1 Introduction

It is anticipated that Next-Generation Networks (NGNs) will be able to efficiently manage an extensive array of devices, industries, technologies, and services. The presence of heterogeneity significantly increases the complexity of managing network infrastructure [1]. Software-defined networking (SDN) and network function virtualization (NFV) have gained traction as methods for managing the fluctuating demand for network resources. Novel approaches are needed to address challenges in ensuring end-to-end Quality of Experience (QoE) and efficient automated resource management in network softwarization [2]. These factors are very important because virtualized resources are linked to physical entities that may be connected to different service providers. The 5th industrial revolution offers organizations new chances to enhance customer value by leveraging communication and computing technologies that are enabled [3]. Cloud-native gateways provide businesses with new possibilities to utilize this technology for expansion and financial success through potential business models. It is essential for all key stakeholders, including prominent telecoms and vertical companies, to collaborate to achieve the necessary economic impact and ensure fair recompense for everyone engaged. The ZTN framework is a high-tech system that aims to do all operational tasks, such as provisioning, monitoring, optimization, delivery, deployment, planning, design, and more without much help from people [4]. By employing ZTNs, network management solutions can offer inherent security. The widespread use of IoT devices and ZTNs’ reliance on edge and cloud-based services are the primary sources of current security risks. IoT devices are vulnerable to hacking [5] because they lack security measures during their physical installation in ZTNs. Furthermore, using an unprotected conduit for communication creates the possibility for many security and privacy breaches to occur inside the network [6]. Hence, it is crucial to examine the most effective strategies to address the previously listed risks and attacks on ZTNs [7]. DL can uncover insights from large amounts of heterogeneous and unorganized ZTN data. Another benefit is that it allows for the automated identification of hidden patterns from large amounts of data, eliminating the requirement for human involvement [8]. To prevent undiscovered fraudulent transactions, intrusion detection systems (IDS) can be strategically installed or redundantly constructed within a network. The primary objective of an IDS is to analyze and categorize network traffic [9]. It is highly efficient at differentiating malicious from authorized network activity, thereby assisting in removing undesired traffic [10]. Unlike machine learning-based IDS, deep learning-based IDS can improve overall accuracy and support a broader range of applications [11]. Research on establishing blockchain and DL-based solutions for secure data exchange, specifically for ZTNs, is still early [12]. In addition, there is a scarcity of research studies investigating the hazards linked to transitioning from traditional to ZTN networks [13]. The studies cited in [14] and [15] provide a variety of frameworks or approaches that can be used to develop IDS in ZTNs using machine learning or deep learning. However, detecting intrusions using standalone machine learning or deep learning-based IDS is difficult for most ZTN applications. The time series data in these applications is usually very long, and there are a lot of features. Because the features are not linear or stationary, they are organized into many layers. Traditional AI/ML-based security models in IoT networks face several challenges, particularly in the context of ZTN. These models often rely on static training datasets and predefined feature extraction, making them less effective in detecting sophisticated cyber threats that evolve over time. Furthermore, IoT networks generate vast amounts of heterogeneous, time-series data, posing scalability and adaptability challenges for conventional AI/ML models. Manual feature engineering, a crucial step in traditional models, is prone to human error, further compromising detection accuracy. Deep learning (DL)-based approaches have emerged as a promising solution, offering automated feature extraction and real-time adaptation to new threats. But using DL models in IoT-based ZTN settings needs a strong security system to make sure that data and model updates are safe [16]. Our proposed framework integrates blockchain, federated transfer learning, and ZTN principles to address these challenges. We ensure secure model updates and data integrity by leveraging blockchain’s decentralized and tamper-proof properties. Federated Transfer Learning enables efficient adaptation of security models across diverse IoT devices without exposing sensitive data. The ZTN framework further reinforces security by enforcing strict access control policies, ensuring that no entity is inherently trusted. This multidisciplinary approach significantly enhances the resilience, scalability, and adaptability of IoT security in Industry 5.0.

2 Attacks on ZTN

The following section discusses the respective layers of ZTN along with possible attacks on the layers.

