The popularity of drones, unmanned aerial vehicles (UAVs), and industrial-level cyber-physical systems has deepened external threats caused by network-based cyber-attacks. Such environments have a problem of dynamic traffic behavior, temporal dependencies, class imbalance and the existence of various type of attacks, such as denial of service, injection, replay attacks, scanning, and man in the middle attacks. This paper presents an effective and justifiable multi-class attack detection model in a heterogeneous environment that can be used as an intrusion detector. Three benchmark datasets, Drone IDS, UAVIDS-2025, and ICSCASD_MPLC were evaluated comprehensively with ensemble-based machine learning models (Random Forest, Extra trees, AdaBoost, XGBoost, and CatBoost) and those with deep learning architecture (ANN, CNN, RNN, LSTM, and ResNet). Within the framework of many preprocessing steps, the accuracy, macro-averaged precision, recall, F1-score, Matthews Correlation Coefficient, Cohen’s Kappa, log loss, and ROC-AUC were used to evaluate the models. According to experimental findings, Random Forest is more effective than other ensemble models, with macro F1-scores of 0.99964, 0.99844, and 0.99994 on Drone IDS, UAVIDS-2025, and ICSCASD_MPLC datasets, respectively, with nearly perfect ROC-AUC indicators. Compared to other deep learning methods, LSTM is best at learning patterns of attack over time, ANN is well-performing with minimal computing costs, and RNN is well-performing in generalizing on industrial traffic. The validity of statistical significance of results is tested with Friedman and Wilcoxon signed-rank tests with Holm correction, bootstrap confidence intervals, and McNemar test. Also, explainable tools of AI, including SHAP and LIME, provide both local and global explanations, which are both intuitive, as well as ablation testing demonstrates that a small set of flow-based and temporal features are capable of sustaining close-optimal performance. In general, the framework proposed provides real-time and safety–critical deployments with intrusion detection algorithms that are accurate, interpretable, and validated statistically.
Designing novel and effective distortion functions for spatial image steganography has become increasingly challenging. The controversial pixels prior (CPP) rule mitigates this by fusing existing distortion functions rather than constructing new ones, but it is limited to functions with comparable security performance. We propose G-CPP, a generalized fusion framework based on the grading of controversial pixels. G-CPP assigns embedding priorities according to pixel conflict levels, enabling more effective utilization of high-potential embedding locations. Furthermore, we introduce a customized scheduling strategy for the G-CPP and cost-spreading rules, tailored to the intrinsic properties of different distortion-function combinations, thereby enhancing statistical undetectability against both conventional and deep learning–based steganalyzers. G-CPP preserves the advantages of CPP while extending its applicability to functions with significantly divergent security levels. Experiments on multiple benchmark datasets show that G-CPP consistently outperforms the conventional CPP rule, achieving superior security performance across diverse function combinations.
Generative AI has made text-guided inpainting a powerful image editing tool, but at the same time a growing challenge for media forensics. Existing benchmarks, including our text-guided inpainting forgery (TGIF) dataset, show that image forgery localization (IFL) methods can localize manipulations in spliced images but struggle in fully regenerated (FR) images, while synthetic image detection (SID) methods can detect fully regenerated images but cannot perform localization. With new generative inpainting models emerging and the open problem of localization in FR images remaining, updated datasets and benchmarks are needed. We introduce TGIF2, an extended version of TGIF, that captures recent advances in text-guided inpainting and enables a deeper analysis of forensic robustness. TGIF2 augments the original dataset with edits generated by FLUX.1 models, as well as with random non-semantic masks. Using the TGIF2 dataset, we conduct a forensic evaluation spanning IFL and SID, including fine-tuning IFL methods on FR images and generative super-resolution attacks. Our experiments show that both IFL and SID methods degrade on FLUX.1 manipulations, highlighting limited generalization. Additionally, while fine-tuning improves localization on FR images, evaluation with random non-semantic masks reveals object bias. Furthermore, generative super-resolution significantly weakens forensic traces, demonstrating that common image enhancement operations can undermine current forensic pipelines. In summary, TGIF2 provides an updated dataset and benchmark, which enables new insights into the challenges posed by modern inpainting and AI-based image enhancements. TGIF2 is available at https://github.com/IDLabMedia/tgif-dataset.
