Harsha Sandaruwan Gardiyawasam Pussewalage

• Wijesekara, Patikiri Arachchige Don Shehan Nilmantha; Sudheera, Kalupahana Liyanage Kushan; Sandaruwan, Harsha & Wijesiri, Geeth Priyankara (2026). BQLLDA: A blockchain, Q-learning, and hybrid post-quantum cryptography-driven adaptive framework with consensus-based trust management to mitigate zero-trust link discovery attacks in SDVNs. Computer Networks. ISSN 1389-1286. 288. doi: 10.1016/j.comnet.2026.112574. Full text in Research Archive Show summary

  In a Software-Defined Vehicular Network (SDVN), the operation of vehicular networks can be improved due to optimizations at the controller driven by a global network view. However, such performance can be drastically affected if the network topology is poisoned by Link Discovery Attacks (LDAs), causing packet loss, exhausting the network, and enabling eavesdropping. Recent solutions for LDA mitigation are centralized with no fault tolerance and assume a high trust in the controller in the LD process. Moreover, they struggle to mitigate the attack for dynamic SDVN LD owing to frequent topology changes with non-adaptive link rediscovery. Other key shortcomings include (i) lack of distributed node behavioral monitoring and blacklisting, (ii) high communication interception, (iii) lack of authenticity and integrity, and (iv) relying on single observation without distributed consensus. In order to respond to this research gap, we first demonstrate 5 LDAs that can exist in a Zero-Trust (ZT) standard SDVN architecture by exploiting the vulnerabilities in location tracking and the LD service. Our main contribution is to propose a novel framework to detect LDA by using Q-learning to derive link states by considering the link’s suspicious behavior, packet delivery, and latency and with a location-driven adaptive LD technique. Attack mitigation is achieved through (i) cycle- and non-cycle-based digital signatures with mixed post-quantum and classical cryptography, (ii) Zero-Knowledge Proofs (ZKPs) of Hash Message Authentication Codes (HMACs) stored in the blockchain, (iii) time-limited session-based HMACs, (iv) packet limiting with signature matching, (v) location verification and behavioral monitoring, and (vi) symmetric key deriving using Diffie Hellman. Moreover, a permissioned blockchain is utilized by using 3 Smart Contracts (SCs). The first SC handles node registration using a challenge-response mechanism and subsequent node authentication using signatures, ZKPs, attributes, and encrypted HMACs. The second SC is used to maintain non-tamperable node reputation and location scores by monitoring node behavior and maintaining endorser trust scores for weighted reputation updates for consensus-based node blacklisting. Furthermore, a third SC is used to verify the discovered link state and penalize the controller’s malicious behavior using the trust-score-weighted blockchain endorsement policy-driven consensus of the broadcasted HELLO packet and packet-out received nodes to further evaluate the controller’s trust and switch it under low trust. Two operational modes: BQLLDA-H (High-performing), which offers maximum security, and BQLLDA-L (Lightweight), optimized for resource-constrained deployment by selectively disabling ZKP authentication, reverse LLDP verification, and post-quantum primitives, while enabling unicasting key pair, rule-based adaptation, and single-stage authentication. The proposed BQLLDA was simulated using NS-3 and Hyperledger Fabric and is effective in attack mitigation, as the combined attack evaluations for the proposed BQLLDA-H resulted in (i) the best Packet Delivery Ratio (PDR) (97%–98% under 80% attacks), (ii) zero Packet Interception Ratio (PIR), (iii) the best Matthews Correlation Coefficient (MCC) (0.95-0.66 under 80% attacks), (iv) competitive channel utilization (14%–37%), and (v) latency (24-170 ms), albeit with higher computational complexity (46-323 ms) compared to existing approaches. BQLLDA-L achieves a complexity of 18-95 ms (60%–70% reduction) with graceful degradation to 88.7% PDR, 8.4% PIR, and 0.52 MCC at 80 percent attacks.