3 Related work

We aim to provide a more thorough literature review by incorporating additional studies that align with our research on blockchain-based ZTN and FTL in Industry 5.0 security frameworks. Initially, our related work section lacked a dedicated discussion on the unique security challenges posed by Industry 5.0 IoT environments. The role of next-generation networks in automating factories and the security risks that come with places that are always connected [22]. These studies give us important information about how we need stronger, scalable, and decentralized security systems, which makes our proposed framework even more important. The previous version did not comprehensively discuss prior blockchain-based security solutions for IoT networks. The researchers in [23], which explore how blockchain enhances security in distributed IoT architectures. These studies show that blockchain is good at protecting data transmission and building trust in decentralized settings. This is another reason why we think blockchain should be a part of the proposed framework. Our original discussion of ZTN principles and intrusion detection was limited. To address this, we have included the work of the researchers [24], which discuss implementing ZTN security models in dynamic IoT environments. These studies give us important background information on how ZTN policies stop people from getting in without permission and how deep learning-based IDS make finding threats in modern cyber-physical systems easier. Our previous related work section did not sufficiently emphasize how FTL has been applied in cybersecurity. Our research now includes studies like those in [25], which show how federated learning can help protect data privacy and make models more flexible in IoT networks. These additions strengthen our argument for adopting FTL to enable decentralized yet efficient security model updates across IoT devices. While blockchain, ZTN, and federated learning have all been studied separately in the past, there is still a big need to combine them into a single security framework for Industry 5.0 IoT environments. Our work specifically addresses this gap through the following key contributions:

• In contrast to traditional centralized models, our method uses blockchain as a decentralized ledger to safely handle and record model updates in a federated learning environment. This protects the integrity of data and builds trust across IoT devices. This builds upon the foundational work of the researchers and extends it by incorporating transfer learning to improve adaptability.
• We incorporate ZTN principles to implement stringent access control mechanisms, guaranteeing that no entity receives default trust. This fixes the problems that were pointed out in the previous work, which talked about ZTN models but didn’t look into how they could be used in federated IoT security frameworks.
• We introduce an adaptive stochastic blockchain model that continuously refines its security policies based on real-time network threats and learning updates. This model builds upon the federated learning approaches discussed by researchers by incorporating blockchain for enhanced trust management.
• The ToN-IoT and BoT-IoT datasets are used in our study to test how well our model works on a number of security measures, including accuracy, precision, recall, and F1-score. Our results are much better than baseline models and do a better job of finding intrusions than existing deep learning-based methods.

4 ZTN overview

ZTNs, possessing the ability to autonomously configure, monitor, heal, and optimize themselves, have become a viable option to fully automate network operations [19]. Without human interaction, their primary function is to operate and execute business procedures, maintain their own functioning, overcome obstacles, and fulfill additional obligations related to the network. ZTN can be easily installed with the use of various APIs and end-to-end (E2E) programmability [26]. The automation capabilities of ZTN are crucial to evaluating and addressing customer-specific requirements and achieving the necessary QoE. In addition, end-to-end automation allows zero-trust networks to develop and enhance by integrating and modifying the necessary features needed for practical use. The integration enables the collection and analysis of real-time network data, improving security, predictive maintenance, and overall performance. By incorporating AI/ML techniques into closed-loop operations, it is possible to automate cybersecurity procedures in the field of network and service management [17]. The ZTN architecture incorporates a data analytics service that is seamlessly integrated into all management domains. This integration allows for closed-loop operations in network security and optimization. The INSPIRE-5Gplus project, funded by the European Union (EU), introduces a comprehensive autonomous security network framework model for ZTN systems [27]. A management domain refers to a grouping of resources and services that are arranged based on different limitations, such as functions, operations, and deployment. The domain integration fabric promotes intra-domain communication, while the inter-domain integration fabric permits inter-domain communication and end-to-end management domains.

