Private transfers on public smart contract blockchains hide transaction values and private transfer links, but accountable privacy requires controlled auditability. Existing auditable zero-knowledge transfer systems make per-transaction audit information available to an authorized auditor, but their audit model may allow the auditor to inspect transactions beyond the flow connected to the authorized audit target. In such a model, granting audit capability for one investigation can expose unrelated transactions or allow tracing to continue farther than intended. In this paper, we propose token-guided flow tracing for auditable zero-knowledge smart contract transfers, enabling audit authorization to be scoped to a transaction flow and epoch range. The construction separates audit authorization from audit capability by introducing a tracing-token manager and an auditor. The auditor can open audit information only when it holds the auditor secret key, an epoch secret key for an authorized epoch, and a tracing token associated with the target transaction flow. Direction-specific tracing tokens confine tracing to the authorized direction, while epoch public keys and a binary key-derivation tree support compact authorization of audit intervals. We analyze security through ledger indistinguishability, transaction nonmalleability, balance, audit correctness, and restricted audit authorization. Restricted audit authorization is established in an honest authorization model that assumes the tracing-token manager and the auditor do not collude beyond explicit audit authorizations; under these assumptions, the auditor cannot open or trace transactions outside the authorized flow, direction, and epoch scope. Our implementation adds 16,349 transfer-circuit constraints, about 178,000 gas to each accepted transfer, and 448 bytes to the serialized transfer transaction, showing that scoped auditability can be added with moderate on-chain overhead.
Machine‐type communication (MTC) is a fundamental enabler of the Internet of Things (IoT) and emerging 5G/6G networks, supporting massive deployments of heterogeneous and resource‐constrained devices. However, large‐scale data collection, persistent connectivity, and limited device capabilities introduce critical privacy challenges that are not adequately addressed by conventional security mechanisms designed for human‐centric or homogeneous networks. This survey presents a comprehensive analysis of privacy threats and countermeasures in MTC networks. Using a domain‐based approach aligned with the ETSI M2M architecture, we examine privacy vulnerabilities and attacks across the device, network, and application domains. We further provide a structured classification of privacy‐preserving solutions, encompassing identity protection, data confidentiality, and behavioral obfuscation, and compare them in terms of effectiveness and deployment feasibility. Finally, we identify open challenges and research directions for scalable and lightweight privacy protection in massive MTC environments and propose a cybersecurity framework that integrates technical, regulatory, and operational considerations to support trustworthy MTC systems.
Modern data-driven collaborations, such as spanning healthcare analysis and advertising attribution, need to merge large identifier sets without revealing which records overlap. A private set union (PSU) protocol enables two parties, each holding a private set X and Y, to securely compute their union X∪Y without revealing any additional information. In this work, we revisit recent constructions of PSU protocol to understand it in modular fashion, which enables a better instantiation of such submodules. Furthermore, we further propose an optimization that reduces communication cost, which comes from a novel application permutation-based hashing (phasing). The proposed PSU protocol shows up to 6.9x speed up over high-speed network, and up to 43% reduction in communication costs than the original protocol due for n=212−220 sized set, which is the best performance over LAN network; up to 2.3x faster than the state-of-the-art PSU protocol. Based on this core primitive, we propose a database anonymization system called private-ID (PID). End-to-end evaluations show our PID inherits the PSU improvements, outperforming previous works over high-bandwidth links while remaining competitive on WAN network. Taken together, our results provide a drop-in, high-throughput building block for privacy-preserving data-driven collaborations.
Central bank digital currencies (CBDCs) are increasingly being explored as a means to enhance financial inclusion, reduce transaction costs and modernise payment systems. However, their design and implementation pose significant challenges, particularly in emerging economies such as Tanzania, where security risks, infrastructural constraints and interoperability issues persist in the digital financial services (DFS) ecosystem. This study proposes a context-aware, secure, two-tier, account-based retail CBDC framework for Tanzania, developed using the design science research (DSR) methodology. Furthermore, the proposed framework is structured around the access, service, asset and platform (ASAP) model and integrates the security-by-design principles, including zero-trust architecture, defence-in-depth and cryptographic agility. It further incorporates context-aware considerations, such as interoperability with existing mobile money systems, tiered know-your-customer mechanisms for financial inclusion, and support for connectivity and usability constraints. Moreover, the framework is demonstrated and evaluated using objective-based, security-oriented and contextual assessments. The evaluation indicated that the framework promises to provide a coherent and practical approach for the design of secure, interoperable and inclusive CBDC systems. This study contributes a prescriptive and contextually grounded CBDC design framework that offers both academic value and practical guidance for CBDC implementation in Tanzania and similar emerging economies.
