Several problems in distributed system security naturally map to graphs. The concept of centrality assesses the importance of nodes in a graph. It is used in various applications. Cooperative game theory has also been used to create nuanced and flexible notions of node centrality. However, the approach is often computationally complex to implement in classical settings. Our first contribution describes a quantum approach to approximating the importance of quantum nodes that support a target connection in a quantum network. We detail a method for quickly identifying high-importance nodes that adversaries can target. The approximation method relies on quantum subroutines for evaluating st-connectivity, approximating Shapley values, and finding the maximum of a list. We consider a malicious actor targeting a subset of nodes to disrupt the system functionality. Our method identifies the nodes that are most important in keeping nodes s and t connected. Once we have identified high-importance nodes, we require methods to identify when those nodes are compromised. Our second contribution describes how Quantum Support Vector Machine (QSVM) classifiers can be used to detect malicious behavior in quantum networks. In particular, we describe the detection of entanglement attacks in quantum repeaters. We show that our initial assessment approach can be complemented by QSVM classifiers to identify and alert when anomalous situations related to malicious manipulation of entanglement swapping occur. Finally, we explore the potential complexity benefits of our quantum approach compared with classical and probabilistic methods. We also release all the simulation code and artifacts associated to the work, to foster reproducibility and further research on the topic.
The Linux kernel network stack is a safety–critical subsystem that manages network communications, such as TCP/IP session handling and UDP datagram routing. However, effectively fuzzing the kernel network stack presents significant challenges: large portions of code are disabled by static configurations; generating network-specific inputs for both syscalls and packets is difficult; and testing the interplay between syscall execution and packet injection requires precise coordination. In this paper, we introduce Pacaller, a packet-syscall coordinated fuzzer designed for the kernel network stack. Pacaller first performs automated configuration analysis to enhance code reachability. Then, Pacaller extracts network resources from the kernel source code to generate network-specific syscall specifications and packet models. Finally, Pacaller coordinates syscall execution with packet injection to test their complex interactions within the network stack. We implemented and evaluated Pacaller on four recent versions of the Linux kernel, discovering 26 previously unknown bugs (16 confirmed, 10 fixed). Pacaller also achieved 13.3% to 22.3% higher network stack coverage than Syzkaller, SyzGen++, KernelGPT, Syz-TCP, and TRON. These results demonstrate that Pacaller significantly improves the effectiveness of fuzzing the kernel network stack.
Honeypots serve as powerful tools for protecting critical internal assets by deploying resources without real value as decoys to attract, capture, and analyze attacker behaviors, and have been widely applied in enterprise-level advanced network defense systems. However, as the cybersecurity landscape evolves, attackers are increasingly developing anti-honeypot techniques that can identify and bypass deception mechanisms, or even exploit honeypots as stepping stones to compromise other hosts, thus escalating overall network risks. Consequently, maintaining both strong deception capability and intrinsic security has become a key challenge in network defense. To address this issue, we propose an adaptive defense generation method for mimic honeypots based on Minimax-Q game theory, which effectively enhances both deception and security in honeypot defense systems. Specifically, building upon the multi-level adjudication mechanism, we design mimic honeypots composed of multiple business executors and further define the reward evaluation function of each executor to quantify its defensive effectiveness. Subsequently, an attack–defense game model for mimic honeypots is constructed, and the Minimax-Q reinforcement learning algorithm is employed to solve for the Bayesian Nash equilibrium, enabling the adaptive generation of optimal defense strategies. Furthermore, a dynamic scheduling mechanism is integrated to replace suspicious executors in real time, thereby preventing attackers from further compromising other hosts. Finally, experimental results show that compared with existing methods, the proposed mimic honeypot demonstrates significant advantages in both deception capability and intrinsic security, offering new insights for building more robust network defense systems.
As satellite missions increasingly adopt standardized protocols and software-defined infrastructure, protocol compliance alone cannot fully prevent operational misconfigurations and security flaws, motivating additional mechanisms to monitor and validate Consultative Committee for Space Data Systems (CCSDS) traffic at the onboard ingress boundary.This paper addresses the critical need for an onboard security audit system capable of inspecting CCSDS traffic for semantic inconsistencies and policy violations in real time, even within correctly encrypted links that may be compromised by administrative errors. To this end, we propose a satellite-onboard CCSDS-compliant firewall that observes TC/TM traffic at the OBC and automatically detects insecure configurations, nonstandard customizations, missing or improperly implemented protocol security, and anomalous traffic conditions, based on predefined risk scenarios derived from the CCSDS standards and operational recommendations.We implemented and evaluated our system on both a simulation-based environment and two flight-proven CubeSat hardware platforms. To ensure mission reliability, we applied architecture-specific optimizations to minimize performance overhead. Experimental results demonstrate the feasibility of integrating this onboard security-audit capability within the resource constraints of CubeSat platforms.
Industrial Control Systems (ICS) increasingly integrate both information technology (IT) networks and operational technology (OT) processes, creating complex cyber–physical environments exposed to a wide range of cyber threats. Deploying effective intrusion detection in such environments is challenging not only due to the diversity of attack surfaces across IT and OT layers, but also because ICS components typically run on resource-constrained embedded hardware with limited computational capacity. This paper extends our prior temporal-symbolic representation (Zamaïand Espes, 2025) along three axes: we replace the static position-weighted pooling with a mask-guided variable-window pooling mechanism that learns end-to-end the effective temporal horizon required for each observation; we extend the framework from IT network intrusion detection to OT anomaly detection under an unsupervised protocol on multivariate sensor time series; and we demonstrate that a single compact convolutional architecture combining these two components provides a unified intrusion detection framework operating effectively across both ICS layers. Experimental evaluation on CICIDS2017, SWaT, and WADI demonstrates competitive detection performance and a favorable trade-off between accuracy, model compactness, and embedded deployability, with model sizes below 170k parameters. ARM CPU-class deployment measurements, together with Raspberry Pi 4-class throughput estimates, confirm that all configurations sustain real-time inference well above operational constraints, supporting practical deployment on low-cost resource-constrained devices commonly used at the industrial edge.