5 Proposed methodology: Adaptive stochastic blockchain model for ZTN security

To expand on the integration of ZTN security using automated machine learning and blockchain, it will involve the development of a dynamic model that continuously updates and refines its parameters based on real-time network data and threat analysis. This approach utilizes a federated learning framework, which allows for the decentralized training of machine learning models across multiple IoT devices without the need to transfer raw data to a central location. This aligns with blockchain’s strengths in ensuring transparency, security, and data integrity. Blockchain can be used to manage and log the distribution and synchronization of the federated learning model updates. We integrate a CNN-MLP model within a deep learning-based IDS to efficiently perform feature extraction and intrusion detection. Implement smart contracts to automate the update process and ensure that only verified updates are applied to the model. This enhances security against tampering and malicious updates. Initially, each IoT device receives a copy of a pre-trained model from a central server [33]. This model is pre-trained on a large, diverse dataset that is representative of typical network behaviors and potential threats, but not specifically fine-tuned to the nuances of the individual devices’ operating environments. Each device continuously collects data relevant to its operation. This data includes both normal operational data and any anomalies or potential security threats. The types of data collected can vary widely, depending on the device’s purpose and environment, but generally include network traffic, sensor outputs, system logs, and any other telemetry data relevant to the device’s function. Before training, the device processes the collected data to extract and select the characteristics that are most indicative of its operational state and potential security risks [34]. This step is crucial because it determines what aspects of the data the model will focus on during training. Effective feature extraction and selection can significantly enhance the model’s ability to detect subtle or complex anomalies that might indicate a security threat. With the relevant features selected, each device begins adapting the pre-trained model using its local dataset. This adaptation is performed using transfer learning techniques, where the initial layers of the model (trained to recognize general patterns and features in the data) are usually kept fixed, and the deeper layers are fine-tuned to align closely with the device’s specific data characteristics. Fine-tuning involves adjusting the weights of the pre-trained model using the local data. The learning process typically focuses on the final layers of the model, where the representations are more specific to the task, accurately identifying potential security threats from normal behavior. The extent of fine-tuning can vary; in some cases, only the output layers are adjusted, while in more complex scenarios, several deeper layers might also be fine-tuned. Choice of loss function can significantly affect the model’s performance, with common choices including cross-entropy for classification tasks or mean squared error for regression tasks. Optimization is typically performed using stochastic gradient descent or one of its variants, adjusted for the limited computational resources available on many IoT devices [35]. After an initial round of training, the device evaluates the adapted model against a separate portion of its collected data that was not used during training. This step is crucial to ensure that the model not only memorizes the training data but actually learns to generalize from it [36]. Based on the performance in the validation dataset, further training iterations might be performed, tweaking the model parameters, or even revisiting the feature selection step if necessary [37, 38]. Fig 1 shows the proposed methodology. This process of local training using transfer learning enables each device in the IoT network to have a model that is both robust in its general capabilities and highly specialized to its particular needs. The result is a better overall security posture, with each device better equipped to detect and respond to the specific types of threat it is most likely to encounter in its operating environment.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 1. Proposed methodology adaptive stochastic blockchain model for ZTN security.

https://doi.org/10.1371/journal.pone.0323241.g001

Let represent the parameters of the global model. The initial parameters are derived from the pre-trained model. Each device i trains the model locally based on its dataset D_i. The objective is to minimize a loss function L_i specific to the data:

(1)

In the previous equation, is the gradient of the local loss with respect to the model parameters, and is the learning rate, which controls the step size of the update.

The parameter updates from each device are aggregated to update the global model:

(2)

where represents the weight of the i-th device’s contribution, typically based on the size of D_i or the reliability of the device. This process repeats across several iterations t, refining the global model with each cycle:

(3)

A mathematical model involving concepts from adaptive learning and stochastic optimization. Let S_t represent the state of the network at time t, which includes vectors of the network performance indicators and security metrics. Assume threats are stochastic processes characterized by the probability distribution that evolves over time due to external factors and adversarial strategies. Define a for the ML model that adapts over time based on observed data and identified threats. At each step, the model changes according to the following equation:

(4)

where is the parameter vector at time t. n_k is the learning rate at time t, potentially adaptive. L is the loss function that quantifies the deviation from optimal security settings, incorporating both performance and security metrics. is the gradient of the loss function with respect to the model parameters.

Given the potential unavailability of explicit forms of threats and their evolution, the gradient is estimated using stochastic approximation methods

(5)

Here, l represents the loss associated with the individual samples drawn from the distribution of network states and threats at time t. N is the number of samples used for the estimation, which could be adapted based on the variance of the gradient estimates.

To accommodate the changing dynamics of the network and threats, the learning rate n_k is adjusted using an adaptive strategy based on the variance of the loss gradient:

(6)

is a scaling factor, is the estimated variance of the loss gradients, and is a small constant to avoid division by zero.