• Wijesekara, Patikiri Arachchige Don Shehan Nilmantha; Sudheera, Kalupahana Liyanage Kushan; Sandaruwan, Harsha; Wijesiri, Geeth Priyankara & Chong, Peter Han Joo (2026). RQSMR: Reinforcement learning-based path dynamics and QoS-aware multipath flow routing in software-defined vehicular networking. Computer Networks. ISSN 1389-1286. 276. doi: 10.1016/j.comnet.2026.111993. Full text in Research Archive Show summary

  The frequent and dynamic topology changes owing to vehicular mobility pose significant routing challenges in Software-Defined Vehicular Networking (SDVN). Multipath flow routing is a complex problem that involves routing multiple data flows across multiple paths. Existing works on this problem in the Software-Defined Networking (SDN) domain do not consider the combined effects of path dynamics, Quality of Service (QoS), and flow balancing and have been proposed for networks that rarely or do not change with time. Moreover, few existing frameworks in the SDVN domain are coarse-grained and lack proper proactive planning, finding a single path for a flow, either using the shortest path or least cost path, and do not model sub-flow path lifetimes and delays. To address this research gap, in this paper, we scrutinize SDVN characteristics to optimize flows with high granularity by going into the sub-flow level using reinforcement learning. In the proposed framework, the controller collects information about traffic flows and node mobility to derive link dynamics, and routes are optimized to maximize QoS adherence and load balance for demanding and affected flows. Precisely, unlike prior work, reinforcement learning is deployed to learn to split flows into multiple routes with optimized flow split ratios, considering path dynamics-associated parameters: destination connectivity, sub-flow quality parameters (path lifetime, path latency, QoS delivery capability, and QoS packet latency requirements), and load balance, where flow tables are updated proactively. Simulation results show that the proposed RQSMR framework yields superior QoS by achieving a higher packet delivery ratio while adhering to QoS packet latency requirements and with a considerable flow balance compared to existing approaches.

• Kumarasinghe, Kalu Gamage Kavindu Induwara; Kumarsiri, Ilangan Pakshage Madhawi Pathum; Sandaruwan, Harsha; Kumarasinghe, Kapuruka Abarana Gedara Thihara Vilochana; Liyanage, Kushan Sudheera Kalupahana & Manawadu, Yahani Pinsara [Show all 7 contributors for this article] (2025). Efficient Post-Processing of Intrusion Detection Alerts Using Data Mining and Clustering. International Conference on Security and Cryptography (SECRYPT). 1, p. 682–689. doi: 10.5220/0013558700003979. Full text in Research Archive Show summary

  Network Intrusion Detection Systems (IDS) have evolved significantly over the past two decades to address the growing complexity of network infrastructures and the increasing volume of cyber threats. However, traditional IDS approaches either rely on predefined signatures, which fail to detect zero-day attacks, or use anomaly detection models that suffer from high false alarm rates, overwhelming security analysts with excessive alerts. This paper proposes a data mining and adaptive clustering-based unsupervised approach to efficiently process IDS-generated network alerts, reducing false positives and enhancing threat detection. Relevant alert features are extracted, and advanced data mining techniques are applied to identify frequent patterns, reducing false alerts. Clustering similar patterns further groups alerts from related attacks, thereby reducing the workload of security analysts. This allows analysts to gain a high-level understanding of intrusions without manually reviewing vast numbers of alerts. The approach furthur enhances intrusion detection accuracy and provides actionable insights through alert correlation. The experimental results demonstrate significant improvements in detecting various cyber threats, including DDoS, Botnets, Port-scans, and more.

• Ghose, Debasish; Pussewalage, Harsha Gardiyawasam; Balapuwaduge, Indika A.M. & Dash, Soumya P. (2024). Secure and Lightweight Communication Protocol for Wake-up Radio Enabled Internet of Things. In Tran, Kim-Phuc; Li, Shujun; Heuchenne, Cédric & Thu-Huong, Truong (Ed.), The 7th International Conference on Safety and Security with IoT. Springer. ISSN 9783031530289. p. 3–16. doi: 10.1007/978-3-031-53028-9_1. Full text in Research Archive
• Bhardwaj, Jyotirmoy; Harman, Christopher Peter; Pussewalage, Harsha Gardiyawasam & Cenkeramaddi, Linga Reddy (2023). Real-Time Missing Data Estimation in Water Networks, 2023 IEEE Applied Sensing Conference (APSCON). IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781665461634. doi: 10.1109/APSCON56343.2023.10101123. Full text in Research Archive Show summary

  Estimating missing data (e.g., pressure) in geographically distributed nodes is one of the fundamental challenges in a water distribution network (WDN). The Model-Based Kalman Filter is a simple solution that can estimate missing data in systems with a linear Gaussian state model. However, in large WDN, the state model is non-linear, and accurate system dynamics are unknown. Thus, we investigate the use of Data-Driven Kalman Filter (DDKF), in which the Recurrent Neural Network (RNN) updates the Kalman Gain. This data-driven approach has the potential to reduce approximation errors caused by the state model’s nonlinearity. As a result, this work demonstrates the application of a DDKF in a WDN. In addition, we demonstrate numerically that the DDKF can overcome approximation errors caused by flow equations and can estimate missing data in a WDN.

