *Proc. IEEE Glob. Commun. Conf.*, 2022, pp. 2782-2787.

[145] A. B. Osei, S. R. Yeginati, Y. Al Mtawa, and T. Halabi, "Optimized moving target defense against DDoS attacks in IoT networks: When to adapt?" in *Proc. IEEE Glob. Commun. Conf.*, 2022, pp. 2782-2787.

[146] D. S. M. Gonçalves, R. S. Couto, and M. G. Rubinstein, "A protection system against HTTP flood attacks using software defined networking," *J. Netw. Syst. Manage.*, vol. 31, no. 1, pp. 1-23, Jan. 2023.

[147] S. E. Quincozes, J. F. Kazienko, and V. E. Quincozes, "An extended evaluation on machine learning techniques for denial-of-service detection in wireless sensor networks," *Internet Things*, vol. 22, Jul. 2023, Art. no. 100684.

[148] R. Vishwakarma and A. K. Jain, "A survey of DDoS attacking techniques and defence mechanisms in the IoT network," *Telecommun. Syst.*, vol. 73, no. 1, pp. 3-25, Jan. 2020.
[149] J. Fan, Q. Yan, M. Li, G. Qu, and Y. Xiao, "A survey on data poisoning attacks and defenses," in *Proc. 7th IEEE Int. Conf. Data Sci. Cyberspace (DSC)*, 2022, pp. 48-55.

[150] Y. Ge et al., "A survey on trustworthy recommender systems," 2022, arXiv:2207.12515.

[151] M. Fang, M. Sun, Q. Li, N. Z. Gong, J. Tian, and J. Liu, "Data poisoning attacks and defenses to crowdsourcing systems," in *Proc. Web Conf. WWW*, 2021, pp. 969-980.

[152] Y. Huang and C. Chen, "Smart app attack: Hacking deep learning models in android apps," *IEEE Trans. Inf. Forensics Security*, vol. 17, pp. 1827-1840, 2022.

[153] A. Takiddin, M. Ismail, and E. Serpedin, "Robust data-driven detection of electricity theft adversarial evasion attacks in smart grids," *IEEE Trans. Smart Grid*, vol. 14, no. 1, pp. 663-676, Jan. 2022.

[154] L. Chi, M. Msahli, G. Memmi, and H. Qiu, "Public-attention-based adversarial attack on traffic sign recognition," in *Proc. IEEE 20th Consum. Commun. Netw. Conf. (CCNC)*, 2023, pp. 740-745.

[155] X. Zhang, C. Chen, Y. Xie, X. Chen, J. Zhang, and Y. Xiang, "A survey on privacy inference attacks and defenses in cloud-based deep neural network," *Comput. Stand. Interf.*, vol. 83, Jan. 2023, Art. no. 103672.

[156] Y. Shi and Y. Sagduyu, "Membership inference attack and defense for wireless signal classifiers with deep learning," *IEEE Trans. Mobile Comput.*, vol. 22, no. 7, pp. 4032-4043, Jul. 2023.

[157] Q. Chen et al., "A generic cryptographic deep-learning inference platform for remote sensing scenes," *IEEE J. Sel. Top. Appl. Earth Observ. Remote Sens.*, vol. 16, pp. 3309-3321, Mar. 2023.

[158] H. Yan et al., "Membership inference attacks against deep learning models via logs distribution," *IEEE Trans. Dependable Secure Comput.*, vol. 20, no. 5, pp. 3799-3808, Sep./Oct. 2023.

[159] Y. Liu, H. Li, G. Huang, and W. Hua, "OPUPO: Defending against membership inference attacks with order-preserving and utility-preserving obfuscation," *IEEE Trans. Dependable Secure Comput.*, vol. 20, no. 6, pp. 4690-4701, Nov./Dec. 2023.

[160] A. W. Atamli and A. Martin, "Threat-based security analysis for the Internet of Things," in *Proc. Int. Workshop Secure Internet Things*, 2014, pp. 35-43.

[161] D. R. Gomes, F. A. A. Lins, O. O. Nóbrega, E. F. Felix, B. A. Jesus, and M. Vieira, "Security evaluation of authentication requirements in IoT gateways," *J. Netw. Syst. Manage.*, vol. 31, no. 4, pp. 1-24, Oct. 2023.

[162] X. Huang, P. Craig, H. Lin, and Z. Yan, "SecIoT: A security framework for the Internet of Things," *Secur. Commun. Netw.*, vol. 9, no. 16, pp. 3083-3094, Nov. 2016.

[163] M. Bagaa, T. Taleb, J. B. Bernabe, and A. Skarmeta, "A machine learning security framework for IoT systems," *IEEE Access*, vol. 8, pp. 114066-114077, 2020.

[164] F. A. A. Lins and M. Vieira, "Security requirements and solutions for IoT gateways: A comprehensive study," *IEEE Internet Things J.*, vol. 8, no. 11, pp. 8667-8679, Nov. 2020.

[165] G. Platform, *Security Evaluation Standard For IoT Platforms v1.1 (SESIP)*, GlobalPlatform, Redwood City, CA, USA, 2021.

[166] *Common Criteria for Information Technology Security Evaluation*, Nat. Secur. Agency, Fort Meade, MD, USA, 2002.

[167] B. Potter and B. Fleck, *802.11 Security*. Sebastopol, CA, USA: O'Reilly Media, Inc., 2002.

[168] F. Körner, "Current challenges of implementing ETSI EN 303 645 as a baseline security standard for consumer IoT security certification," TechRxiv, Preprint, 2023.

[169] N. M. Karie, N. M. Sahri, W. Yang, C. Valli, and V. R. Kebande, "A review of security standards and frameworks for IoT-based smart environments," *IEEE Access*, vol. 9, pp. 121975-121995, 2021.

[170] E. Lee, Y.-D. Seo, S.-R. Oh, and Y.-G. Kim, "A survey on standards for interoperability and security in the Internet of Things," *IEEE Commun. Surveys Tuts.*, vol. 23, no. 2, pp. 1020-1047, 2nd Quart., 2021.

[171] Y. Zhang, Q. He, G. Chen, X. Zhang, and Y. Xiang, "A low-overhead, confidentiality-assured, and authenticated data acquisition framework for IoT," *IEEE Trans. Ind. Informat.*, vol. 16, no. 12, pp. 7566-7578, Dec. 2019.

[172] P. M. Chanal and M. S. Kakkasageri, "Hybrid algorithm for data confidentiality in Internet of Things," in *Proc. 10th Int. Conf. Comput. Commun. Netw. Technol. (ICCCNT)*, 2019, pp. 1-5.

[173] B. Reagen et al., "Cheetah: Optimizing and accelerating homomorphic encryption for private inference," in *Proc. IEEE Int. Symp. High-Perform. Comput. Archit. (HPCA)*, Seoul, South Korea, 2021, pp. 26-39.

[174] S. Behera and J. R. Prathuri, "Design of novel hardware architecture for fully homomorphic encryption algorithms in FPGA for real-time data in cloud computing," *IEEE Access*, vol. 10, pp. 131406-131418, Dec. 2022.

[175] X. Li, H. Gao, J. Zhang, S. Yang, and X. Jin, "GPU accelerated full homomorphic encryption cryptosystem, library, and applications for IoT systems," *IEEE Internet Things J.*, vol. 11, no. 4, pp. 6893-6903, Sep. 2023.

[176] M. Matsumoto and M. Oguchi, "Speeding up encryption on IoT devices using homomorphic encryption," in *Proc. IEEE Int. Conf. Smart Comput. (SMARTCOMP)*, Irvine, CA, USA, 2021, pp. 270-275.

[177] Z. Dar et al., "A context-aware encryption protocol suite for edge computing-based IoT devices," *J. Supercomput.*, vol. 76, no. 4, pp. 2548-2567, Apr. 2020.

[178] R. Lu, K. Heung, A. H. Lashkari, and A. A. Ghorbani, "A lightweight privacy-preserving data aggregation scheme for fog computing-enhanced IoT," *IEEE Access*, vol. 5, pp. 3302-3312, 2017.