Incorporate a feedback loop that adjusts the model based on discrepancies between expected and actual network performance outcomes as depicted below:

(7)

k is a feedback gain parameter. S_target represents target states of network performance and security metrics. The primary objective of the proposed approach is to dynamically optimize the use of computational and communication resources in a smart factory environment. The mathematical model is formulated as follows:

(8)

Where F(x) is the total cost function of allocating network resources. c_i represents the cost associated with the resource i, which is allocated. x_i is a binary variable that represents whether resource i is allocated. Here are the following constraints:

• Resource Capacity(9)where a_ij represents the amount of resource i required by task j. b_i is the total available capacity of the resource i.
• Quality of Service (QoS)(10)Where: QoS_j(x) is the quality of service for task j, which depends on the allocated resources. QoS_min,j is the minimum quality of service required for task j.
• Latency Requirements:(11)Where: L(x) represents the network latency under the current allocation x. L_max is the maximum allowable latency.

Algorithm 1 presents the algorithm for the proposed methodology.

Algorithm 1. Adaptive stochastic blockchain model for ZTN security.

Input: Pre-trained global model parameters global , set of all IoT devices D, learning rate , blockchain ledger .

Output: Updated global model parameters global , updated blockchain ledger .

1: DistributeGlobalModel()

InitializeBlockchain()

2: For each device

CollectLocalData(i)

LocalAdaptation , D_i,)

TransmitToBlockchain(B,i, )

3: WaitForAllUpdates(D)

BUpdateBlockchain(B, )

4: For each access request r from any device i:

VerifyAccess(B,i,r)

LogAccessRequest(B,i,r,Access_i,r )

5: DistributeUpdatedModel(D,)

MonitorSystem // Optional: Adjust based on performance metrics

6 Results and discussion

The experiment was carried out on a Dell PowerEdge T20 server with an Intel Xeon(R) CPU E3-1225v3 3.20 GHz 4 processor. The research employs the ToN-IoT [ https://research.unsw.edu.au/projects/toniot-datasets] and BoT-IoT [https://research.unsw.edu.au/projects/bot-iot-dataset] datasets. Detailed explanations of both datasets can be found in [36–41]. The hyperparameters were found using the random search method from the scikit-learn and Keras libraries. In this study, macro-averaging methods were used to obtain the following metrics: Accuracy (AC), Detection Rate (DR), Precision (PR), F1 score. Table 1 shows the impact of learning rates and epochs on multiple model metrics. Fig 2 shows the accuracy of the model with training samples. The training curve exhibits an initial phase of rapid improvement, followed by a gradual stabilization, with slight fluctuations indicative of adjustments to the learning rate and potential overfitting. To enhance model convergence and generalization, future work will focus on adaptive learning rate scheduling, regularization techniques such as dropout and batch normalization, and hyperparameter tuning for optimal training stability. Furthermore, investigating ensemble learning strategies and reinforcement learning-based optimization could further improve the robustness of the model in dynamic IoT security environments.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 2. Model accuracy with training samples.

https://doi.org/10.1371/journal.pone.0323241.g002

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 1. Impact of varying learning rates and epochs on multiple model metrics.

https://doi.org/10.1371/journal.pone.0323241.t001

6.1 Impact of learning rate on model convergence

• High Learning Rates: The data show relatively quick improvement in all metrics as the epochs increase from 10 to 100. This suggests that a higher learning rate might lead to faster convergence in this scenario. However, it risks overshooting the loss function’s minimum, potentially causing instability if unchecked. Fig 3 shows the impact of the learning rate (0.01) and the epochs on multiple model metrics.
• Medium Learning Rates: Here, the model shows a steady improvement and eventually surpasses the performance of the higher learning rate in 100 epochs. This indicates a more stable learning path and suggests that, for longer training periods, a medium learning rate might be more effective. Fig 4 shows the impact of the learning rate (0.001) and the epochs on multiple model metrics.
• Low learning rates: The slowest improvement rate is observed with the lowest learning rate. Although initial performance is significantly lower, the final metrics at 100 epochs are competitive, indicating that given sufficient training time, lower learning rates can achieve similar, if not better, performance without risking the stability seen in higher rates. Fig 5 shows the impact of the learning rate (0.0001) and the epochs on multiple model metrics.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 3. Impact of learning rate (0.01) and epochs on multiple model metrics.

https://doi.org/10.1371/journal.pone.0323241.g003

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 4. Impact of varying learning rate (0.001) and epochs on multiple model metrics.

https://doi.org/10.1371/journal.pone.0323241.g004

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 5. Impact of varying learning rate (0.0001) and epochs on multiple model metrics.

https://doi.org/10.1371/journal.pone.0323241.g005

7 Conclusion and future work