Return-oriented programming (ROP) remains one of the key classes of code-reuse attacks; however, the mere presence of individual gadgets in an executable module does not by itself allow one to conclude that a practically meaningful chain can be constructed. This gives rise to the problem of formally determining whether a target operation can be achieved in a specific Windows PE module under constraints on chain length and search scope. The aim of this study is to develop a static method and a software prototype for determining whether an ROP chain can be constructed based on a user-defined specification of target operations in Portable Executable (PE) modules for x86/x64 architectures. The methods used include static extraction of gadgets ending in the RET instruction and its admissible equivalents, construction of a semantic description of each gadget’s effect on registers, the stack, and memory, and reduction of the chain search problem to a program synthesis problem within a gadget virtual machine model, where gadgets are treated as instructions. The search procedure is performed by matching preconditions and postconditions, pruning invalid branches, and subsequently validating the discovered chains by means of emulation. The results of the study are as follows: a specification-oriented formulation of the static ROP-chain construction problem for Windows PE modules under explicit architectural and search constraints is proposed; a method is developed that provides two mutually exclusive outcomes of analysis, namely, the construction of a chain satisfying the given specification or a formally recorded proof of target infeasibility within the selected model and constraints; and a prototype is implemented that produces a reproducible description of a discovered chain, including gadget addresses, instruction sequences, input requirements, and the expected final state. Experimental evaluation on test examples and Windows system libraries confirms the practical applicability of the proposed approach for preliminary assessment of the possibility of constructing ROP chains in the analyzed module and for supporting decisions related to the use of control-flow protection mechanisms.
One of the factors determining the reliability of information systems is the accuracy of data processing results. The paper addresses the design challenges of spectrum limiters incorporated at the input and output of discrete-analog switched-capacitor filters (SCFs), which are essential for reducing aliasing errors and improving the reliability of analog information processing systems based on them. Possible frequency tuning options for the amplitude-frequency response of SCFs are demonstrated – by adjusting component parameters, pulse-width modulation of control pulses, and the switching frequency of electronic switches. A design methodology is proposed for analog anti‑aliasing filters that provide specified attenuation of additional spurious spectral components at the SCF output. MicroCap simulations indicate that a high-order Chebyshev low-pass filter (LPF) should be selected as the anti‑aliasing filter to achieve the required suppression of spurious passband frequencies. Experimental studies of a prototype of one of the developed SCFs using the Russian electronic components have shown a high degree of correlation between the measured SCF characteristics and the computer simulation results for the same characteristics.
Corporate information systems are currently facing a growing number of cyber threats, requiring a rethinking of traditional approaches to information security. Classical methods based on signature analysis are becoming less effective against modern targeted attacks, as the methods and techniques of network intrusions are constantly being changed and upgraded by attackers. In response to these challenges, information security practices are increasingly using an approach that first formulates hypotheses and then conducts a targeted search for hidden threats and signs of compromise in a company's infrastructure – in other words, Threat Hunting. The purpose of this article is to develop and apply a hypothesis-driven approach to proactive cyber threat hunting. This approach involves generating, testing, and automating hypotheses about possible attack vectors. During the research, existing methods and tools for proactive threat hunting in corporate infrastructure, as well as approaches to hypothesis generation and testing, were examined. As a result, a number of hypotheses were formulated, implemented, and tested to detect current threats, including cleartext password storage, cryptocurrency mining, and suspicious network activity. To automate the threat hunting process, correlation rules for the SIEM system were developed and integrated into a browser extension. This extension enhances the convenience and efficiency of analysts' work when reviewing security logs. After familiarizing themselves with the functionality and testing the tool in real-world conditions, users noted the convenience and ease of use of the correlation rules, as well as the high speed of obtaining analysis results.
