The increasing sophistication of AI-generated misinformation poses a significant challenge, particularly in Vietnamese digital environments, where scam tactics are evolving rapidly. In response, this paper presents FraudTrace, an automated, multi-agent verification system designed to detect and explain misinformation and online fraud. Our key contributions include (1) the construction of a diverse and realistic dataset comprising 4,221 labeled samples, (2) the introduction of a URC (Understandable Response Clarity) metric for evaluating model explainability, and (3) the deployment of a modular, role-based multi-agent architecture integrating fine-tuned Large Language Models (LLMs), Retrieval-Augmented Generation (RAG), Google Search APIs, and scam detection frameworks. Experimental results indicate that fine-tuned LLMs significantly outperform zero-shot baselines, with the best-performing model achieving over 91
The rapid development of the Internet of Things (IoT) has realized the mutual communication between intelligent devices such as sensors, smart phones and vehicles. However, it is a challenge to design an authentication and key agreement protocol suitable for resource-constrained Industrial Internet of Things (IIoT) environment. Recently, Zahednejad et al. proposed a robust three-factor authentication protocol based on Elliptic Curve Diffie-Hellman (ECDH), and claimed that the protocol can resist various attacks. However, we found that their scheme could not resist sensor node capture attack. In order to overcome this problem, we propose an improved three-factor authentication scheme based on physical unclonable function (PUF). Informal analysis shows that the scheme has the ability to resist multiple attacks. In addition, we employed the Real or Random (ROR) model to conduct a formal analysis of the scheme, and the results indicate that the scheme is secure. Finally, compared with other similar schemes, this scheme has advantages in computation and communication costs, and is more practical.
As organizations navigate the complexities of the digital era, they face a growing and particularly insidious threat: internal cyber-attacks. These insider threats, whether intentional or unintentional, present unique cybersecurity challenges. This paper introduces a novel approach to real-time anomaly detection for insider threat hunting, leveraging sliding windows to analyze event streams at the finest granularity, event by event. Our methodology employs a range of unsupervised learning algorithms, including conventional machine learning methods, graph neural networks (GNN), and natural language processing (NLP) techniques, to identify anomalies without prior knowledge of potential attacks. Using sliding windows, we ensure continuous and contextual analysis, enabling real-time processing and detection. This approach is evaluated using the CERT insider threat dataset, renowned for its richness and believability, which simulates the activities of a large organization over an extended period, offers between 0.95 and 1 in usual ML metrics, and a true real-time process. By unifying these techniques under a shared framework, our solution aims to provide a robust and practical approach for the real-time detection of anomalies involved in insider threat activities, thereby enabling organizations to protect their critical assets from potential damage by malicious or negligent insiders.
With rising global energy consumption, smart grids require integrating massive, scattered device data, making energy-efficient data aggregation techniques critical. Yet, they face key challenges: balancing data privacy, boosting operational efficiency, and ensuring accurate anomaly detection across more scenarios. The article presents a distributed data aggregation frame for smart grids that guarantees data integrity amid malicious nodes or adversarial attacks. The system, governed by rigorous privacy protections, enables the rapid identification of data that surpasses specified criteria while maintaining the accuracy and uniformity of normal data through integrity verification mechanisms. This is, to our knowledge, the inaugural solution that concurrently incorporates malicious threat models and meter data integrity verification in distributed data gathering environments while preserving anomaly detection functionalities. Assessments of security, computational burden, and privacy safeguarding efficacy indicate that the suggested method attains an optimal balance among these elements, fully fulfilling the stringent demands of contemporary smart grid applications for both performance and security.
The diffusion model has gained considerable attention as an advanced deep generation model, showcasing remarkable performance. However, concerns have emerged regarding privacy and equity due to potential model misuse, especially for some sensitive features such as gender. Our focus is on addressing the challenge of machine unlearning within an unconditional diffusion model that selectively omits specific features. Our objective is to modify images generated by a pre-trained model by selectively removing particular image components. To achieve this, we propose a novel learning framework for unconditional image-to-image diffusion models. This framework integrates a scoring model into a pre-trained diffusion model, allowing for refinement without the need for a complete retraining process. Experimental validation using datasets such as MNIST and CelebA demonstrates the effectiveness of our approach. It highlights the model’s capability to generate and remove target features while maintaining the fidelity of the original image.