SNOW-V is a member in the SNOW family of stream ciphers designed for the 5G mobile communication system. In order to have a high speed, both the linear feedback shift register (LFSR) and finite state machine (FSM) are updated to better align with vectorized implementations and the update function is based on the round function of AES. In this paper, we find the 512-bit LFSR can be approximately divided into four parts and each clock one 128-bit part updates the FSM, another 128-bit part masks the 128-bit keystream. Differences in different bytes of the LFSR have distinguishable propagations in the keystream, which all behaves not randomly. Under the assumption that the cipher can be reset several times with the same key and IV to permit the adversary to inject different one-byte faults in the higher 16 bytes of LFSR-B during the keystream-generating phase, the state of SNOW-V can be revealed. For the simplified version of SNOW-V that addition with carry is replaced by XOR, the 384-bit FSM state can be revealed from the faulty and fault-free keystreams of seven faults with evenly 223 computational complexity, and then the 512-bit LFSR state can be revealed with no more complexity. For the full version of SNOW-V, we can conduct another fault attack with 248 computational complexity and 64 faults on average.
The security of symmetric-key ciphers critically depends on the diffusion efficiency of their linear components. Iterative maximum distance separable (MDS) matrices, as fundamental elements of diffusion layer, play a pivotal role in constructing secure cryptographic systems. This study focuses on the construction of iterative MDS matrices based on the iterative MISTY structure. First, we present iterative MISTY structures with same round functions over F2m22n & times;n, along with the corresponding necessary conditions for constructing iterative MDS matrices. Then, we investigate the construction of 4th-order iterative MDS matrices over F2m44 & times; for m = 4, 5, 6, 8, and evaluate the implementation cost in terms of gate count for some instances. Second, we extend this paradigm to MISTY structures with distinct round functions, establishing corresponding necessary conditions and generating 4th-order iterative MDS matrices over F2m44 & times; for m = 3, 4. Based on which, we investigate 4th-order iterative MDS matrices over F2m44 & times; for m = 3, 4 and exhibit some instances selected from the resulting matrices.
Attribute-Based Access Control (ABAC) frameworks coordinate access requests based on subject, object, and environment attributes, as well as policy rules, and are widely used in corporate security systems. Recently, machine learning has been applied to ABAC to address policy-generation imbalances, misassigned privileges, and attribute leakages. However, existing MLBAC techniques do not consider the structural constraints and attribute interdependencies present in traditional ABAC systems. Moreover, these frameworks have not been extensively evaluated under black-box attack scenarios. To address these gaps, we propose extensions to MLBAC that integrate structural constraints, attribute dynamism, and attribute weighting into the MLBAC objective function. Additionally, we study the behavior of these extended MLBAC models under black-box adversarial attacks. We implemented the framework using five deep-learning models: RNN, LSTM, Deep Belief Network (DBN), TabTransformer, and DeepFM, on both synthetic and real-world datasets. Our findings show that the DBN model consistently achieves the best performance, while the black-box adversarial attacks reveal general vulnerabilities across MLBAC systems. These outcomes highlight the need for more robust defense mechanisms in future research. Accordingly, we propose several potential mitigation strategies against black-box attacks.
This research aims to enhance password security by designing, training and testing Cipher-Guard, a machine learning (ML) algorithm that incorporates complex features and techniques derived from proven feature engineering. The current model is inherently built on the equations of mathematical modelling concerning complexity metrics of passwords and contextualisation. This is in terms of password length (PL), entropy (E) and the character set diversity (CSD) of the passwords, as well as contextual embeddings such as user-specific password history (UPH) and temporal patterns (TPs). A simulation of the data matrix was created, containing 1000 records, which formed the basis of the model and a thorough exploratory data analysis (EDA). The proposed model demonstrates interpretability and credibility in distinguishing patterns related to password complexity metrics, yielding promising formative results in the specified evaluation metrics. PL, E and CSD were analysed thoroughly, and the importance of increasing password security was identified. Specific contextual embeddings were identified as UPH and TPs, which reflect the model’s ability to adapt to the particular user’s actions. Including adversarial training features also helped protect the model from potential manipulations through a proactive defence plan. Moreover, the enhancement of cryptographic principles, which include hashing and salting, also improved the dataset security, thereby increasing the standard practice within the industry. The metrics involved in the comparative assessment included receiver operating characteristic-area under the curve (ROC-AUC), learning curves, confusion matrix, precision matrix and precision-recall curves, among others. Cipher-Guard performed consistently well across these parameters, which has reinforced its authenticity in strengthening password protection. However, to appreciate such findings, certain constraints need to be well addressed, such as the quality of the chosen dataset, some ethical concerns raised in the study and the fact that new threats are constantly emerging. Recommendations for enhancing continuous dataset monitoring and establishing an ethical framework for the case are also suggested. The research directions broaden future possibilities for research while emphasising continuous model updating, individual-centred protection and compatibility with other emerging technologies. Therefore, Cipher-Guard represents a significant advancement in password protection and offers a promising prospect for flexible and personalised security in the modern era.