This paper discusses the creation of an experimental installation for testing the information security of special-purpose wireless communication systems. Traditional testing methods based on the use of generators with fixed parameters do not allow fully simulating a dynamically changing electromagnetic environment and adapt to the characteristics of a particular piece of equipment. A distinctive feature of the proposed complex is the integration of a software-defined radio based on the HackRF One platform, a multiband signal blocker, a set of specialized antennas (including horn-lens antennas), as well as an intelligent control system based on a neural network. For an objective assessment of the degree of impact, measuring devices have been introduced into the installation: a spectrum analyzer and a packet network tester, which makes it possible to estimate the bit error rate (BER). The architecture of the experimental installation is proposed, built on a modular principle and including a hardware module for generating impacts, an antenna-feeder module, a measuring module, a software control module, and an intelligent module (a knowledge base and a neural network module for selecting parameters). A mathematical description of the process of selecting the exposure parameters has been developed, including an objective function for testing effectiveness, a neural network approximation of the unknown relationship between the exposure parameters and the result, as well as an expression relating the signal-to-noise ratio at the receiver input to the transmitter power, antenna gain coefficients, and propagation conditions. An algorithm for conducting an experiment is presented using the example of an impact on an unmanned aircraft system, which features adaptive adjustment of interference parameters in real time.
This paper addresses the problem of improving the resilience of software modules to code-reuse attacks, primarily Return-Oriented Programming (ROP) and Jump-Oriented Programming (JOP). Unlike classical code injection, such attacks assemble a malicious execution sequence from fragments of machine code that are already present in the program. Therefore, they remain feasible even when data execution is prohibited and address space randomization is partially enabled. We propose the Morpheus-X architecture, which extends the moving target defense (MTD) paradigm by means of periodic state reconfiguration. The architecture includes the following components: (1) code multiversioning and a Code Version Manager (CVM); (2) context-dependent encryption of code pointers and metadata; (3) execution of code from encrypted memory in execute-only mode; (4) a control-flow binding mechanism, in which correct decryption depends on the preceding control-flow point; and (5) a detector of ROP and JOP patterns used to trigger accelerated state reconfiguration. It is shown that this combination of mechanisms reduces the period during which previously identified gadgets and addresses remain usable for an attack, thereby complicating the construction of long ROP and JOP chains. The paper also presents the threat model, the limitations of the proposed approach, and a methodology for evaluating its overhead and compatibility.
Random number generation in cryptographic systems is one of the most critical components of information security. Statistical test suites are widely used to evaluate the quality of random sequences. Monte Carlo methods, a standard tool for statistical modeling, traditionally rely on the assumption of input randomness; however, they have not yet been adapted into a dedicated test suite for assessing random sequences. The core hypothesis of this study posits that Monte Carlo methods can be effectively employed to evaluate whether numerical sequences satisfy randomness properties. A set of classical algorithms, including Buffon’s needle, elementary Monte Carlo integration, Markov chains, and others, forms the basis of a newly developed suite comprising 18 statistical tests. The fundamental concepts and principles of conducting statistical testing using Monte Carlo approaches are established. Test suites requirements and architecture are defined, detailing component structure, functional responsibilities, and the operational workflow – from configuration and initialization to result reporting. A flexible JSON-based configuration system is proposed. The software implementation is written in C++ and organized as a static library containing core test classes and auxiliary utilities. Additionally, mechanisms were developed to simplify package configuration using pre-labeled sequence datasets. The proposed Monte Carlo test suite was evaluated on several sample sequences, and the results were benchmarked against established frameworks (NIST STS, Dieharder, and TestU01).
The purpose of this paper is to analyze cryptographic properties of the XTS (XEX-based Tweaked codebook with ciphertext Stealing) block cipher mode of operation. This mode is widely used across the existing software for full disk encryption, i.e. the software that encrypts the whole data on a storage device. In this paper, we show that widely applied provable security model (Tweakable Strong Pseudo-Random Permutation) is not suitable for security analysis of block cipher modes of operation for block-oriented storage devices protection. We provide a strict proof of the XTS mode insecurity in provable security model , proposed earlier by the authors. The model addresses full disk encryption peculiarities such that every sector consists of several number of blocks, all sectors have the same length, etc. We construct an attacker in this model with advantage being close to 1. We demonstrate how the XTS mode’s design features could be used for recovery of the mode’s secret parameters by generalizing a known collision attack. Further, we propose a new attack aimed to form a predictable plaintext with some information about previous plaintexts stored on the disk in hand. In generalized version of the mentioned above collision attack, we perform collision search in an arbitrary subset of blocks in sector rather than just two a-priory chosen ones. For this attack the probability of at least one collision occurrence is obtained depending on the amount of the data processed. We provide a new combinatorial proof and recurrent form for a formula which expresses the number of ways to select sets consisting of elements each drawn from an -sized set such that there is at least one element that appears in two or more sets.