With the widespread use of the Internet, network attacks are common and emerge endlessly. The Network Intrusion Detection System (NIDS) stands as a critical security infrastructure, commonly categorized into signature-based and anomaly-based approaches. The former pursues a fine-grained classification while the latter provides unknown attack detection in a binary-classification manner (i.e., merely identifying malicious or not). However, they cannot support both simultaneously, e.g., identify unknown attacks when performing fine-grained classification. This paper introduces HF-IDS, a hybrid method that combines the strengths of both anomaly and signature-based detection to address the challenge of fine-grained known/unknown intrusion detection. We first employs an anomaly detector to distinguish the anomaly (malicious) and benign traffic. Subsequently, a lightweight Variational Encoder-Augmented Classifier (VEAC) is designed for precise fine-grained classification. With the results of both models, a tailored unknown identification rule set is deployed to pinpoint unknown attacks and guarantee the fine-grained classification performance for known attacks. Extensive experiments showcase the superiority of HF-IDS over state-of-the-art methods, particularly in the detection rate of unknown attacks, with an average improvement of 14.54
The evolving cybersecurity landscape demands advanced malware classification techniques to mitigate risks such as data breaches and financial losses. In response, we propose a novel lightweight image-based malware classification method that leverages grayscale image transformation, making it compatible with convolutional neural networks (CNNs). Our optimized CNN model, enhanced with an attention mechanism and efficient convolutional units, effectively captures complex malware patterns and outperforms traditional classifiers. We evaluated our approach on both a curated malware dataset and a widely used open-source dataset, achieving classification accuracies of 98.71
Multimodal learning provides an effective approach for Android malware detection by integrating heterogeneous data sources such as permissions, intents, and binary content. However, existing fusion algorithms remain simplistic, lacking the capacity to model complex cross-modal relationships. This paper proposes a Large Language Model (LLM)-based feature fusion framework for Android malware classification. The framework combines tabular features (permissions and intents) and visual representations derived from DEX bytecode using a dual-stream architecture with Deep Neural Network (DNN) and Convolutional Neural Network (CNN) backbones. A fusion head inspired by LLMs is employed to capture rich interactions across modalities. Experimental results on the CICMalDroid 2020 dataset show that LLM-based fusion using TinyLLaMA achieves 96.81 .
Modern smart grids increasingly rely on accurate load forecasting to manage energy resources efficiently amid the growing integration of renewable and distributed energy sources. While federated learning offers a promising approach by enabling decentralized model training without raw data sharing, it still exposes users to privacy risks through model updates and remains vulnerable to malicious participants. This paper presents a secure and privacy-preserving federated learning framework tailored for smart grid load forecasting. The proposed system enhances privacy by employing anonymous update submissions, zero-knowledge proofs, and blind signatures, thereby unlinking user identities from their model contributions. To ensure model integrity, a blockchain-based reputation mechanism is introduced, incentivizing honest participation while penalizing malicious behavior without unfairly targeting legitimate users. The system also incorporates a distributed clustering process to address data heterogeneity, enabling the training of specialized models across user clusters. The framework is evaluated in terms of privacy, security, and performance, showing that it preserves user confidentiality, ensures model integrity, and operates efficiently on resource-constrained IoT devices.
In an era of rapidly evolving cyber threats, the ability to accurately detect and classify malicious software has become a critical component of modern cybersecurity operations. YARA, a rule-based pattern matching tool, has established itself as a fundamental asset in malware analysis, threat hunting, and incident response workflows. Notably, YARA rules are authored by experienced security professionals, making them a reliable and valuable source of intelligence for training machine learning models. These rules are continuously updated or newly generated as emerging malware strains are discovered, ensuring they remain aligned with the evolving threat landscape. This work proposes a dynamic integration of established malware datasets, such as EMBER, with information automatically extracted from YARA rules to enhance malware detection strategies using machine learning algorithms. The study further investigates how the conditions embedded within YARA rules can be strategically leveraged to generate enriched datasets, dynamically producing additional entries sourced from public platforms like GitHub repositories. Additionally, when malware family identifiers are explicitly mentioned within YARA rules, these labels are extracted and incorporated into classification models, providing critical context for supervised learning processes. All these processes are orchestrated within a fully automated pipeline, enabling continuous, intelligent data enrichment. By harvesting essential detection features such as unique signatures, string patterns, and logical conditions, this methodology aims to enhance malware detection capabilities and strengthen proactive cybersecurity defences.