• Ullah, Syed Sajid; Oleshchuk, Vladimir & Pussewalage, Harsha Gardiyawasam (2023). A Lightweight Access Control Scheme with Attribute Policy for Blockchain-Enabled Internet of Things. In Vimercati, Sabrina De Capitani di & Samarati, Pierangela (Ed.), Proceedings of the 20th International Conference on Security and Cryptography. SciTePress. ISSN 9789897586668. p. 528–539. doi: 10.5220/0012138900003555. Full text in Research Archive
• Ullah, Syed Sajid; Oleshchuk, Vladimir & Pussewalage, Harsha Gardiyawasam (2023). A survey on blockchain envisioned attribute based access control for internet of things: Overview, comparative analysis, and open research challenges. Computer Networks. ISSN 1389-1286. 235, p. 1–16. doi: 10.1016/j.comnet.2023.109994. Full text in Research Archive Show summary

  The Internet of Things (IoT) network is rapidly expanding due to sudden technological advancements, which enable objects to become intelligent and contribute to the network. Before permitting a newly added IoT device to communicate with the network, it is essential to provide access and authenticate the device’s legitimacy by ensuring that it has not been tampered. Recently, blockchain technology has been integrated into Attribute Based Access Control (ABAC) protocols to supply a more robust security mechanism for access control in IoT. The IoT and blockchain-based ABAC serve as the foundation of this survey, offering a comprehensive introduction to both topics. Additionally, several security concerns and vulnerabilities associated with Blockchain Envisioned ABAC (BE-ABAC) are presented. A Comparison with related surveys has also been made. Besides, we also present a comparative analysis based on evaluation based on Distance from Average Solution (EDAS) to rank the best schemes among the suggested BE-ABAC schemes. In conclusion, we discuss some open research challenges in an IoT network that uses blockchain to manage access control.

• Pussewalage, Harsha Gardiyawasam & Oleshchuk, Vladimir (2022). A Delegatable Attribute Based Encryption Scheme for a Collaborative E-health Cloud. IEEE Transactions on Services Computing. 16(2), p. 787–801. doi: 10.1109/TSC.2022.3174909. Full text in Research Archive
• Abeyrathna, Kuruge Darshana; Pussewalage, Harsha Gardiyawasam; Ranasinghe, Sasanka Niromi; Oleshchuk, Vladimir & Granmo, Ole-Christoffer (2020). Intrusion Detection with Interpretable Rules Generated Using the Tsetlin Machine, 2020 IEEE Symposium Series on Computational Intelligence (SSCI). IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781728125473. p. 1121–1130. doi: 10.1109/SSCI47803.2020.9308206. Full text in Research Archive
• Pussewalage, Harsha Gardiyawasam & Oleshchuk, Vladimir (2019). An Anonymous Delegatable Attribute-based Credential Scheme for a Collaborative E-health Environment. ACM Transactions on Internet Technology (TOIT). ISSN 1533-5399. 19(3). doi: 10.1145/3338854. Full text in Research Archive
• Pussewalage, Harsha Gardiyawasam & Oleshchuk, Vladimir (2018). Blockchain Based Delegatable Access Control Scheme for a Collaborative E-health Environment, 2018 IEEE Confs on Internet of Things, Green Computing and Communications, Cyber, Physical and Social Computing, Smart Data, Blockchain, Computer and Information Technology, Congress on Cybermatics. IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781538679753. p. 1204–1211. doi: 10.1109/Cybermatics_2018.2018.00214. Full text in Research Archive Show summary

  Abstract—Modern electronic healthcare (e-health) settings constitute collaborative environments requiring sophisticated finegrained access control mechanisms to cater their access demands. Access delegatability is quite crucial to realize fine-grained, flexible access control schemes compatible with such environments. In this paper, we addressed this issue through proposing an attribute based access control scheme integrated with controlled access delegation capabilities suitable for a multi-domain e-health environment. We have utilized the blockchain technology to manage attribute assignments, delegations as well as revocations. The scheme enables delegations in a controlled manner without jeopardizing the security of the system. The control is achieved via granting each delegating user the capability of controlling the subsequent delegations made by the delegatee as well as limiting the length of a chain of delegations. Furthermore, it is equipped with a superior attribute revocation mechanism and induces substantially lower key management overhead to the endusers in comparison to the existing access control schemes with delegatability