This research explores the enhancement of cybersecurity systems by integrating emotion-based techniques with conventional brain-mapping measurements. By incorporating biosignals such as electroencephalography (EEG) and speech analysis, this approach allows for a more comprehensive evaluation of emotional and cognitive states, improving the reliability and robustness of lie detection. Despite the lack of external proof from such evaluations, the proposed system represents a significant advancement over conventional methods, offering deeper insights into user intentions and emotion levels. This paper presents a method for multimodal emotion detection using physiological and behavioral signals—such as EEG and speech expressions; however, several challenges arise in integrating these modalities effectively. These include the complexity of synchronizing multiple data sources, applying appropriate fusion techniques, and using advanced representation learning to extract meaningful emotional cues. Overcoming these issues is crucial to fully realizing the potential of this enhanced cybersecurity framework. The proposed model was evaluated using the newly introduced EAV and PME4 datasets, both well suited for multimodal emotion analysis owing to their synchronized EEG and speech expressions. The modality-specific weighted feature-fusing strategy was utilized to combine the features extracted from the DCCA network, and the fused features were then used to train the suggested ANN classifier. The proposed model achieved performances of 68.95
The ability of AI to generate highly realistic, fully synthetic images, particularly of human faces, is rapidly advancing, making it increasingly difficult to distinguish between real and artificially generated content. This growing realism highlights the urgent need for reliable methods to detect subtle inconsistencies introduced during the image generation process. A fundamental distinction between authentic and deepfake content lies in the absence, for the latter, of an acquisition process by a real camera. As a result, the intricate relationships among scene elements, such as lighting, reflectance, and spatial positioning, are not captured from the physical world but are artificially reconstructed. Motivated by this observation, we propose the use of local camera surface frames as a feature to encode such environment-specific attributes. Our experimental results demonstrate that this representation not only achieves high detection accuracy but also exhibits strong and robust generalisation capabilities across different GAN-based generative models.
This research examines the feasibility and effectiveness of detecting ransomware attacks in quasi real-time by leveraging AI-based monitoring of centralized file operations. As ransomware continues to evolve in speed and complexity, traditional endpoint protection mechanisms often fall short, especially in environments with limited client-side defense. The goal is to determine whether lightweight, server-side monitoring combined with machine learning can provide a quasi real-time and accurate detection mechanism without relying on client instrumentation. A virtualized SME (small- and medium-sized enterprise) infrastructure was developed, simulating realistic user behavior through automated file operations and randomly triggered attacks by ransomware samples (Ryuk, NotPetya, Lockbit, Teslacrypt, and WannaCry). A nanosecond-scale time-stamped logging mechanism was implemented using Fluentbit and InfluxDB to track file creation, renaming, and deletion events. Five classic and ensemble machine learning models (Random Forest, Decision Tree, SVM, AdaBoost, XGBoost) were trained and optimized using supervised learning on aggregated file operation sequences using one-second intervals. The comparative evaluation of the models showed that all five achieved reliable detection performance, but XGBoost outperformed the others with a sensitivity of 91.87
Privacy regulations and ethical concerns have encouraged the use of privacy-friendly synthetic data for the training of facial analysis systems. However, the automated generation of images depicting the same synthetic subject in different environmental scenarios remains challenging, as identity-related features may not be accurately preserved. This is a severe issue for the training of differential morphing attack detection (MAD) algorithms, where subtle differences in facial features can indicate morphing attacks. This work introduces IDSwapMAD as a new way for generating privacy-friendly training data for differential MAD methods. In detail, a generative adversarial network is employed to generate synthetic facial images of which the faces are swapped with pairs of real reference and probe images containing variations that mimic a border control scenario. In this way, style-related properties of the reference and probe images are retained, while identity-related features are replaced. It is shown that the proposed IDSwapMAD technique is an effective and privacy-friendly strategy for training differential MAD methods, whose detection performance is on par with a state-of-the-art MAD method trained on real data.