As modern vehicles become increasingly connected and software-driven, securing their in-vehicle networks (IVNs)—especially the ubiquitous, vulnerable Controller Area Network (CAN)—has become paramount. However, contemporary automotive intrusion detection systems (IDSs) suffer from elevated false positive rates that significantly impact their practical effectiveness. This work aims to address these limitations by developing an enhanced rule-based IDS that incorporates adaptive pattern recognition mechanisms. We propose two novel detection rules that leverage attack-free traffic analysis to establish baseline behavioral patterns for the CAN bus. More specifically, Rule #1 analyzes message data field lengths against “normal” patterns derived from attack-free network traffic, and Rule #2 employs field classification to categorize message types for each arbitration ID, distinguishing between constant values, counters, multi-values, and sensor data. Our experimental evaluation demonstrates that the proposed detection rules achieve superior accuracy metrics while significantly reducing false positive rates compared to conventional approaches.
Machine learning (ML) and deep learning (DL)-based Intrusion Detection Systems (IDS) have shown promise but remain highly vulnerable to adversarial examples (AEs) – specially crafted inputs designed to evade detection – posing serious security risks. Moreover, their black-box nature limits explainability, undermining trust and hindering defense development. To address these challenges, we propose X-AdvIDS, a novel framework combining adversarial robustness and IDS explainability. Specifically, X-AdvIDS consists of two key modules: Adv-Sword, which leverages explainable Artificial Intelligence (XAI) to generate high-evasion AEs for assessing IDS weaknesses, and Adv-Shield, which utilizes explainable AI to construct a whitelist of trusted features for adversarial sample detection. Experiments on the InSDN and CICIDS2018 demonstrate that Adv-Sword significantly reduces IDS detection performance, revealing vulnerabilities, while Adv-Shield detects over 90
Consider a scenario where several mutually distrustful enterprises need to collaboratively train an artificial intelligence model. Due to the need for data privacy protection, the comparison operations involved in the model training process must not disclose the compared data or the results of the comparisons. Currently, the open-source implementation MP-SPDZ supports dishonest majority settings, and its most efficient secure comparison protocol is primarily based on the framework proposed by Catrina and Hoogh in 2010. Protocols within this framework are mainly implemented using secret sharing techniques, especially for the basic multiplication operation, with communication overhead being a significant technical challenge. This paper firstly introduces fully homomorphic encryption technology into this framework, leveraging its single instruction multiple data (SIMD) capabilities to improve the random number generation and bit comparison protocols. This results in reduced communication overhead and enhanced protocol efficiency. Experimental data demonstrates that when the vector dimension is 8192 and the number of parties is 7, the communication overhead of the improved protocol is 37
In the context of open ledgers and multi-party consensus, ensuring transaction identity privacy is a critical challenge in blockchain. Current identity privacy protection schemes in public blockchains often rely on anonymous authentication and transaction obfuscation, which are difficult to apply widely due to a lack of effective regulation. Moreover, reliance on a single regulator introduces the risk of malicious behavior. Drawing on Monero’s privacy mechanism, this paper proposes an identity privacy protection scheme based on bilinear pairing and elliptic curve cryptography, while introducing the Information Dispersal Algorithm (IDA) to establish a distributed regulatory mechanism. By enhancing controllable anonymous identity markers and smart contract verification methods, this scheme allows distributed regulators to recover the true identity of transaction participants in an offline setting, thereby achieving ‘controllable anonymity’ in regulation. Security model analysis demonstrates that the proposed scheme ensures anonymity for the transaction recipient, regulability, regulatory reliability, and one-time private key security.
Unmanned information systems (unmanned systems) leverage automation and remote control to collect, process, and transmit information with minimal human involvement. To support diverse functions, they rely on complex and highly configurable hardware and software components. However, this configurability also enlarges the attack surface, posing significant security risks such as system failures, data breaches, and identity theft. To address the security vulnerabilities associated with configuration in autonomous driving systems, we employ static analysis techniques to construct mapping of configuration options, integrated with black-box fuzz testing approaches to systematically identify configuration-related defects. Specifically, a fuzz testing methodology employing a high-fidelity simulator is employed to detect potential configuration defects in unmanned systems. This simulator dynamically generates and modifies driving scenarios as well as configuration options, incorporating real-world traffic regulations to improve simulation realism and applicability. Experimental results reveal the identification of five configurations and scenarios that may induce system anomalies, demonstrating the effectiveness of the approach in enhancing the safety and reliability of unmanned systems.