[179] S. Gupta, R. Garg, N. Gupta, W. S. Alnumay, U. Ghosh, and P. K. Sharma, "Energy-efficient dynamic homomorphic security scheme for fog computing in IoT networks," *J. Inf. Secur. Appl.*, vol. 58, May 2021, Art. no. 102768.

[180] Y. Ding et al., "DeepEDN: A deep-learning-based image encryption and decryption network for Internet of Medical Things," *IEEE Internet Things J.*, vol. 8, no. 3, pp. 1504-1518, Feb. 2021.

[181] T. Saba, K. Haseeb, A. A. Shah, A. Rehman, U. Tariq, and Z. Mehmod, "A machine-learning-based approach for autonomous IoT security," *IT Profess.*, vol. 23, no. 3, pp. 69-75, May/Jun. 2021.

[182] J. Song, W. Wang, T. R. Gadekallu, J. Cao, and Y. Liu, "EPPDA: An efficient privacy-preserving data aggregation federated learning scheme," *IEEE Trans. Netw. Sci. Eng.*, vol. 10, no. 5, pp. 3047-3057, Sep./Oct. 2023.

[183] B. Jia, X. Zhang, J. Liu, Y. Zhang, K. Huang, and Y. Liang, "Blockchain-enabled federated learning data protection aggregation scheme with differential privacy and homomorphic encryption in IIoT," *IEEE Trans. Ind. Informat.*, vol. 18, no. 6, pp. 4049-4058, Jun. 2022.

[184] M. Tanveer, A. Alkhayyat, A. Naushad, A. U. Khan, N. Kumar, and A. G. Alharbi, "RUAM-IoD: A robust user authentication mechanism for the Internet of Drones," *IEEE Access*, vol. 10, pp. 19836-19851, 2022.

[185] J. B. Perazzone, P. L. Yu, B. M. Sadler, and R. S. Blum, "Artificial noise-aided MIMO physical layer authentication with imperfect CSI," *IEEE Trans. Inf. Forensics Security*, vol. 16, pp. 2173-2185, 2021.

[186] G. Manogaran et al., "Token-based authorization and authentication for secure Internet of Vehicles communication," *ACM Trans. Internet Technol.*, vol. 22, no. 4, pp. 1-20, Mar. 2023.

[187] H. Cui, X. Yang, W. Yang, B. Qin, and X. Yi, "Token-based biometric enhanced key derivation for authentication over wireless networks," *IEEE Trans. Netw. Sci. Eng.*, vol. 10, no. 4, pp. 2347-2357, Jul./Aug. 2023.

[188] B. M. Alselami and P. D. Deshmukh, "The recent trends in biometric traits authentication based on Internet of Things (IoT)," in *Proc. Int. Conf. Artif. Intell. Smart Syst. (ICAIS)*, 2021, pp. 1359-1365.

[189] J. Leng, Z. Lin, and P. Wang, "Poster abstract: An implementation of an Internet of Things system for smart hospitals," in *Proc. IEEE/ACM 5th Int. Conf. Internet Things Design Implement. (IoTDI)*, 2020, pp. 254-255.

[190] R. P. Sukumaran and S. Benedict, "Authentication and cryptography solutions for industrial IoT—A study," in *Proc. 6th Int. Conf. IoT Social, Mobile, Analytics Cloud (I-SMAC)*, 2022, pp. 76-81.

[191] A. K. Gautam and R. Kumar, "A comprehensive study on key management, authentication and trust management techniques in wireless sensor networks," *SN Appl. Sci.*, vol. 3, no. 1, pp. 1-27, Jan. 2021.

[192] W. Zhao, S. Yang, and X. Luo, "On threat analysis of IoT-based systems: A survey," in *Proc. IEEE Int. Conf. Smart Internet Things (SmartIoT)*, 2020, pp. 205-212.

[193] Z. Ullah, B. Raza, H. Shah, S. Khan, and A. Waheed, "Towards blockchain-based secure storage and trusted data sharing scheme for IoT environment," *IEEE Access*, vol. 10, pp. 36978-36994, 2022.

[194] J. Oh, J. Lee, M. Kim, Y. Park, K. Park, and S. Noh, "A secure data sharing based on key aggregate searchable encryption in fog-enabled IoT environment," *IEEE Trans. Netw. Sci. Eng.*, vol. 9, no. 6, pp. 4468-4481, Nov./Dec. 2022.

[195] M. Rasori, M. La Manna, P. Perazzo, and G. Dini, "A survey on attribute-based encryption schemes suitable for the Internet of Things," *IEEE Internet Things J.*, vol. 9, no. 11, pp. 8269-8290, Feb. 2022.
[196] S. Namasudra, "A secure cryptosystem using DNA cryptography and DNA steganography for the cloud-based IoT infrastructure," *Comput. Electr. Eng.*, vol. 104, Dec. 2022, Art. no. 108426.

[197] A. John, R. C. Panicker, B. Cardiff, Y. Lian, and D. John, "Binary classifiers for data integrity detection in wearable IoT edge devices," *IEEE Open J. Circuits Syst.*, vol. 1, pp. 88–99, Aug. 2020.

[198] Y. Wang and T. Liao, "Data integrity and causation analysis for wearable devices in 5G," in *Proc. IEEE Int. Conf. E-health Netw., Appl. Services (HealthCom)*, 2022, pp. 142–148.

[199] S. Sneha, A. Panjwani, B. Lade, J. Randolph, and M. Vickery, "Alleviating challenges related to FDA-approved medical Wearables using blockchain technology," *IT Profess.*, vol. 23, no. 4, pp. 21–27, Jul./Aug. 2021.

[200] N. Y.-R. Douha, M. Bhuyan, S. Kashihara, D. Fall, Y. Taenaka, and Y. Kadobayashi, "A survey on blockchain, SDN and NFV for the smart-home security," *Internet Things*, vol. 20, Nov. 2022, Art. no. 100588.

[201] C. Thammarat and C. Techapanupreeda, "Secure key establishment protocol for smart homes based on symmetric cryptography," in *Proc. Int. Conf. Inf. Netw. (ICOIN)*, 2022, pp. 46–51.

[202] A. R. Kairaldeen, N. F. Abdullah, A. Abu-Samah, and R. Nordin, "Data integrity time optimization of a blockchain IoT smart home network using different consensus and hash algorithms," *Wireless Commun. Mobile Comput.*, vol. 2021, no. 1, Nov. 2021, Art. no. 4401809.

[203] M. Ammi, S. Alarabi, and E. Benkhelifa, "Customized blockchain-based architecture for secure smart home for lightweight IoT," *Inf. Process. Manage.*, vol. 58, no. 3, May 2021, Art. no. 102482.

[204] C. Chen, L. Wang, Y. Long, Y. Luo, and K. Chen, "A blockchain-based dynamic and traceable data integrity verification scheme for smart homes," *J. Syst. Archit.*, vol. 130, Sep. 2022, Art. no. 102677.

[205] N. K. Jadav, R. Gupta, M. D. Alshehri, H. Mankodiya, S. Tanwar, and N. Kumar, "Deep learning and onion routing-based collaborative intelligence framework for smart homes underlying 6G networks," *IEEE Trans. Netw. Service Manag.*, vol. 19, no. 3, pp. 3401–3412, Apr. 2022.

[206] Z. Zhang, R. Deng, D. K. Y. Yau, and P. Chen, "Zero-parameter-information data integrity attacks and countermeasures in IoT-based smart grid," *IEEE Internet Things J.*, vol. 8, no. 8, pp. 6608–6623, Jan. 2021.

[207] D. An, F. Zhang, Q. Yang, and C. Zhang, "Data integrity attack in dynamic state estimation of smart grid: Attack model and countermeasures," *IEEE Trans. Autom. Sci. Eng.*, vol. 19, no. 3, pp. 1631–1644, Feb. 2022.

[208] H. T. Reda, A. Anwar, A. Mahmood, and N. Chilamkurti, "Data-driven approach for state prediction and detection of false data injection attacks in smart grid," *J. Mod. Power Syst. Clean Energy*, vol. 11, no. 2, pp. 455–467, Jun. 2022.

[209] H. Goyel and K. S. Swarup, "Data integrity attack detection using ensemble-based learning for cyber-physical power systems," *IEEE Trans. Smart Grid*, vol. 14, no. 2, pp. 1198–1209, Aug. 2022.