• Ranasinghe, Sasanka Niromi; Pussewalage, Harsha Gardiyawasam & Middleton, Peter Hugh (2017). Performance analysis of single cell solid oxide fuel cells, 2017 Moratuwa Engineering Research Conference (MERCon). IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781509064915. doi: 10.1109/MERCon.2017.7980515. Full text in Research Archive
• Pussewalage, Harsha Gardiyawasam & Oleshchuk, Vladimir (2017). A Distributed Multi-Authority Attribute Based Encryption Scheme for Secure Sharing of Personal Health Records. In NN, N (Eds.), Proceedings of the 22nd ACM Symposium on Access Control Models and Technologies (ACM SACMAT). Association for Computing Machinery (ACM). ISSN 9781450347020. p. 255–262. doi: 10.1145/3078861.3078880. Full text in Research Archive
• Pussewalage, Harsha Gardiyawasam & Oleshchuk, Vladimir (2017). An Efficient Multi-Show Unlinkable Attribute Based Credential Scheme for a Collaborative E-Health Environment. In NN, N (Eds.), 2017 IEEE 3rd International Conference on Collaboration and Internet Computing (CIC). IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781538625651. p. 421–428. doi: 10.1109/CIC.2017.00060. Full text in Research Archive
• Pussewalage, Harsha Gardiyawasam & Oleshchuk, Vladimir (2017). Attribute based access control scheme with controlled access delegation for collaborative E-health environments. Journal of Information Security and Applications. ISSN 2214-2134. 37, p. 50–64. doi: 10.1016/j.jisa.2017.10.004. Full text in Research Archive
• Pussewalage, Harsha Gardiyawasam & Oleshchuk, Vladimir (2016). A Patient-Centric Attribute Based Access Control Scheme for Secure Sharing of Personal Health Records Using Cloud Computing. In Bilof, Randall (Eds.), 2016 IEEE 2nd International Conference on Collaboration and Internet Computing (CIC). IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781509046072. p. 46–53. doi: 10.1109/CIC.2016.020. Full text in Research Archive
• Pussewalage, Harsha Gardiyawasam; Ranaweera, Pasika; Oleshchuk, Vladimir & Balapuwaduge, Indika A.M. (2016). Secure Multi-party based Cloud Computing Framework for Statistical Data Analysis of Encrypted Data. In NN, N (Eds.), 19th International Conference on Innovations in Clouds, Internet and Networks. IFIP International Federation for Information Processing. ISSN 9783901882814. p. 22–28. Full text in Research Archive Show summary

  Secure multi-party computation (SMC) is a paradigm used to accomplish a common computation among multiple users while keeping the data of each party secret from others. Cloud computing is a next generation computing solution which allows its users to use high speed infrastructure and services provided by cloud service providers (CSP) in a cost effective manner. Therefore, deployment of cloud based architecture for SMCs would aid in improving its performance and efficiency. However, cloud based solutions raises concerns over security of users’ private data, since data is under the control of an external entity when outsourced to cloud platforms. In this paper we have proposed a Secure Multi-party based Cloud Computing Framework which can ensure security, privacy and anonymity of users’ private data. This framework is modeled by considering a scenario which requires outsourcing statistical parameter computation of private sales data of an organization’s sales personnel. The results that we have obtained, provides significant evidence of feasibility of multi-party based cloud computing solutions.

• Pussewalage, Harsha Gardiyawasam & Oleshchuk, Vladimir (2016). An attribute based access control scheme for secure sharing of electronic health records, 2016 IEEE 18th International Conference on e-Health Networking, Applications and Services (Healthcom),. IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781509033706. doi: 10.1109/HealthCom.2016.7749516. Full text in Research Archive
• Pussewalage, Harsha Gardiyawasam & Oleshchuk, Vladimir (2016). Privacy preserving mechanisms for enforcing security and privacy requirements in E-health solutions. International Journal of Information Management. ISSN 0268-4012. 36(6), p. 1161–1173. doi: 10.1016/j.ijinfomgt.2016.07.006. Full text in Research Archive

View all works in NVA

• Bhardwaj, Jyotirmoy; Harman, Christopher Peter; Pussewalage, Harsha Gardiyawasam & Cenkeramaddi, Linga Reddy (2023). Real-Time Missing Data Estimation in Water Networks. Full text in Research Archive
• Pussewalage, Harsha Gardiyawasam (2019). Attribute Based Cryptographic Enforcements for Security and Privacy in E-health Environments. Universitetet i Agder. ISSN 9788271179236. Full text in Research Archive

View all works in NVA