This paper considers the problem of formalizing a recomposition-based information security system using group theory. The goal of the study is to construct a mathematical model capable of ensuring continuous information security. This model supports structured switch control and generates switching routes whose determination is equivalent to solving the computationally difficult discrete logarithm problem. The set of state switches is represented as a group isomorphic to the Cartesian product of finite cyclic groups. Switches between states are interpreted as shift operators forming a finite Abelian group. To address the drawback of classical recomposition ‒ temporary "vulnerability windows" ‒ generalized states are introduced in which one configuration remains active while the second is formed in parallel. This leads to an expansion of the state set and the introduction of an invariant ensuring continuous security. The paper rigorously substantiates the group structure of the switching set. Several behavioral patterns ‒ full, partial, and minimal recomposition ‒ are proposed as disjoint subsets of the group, enabling the implementation of adaptive control strategies depending on the threat level. It is shown that sequences generated by powers of a fixed operator form cyclic subgroups. The developed model, in particular, can be applied to the design of dynamic security architectures in virtualized and cloud infrastructures, where support for parallel configurations is implemented through snapshots or containers.
This paper considers the secure computing mode of the Elbrus platform as a hardware-supported tool for software certification diagnostics. The relevance of the study is determined by the high prevalence of vulnerabilities associated with memory access errors and by the limited completeness of their detection by conventional analysis and testing tools. It is shown that the use of the secure computing mode makes it possible to transfer some memory-related defects from the domain of undefined behavior to the domain of reproducible and hardware-controlled execution violations. This increases the diagnostic certainty of verification results and expands the capabilities of the testing framework when analyzing programs written in C and C++. The paper examines the architectural features of the secure computing mode, which are based on descriptor-based representation of address information and tag-based data control. Program execution in the secure computing mode is interpreted as a source of typed violation events suitable for use in software certification diagnostics. A methodology is substantiated for incorporating the secure computing mode into the secure development and certification testing framework as a specialized stage of dynamic analysis. Practical examples show that this approach enables more reliable detection of certain classes of memory errors, including the use of uninitialized data, out-of-bounds object access, and use-after-free. It is concluded that the secure computing mode is advisable as a hardware supplement strengthening existing software security assurance methods.
A stochastic transformation is an unpredictable transformation of information. It is used, for example, in implementing a feedback function or an output function of a pseudorandom number generators intended for solving information security problems. This paper considers an XSL transformation that involves multiple rounds. A round consists of an XOR operation with a round key, a substitution, and linear MixState operation. Each substitution transformation in each substitution block is itself a multi-round XSL transformation nested within the main stochastic XSL transformation. The proposed transformation uses the heuristic «Matryoshka principle», which complicates the transformation and makes it irreversible. This solution corresponds to one of the laws of technical systems development known as «transition to the microlevel».
Factorization of large numbers remains an important field of research in cryptography. As algorithms and computing power develop, key sizes and cryptographic methods must constantly adapt to ensure reliable information protection. Dozens of different factorization methods are known, all of them have great computational complexity for large values of the modulus N. As a rule; the best methods have great mathematical complexity. Currently, the number field sieve method is considered to be the best sub-exponential algorithm for factorization of semiprime numbers. The task of building a more effective, polynomial solvable factorization algorithm remains relevant. In this work, the methodology of dynamic system (DS) is used to build the algorithm, which allows solving the problem step by step in a certain sequence. An algorithm using an integer programming device has been developed to create a polynomial algorithm for factoring large semiprime numbers. This paper justifies the possibility of creating such a system based on a polynomial algorithm for obtaining invariant systems of initial polynomials. Theoretical studies are confirmed by experimental calculations for various types of input data.
