Sign flags in High Efficiency Video Coding (HEVC) bitstreams provide a stable bitrate-neutral embedding channel because they are coded independently in context-adaptive binary arithmetic coding (CABAC) bypass mode. However, existing works typically treat each sign flag as a binary carrier with fixed one-bit capacity, ignoring the inherent heterogeneity of transform coefficients. This leads to inefficient carrier utilization, where reliable carriers are underexploited and sensitive carriers are overused. Furthermore, most compressed-domain steganographic methods lack mechanisms to mitigate practical channel disturbances such as packet loss, bit errors, and transcoding. To address these limitations, we propose a robust HEVC video steganography framework via mixed-base embedding of sign flags and forward error correction (FEC). By assigning heterogeneous logical bases to carriers according to their reliability, the proposed approach enables adaptive capacity allocation and improved embedding efficiency. A distortion-aware embedding strategy is also designed to minimize perceptual impact, and Reed-Solomon (RS) code is used to enhance resilience against channel impairments. Experimental results demonstrate that the proposed approach achieves negligible visual distortion (ΔPSNR: 0.002–0.006dB, SSIM > 0.991), without bitrate overhead. It achieves an embedding capacity of up to 14.8 Kbits/frame under low quantization parameter (QP) setting. In terms of security, it also exhibits strong resistance to steganalysis, with detection accuracy close to random guessing (50.6%–55.0%). Robustness evaluation shows that post-FEC bit error rates are reduced to 0.16%–0.20% under normal conditions and remain below 2% under severe distortions, while capacity retention exceeds 85% across all evaluated channel impairments. These results indicate that the proposed framework improves the robustness of bitrate-preserving HEVC steganography under controlled channel impairments.
The proliferation of federated learning has revolutionized decentralized machine learning, but its distributed nature introduces a critical vulnerability, such as privacy leakage and model poisoning attacks. While contemporary literature offers various countermeasures, the fundamental challenge remains: achieving robust mitigation of adversarial influence without compromising global model utility or incurring prohibitive computational overhead. In this article, a robust and adaptive aggregation framework is engineered to neutralize sophisticated poisoning vectors within highly heterogeneous, non-independent, and identically distributed environments. This approach improves the inherent trade-off between security and performance by integrating a trust-based mechanism with rigorous privacy safeguards. This framework enables collaborative model construction while shielding the global objective. Formal theoretical proofs measure the efficacy of the proposed methodology, and empirical evaluations validate it. Furthermore, a security analysis across multiple poisoning attacks ensures the framework’s resilience. Furthermore, it demonstrates a superior balance of robustness, privacy preservation, and operational efficiency compared to existing baselines. The experimental results present that the proposed works perform the best compared to the state-of-the-art methods.
Enforcing commitments under time-dependent constraints is a fundamental challenge in distributed and blockchain-based systems operating without centralized trust. Existing approaches often face a critical trade-off: they incur linear verification costs, rely on trusted parties, or fail to prevent strategic abort behavior by malicious committers. To address this problem, we propose a Verifiable Timed-Release Adaptor Signature (VTRAS) scheme. VTRAS integrates time-lock puzzles with Non-Interactive Zero-Knowledge (NIZK) proofs into the adaptor signature framework, enabling a witness to be cryptographically bound to a hard relation for a predetermined duration while supporting verifiable recovery. This design allows any committed puzzle to be efficiently verified as well-formed and correctly bound to a witness before acceptance, thereby preventing abort-based and invalid-puzzle attacks. As a concrete application, we construct a decentralized auction protocol that leverages VTRAS to enforce post-auction payments without trusted intermediaries. The protocol enables the seller to complete payment extraction after a time delay if the buyer defaults, ensuring fairness in asynchronous and adversarial settings. We formally analyze the correctness, soundness, and privacy of VTRAS, and evaluate its practical performance on the Ethereum Virtual Machine (EVM). Experimental results demonstrate that VTRAS achieves constant on-chain verification cost, reducing gas consumption by over 90% compared to threshold-based alternatives. These results establish VTRAS as an economically viable security primitive for time-critical decentralized applications.