[210] H. Zhu et al., "A secure and efficient data integrity verification scheme for cloud-IoT based on short signature," *IEEE Access*, vol. 7, pp. 90036–90044, 2019.

[211] H. Wang and J. Zhang, "Blockchain based data integrity verification for large-scale IoT data," *IEEE Access*, vol. 7, pp. 164996–165006, 2019.

[212] Y. Li and F. Zhang, "An efficient certificate-based data integrity auditing protocol for cloud-assisted WBANs," *IEEE Internet Things J.*, vol. 9, no. 13, pp. 11513–11523, Nov. 2021.

[213] T. Sang, P. Zeng, and K.-K. R. Choo, "Provable multiple-copy integrity auditing scheme for cloud-based IoT," *IEEE Syst. J.*, vol. 17, no. 1, pp. 224–233, Aug. 2022.

[214] H. Han, S. Fei, Z. Yan, and X. Zhou, "A survey on blockchain-based integrity auditing for cloud data," *Digit. Commun. Netw.*, vol. 8, no. 5, pp. 591–603, Oct. 2022.

[215] C. Ioannou, A. Charalambus, and V. Vassiliou, "Decentralized dedicated intrusion detection security agents for IoT networks," in *Proc. 17th Int. Conf. Distrib. Comput. Sens. Syst. (DCOSS)*, 2021, pp. 414–419.

[216] M. Abdel-Basset, H. Hawash, R. K. Chakrabortty, and M. J. Ryan, "Semi-supervised spatiotemporal deep learning for intrusions detection in IoT networks," *IEEE Internet Things J.*, vol. 8, no. 15, pp. 12251–12265, Feb. 2021.

[217] S. D. Roy, S. Debbarma, and A. Iqbal, "A decentralized intrusion detection system for security of generation control," *IEEE Internet Things J.*, vol. 9, no. 19, pp. 18924–18933, Oct. 2022.

[218] S. Otoum, N. Guizani, and H. Mouftah, "Federated reinforcement learning-supported IDS for IoT-steered healthcare systems," in *Proc. IEEE Int. Conf. Commun.*, 2021, pp. 1–6.

[219] C. Regan, M. Nasajpour, R. M. Parizi, S. Pouriyeh, A. Dehghantanha, and K. K. Raymond Choo, "Federated IoT attack detection using decentralized edge data," *Mach. Learn. Appl.*, vol. 8, Jun. 2022, Art. no. 100263.

[221] O. Aouedi, K. Piamrat, G. Muller, and K. Singh, "Intrusion detection for softwarized networks with semi-supervised federated learning," in *Proc. IEEE Int. Conf. Commun.*, 2022, pp. 5244–5249.

[222] A. N. Bikos and S. Kumar, "Reinforcement learning-based anomaly detection for Internet of Things distributed ledger technology," in *Proc. IEEE Symp. Comput. Commun. (ISCC)*, 2021, pp. 1–7.

[223] G. Shingi, H. Saglani, and P. Jain, "Segmented federated learning for adaptive intrusion detection system," 2021, arXiv:2107.00881.

[224] M. Liu, L. Ma, C. Li, and R. Li, "Fortified network security perception: A decentralized multiagent coordination perspective," in *Proc. IEEE 3rd Int. Conf. Electron. Technol. (ICET)*, 2020, pp. 746–750.

[225] G. D. Putra, V. Dedeoglu, S. S. Kanhere, and R. Jurdak, "Poster abstract: Towards scalable and trustworthy decentralized collaborative intrusion detection system for IoT," in *Proc. IEEE/ACM 5th Int. Conf. Internet Things Design Implement. (IoTDI)*, 2020, pp. 256–257.

[226] O. Friha, M. A. Ferrag, M. Benbouzid, T. Berghout, B. Kantarci, and K. K. Raymond Choo, "2DF-IDS: Decentralized and differentially private federated learning-based intrusion detection system for industrial IoT," *Comput. Secur.*, vol. 127, Apr. 2023, Art. no. 103097.

[227] D. K. K. Reddy, H. S. Behera, J. Nayak, B. Naik, U. Ghosh, and P. K. Sharma, "Exact greedy algorithm based split finding approach for intrusion detection in fog-enabled IoT environment," *J. Inf. Secur. Appl.*, vol. 60, Aug. 2021, Art. no. 102866.

[228] M. Sahi, M. Soni, and N. Auluck, "An intrusion detection system on fog architecture," in *Proc. IEEE 18th Int. Conf. Mobile Ad Hoc Smart Syst. (MASS)*, 2021, pp. 591–596.

[229] S. Li, Y. Lu, and J. Li, "CAD-IDS: A cooperative adaptive distributed intrusion detection system with fog computing," in *Proc. IEEE 25th Int. Conf. Comput. Support. Cooper. Work Design (CSCWD)*, 2022, pp. 635–640.

[230] M. Abdel-Basset, V. Chang, H. Hawash, R. K. Chakrabortty, and M. Ryan, "Deep-IFS: Intrusion detection approach for industrial Internet of Things traffic in fog environment," *IEEE Trans. Ind. Informat.*, vol. 17, no. 11, pp. 7704–7715, Sep. 2020.

[231] W. Jung, Y. Feng, S. A. Khan, C. Xin, D. Zhao, and G. Zhou, "DeepAuditor: Distributed online intrusion detection system for IoT devices via power side-channel auditing," in *Proc. 21st ACM/IEEE Int. Conf. In. Process. Sens. Netw. (IPSN)*, 2022, pp. 415–427.

[232] Z. Chiba, N. Abghour, K. Moussaid, O. Lifandali, and R. Kinta, "A deep study of novel intrusion detection systems and intrusion prevention systems for Internet of Things networks," *Procedia Comput. Sci.*, vol. 210, pp. 94–103, Jan. 2022.

[233] P. Illy, G. Kaddoum, P. F. de Araujo-Filho, K. Kaur, and S. Garg, "A hybrid multistage DNN-based collaborative IDPS for high-risk smart factory networks," *IEEE Trans. Netw. Service Manag.*, vol. 19, no. 4, pp. 4273–4283, Aug. 2022.

[234] P. L. S. Jayalaxmi, G. Kumar, R. Saha, M. Conti, T.-H. Kim, and R. Thomas, "DeBot: A deep learning-based model for bot detection in industrial Internet-of-Things," *Comput. Electr. Eng.*, vol. 102, Sep. 2022, Art. no. 108214.

[235] J. O. Onah, S. M. Abdulhamid, M. Abdullahi, I. H. Hassan, and A. Al-Ghusham, "Genetic algorithm based feature selection and naïve Bayes for anomaly detection in fog computing environment," *Mach. Learn. Appl.*, vol. 6, Dec. 2021, Art. no. 100156.

[236] N. Ravi and S. M. Shalinie, "Semisupervised-learning-based security to detect and mitigate intrusions in IoT network," *IEEE Internet Things J.*, vol. 7, no. 11, pp. 11041–11052, Nov. 2020.

[237] H. Hasan, G. Ali, W. Elmedany, and C. Balakrishna, "Lightweight encryption algorithms for internet of things: A review on security and performance aspects," in *Proc. Int. Conf. Innov. Intell. Inform., Comput., Technol. (3ICT)*, 2022, pp. 239–244.

[238] P. Gope, P. K. Sharma, and B. Sikdar, "An ultra-lightweight data-aggregation scheme with deep learning security for smart grid," *IEEE Wireless Commun.*, vol. 29, no. 2, pp. 30–36, Apr. 2022.
[239] X. Kong and Z. Ge, "Deep PLS: A lightweight deep learning model for interpretable and efficient data analytics," *IEEE Trans. Neural Netw. Learn. Syst.*, vol. 34, no. 11, pp. 8923-8937, Nov. 2023.

[240] S. Kang et al., "Generative adversarial networks for DNA storage channel simulator," *IEEE Access*, vol. 11, pp. 3781-3793, Jan. 2023.

[241] C. Ma, J. Li, M. Ding, K. Wei, W. Chen, and H. V. Poor, "Federated learning with unreliable clients: Performance analysis and mechanism design," *IEEE Internet Things J.*, vol. 8, no. 24, pp. 17308-17319, Dec. 2021.