The growing use of Internet of Things (IoT) devices has increased the need for secure and reliable communication protocols, with MQTT being one of the most widely used. However, MQTT brokers are vulnerable to denial-of-service (DoS) attacks, which can disrupt data flow in IoT systems. This research compares three MQTT brokers, Mosquitto, HiveMQ, and EMQX, to evaluate their resilience against DoS attacks, specifically the MQTT publish flooding attack. Using a testing environment replicating real-world IoT scenarios, the brokers were subjected to simulated attacks, and their performance was measured based on five key metrics: latency, packet loss, throughput, CPU usage, and recovery time. The results show varying levels of resilience among the brokers. Mosquitto demonstrated quick recovery but suffered from high latency and moderate packet loss. HiveMQ maintained low latency but experienced high packet loss and failed to recover without manual intervention. EMQX balanced performance with the lowest packet loss and a reasonable recovery time, making it the most robust among the three. These findings provide insights into selecting suitable MQTT brokers for IoT deployments, emphasizing the importance of considering factors such as latency, message reliability, and recovery capability when dealing with potential DoS attacks.
We establish the randomized distributed function computation (RDFC) framework, in which a sender transmits just enough information for a receiver to generate a randomized function of the input data. Describing RDFC as a form of semantic communication, which can be essentially seen as a generalized remote-source-coding problem, we show that security and privacy constraints naturally fit this model, as they generally require a randomization step. Using strong coordination metrics, we ensure (local differential) privacy for every input sequence and prove that such guarantees can be met even when no common randomness is shared between the transmitter and receiver. This work provides lower bounds on Wyner’s common information (WCI), which is the communication cost when common randomness is absent, and proposes numerical techniques to evaluate the other corner point of the RDFC rate region for continuous-alphabet random variables with unlimited shared randomness. Experiments illustrate that a sufficient amount of common randomness can reduce the semantic communication rate by up to two orders of magnitude compared to the WCI point, while RDFC without any shared randomness still outperforms lossless transmission by a large margin. A finite blocklength analysis further confirms that the privacy parameter gap between the asymptotic and non-asymptotic RDFC methods closes exponentially fast with input length. Our results position RDFC as an energy-efficient semantic communication strategy for privacy-aware distributed computation systems.
Exponentially expanding domain name system (DNS) over HTTPS (DoH) has significantly increased privacy but has also quietly masked malicious activities, rendering traditional threat detection systems meaningless. Existing deep learning-powered systems are unable to detect fleeting micro-temporal abnormalities in encrypted streams, are too costly for real-time operation, and are still vulnerable to adversarial attacks. To overcome these complex issues, this work proposes a new architecture—Neuromorphic Quantum Adversarial Learning (NQAL)—a bio-inspired, zero-knowledge-supported detection mechanism combining spiking neural networks (SNNs), quantum noise injection (QNI), and federated swarm intelligence to immunize, rather than detect, DoH-based attacks. The method relies on a neuromorphic model employing Dynamic Spiking Graph Attention (DSGAT) and Spike-Timing-Dependent Plasticity (STDP) to encode encrypted traffic as dynamic spike trains to enable ultra-fast, energy-efficient inference on processors such as Intel Loihi and BrainChip Akida. Quantum adversarial noise, emulated through stochastic perturbations created from quantum random walks, is injected during training to build gradient-obfuscating robustness. A threat immunization engine powered by adversarial GANs and quantum perturbations to simulate zero-day anomalies for preconditioning the model. Zero-knowledge verification is guaranteed through zk-SNARKs for privacy-preserving confirmation of anomalies without decrypting packets. Empirical studies confirm that NQAL achieves 99.18 <1 ms latency, and 10x less energy consumption than GPU-based models, while also being robust to both classical and quantum adversarial attacks. Feasibility, novelty, and decentralization of the system amount to a paradigm shift from existing architectures—hence, making NQAL a resilient frontier in encrypted traffic immunization.