Collaborative Machine Learning (CML) architectures, such as Federated Learning (FL), Split Learning (SL), and Knowledge Distillation (KD), mitigate direct data leakage but remain highly vulnerable to sophisticated adversarial attacks and privacy breaches. Current literature often fragments these vulnerabilities by architecture, lacking a generalized framework to assess underlying threat vectors. This paper introduces a novel, mechanism-driven taxonomy that unifies CML approaches based on their shared communication medium-categorized into Weight/Gradient Sharing, Model/Smashed-Data Sharing, and Knowledge Sharing-to systematically evaluate state-of-the-art security and privacy-preserving mechanisms. A Systematic Literature Review (SLR) was conducted in strict adherence to the PRISMA workflow. Following a highly transparent search and multi-stage screening process across leading academic databases, 160 primary studies were selected based on robust mathematical and methodological quality assessments. The empirical synthesis quantifies critical trade-offs between privacy guarantees and model utility (e.g., accuracy degradation vs. Differential Privacy budgets) and evaluates the computational overheads of cryptographic protocols, including Homomorphic Encryption and Secure Aggregation. The proposed taxonomy successfully maps specific adversarial threats directly to topological nodes, revealing critical vulnerabilities in current cut-layer and gradient-sharing mitigations under specific network constraints. By bridging theoretical cryptographic frameworks with practical implementation realities, this review provides a strategic roadmap for deploying secure, regulatory-compliant CML defenses in resource-constrained edge networks.
Federated Graph Neural Networks (FGNNs) have gained popularity in privacy preservation and demonstrated their effectiveness on graph-structured data. However, most existing FGNN-based methods rely on a centralized server to coordinate global parameter updates, which introduces risks of single-point failure and privacy leakage, while also limiting their applicability in highly sensitive or peer-to-peer scenarios. Furthermore, client data in real-world settings often exhibit significant non-independent and identically distributed (non-IID) characteristics, under which conventional federated learning frameworks typically suffer from slow convergence, significant performance fluctuations, and negative transfer when distribution discrepancies are large. To address these issues, this paper proposes DAP-FedGL, a decentralized adaptive federated graph learning framework for non-IID client data, with the goal of achieving efficient and personalized optimization in distributed environments without central coordination. Specifically, we construct a peer-to-peer decentralized federated learning framework that enables direct collaboration among clients without sharing raw graph data. We further design an Elliptic Curve Diffie–Hellman (ECDH)-based secure aggregation mechanism to securely exchange and correctly aggregate shared updates. In addition, an adaptive personalization strategy based on logits fusion is introduced to dynamically balance the utilization of shared knowledge and adaptation to local data distributions. For empirical validation, we take graph classification as an example and conduct experiments on multiple public benchmark datasets. The results show that DAP-FedGL achieves superior or more robust performance than conventional federated graph learning baselines, thereby verifying the effectiveness of the joint design of decentralized secure aggregation and adaptive personalization.
Anomaly detection in IoT faces challenging situations: IoT data is extremely heterogeneous and non-IID (not independently and identically distributed) in nature; there are limitations related to computation and energy in IoT edge nodes; and IoT networks still pose potential security risks like poisoning attacks. These problems pose a challenge to accuracy because they arise out of the nature of an IoT setting. Hence, there is a recent emphasis on creating frameworks that can address the above-mentioned challenges. This paper proposes a novel framework named H-FAR (Hierarchical Federated Anomaly Resilience) to achieve anomaly detection in a resource-optimized manner with the help of FL (Federated Learning) and HRL (Hierarchical Reinforcement Learning). The proposed framework includes a high-level HRL-based model to strategically choose clients and control their parameters. At the client-level model, AutoEncoder-Attention is employed to acquire abstract features. At the server level, there is a secure attention-based aggregation method to filter out attacks and aggregate the parameters of the client model. Performance assessment of the proposed framework is conducted on Raspberry Pi 4 boards with a simulation task with 100 clients and a DQN-based agent. Additionally, H-FAR is tested with three exemplary methods: Fed-ANIDS, Krum-VAE, and FL-SDAE. From the experimental results, it can be highlighted that H-FAR showed a considerable improvement of 7.6%, 8.1%, 8.6%, and 8.3% in Accuracy, Precision, Recall, and F1-score, respectively, over the current state-of-the-art methods. In summary, the proposed H-FAR framework is a comprehensible, intelligent, and optimum mechanism for implementing trustworthy and resilient anomaly detection systems in dynamic and heterogeneous IoT networks.