We have developed a corruption-correctable message authentication code (CCMAC) that enables data integrity to be verified and corruptions of data to be corrected up to a certain threshold. As in a previous technique for identifying corrupted points, called corruption detectable MAC (CDMAC), the proposed scheme utilizes a system model composed of two types of storage: general and secure. General storage is vulnerable, that is, data stored in it could be attacked by a malicious third party, whereas secure storage is not vulnerable. In this study, we present two methods of the proposed scheme, each of which has a trade-off relationship regarding the data size requirements between general and secure storage. We also define security notions for our methods and prove that they can be reduced to those of the MAC or CDMAC used as an internal component.
Contemporary distributed ledgers face an inherent trilemma when attempting to simultaneously optimize three critical properties: transaction throughput (measured in transactions per second [TPS]), network security, and node decentralization. Current decentralized storage platforms such as Filecoin encounter constraints in managing peak transaction loads effectively. We propose a novel storage architecture that integrates Arweave's permanent data layer with an enhanced proof-of-access (PoA) consensus protocol and adaptive block management. While control-theoretic methods are established, their novel integration with Arweave's permanent storage and PoA consensus creates a unique symbiotic relationship that directly tackles the blockchain trilemma. Through transaction metadata compression to 48-byte entries, our framework achieves a transaction density of 7200 entries per megabyte of block capacity. Under baseline conditions (1 MB blocks generated every 44 s), this yields 162 TPS, scaling to a simulated peak of 7200 TPS with 200 MB blocks under optimal network parameters. Experimental validation through simulation and a multiphase global testbed (25-112 nodes) demonstrates robust security characteristics with 0.82 chain quality under 40% adversarial presence, defense mechanisms against prevalent network attacks, and 99% reduction in annual storage growth compared to conventional blockchain systems, outperforming modern alternatives including Sui (5.3 & times; storage efficiency) and Avalanche (3.5 & times; storage efficiency). Game-theoretic proofs establish formal security guarantees, while extended adversarial modeling confirms resilience under worst-case conditions. To ensure reproducibility and foster further research, all simulation code and deployment tools for the testbed have been made publicly available on GitHub. These findings present a viable equilibrium between essential blockchain properties for practical implementations.
Since 1980, the arrival of the internet has made fabulous changes, and presently, the Internet of Things (IoT) is having the same track. IoT becomes more attractive due to its potential, but on the other hand, the IoT network is targeted to be demolished. IoT networks are always under the risk of denial of services (DoSs) attacks, which have shocking significance. Under this situation, the need for cybersecurity actions like intrusion detection systems (IDSs) are very much essential. The scope of this article is to propose an IDS for big data architecture. The IoT dataset (BoT-IoT) was used with libraries of Apache Spark, and experimental work was evaluated on the F1 measure. The dataset was divided into few parts; the partial part of dataset was examined by random forest for binary classification resulted in 98.6% F1 measure. Main categorical phase was resulted in 98.4% and subcategory classification resulted in 84.1% F1 measure. For overall classification of dataset decision tree resulted in 96.4 for binary classification, 78.6 for major category and 74% for categorical classification.