Advanced persistent threat (APT) attribution is a key defense strategy that can effectively safeguard the security of critical assets and systems. Cyber threat intelligence (CTI) contains rich information about APT groups that can be leveraged for attribution. However, most existing studies focus on a single feature from different perspectives, neglecting the multi-level mining and combined features of CTI, which limits the depth and accuracy of attribution analysis and may even lead to misleading conclusions. To overcome these limitations, we propose a multi-level feature Dempster–Shafer joint (MLDSJ) attribution method for APT groups based on threat intelligence. Specifically, we extract multi-level features such as attack patterns, textual information, and graph topology from CTI reports to construct feature vectors. Subsequently, we classify the three types of features separately using simple machine learning models. Finally, we introduce Dempster–Shafer (DS) evidence theory and apply the Dempster combination rule to integrate the three feature types and determine the final attribution. Experimental results show that our method outperforms the baseline in classification, achieving an accuracy of 89.9
Phishing involves manipulating individuals into revealing private data, e.g., user IDs, bank details, and passwords. The observed surge in fraud is related to increased deception, impersonation, and advanced online attacks. Thus, effective phishing detection methods are required to mitigate escalating global phishing threats. Existing methods (e.g., heuristics-based, signature-based, and visual similarity-based methods) attempt to detect phishing sites, and machine learning (ML) and deep learning (DL) methods are effective in the cybersecurity context in terms of learning from data, offering insights, and forecasting. However, independent ML algorithms are limited when handling complex data, and DL techniques surpass traditional ML methods in terms of performance but require more data and time. To tackle these challenges, we present EnLeM, an ensemble learning model designed specifically for phishing website detection. EnLeM brings together three well-known machine learning classifiers—decision tree, random forest, and k-nearest neighbor—using a hard voting mechanism, and further strengthens efficiency with Mutual Information–based feature selection. When tested on the UCI phishing dataset, EnLeM delivered strong results, reaching 97.21
Anonymization of graph data is fundamental to preserving users’ privacy while publishing social network datasets. The strongest privacy guarantees against any structural attacks provide three well-known methods: k-automorphism, k-isomorphism and k-symmetry. These methods have been proposed independently and are often considered distinct, although certain relationships between them have been noted. This paper presents a comprehensive theoretical analysis of the relationships between these methods. A refined definition of k-automorphism is introduced, formalizing conditions implicitly assumed in practical algorithms. Using this enhanced definition, it is formally proved that k-symmetry and k-automorphism are equivalent. Additionally, the relationship between these two methods and k-isomorphism is analyzed. A novel proof demonstrates that a k-automorphic graph necessarily contains k isomorphic subgraphs. The practical relevance of the provided theoretical results is shown by comparing existing anonymization algorithms. This work contributes to a deeper mathematical understanding of privacy guarantees in graph-structured data, supporting the design of anonymization methods in network security.
Speaker recognition is the task of identifying or verifying a person's identity using their voice. This problem involves challenges like variations in speech due to emotional states, health conditions, heterogeneity of microphone models, different environments and background noise. Accurate speaker recognition is critical for security, personalization, and forensic applications. Applying a CNN with Monte Carlo dropout can enhance Speaker Recognition by enabling robust uncertainty-aware predictions, making the presented architecture particularly effective for smaller, noisy datasets without the need for large-scale pre-training. This approach helps mitigate overfitting and improves generalization, making it effective in handling diverse speech patterns. The designed deep learning model showcases superior performance in multiple dimensions, achieving a peak validation accuracy of 93.27% for speaker recognition on a specific dataset recorded in the wild by phone, and 0.030 of EER, showing competitive performance with respect to state-of-the-art baselines.
Having a strong password is vital in maintaining secure access to private or sensitive data. However, strong passwords require good memorization skills, placing a significant burden on human memory and cognitive capacity. Using additional authentication measures, such as token-based access, reduces the need for overly complex passwords while maintaining a high level of security. However, using additional measures introduces additional user interaction during the log-in process. In this work, we propose a password hardening scheme that provides a location based authentication mechanism. We use the information contained within the local WiFi environment to strengthen a user’s password. With our method, the requirements on the user password remain at a reasonable level, while keeping extra user involvement to a minimum. We achieve this by generating a cryptographic key from WiFi beacon frames, which we combine with the user password using a key derivation function. Furthermore, we conduct an analysis to assess the stability of local WiFi environments to determine the practicality of our proposed password hardening scheme.