[242] X. He, S. Alqahtani, R. Gamble, and M. Papa, "Securing over-the-air IoT firmware updates using blockchain," in *Proc. Int. Conf. Omni-Layer Intell. Syst.*, 2019, pp. 164-171.

[243] Z. Sun, R. Sun, C. Liu, A. R. Chowdhury, L. Lu, and S. Jha, "ShadowNet: A secure and efficient on-device model inference system for convolutional neural networks," in *Proc. IEEE Symp. Secur. Privacy (SP)*, 2023, pp. 21-25.

[244] Z. Liu, Y. Luo, S. Duan, T. Zhou, and X. Xu, "MirrorNet: A TEE-friendly framework for secure on-device DNN inference," in *Proc. IEEE/ACM Int. Conf. Comput. Aided Design (ICCAD)*, 2023, pp. 1-9.

[245] Y. Yang, L. Wu, G. Yin, L. Li, and H. Zhao, "A survey on security and privacy issues in Internet-of-Things," *IEEE Internet Things J.*, vol. 4, no. 5, pp. 1250-1258, Oct. 2017.

[246] P. Schaar, "Privacy by design," *Ident. Inf. Soc.*, vol. 3, no. 2, pp. 267-274, 2010.

[247] R. Roman, J. Zhou, and J. Lopez, "On the features and challenges of security and privacy in distributed Internet of Things," *Comput. Netw.*, vol. 57, no. 10, pp. 2266-2279, 2013.

[248] J. H. Ziegeldorf, O. G. Morchon, and K. Wehrle, "Privacy in the Internet of Things: Threats and challenges," *Secur. Commun. Netw.*, vol. 7, no. 12, pp. 2728-2742, 2014.

[249] P. Porambage, M. Ylianttila, C. Schmitt, P. Kumar, A. Gurtov, and A. V. Vasilakos, "The quest for privacy in the Internet of Things," *IEEE Cloud Comput.*, vol. 3, no. 2, pp. 36-45, 2016.

[250] D. Storm, "MEDJACK: Hackers hijacking medical devices to create backdoors in hospital networks," in *Proc. Computerworld*, vol. 8, 2015, p. 42.

[251] R. H. Weber, "Internet of Things–new security and privacy challenges," *Comput. Law Secur. Rev.*, vol. 26, no. 1, pp. 23–30, 2010.

[252] S. Zeadally, A.-S. K. Pathan, C. Alcaraz, and M. Badra, "Towards privacy protection in smart grid," *Wireless Pers. Commun.*, vol. 73, pp. 23-50, Nov. 2013.

[253] D. Miorandi, S. Sicari, F. De Pellegrini, and I. Chlamtac, "Internet of Things: Vision, applications and research challenges," *Ad hoc Netw.*, vol. 10, no. 7, pp. 1497-1516, 2012.

[254] J. Noll, I. Garitano, S. Fayyad, Â. Erik, and H. Abie, "Measurable security, privacy and dependability in smart grids," *J. Cyber Secur. Mobil.*, vol. 3, no. 4, pp. 371-398, 2014.

[255] M. A. Rahman, M. H. Manshaei, E. Al-Shaer, and M. Shehab, "Secure and private data aggregation for energy consumption scheduling in smart grids," *IEEE Trans. Dependable Secure Comput.*, vol. 14, no. 2, pp. 221-234, Mar./Apr. 2017.

[256] N. Saputro, K. Akkaya, and I. Guvenc, "Privacy-aware communication protocol for hybrid IEEE 802.11 s/LTE smart grid architectures," in *Proc. IEEE 40th Local Comput. Netw. Conf. Workshops*, 2015, pp. 905-911.

[257] F. Borges, F. Volk, and M. Mühlhäuser, "Efficient, verifiable, secure, and privacy-friendly computations for the smart grid," in *Proc. IEEE Power Energy Soc. Innovat. Smart Grid Technol. Conf. (ISGT)*, 2015, pp. 1-5.

[258] C. Sutheerakul, N. Kronprasert, M. Kaewmoracharoen, and P. Pichayapan, "Application of unmanned aerial vehicles to pedestrian traffic monitoring and management for shopping streets," *Transp. Res. procedia*, vol. 25, pp. 1717-1734, 2017.

[259] Y. Zhi, Z. Fu, X. Sun, and J. Yu, "Security and privacy issues of UAV: A survey," *Mobile Netw. Appl.*, vol. 25, pp. 95-101, Feb. 2020.

[260] R. Ch, G. Srivastava, T. R. Gadekallu, P. K. R. Maddikunta, and S. Bhattacharya, "Security and privacy of UAV data using blockchain technology," *J. Inf. Secur. Appl.*, vol. 55, Dec. 2020, Art. no. 102670.

[261] H. R. Hasan and K. Salah, "Proof of delivery of digital assets using blockchain and smart contracts," *IEEE Access*, vol. 6, pp. 65439-65448, 2018.

[262] Q.-V. Pham, M. Le, T. Huynh-The, Z. Han, and W.-J. Hwang, "Energy-efficient federated learning over UAV-enabled wireless powered communications," *IEEE Trans. Veh. Technol.*, vol. 71, no. 5, pp. 4977-4990, May 2022.

[263] N. Rieke et al., "The future of digital health with federated learning," *NPJ Digit. Med.*, vol. 3, no. 1, pp. 1-7, 2020.

[264] L. Rocher, J. M. Hendrickx, and Y.-A. De Montjoye, "Estimating the success of re-identifications in incomplete datasets using generative models," *Nat. Commun.*, vol. 10, no. 1, pp. 1-9, 2019.

[265] M. Elkhodr, S. Shahrestani, and H. Cheung, "A review of mobile location privacy in the Internet of Things," in *Proc. 10th Int. Conf. ICT Knowl. Eng.*, 2012, pp. 266-272.

[266] N. Li, N. Zhang, S. K. Das, and B. Thuraisingham, "Privacy preservation in wireless sensor networks: A state-of-the-art survey," *Ad Hoc Netw.*, vol. 7, no. 8, pp. 1501-1514, 2009.

[267] S. Sicari, A. Rizzardi, L. A. Grieco, and A. Coen-Porisini, "Security, privacy and trust in Internet of Things: The road ahead," *Comput. Netw.*, vol. 76, pp. 146-164, Jan. 2015.

[268] P. Kamat, Y. Zhang, W. Trappe, and C. Ozturk, "Enhancing source-location privacy in sensor network routing," in *Proc. 25th IEEE Int. Conf. Distrib. Comput. Syst. (ICDCS)*, 2005, pp. 599-608.

[269] S. Pai et al., "Transactional confidentiality in sensor networks," *IEEE Secur. Privacy*, vol. 6, no. 4, pp. 28-35, Jul./Aug. 2008.

[270] C.-Y. Chow, M. F. Mokbel, and T. He, "A privacy-preserving location monitoring system for wireless sensor networks," *IEEE Trans. Mobile Comput.*, vol. 10, no. 1, pp. 94-107, Jan. 2011.

[271] W.-P. Wang, L. Chen, and J.-X. Wang, "A source-location privacy protocol in WSN based on locational angle," in *Proc. IEEE Int. Conf. Commun. (ICC)*, 2008, pp. 1630-1634.

[272] L. Lightfoot, Y. Li, and J. Ren, "STaR: Design and quantitative measurement of source-location privacy for wireless sensor networks," *Secur. Commun. Netw.*, vol. 9, no. 3, pp. 220-228, 2016.

[273] Y. Xi, L. Schwiebert, and W. Shi, "Preserving source location privacy in monitoring-based wireless sensor networks," in *Proc. 20th IEEE Int. Parallel Distrib. Process. Symp. (IPDPS)*, 2006, p. 8.

[274] S. M. Ross et al., *Stochastic Processes*, vol. 2. New York, NY, USA: Wiley, 1996.

[275] G. Tan, W. Li, and J. Song, "Enhancing source location privacy in energy-constrained wireless sensor networks," in *Proc. Int. Conf. Comput. Sci. Inf. Technol. (CSAIT)*, 2014, pp. 279-289.

[276] D. Tang, T. Li, J. Ren, and J. Wu, "Cost-aware secure routing (CASER) protocol design for wireless sensor networks," *IEEE Trans. Parallel Distrib. Syst.*, vol. 26, no. 4, pp. 960-973, Apr. 2014.