The growing use of blockchain and distributed systems requires Byzantine fault tolerant (BFT) protocols that remain secure under dynamic adversaries. However, existing BFT protocols often rely on static assumptions and lack clear mechanisms to detect and remove malicious or denial-of-service (DoS) nodes during execution. We present MBFT, a BFT framework that combines secure multi-party computation (MPC) with protocol-level node verification. MBFT integrates ElGamal threshold encryption with an SPDZ-style preprocessing phase and uses MAC-based checks to detect inconsistent behavior. It also adopts a hybrid timestamp oracle with off-chain aggregation and on-chain validation to support time-bounded decisions. We specify its trust assumptions and analyze its failure cases within the protocol. Our analysis shows that MBFT maintains safety and liveness under adaptive adversaries, including censorship, internal Byzantine faults, and DoS attacks. Experimental results show that, for a network with n = 32 nodes, MBFT achieves an average per-round latency of about 0.5 s on desktop platforms, which is comparable to Dumbo BFT under the same setting. The additional cost introduced by node verification remains small, contributing less than 5% of the total latency. In terms of communication, MBFT incurs approximately 27.2 kB total traffic per round, reducing communication overhead by about 50% compared to HoneyBadger BFT and remaining within 4%-6% of Dumbo BFT. These results indicate that MBFT preserves the efficiency of asynchronous BFT protocols while providing explicit support for node accountability.
Blockchain organizes information through a chain structure, and retrieving data from the blockchain requires traversing blocks. This makes traditional retrieval methods unsuitable for intensive query scenarios. To address the inefficiency of blockchain data retrieval, this paper proposes an efficient and secure retrieval method based on Merkle Patricia tries (MPTs). The method uses users’ public keys to construct a global latest state index tree, enabling quick access to the latest transaction information of a queried user as both sender and receiver. The hash of the latest state index tree is stored in the block header to ensure the verifiability and immutability of the index information. Additionally, the transaction structure in the block is reconstructed to include the hash and block height of the previous transaction for the same user. This allows simultaneous retrieval of the current and previous transaction information, improving retrieval speed. Experiments demonstrate that the proposed method significantly enhances retrieval efficiency within acceptable construction costs. Furthermore, the more transaction versions traced back, the greater the advantage of the method.
The subcategory classification problem subdivides a category into several finer categories after categorizing major categories. Sub-categories usually share highly similar features, such as in cat species classification and COVID-19 detection and classification based on chest X-ray (CXR) images. They are likely to be attacked as another subcategory at a low cost by adversarial attacks. It is a challenge for detection methods to distinguish the adversaries from the normal samples of the same subcategory. We propose multi-channel feature redistribution (MFR), a novel adversary detection mechanism based on the MFR, which disentangles the initial embedded features into three channels: (1) core feature—it guarantees the robustness and the precision of classification; (2) co-activation feature—it causes the prediction into the adjacent category; and (3) background noise—it introduces high-frequency perturbations that distort the feature distribution. We design a new optimization goal to extract the corresponding features in each channel. A binary meta-classifier is then built to further evaluate the balance among the three feature channels and detect adversarial samples. We combine the abstract visualization projection of the three channels as new inputs to train the meta-classifier. The experiments are conducted on eight datasets, and all the results show that MFR can effectively enhance the meta-classifier’s detection performance. We verify each channel’s utility by ablation analysis and test the transferability between classifiers. Furthermore, experimental results show that MFR can effectively detect adversarial samples in subcategory classification, even against secondary adversarial attacks.
In recent years, many symmetric encryption ciphers have been proposed for homomorphic encryption (HE) applications. Rasta and its variants Masta and Pasta have gradually become a self-contained series of HE-friendly stream ciphers. The feature of these ciphers is that a fresh affine layer is randomly generated for each encryption. Although Rasta explicitly stated that it does not consider related-key attacks in its specification and it is difficult to find exploitable good differential characteristics even if considered, Masta and Pasta do not mention related-key attacks. Therefore, in this paper, we aim to comprehensively study the impact of related-key attacks on the security of these ciphers and determine whether the round requirement for satisfying the security bound is effective even in the multi-client scenario. Based on the general key structure and specific key differential patterns, we propose two practical related-key attacks based on linearization attacks and one based on SAT solving method. These attacks successfully break Pasta’s both instances (2/2), Masta and Rasta’s most instances (9/16 and 5/9). Furthermore, we theoretically discuss the validity conditions of the trivial linearization attack and experimentally verify it.
Traditional security methods need to be improved as a result of security difficulties over time. Biometrics was introduced as a result of this. The sclera has been an area of extensive study recently as far as biometrics is concerned. This is because it is accurate; nevertheless, the application of this biometric feature has been limited by its segmentation. It is still necessary to improve segmentation accuracy even though several techniques have been published in the literature. This study recommends using a sclera detection tracing (SDT) approach in conjunction with the circular Hough transform. Additionally, a system based on the discrete wavelet transform (DWT) fusion of local binary-based features of the iris and sclera was proposed by the study. The fusion was passed to a Siamese network for classification. A comparison between the outcomes of the unimodal and bimodal systems was conducted. The result showed that the best performance of 98.5 was obtained for the fusion of the two biometrics. Likewise, the sclera result based on the sclera detection algorithm performed better than the segmentation that was done with the convolutional neural network (CNN).