Advances in audio synthesis techniques have led to the creation of highly realistic audio deepfakes, posing growing threats to digital integrity and public trust. These synthetic manipulations mimic natural speech with high fidelity, making detection increasingly challenging and fueling the spread of misinformation, identity fraud, and voice-based attacks. To address these concerns, this study proposes the Adaptive Spectro-Temporal Diffusion Transformer (ASTDT), a novel detection framework that tackles key challenges in generalization, interpretability, and adaptability across diverse audio generation techniques. ASTDT integrates a score-based diffusion model to augment training spectrograms with realistic deepfake variations, improving generalization to unseen text-to-speech and voice conversion attacks. An adaptive spectro-temporal feature extraction mechanism partitions audio into interpretable frequency and temporal segments, while a dual-modal attention fusion module jointly processes magnitude and phase features. These fused features are processed by a transformer encoder with diffusion-aware attention, enabling effective modeling of long-range temporal dependencies. To enhance transparency, ASTDT includes an interpretability module that combines quantitative feature attributions and spatial heatmaps to explain model predictions. Experimental results across four benchmark datasets demonstrate the effectiveness of ASTDT, with the model achieving the lowest equal error rate of 1.20
In the Internet of Things (IoT) security, traditional access control methods are increasingly insufficient to address the complexities and scalability challenges posed by vast networks of interconnected devices. This paper introduces an advanced IoT system for access control that leverages blockchain methodology and a message queuing system to enhance security, clarity, and efficiency. The suggested framework integrates blockchain to provide a decentralized and unchangeable record keeper for access control transactions, ensuring that access rights and logs are absolute. In line with this, we employ a message queuing system to facilitate real-time communication and coordination among IoT gadgets, access control nodes, and users. This combination allows for secure, scalable, and efficient management of access requests and permissions across a dynamic IoT environment. This paper details the design of the system, the integration of blockchain, and message queuing components and evaluates the system’s performance through a sequence of modeling and real-world scenarios. The outcome shows significant improvements in security, transparency, and operational efficiency compared to conventional access control mechanisms. This innovative approach paves the way for more robust and reliable IoT access control solutions, addressing key challenges in modern IoT deployments like scalability.
This paper introduces a simple and efficient method for generating Goppa polynomials used in post-quantum cryptography based on any variant of the McEliece algorithm. The approach demonstrates that such polynomials can be constructed more rapidly by multiplying several low-degree polynomials that satisfy specific properties. It is also proven that employing these polynomials does not compromise the code’s error-correcting capability or overall security. The proposed method is especially advantageous when high-order Goppa polynomials are required. As a proof of concept, we present an application for user identification that combines cryptography and iris biometrics. In this system, encrypted versions of iris templates are securely stored. Using the homomorphic property of McEliece, recognition can be performed within the encrypted domain, ensuring that biometric data remains confidential throughout the entire process.
This research aims to develop a Network Detection System (NDS) utilizing various machine learning techniques to enhance network security through anomaly detection. It evaluates the effectiveness of K-nearest neighbors (KNN), gradient boosting, support vector machines (SVM), random forests, and logistic regression in identifying deviations from normal network behavior. Furthermore, ensemble learning methods, including voting and stacking techniques, are explored to improve detection accuracy. The study proposes and tests a hybrid multi-layered stacking model using the CICIDS 2017 dataset, which encompasses both historical and modern attack patterns, providing a comprehensive benchmark for evaluation. Model performance is assessed using metrics such as accuracy, precision, recall, and F1 score. Special emphasis is placed on feature importance and reduction in dimensionality to enhance model efficiency. Additionally, the study addresses the critical challenge of minimizing false positives and false negatives for practical deployment. Results indicate that the hybrid ensemble stacking model achieves superior performance, with an accuracy of 98.79%, significantly improving network anomaly detection. The research highlights the potential for further advances through deep learning and real-time detection methodologies to improve network security in the future.
Social network-based covert communication conceals the communication link between the sender and receiver, enabling one-to-many communication. Videos, due to their rich content and high embedding capacity, are ideal carriers for steganographic techniques. However, social networks typically apply lossy processing to uploaded videos, presenting significant challenges in constructing reliable covert communication channels. While prior research has proposed robust video steganographic methods, these approaches often rely on synchronization of robust regions to correctly extract hidden data. A major challenge arises when synchronization information is altered during lossy processing, complicating the accurate extraction of hidden data. To address this, a robust video steganographic framework is proposed. We then analyze the factors influencing the robustness of embedding units, including neighboring block differences, modulation types, and rate control modes. Based on this analysis, we introduce the Neighboring block Differences-based Cost Assignment (NDCA) method. Extensive experiments are conducted to demonstrate that the proposed framework and NDCA enhance robustness against lossy processing while maintaining high steganographic security. Furthermore, the robust video steganographic techniques based on the proposed framework and NDCA are broadly applicable to commonly used video encoders and rate control modes, enabling reliable covert communication on mainstream social networks.