[277] Y. Yang, M. Shao, S. Zhu, and G. Cao, "Towards statistically strong source anonymity for sensor networks," *ACM Trans. Sens. Netw. (TOSN)*, vol. 9, no. 3, pp. 1-23, 2013.

[278] Y. Yang, M. Shao, S. Zhu, B. Urgaonkar, and G. Cao, "Towards event source unobservability with minimum network traffic in sensor networks," in *Proc. 1st ACM Conf. Wireless Netw. Secur. (WiSec)*, 2008, pp. 77-88.

[279] G. Han, L. Zhou, H. Wang, W. Zhang, and S. Chan, "A source location protection protocol based on dynamic routing in WSNs for the social Internet of Things," *Future Gener. Comput. Syst.*, vol. 82, pp. 689-697, May 2018.

[280] K. Mehta, D. Liu, and M. Wright, "Location privacy in sensor networks against a global eavesdropper," in *Proc. IEEE Int. Conf. Netw. Protocols (ICNP)*, 2007, pp. 314-323.

[281] A. Majeed, K. Liu, and N. Abu-Ghazaleh, "TARP: Timing analysis resilient protocol for wireless sensor networks," in *Proc. IEEE Int. Conf. Wireless Mobile Comput., Netw. Commun.*, 2009, pp. 85-90.

[282] A. Bushnag, A. Abuzneid, and A. Mahmood, "Source anonymity in WSNs against global adversary utilizing low transmission rates with delay constraints," *Sensors*, vol. 16, no. 7, p. 957, 2016.

[283] G. Miao, N. Himayat, Y. Li, and A. Swami, "Cross-layer optimization for energy-efficient wireless communications: A survey," *Wireless Commun. Mobile Comput.*, vol. 9, no. 4, pp. 529-542, 2009.

[284] M. Shao, W. Hu, S. Zhu, G. Cao, S. Krishnamurth, and T. La Porta, "Cross-layer enhanced source location privacy in sensor networks," in *Proc. 6th Annu. IEEE Commun. Soc. Conf. Sens., Mesh Ad Hoc Commun. Netw. (SECON)*, 2009, pp. 1-9.

[285] A. F. Molisch et al., *A Channel Model-Final Report*, IEEE Standard 802.15.4, 2004.

[286] N. Dutta, A. Saxena, and S. Chellappan, "Defending wireless sensor networks against adversarial Localization," in *Proc. 11th Int. Conf. Mobile Data Manage. (MDM 10)*, 2010, pp. 336-341.

[287] B. Tavli, M. M. Ozciloglu, and K. Bicakci, "Mitigation of compromising privacy by transmission range control in wireless sensor networks," *IEEE Commun. Lett.*, vol. 14, no. 12, pp. 1104-1106, Dec. 2010.

[288] S. S. Rana and N. H. Vaidya, "A new 'direction' for source location privacy in wireless sensor networks'," in *Proc. IEEE Glob. Commun. Conf. (GLOBECOM)*, 2012, pp. 342-347.
[289] A. Das and L. Moharana, "Bypassing using directional transceivers: A design for anti-tracking source location privacy protection in WSNs," in *Proc. 2nd Int. Conf. Res. Comput. Intell. Commun. Netw. (ICRCICN)*, 2016, pp. 39-44.

[290] J. Deng, R. Han, and S. Mishra, "Decorrelating wireless sensor network traffic to inhibit traffic analysis attacks," *Pervas. Mobile Comput.*, vol. 2, no. 2, pp. 159-186, 2006.

[291] P. Syverson, R. Dingledine, and N. Mathewson, "Tor: The second-generation onion router," in *Proc. 13th USENIX Secur. Symp.*, 2004, pp. 303-320.

[292] J. Deng, R. Han, and S. Mishra, "Countermeasures against traffic analysis attacks in wireless sensor networks," in *Proc. 1st Int. Conf. Secur. Privacy Emerg. Areas Commun. Netw. (SECURECOMM'05)*, 2005, pp. 113-126.

[293] X. Luo, X. Ji, and M.-S. Park, "Location privacy against traffic analysis attacks in wireless sensor networks," in *Proc. Int. Conf. Inf. Sci. Appl. (ICISA)*, 2010, pp. 1-6.

[294] J. Deng, R. Han, and S. Mishra, "Intrusion tolerance and anti-traffic analysis strategies for wireless sensor networks," in *Proc. Int. Conf. Dependable Syst. Netw. (DSN)*, 2004, pp. 637-646.

[295] N. Carlini, C. Liu, Ú. Erlingsson, J. Kos, and D. Song, "The secret sharer: Evaluating and testing unintended Memorization in neural networks," in *Proc. 28th USENIX Secur. Symp. (Security)*, 2019, pp. 267-284.

[296] A. Cohen, "Attacks on deidentification's defenses," in *Proc. 31st USENIX Secur. Symp. (Security)*, 2022, pp. 1469-1486.

[297] C. C. Aggarwal, "On k-anonymity and the curse of dimensionality," in *Proc. VLDB*, vol. 5, 2005, pp. 901-909.

[298] J. Cao, B. Carminati, E. Ferrari, and K.-L. Tan, "CASTLE: Continuously anonymizing data streams," *IEEE Trans. Dependable Secure Comput.*, vol. 8, no. 3, pp. 337-352, May-Jun. 2010.

[299] C. Dwork, "Differential privacy," in *Proc. 33rd Int. Colloq. (ICALP)*, 2006, pp. 1-12.

[300] I. Mironov, "Rényi differential privacy," in *Proc. IEEE 30th Comput. Security Found. Symp. (CSF)*, 2017, pp. 263-275.

[301] R. Poddar, G. Ananthanarayanan, S. Setty, S. Volos, and R. A. Popa, "Visor: Privacy-preserving video analytics as a cloud service," in *Proc. 29th USENIX Conf. Security Symp.*, 2020, pp. 1039-1056.

[302] R. Shokri, M. Stronati, C. Song, and V. Shmatikov, "Membership inference attacks against machine learning models," in *Proc. 38th IEEE Symp. Security Privacy (SP)*, 2017, pp. 3-18.

[303] A. Frome et al., "Large-scale privacy protection in Google street view," in *Proc. IEEE 12th Int. Conf. Comput. Vis. (ICCV)*, 2009, pp. 2373-2380.

[304] Q. Sun, L. Ma, S. J. Oh, L. Van Gool, B. Schiele, and M. Fritz, "Natural and effective obfuscation by head inpainting," in *Proc. IEEE Conf. Comput. Vis. Pattern Recognit. (CVPR)*, 2018, pp. 5050-5059.

[305] T. Li and C. Clifton, "Differentially private imaging via latent space manipulation," 2021, arXiv:2103.05472.

[306] A. Senior et al., "Enabling video privacy through computer vision," *IEEE Security Privacy*, vol. 3, no. 3, pp. 50-57, May/Jun. 2005.

[307] M. Saini, P. K. Atrey, S. Mehrotra, and M. Kankanhalli, "W3. privacy: Understanding what, when, and where inference channels in multi-camera surveillance video," *Multimedia Tools Appl.*, vol. 68, pp. 135-158, Jan. 2014.

[308] H. Wang, S. Xie, and Y. Hong, "VideoDP: A flexible platform for video analytics with differential privacy," in *Proc. Priv. Enhanc. Technol.*, vol. 2020, no. 4, pp. 277-296, 2020.

[309] B. Weggenmann and F. Kerschbaum, "SynTF: Synthetic and differentially private term frequency vectors for privacy-preserving text mining," in *Proc. 41st Int. ACM SIGIR Conf. Res. Develop. Inf. Retrieval (SIGIR)*, 2018, pp. 305-314.

[310] N. Fernandes, M. Dras, and A. McIver, "Generalised differential privacy for text document processing," in *Proc. 8th Int. Conf. Princ. Security Trust (POST)*, 2019, pp. 123-148.

[311] O. Feyisetan, B. Balle, T. Drake, and T. Diethe, "Privacy-and utility-preserving textual analysis via calibrated multivariate perturbations," in *Proc. 13th ACM Int. Conf. Web Search Data Min. (WSDM)*, 2020, pp. 178-186.