The recent rise of artificial intelligence (AI) solutions has also had a significant impact on electoral processes. Most notably, deepfakes created by generative AI applications can (and have been) used to spread misinformation during the campaigns, but they can also be used for cyberattack automation, biased social media bots, etc. We instead present a positive use case for generative AI in manipulating video material required as proof of voting by potential coercers. For this, we have created a pipeline that takes a video of a voting ballot and replaces its critical content (in our case, the digits on the ballot). To achieve this, a YOLOv11 model is used to find the digits, a WavePaint image inpainting model is used to cover up the old digits and a separate image of the new digits is used to place them into the video. Additionally, we implemented the prototype application in the form of a web service and validated the outcome by asking the humans to distinguish fake ballot images and videos from the real ones. Our results show that humans can still recognise fake ballot videos relatively well, implying that requesting ballot videos is still an efficient attack against voter freedom in the case of paper voting. However, future developments in the generative AI techniques are likely to improve the situation significantly.
Phishing emails represent a critical cybersecurity challenge, exploiting human vulnerability to illicitly obtain sensitive personal and financial data. This study proposes a novel content-based filtering framework for phishing email detection, employing Global Vectors for Word Representation (GloVe) embeddings for semantic feature extraction and a stacked ensemble machine learning architecture for classification. Four publicly available datasets were systematically processed and amalgamated to ensure diversity and robustness in model training. The proposed hierarchical architecture integrates three distinct base learners, K-nearest neighbors (KNNs), light gradient boosting machine (LGBM), and extremely randomized trees (Extra Trees) classifier (ETC), with extreme gradient boosting (XGBoost) optimized as the meta-classifier. Comparative experimental analyses demonstrate that this ensemble model achieves superior performance relative to existing methodologies. Empirical evaluations reveal state-of-the-art metrics, including 99.84% accuracy, 99.87% precision, 99.74% recall, and a 99.81% F1-score, coupled with a minimal error rate of 0.16%. The results substantiate the framework’s efficacy in mitigating phishing threats, exhibiting statistically significant improvements in both discriminative capability and operational reliability compared to prior approaches. This advancement underscores the potential of stacked ensemble learning combined with semantic feature representation to address evolving cybersecurity vulnerabilities.
Anomaly detection in distributed environments poses significant challenges, particularly in balancing privacy, communication overhead, and detection accuracy. This paper presents FedAnomDetect, a novel federated learning (FL-based framework designed for anomaly detection across large-scale, distributed systems. FedAnomDetect incorporates advanced privacy-preserving techniques, such as differential privacy, to ensure data security during the model aggregation process, while introducing adversarial robustness mechanisms to defend against model poisoning and adversarial perturbations. The framework is further optimized to reduce communication overhead through model compression and clustered FL, ensuring scalability across networks with thousands of edge devices. Experimental results demonstrate that FedAnomDetect outperforms traditional anomaly detection approaches in terms of detection accuracy, false positive rate, and communication efficiency. Additionally, we present a detailed analysis of the framework’s resilience under adversarial conditions and provide quantitative results on latency and scalability in real-world deployments. These findings validate the feasibility of FedAnomDetect for anomaly detection in large-scale distributed networks while maintaining high privacy standards and minimizing computational costs.
The combination of chaos theory and cryptographic methodologies constitutes a pivotal aspect of the information security. Owing to certain attributes of images, like their large data capacity and significant redundancy, image encryption needs specialized techniques instead of conventional text encryption. This study presents an innovative hybrid image encryption scheme that integrates Henon map-based key generation and involves diffusion process to ensure security and efficiency of the system. The experimental findings indicate that the methodology provides strong confusion and diffusion, low correlation between adjacent pixels, high entropy values close to 8, and number of pixel change rate (NPCR) above 99%. The method ensures secure image transmission using the same secret keys and maintains computational efficiency, making it suitable for practical applications in secure communication and multimedia protection. Unlike conventional Henon map-based encryption schemes, this study fuses Henon map-based key generation with error correction code (ECC) and an organized diffusion mechanism, enhancing both cryptographic robustness and reliability against channel errors during transmission.