Attribute-Based Encryption (ABE) enables fine-grained data access control by tying decryption rights to user attributes, but traditional ABE schemes face two critical challenges: (1) vulnerability to quantum attacks and (2) inflexible policy enforcement. We introduce a verifiable Quantum Attribute-Based Encryption (ABE) system that cryptographically binds policy evaluation to post-quantum primitives. Unlike classical ABE, our construction enforces (1) tamper-evident quantum states through Boneh-Lynn-Shacham (BLS) signatures and (2) policy integrity via Dilithium-certified circuit configurations. This dual-layer approach prevents Quantum State Tampering and Policy Bypass (QSTAPB) attacks while supporting adaptive access control through time-aware attribute encoding. We formalize the security of our hybrid quantum-classical construction under the Module Learning with Errors (Module-LWE) hardness assumption, achieving 128-bit quantum security against both polynomial-time quantum adversaries (Shor-capable) and classical runtime attackers. This work bridges the gap between quantum-enhanced access control and NIST-approved post-quantum security.
The primary objective of DNS over HTTPS (DoH) is to improve users’ privacy and security by encrypting DNS traffic. However, its implementation also allows malicious actors to evade security measures that depend on analyzing unencrypted DNS data. Hence, in certain network environments, it becomes necessary to identify and block malicious DoH traffic to maintain security standards. While various detection methods have been proposed, they often rely on specialized flow monitoring tools capable of exporting complex features that are resource-intensive and hard to compute in real time. These limitations make it challenging to widely adopt them in real network environments. To address this gap, this study introduces a machine learning-based malicious DoH traffic detection and categorization mechanism, utilizing standard flow features. The proposed approach ensures compatibility with standard flow monitoring tools implementing protocols such as NetFlow, sFlow, and IPFIX, making it easier to deploy in diverse network infrastructures. The evaluation results confirm that the proposed system achieves a high classification accuracy of 98.9
Deploying 5G networks requires dynamic, scalable, and reliable infrastructures. As communication service providers work with Hyperscale Cloud Providers (HCPs), trust challenges arise due to the multi-stakeholder nature of 5G ecosystems. Choosing an HCP with the highest level of trustworthiness is essential for secure and resilient 5G deployment. Traditional probabilistic approaches struggle to accurately quantify trust, whereas fuzzy logic offers a nuanced evaluation of trust metrics. This paper proposes an Adaptive Layered Trustworthiness Assessment Model (ALTAM) for 5G services deployment, based on a hybrid fuzzy logic system (FLS) and an Adaptive Neuro-Fuzzy Inference System (ANFIS) learning layer. The proposed ALTAM is implemented across all its modules and then tested on three HCPs across twelve experimental scenarios. The performance evaluation and validation based on ALTAM confirm its reliability, effectiveness, scalability, and responsiveness to dynamic environments.
With the advent of quantum computing, blockchain systems based on elliptic curve cryptography and hash functions face serious security threats from Shor’s and Grover’s algorithms. To address this, we propose a quantum-resistant blockchain transaction model using the post-quantum signature scheme CRYSTALS-DILITHIUM. The traditional elliptic curve digital signature in the UTXO model is replaced with DILITHIUM, and a simulated blockchain system is built to evaluate performance. Experimental results are analyzed to compare efficiency and scalability. Given the large size of post-quantum signatures and public keys, a scaling solution is introduced by separating transaction and verification data, storing the latter in extended blocks to enhance transaction throughput. To address wallet security in the event of secret key loss, a multi-wallet mechanism is also designed to maintain security under quantum attacks. The overall solution is tested in a simulation environment to verify its practicality and performance under post-quantum conditions.
Vehicular ad-hoc networks (VANETs) hold great potential for improving traffic safety and efficiency. However, their development is impeded by issues related to information authenticity, integrity, and user privacy. Existing certificateless aggregate signature (CLAS) schemes aim to overcome the limitations of conventional Certificate Authorities and Private Key Generators. Yet these schemes still exhibit high computational costs, low efficiency, susceptibility to selective attacks, and an inability to trace illegal signatures. To address these challenges, we propose a new traceable privacy-preserving authentication scheme. It builds on an optimized lightweight SM2 signature mechanism and employs a two-tier verification architecture. This design reduces verification complexity to a constant level O(1) through random coefficient-based stratified signature aggregation, thereby effectively resisting selective attacks. For traceability, the scheme incorporates rapid node localization paired with binary recursive message set verification. This minimizes the complexity of error signature positioning to O(logN) and supports dynamic vehicle management. Security analysis shows that the scheme satisfies fundamental security requirements for VANETs. It outperforms existing state-of-the-art methods in both authentication and tracing efficiency, providing robust security and privacy for intelligent transportation systems.