[312] O. Feyisetan, T. Diethe, and T. Drake, "Leveraging hierarchical representations for preserving privacy and utility in text," in *Proc. IEEE Int. Conf. Data Min. (ICDM)*. 2019, pp. 210-219.

[313] Y. Zhao and J. Chen, "A survey on differential privacy for unstructured data content," *ACM Comput. Surv.*, vol. 54, no. 10s, pp. 1-28, 2022.

[314] S. Hill, Z. Zhou, L. K. Saul, and H. Shacham, "On the (in) effectiveness of mosaicing and blurring as tools for document redaction," *Proc. Priv. Enhanc. Technol.*, vol. 2016, no. 4, pp. 403-417, 2016.

[315] J. Hamm, "Minimax filter: Learning to preserve privacy from inference attacks," *J. Mach. Learn. Res.*, vol. 18, no. 1, pp. 4704-4734, 2017.

[316] H. B. McMahan, D. Ramage, K. Talwar, and L. Zhang, "Learning differentially private recurrent language models," 2017, arXiv:1710.06963.

[317] K. Wei et al., "Federated learning with differential privacy: Algorithms and performance analysis," *IEEE Trans. Inf. Forensics Security*, vol. 15, pp. 3454-3469, 2020.

[318] L. Yang et al., "A survey on vertical federated learning: From a layered perspective," 2023, arXiv:2304.01829.

[319] P. Ye, Z. Jiang, W. Wang, B. Li, and B. Li, "Feature reconstruction attacks and countermeasures of DNN training in vertical federated learning," 2022, arXiv:2210.06771.

[320] J. Li, M. Khodak, S. Caldas, and A. Talwalkar, "Differentially private meta-learning," in *Proc. Int. Conf. Learn. Represent. (ICLR)*, 2020, pp. 1-18.

[321] N. Agarwal, A. T. Suresh, F. X. X. Yu, S. Kumar, and B. McMahan, "cpSGD: Communication-efficient and differentially-private distributed SGD," in *Proc. Adv. Neural Inf. Process. Syst. (NIPS)*, vol. 31, pp. 7564-7575, 2018.

[322] Y. Qu et al., "Decentralized privacy using blockchain-enabled federated learning in fog computing," *IEEE Internet Things J.*, vol. 7, no. 6, pp. 5171-5183, Jun. 2020.

[323] J. Gubbi, R. Buyya, S. Marusic, and M. Palaniswami, "Internet of Things (IoT): A vision, architectural elements, and future directions," *Future Gener. Comput. Syst.*, vol. 29, no. 7, pp. 1645-1660, 2013.

[324] R. Kotamsetty and M. Govindarasu, "Adaptive latency-aware query processing on encrypted data for the Internet of Things," in *Proc. 25th Int. Conf. Comput. Commun. Netw. (ICCCN)*, 2016, pp. 1-7.

[325] M. Beunardeau, A. Connolly, R. Geraud, and D. Naccache, "Fully homomorphic encryption: Computations with a blindfold," *IEEE Security Privacy*, vol. 14, no. 1, pp. 63-67, Jan./Feb. 2016.

[326] D. Natarajan and W. Dai, "Seal-embedded: A homomorphic encryption library for the Internet of Things," *IACR Trans. Cryptogr. Hardw. Embed. Syst.*, vol. 2021, no. 3, pp. 756-779, 2021.

[327] S. Li, S. Zhao, G. Min, L. Qi, and G. Liu, "Lightweight privacy-preserving scheme using homomorphic encryption in Industrial Internet of Things," *IEEE Internet Things J.*, vol. 9, no. 16, pp. 14542-14550, Aug. 2022.

[328] R. Gilad-Bachrach, N. Dowlin, K. Laine, K. Lauter, M. Naehrig, and J. Wernsing, "CryptoNets: Applying neural networks to encrypted data with high throughput and accuracy," in *Proc. Int. Conf. Mach. Learn. (ICML)*, 2016, pp. 201-210.

[329] R. Lu, "A new communication-efficient privacy-preserving range query scheme in fog-enhanced IoT," *IEEE Internet Things J.*, vol. 6, no. 2, pp. 2497-2505, Apr. 2019.

[330] M. Hao, H. Li, G. Xu, Z. Liu, and Z. Chen, "Privacy-aware and resource-saving collaborative learning for healthcare in cloud computing," in *Proc. IEEE Int. Conf. Commun. (ICC)*, 2020, pp. 1-6.

[331] C. Zhao et al., "Secure multi-party computation: Theory, practice and applications," *Inf. Sci.*, vol. 476, pp. 357-372, Feb. 2019.

[332] J. Liu, M. Juuti, Y. Lu, and N. Asokan, "Oblivious neural network predictions via MiniONN transformations," in *Proc. ACM SIGSAC Conf. Comput. Commun. Security (CCS)*, 2017, pp. 619-631.

[333] B. D. Rouhani, M. S. Riazi, and F. Koushanfar, "Deepsecure: Scalable provably-secure deep learning," in *Proc. 55th Annu. Design Autom. Conf. (DAC)*, 2018, pp. 1-6.

[334] S. Kamara, P. Mohassel, and B. Riva, "Salus: A system for server-aided secure function evaluation," in *Proc. ACM Conf. Comput. Commun. Security (CCS)*, 2012, pp. 797-808.

[335] P. Mukherjee and D. Wichs, "Two round multiparty computation via multi-key FHE," in *Proc. 35th Annu. Int. Conf. Theory Appl. Cryptogr. Techn.*, 2016, pp. 735-763.

[336] A. Peter, E. Tews, and S. Katzenbeisser, "Efficiently outsourcing multiparty computation under multiple keys," *IEEE Trans. Inf. Forensics Security*, vol. 8, pp. 2046-2058, 2013.

[337] G. Asharov, A. Jain, A. López-Alt, E. Tromer, V. Vaikuntanathan, and D. Wichs, "Multiparty computation with low communication, computation and interaction via threshold FHE," in *Proc. 31st Annu. Int. Conf. Theory Appl. Cryptogr. Techn.*, 2012, pp. 483-501.

[338] H. Carter, B. Mood, P. Traynor, and K. Butler, "Secure outsourced garbled circuit evaluation for mobile devices," *J. Comput. Secur.*, vol. 24, no. 2, pp. 137-180, 2016.
[339] R. Bost, R. A. Popa, S. Tu, and S. Goldwasser, "Machine learning classification over encrypted data," Cryptol. ePrint Arch., IACR, Bellevue, WA, USA, Rep. 2014/331, 2014. [Online]. Available: https://eprint.iacr.org/2014/331

[340] B. Knott, S. Venkataraman, A. Hannun, S. Sengupta, M. Ibrahim, and L. van der Maaten, "CRYPTEN: Secure multi-party computation meets machine learning," in Proc. Adv. Neural Inf. Process. Syst. (NeurIPS), vol. 34, 2021, pp. 4961-4973.

[341] V. Mugunthan, A. Polychroniadou, D. Byrd, and T. H. Balch, "SMPAI: Secure multi-party computation for federated learning," in Proc. Workshop Robust AI Financ. Serv., 2019, pp. 1-9.

[342] B. Jayaraman, L. Wang, D. Evans, and Q. Gu, "Distributed learning without distress: Privacy-preserving empirical risk minimization," in Proc. Adv. Neural Inf. Process. Syst. (NeurIPS), vol. 31, 2018, pp. 1-12.

[343] V. Bindschaedler, S. Rane, A. E. Brito, V. Rao, and E. Uzun, "Achieving differential privacy in secure multiparty data aggregation protocols on star networks," in Proc. 7th ACM Conf. Data Appl. Secur. Priv. (CODASPY), 2017, pp. 115-125.

[344] D. Byrd and A. Polychroniadou, "Differentially private secure multi-party computation for federated learning in financial applications," in Proc. 1st ACM Int. Conf. AI Finance (ICAFI), 2020, pp. 1-9.

[345] M. S. Riazi, C. Weinert, O. Tkachenko, E. M. Songhori, T. Schneider, and F. Koushanfar, "Chameleon: A hybrid secure computation framework for machine learning applications," in Proc. Asia Conf. Comput. Commun. Secur. (ASIACCS), 2018, pp. 707-721.