The article is dedicated to improving the reliability of detecting high-quality synthetic images in the context of post-processing. The goal of the work is to develop an informative for inter-pixel smoothing parameter and integrate it into the deep architecture of a deepfake detector. The methodology for applying this parameter includes formalizing the local inter-pixel smoothing index and its multi-level version – the inter-pixel smoothing index map – as the ratio of high- and low-frequency component energies computed within sliding windows. The inter-pixel smoothing index map is fed into the second branch of the model and used to generate attention masks in the RGB branch (ConvNeXt-Tiny) with cross-modal feature fusion and a combined loss function with a "smoothness consistency" regularizer. Experimental evaluation on real and synthetic image datasets, subjected to typical transformations, demonstrated the high effectiveness of the proposed parameter: AUC 96.1% and EER 10.5% in the intra-domain test, inter-domain AUC 89.6%, Robust-AUC (JPEG-20) 87.4%; the improvement over the local-artifact- oriented baseline was 3.3 percentage points, and adding the inter-pixel smoothing index channel to the RGB yielded a +5.8-percentage point AUC increase. The data source consisted of open datasets with the distribution of persons and scenes between training and testing. The index is computed linearly in the number of pixels and can be implemented in real-time on a CPU. Application areas include content moderation, KYC/identity verification, forensics, fact-checking, and SOC/SIEM scenarios. Conclusions: the proposed parameter and dual-branch architecture improve class separability, robustness to user post-processing, and transferability across generators while preserving interpretability of decisions.
Self-checking digital devices are capable of independently monitoring their own proper functioning. They utilize redundancy (structural or informational) to detect failures and malfunctions, thereby ensuring high reliability and accuracy of computations. The paper considers p-ary generators of sequences of length pN with with self-checking. Self-checking is based on predicting of the next value of the convolution modulo p of the states of the generator's registers. Unlike classical p-ary M-sequence generators, the proposed devices do not have a linear dependence between individual fragments of the output pseudo-random sequence. The paper provides examples of constructing ternary and quinary generators. Such generators are designed to implement stochastic methods of information security.
. Counterfeit production of integrated circuits (ICs) and electronic component bases (ECBs) directly violates the trustworthiness of the electronic equipment that incorporates them. Resilient and reliable approaches to countering counterfeit production of IC and ensuring security require random/pseudo-random sequences with unique characteristics. The synthesis and in-circuit implementation of a physically unclonable function (PUF) is a promising and in-demand approach to generating pseudo-random sequences unique to manufactured chips. The object of this study focuses on semiconductor PUFs. The problem is the increasing counterfeit production of ICs, which determines growing threats to the trustworthiness of electronic systems used including critical infrastructure. The subject of this study is methods for in-circuit synthesis of unique binary sequences for IC identification, original component manufacturer (OCM) authentication, hardware obfuscation, and other approaches to countering counterfeit production of IC. The scope of this work is to systematize hardware solutions for implementing semiconductor PUFs and provide methodological support for evaluating their effectiveness and selecting them for practical applications. A classification of physically unclonable functions and the requirements imposed on them are presented. Approaches to implement semiconductor PUFs and the sources of uniqueness of the generated responses to applied challenges are considered. Three groups of semiconductor PUFs are identified: delay-based, memory-based and reconfigurable, for which PUF circuit implementation options are presented. Metrics for quantitatively assessing the effectiveness of semiconductor PUFs are defined. An approach to the qualitative assessment of PUF structural solutions is proposed to reduce the initial set of possible circuit options for inclusion in the original design. In conclusion, it is noted that the formation and use of a library of PUF structural solutions within the framework of the automated design-for-trust (DfTr) flow contributes to the systematic counteraction of counterfeit production and ensuring the security of integrated circuits and the devices using them.
This paper systematizes and analyzes cryptographic methods and destructive data techniques used by malware, and to identify trends in their evolution. This study is relevant due to the growing number of incidents compromising data integrity and availability, and the increasing sophistication of attacks involving the combination of data transformation methods and data exfiltration. The research applies the PRISMA approach to conduct systematic review of sources published between 2010 and 2025 and classifies attacks using a four-component model comprising the attack object, impact method, implementation technique, and impact outcome. Metrics are introduced to quantitatively assess prevalence of partial and intermittent encryption techniques, hybrid key-management schemes, destructive impacts on metadata and boot structures, and combined scenarios aimed at amplifying damage. As a result, a classification of malicious data encryption and data corruption methods is proposed. The analysis shows a shift towards faster cryptographic algorithms and widespread adoption of intermittent encryption to increase stealth and accelerate attacks. The findings may serve as a basis for formulating requirements for detection methods and for architecture of protection solutions against ransomware and wiper malware.