[346] C. Juvekar, V. Vaikuntanathan, and A. Chandrakasan, "GAZELLE: A low latency framework for secure neural network inference," in Proc. 27th USENIX Secur. Symp. (USENIX Security), 2018, pp. 1651-1669.

[347] R. Kanagavelu et al., "Two-phase multi-party computation enabled privacy-preserving federated learning," in Proc. 20th IEEE/ACM Int. Symp. Cluster, Cloud Internet Comput. (CCGRID), 2020, pp. 410-419.

[348] E. Sotthiwat, L. Zhen, Z. Li, and C. Zhang, "Partially encrypted multi-party computation for federated learning," in Proc. 21st IEEE/ACM Int. Symp. Cluster, Cloud Internet Comput. (CCGrid), 2021, pp. 828-835.

[349] P. Mohassel and Y. Zhang, "SecureML: A system for scalable privacy-preserving machine learning," in Proc. IEEE Symp. Security Privacy (SP), 2017, pp. 19-38.

[350] F. Sebastiani, "Machine learning in automated text categorization," ACM Comput. Surv., vol. 34, no. 1, pp. 1-47, 2002.

[351] A. S. Manek, P. D. Shenoy, M. C. Mohan, and K. Venugopal, "Detection of fraudulent and malicious websites by analysing user reviews for online shopping websites," Int. J. Knowl. Web Intell., vol. 5, no. 3, pp. 171-189, 2016.

[352] H. Fu, Z. Zheng, S. Zhu, and P. Mohapatra, "Keeping context in mind: Automating mobile app access control with user interface inspection," in Proc. IEEE Conf. Comput. Commun., 2019, pp. 2089-2097.

[353] V. Avdiienko et al., "Mining apps for abnormal usage of sensitive data," in Proc. IEEE/ACM 37th IEEE Int. Conf. Softw. Eng. (ICSE), vol. 1, 2015, pp. 426-436.

[354] A. Squicciarini, C. Caragea, and R. Balakavi, "Toward automated online photo privacy," ACM Trans. Web, vol. 11, no. 1, pp. 1-29, 2017.

[355] J. Yu, B. Zhang, Z. Kuang, D. Lin, and J. Fan, "iPrivacy: Image privacy protection by identifying sensitive objects via deep multi-task learning," IEEE Trans. Inf. Forensics Security, vol. 12, pp. 1005-1016, 2016.

[356] R. Hasan, D. Crandall, M. Fritz, and A. Kapadia, "Automatically detecting bystanders in photos to reduce privacy risks," in Proc. IEEE Symp. Security Privacy (SP), 2020, pp. 318-335.

[357] L. Lebanoff and F. Liu, "Automatic detection of vague words and sentences in privacy policies," in Proc. Conf. Empir. Methods Nat. Lang. Process., 2018, pp. 3508-3517.

[358] P. Wijesekera, A. Baokar, A. Hosseini, S. Egelman, D. Wagner, and K. Beznosov, "Android permissions remystified: A field study on contextual integrity," in Proc. 24th USENIX Security Symp. (USENIX Security), 2015, pp. 499-514.

[359] K. Olejnik, I. Dacosta, J. S. Machado, K. Huguenin, M. E. Khan, and J.-P. Hubaux, "SmarPer: Context-aware and automatic runtime permissions for mobile devices," in Proc. IEEE Symp. Security Privacy (SP), 2017, pp. 1058-1076.

[360] A. Das, M. Degeling, D. Smullen, and N. Sadeh, "Personalized privacy assistants for the Internet of Things: Providing users with notice and choice," IEEE Pervasive Comput., vol. 17, no. 3, pp. 35-46, Jul.-Sep. 2018.

[361] T. Orekondy, B. Schiele, and M. Fritz, "Towards a visual privacy advisor: Understanding and predicting privacy risks in images," in Proc. IEEE Int. Conf. Comput. Vis. (ICCV), 2017, pp. 3686-3695.

[362] G. Acs, L. Melis, C. Castelluccia, and E. De Cristofaro, "Differentially private mixture of generative neural networks," IEEE Trans. Knowl. Data Eng., vol. 31, no. 6, pp. 1109-1121, Jun. 2019.

[363] E. L. Denton, S. Chintala, and R. Fergus, "Deep generative image models using a Laplacian pyramid of adversarial networks," in Proc. Adv. Neural Inf. Process. Syst. (NIPS), vol. 28, 2015, pp. 1486-1494.

[364] E. Choi, S. Biswal, B. Malin, J. Duke, W. F. Stewart, and J. Sun, "Generating multi-label discrete patient records using generative adversarial networks," in Proc. Mach. Learn. healthcare Conf., 2017, pp. 286-305.

[365] A. Triastcyn and B. Faltings, "Generating artificial data for private deep learning," 2018, arXiv:1803.03148.

[366] N. Park, M. Mohammadi, K. Gorde, S. Jajodia, H. Park, and Y. Kim, "Data synthesis based on generative adversarial networks," Proc. VLDB Endow., vol. 11, no. 10, pp. 1071-1083, 2018.

[367] S. Joon Oh, R. Benenson, M. Fritz, and B. Schiele, "Person recognition in personal photo collections," in Proc. IEEE Int. Conf. Comput. Vis. (CVPR), 2015, pp. 3862-3870.

[368] X. Sun, P. Wu, and S. C. Hoi, "Face detection using deep learning: An improved faster RCNN approach," Neurocomputing, vol. 299, pp. 42-50, Jul. 2018.

[369] R. McPherson, R. Shokri, and V. Shmatikov, "Defeating image obfuscation with deep learning," 2016, arXiv:1609.00408.

[370] S. J. Oh, R. Benenson, M. Fritz, and B. Schiele, "Faceless person recognition: Privacy implications in social media," in Proc. 14th Eur. Conf. (ECCV), 2016, pp. 19-35.

[371] Z. Cheng, J. Caverlee, and K. Lee, "You are where you tweet: A content-based approach to geo-locating twitter users," in Proc. 19th ACM Int. Conf. Inf. Knowl. Manage. (CIKM), 2010, pp. 759-768.

[372] P. Rodríguez, G. Cucurull, J. M. Gonfaus, F. X. Roca, and J. Gonzalez, "Age and gender recognition in the wild with deep attention," Pattern Recognit., vol. 72, pp. 563-571, Dec. 2017.

[373] W. Zhou, H. Li, Y. Lu, and Q. Tian, "Principal visual word discovery for automatic license plate detection," IEEE Trans. Image Process., vol. 21, pp. 4269-4279, 2012.

[374] M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter, "Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition," in Proc. ACM Conf. Comput. Commun. Security (CCS), 2016, pp. 1528-1540.

[375] C. Szegedy et al., "Intriguing properties of neural networks," in Proc. 2nd Int. Conf. Learn. Represent. (ICLR), 2014, pp. 1-10.

[376] N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami, "The limitations of deep learning in adversarial settings," in Proc. IEEE Eur. Symp. Security Privacy (EuroS P), 2016, pp. 372-387.

[377] Y. Liu, W. Zhang, and N. Yu, "Protecting privacy in shared photos via adversarial examples based stealth," Secur. Commun. Netw., vol. 2017, no. 1, 2017, Art. no. 1897438.

[378] M. Friedrich, A. Köhn, G. Wiedemann, and C. Biemann, "Adversarial learning of privacy-preserving text representations for de-identification of medical records," in Proc. 57th Annu. Meeting Assoc. Comput. Linguist. (ACL), 2019, pp. 5829-5839.

[379] B. Liu, M. Ding, T. Zhu, Y. Xiang, and W. Zhou, "Adversaries or allies? Privacy and deep learning in big data era," Concurr. Comput., Pract. Exp., vol. 31, no. 19, 2019, Art. no. e5102.

[380] T. Li and L. Lin, "AnonymousNet: Natural face de-identification with measurable privacy," in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. workshops (CVPRW), 2019, pp. 1-10.

[381] J. Su, D. V. Vargas, and K. Sakurai, "One pixel attack for fooling deep neural networks," IEEE Trans. Evol. Comput., vol. 23, no. 5, pp. 828-841, Oct. 2019.

[382] S. Zahoor and R. N. Mir, "Resource management in pervasive Internet of Things: A survey," J. King Saud Univ.- Comput. Inf. Sci., vol. 33, no. 8, pp. 921-935, Oct. 2021.

[383] D. Zeng, S. Liang, X. Hu, H. Wang, and Z. Xu, "FedLab: A flexible federated learning framework," Jul. 2021, arXiv:2107.11621.

[384] M. Shen, X. Tang, L. Zhu, X. Du, and M. Guizani, "Privacy-preserving support vector machine training over blockchain-based encrypted IoT data in smart cities," IEEE Internet Things J., vol. 6, no. 5, pp. 7702-7712, Feb. 2019.

[385] X. Wei et al., "Learning extremely lightweight and robust model with differentiable constraints on sparsity and condition number," in Proc. Eur. Conf. Comput. Vis., 2022, pp. 690-707.

[386] X. Hu, L. Chu, J. Pei, W. Liu, and J. Bian, "Model complexity of deep learning: A survey," Knowl. Inf. Syst., vol. 63, no. 10, pp. 2585-2619, Oct. 2021.
[387] Y. Ko, A. Chadwick, D. Bates, and R. Mullins, "Lane compression: A lightweight lossless compression method for machine learning on embedded systems," *ACM Trans. Embed. Comput. Syst.*, vol. 20, no. 2, pp. 1-26, Mar. 2021.

[388] S. Zhu, X. Xu, J. Zhao, and F. Xiao, "LKD-STNN: A lightweight malicious traffic detection method for Internet of Things based on knowledge distillation," *IEEE Internet Things J.*, vol. 11, no. 4, pp. 6438-6453, Feb. 2024.

[389] Y. Wang et al., "A lightweight intrusion detection system for Internet of Vehicles based on transfer learning and MobileNetV2 with hyper-parameter optimization," *Multimedia Tools Appl.*, vol. 83, no. 8, pp. 22347-22369, Mar. 2024.

[390] D. C. Nguyen et al., "Federated learning meets blockchain in edge computing: Opportunities and challenges," *IEEE Internet Things J.*, vol. 8, no. 16, pp. 12806-12825, Apr. 2021.

[391] Z. Yang, Y. Shi, Y. Zhou, Z. Wang, and K. Yang, "Trustworthy federated learning via blockchain," *IEEE Internet Things J.*, vol. 10, no. 1, pp. 92-109, Jan. 2023.

[392] I. Pastaltzidis et al., "Data augmentation for fairness-aware machine learning: Preventing algorithmic bias in law enforcement systems," in *Proc. ACM Conf. Fairness, Account., Transpar.*, 2022, pp. 2302-2314.

[393] S. K. Lo et al., "Toward trustworthy AI: Blockchain-based architecture design for accountability and fairness of federated learning systems," *IEEE Internet Things J.*, vol. 10, no. 4, pp. 3276-3284, Feb. 2023.

[394] A. R. Patel, J. Chandrasekaran, Y. Lei, R. N. Kacker, and D. R. Kuhn, "A combinatorial approach to fairness testing of machine learning models," in *Proc. IEEE Int. Conf. Softw. Test., Verif. Valid. Workshops (ICSTW)*, 2022, pp. 94-101.

[395] Z. Li, Y. Zhou, D. Wu, T. Tang, and R. Wang, "Fairness-aware federated learning with unreliable links in resource-constrained Internet of Things," *IEEE Internet Things J.*, vol. 9, no. 18, pp. 17359-17371, Mar. 2022.

[396] G. Li et al., "GT-chain: A fair blockchain for intelligent industrial IoT applications," *IEEE Trans. Netw. Sci. Eng.*, vol. 9, no. 5, pp. 3244-3257, Sep./Oct. 2022.

[397] D. Liu, C. Huang, J. Ni, X. Lin, and X. S. Shen, "Blockchain-cloud transparent data marketing: Consortium management and fairness," *IEEE Trans. Comput.*, vol. 71, no. 12, pp. 3322-3335, Dec. 2022.

[398] "How much does the Internet of Things cost?—ITRex." Dec. 2022. Accessed: Apr. 14, 2023. [Online]. Available: https://itrexgroup.com/blog/how-much-iot-cost-factors-challenges

[399] X. Xu, "The influence of artificial intelligence on the financial industry," in *Proc. 4th Int. Conf. Econ. Manage. Cultural Ind. (ICEMCI)*, Atlantis Press, 2022, pp. 393-400.

[400] S. Dahmen-Lhuissier, "Internet of Things (IoT)." Apr. 2023. Accessed: Apr. 14, 2023. [Online]. Available: https://www.etsi.org/technologies/internet-of-things

[401] E. Rabieinejad, A. Yazdinejad, R. M. Parizi, and A. Dehghantanha, "Generative adversarial networks for cyber threat hunting in Ethereum blockchain," *Distrib. Ledger Technol., Res. Practice*, vol. 2, no. 2, pp. 1-19, 2021.

[402] M. A. Ferrag, M. Debbah, and M. Al-Hawawreh, "Generative AI for Cyber threat-hunting in 6G-enabled IoT networks," 2023, arXiv:2303.11751.

[403] M. A. Ferrag, D. Hamouda, M. Debbah, L. Maglaras, and A. Lakas, "Generative adversarial networks-driven cyber threat intelligence detection framework for securing Internet of Things," *Apr. 2023, arXiv:2304.05644*.

[404] J. Huang, G. Li, J. Tian, and S. Li, "Accurate interpretation of the online learning model for 6G-enabled Internet of Things," *IEEE Internet Things J.*, vol. 8, no. 20, pp. 15228-15239, Oct. 2021.

[405] B. Krawczyk, L. L. Minku, J. Gama, J. Stefanowski, and M. Woźniak, "Ensemble learning for data stream analysis: A survey," *Inf. Fusion*, vol. 37, pp. 132-156, Sep. 2017.

[406] Y. Qu, X. Yuan, M. Ding, W. Ni, T. Rakotoarivelo, and D. Smith, "Learn to unlearn: A survey on machine unlearning," 2023, arXiv:2305.07512.

[407] I. P. Pradhan and P. Saxena, "Reskilling workforce for the artificial intelligence age: Challenges and the way forward," in *The Adoption and Effect of Artificial Intelligence on Human Resources Management, Part B*. Bingley, U.K.: Emerald Publ., Feb. 2023, pp. 181-197.

[408] S. S. Albuq, A. A. A. Sen, N. Almashf, M. Yamin, A. Alshanqiti, and N. M. Bahbouh, "A survey of interoperability challenges and solutions for dealing with them in IoT environment," *IEEE Access*, vol. 10, pp. 36416-36428, 2022.

[409] R. Chengoden et al., "Metaverse for Healthcare: A survey on potential applications, challenges and future directions," *IEEE Access*, vol. 11, pp. 12765-12795, 2023.

[410] Z. Huang, C. Xiong, H. Ni, D. Wang, Y. Tao, and T. Sun, "Standard evolution of 5G-advanced and future mobile network for extended reality and metaverse," *IEEE Internet Things Mag.*, vol. 6, no. 1, pp. 20-25, Mar. 2023.

[411] W. Y. B. Lim et al., "Realizing the metaverse with edge intelligence: A match made in heaven," *IEEE Wireless Commun.*, vol. 30, no. 4, pp. 64-71, Aug. 2023.

[412] S. Zhang et al., "Towards green metaverse networking: Technologies, advancements and future directions," *IEEE Netw.*, vol. 37, no. 5, pp. 223-232, Sep. 2023.

[413] J. C. Schlimmer and R. H. Granger, "Incremental learning from noisy data," *Mach. Learn.*, vol. 1, pp. 317-354, Sep. 1986.

[414] J. Lu, A. Liu, F. Dong, F. Gu, J. Gama, and G. Zhang, "Learning under concept drift: A review," *IEEE Trans. Knowl. Data Eng.*, vol. 31, no. 12, pp. 2346-2363, Dec. 2018.

[415] O. Aouedi, K. Piamrat, and B. Parrein, "Ensemble-based deep learning model for network traffic classification," *IEEE Trans. Netw. Service Manag.*, vol. 19, no. 4, pp. 4124-4135, Dec. 2022.