Secure generation of symmetric cryptographic keys remains a significant challenge for Internet of Things (IoT) environments, where resource-constrained devices require lightweight authentication and encryption mechanisms that do not rely on central key distribution. This paper presents a comprehensive security analysis and performance evaluation of an operational facial-biometry-based key-generation system that establishes symmetric keys directly between two IoT peers using facial-feature coordinates, thereby eliminating the need for any server-side key exchange. This paper evaluates a biometric-based session key agreement protocol that enables two IoT users to compute identical symmetric keys from facial coordinates independently. The system is validated through 2000 experimental trials, comprising 1000 tests on synthetic facial-coordinate pairs and 1000 tests on real facial images, collected to assess key stability, robustness, and usability under diverse conditions. The security evaluation covers three representative attack categories: brute-force attacks against the key space, presentation attacks targeting the biometric acquisition stage, and man-in-the-middle attacks against the peer-to-peer communication channel. The resulting keys achieve high entropy and practical resistance to automated cracking, with estimated attack times that are far beyond the feasible computational limits of current tools. The paper compares the analysed system with state-of-the-art biometric key generation approaches in terms of key size, processing effort on IoT devices, and the security guarantees achieved, highlighting the trade-offs between protection strength and computational cost. The results show that the evaluated solution offers strong security properties while eliminating server dependencies and identifying usability constraints related to liveness detection, capture conditions, and environmental variability. The study provides actionable guidance for IoT security solution designers on balancing security, usability, and implementation complexity in biometric symmetric-key generation systems.
In motion vector domain video steganography, modifying motion vectors can disrupt the local optimality of motion vector prediction, ultimately leading to the insecurity of stego videos. To address this issue, we first analyze the local optima of motion vector prediction and then propose a local optimality maintenance-based video steganography method (LOM) in the motion vector domain. In LOM, we propose a novel video steganography framework and design a cost calculation method for motion vector modifications. Within this framework, the local optimality of motion vector prediction can be preserved during information embedding. Furthermore, by considering the reference relationships between motion vectors for designing the cost calculation method, the calculated costs by the method can better reflect the distortion propagation caused by motion vector modification. Additionally, the horizontal and vertical components of the motion vectors are leveraged to construct two cover element sequences separately. Therefore, the maximum embedding capacity of stego videos is increased. We conduct experiments to evaluate and compare our proposed video steganography method. Experimental results have shown that our proposed method outperforms four state-of-the-art video steganography methods in terms of bit rate growth and security against steganalysis.
As the core communication network in Intelligent Connected Vehicles, the Controller Area Network (CAN) remains vulnerable to cyberattacks due to its plaintext transmission and broadcast mechanism. Despite significant progress in detection accuracy, emerging adversarial threats now target the detection model itself. By attacking or replacing it, adversaries can cause malicious messages to evade detection entirely. To address these challenges, we propose a Dynamic Wavelet Watermarking method to generate watermarked datasets. Models trained on such datasets not only achieve high accuracy in detecting abnormal CAN messages but also exhibit strong resilience against adversarial attacks. We further design a trend-season decomposition-based neural network that enhances anomaly detection and watermark recognition. DWW-IDS is tested on the CAR-HACKING and Can-train-and-test datasets, achieving average F1-scores of 99.99% and 99.82% respectively, outperforming other algorithms proposed in previous studies. Under adversarial example attacks, DWW-IDS achieves an average F1-score of 0.920 in the cross-model FGSM comparison and maintains Macro-F1 scores of 0.9535 and 0.9710 on the Fuzzy and Gear Spoofing subsets, respectively, under the strongest evaluated PGD-20 setting. Additionally, the proposed verification mechanism detects all evaluated black-box model-substitution attacks, achieving a model-substitution detection recall of 1.0000.
The rapid growth of multimedia communication and escalating cyber threats necessitate secure and adaptable image encryption schemes. This paper proposes a novel chaos-quantum hybrid key generation framework with a three key set switch architecture. Chaotic keys are derived from fractional order complex Lorenz system, while the quantum keys are obtained from quantum key distribution protocols such as BB84 and E91. These keys are independently processed and combined through a configurable mechanism, which enables the use of chaotic, quantum or hybrid keys based on the requirement. The generated keys are further hashed using SHA 512 for improving the Shannon entropy and validated through NIST statistical test suite. In addition, the proposed keys exhibit the highest key space to withstand quantum Grover’s attack. The robustness of the framework under practical conditions is analyzed by evaluating the Quantum Bit Error Rate (QBER) for different channel noise levels leading to automatic key rejection beyond a threshold. A nonlinear fractional observer based synchronisation mechanism is employed to ensure key alignment between transmitter and receiver. The generated keys are further integrated with AES-CBC algorithm for image encryption, achieving high information entropy (7.9994) and MSE (12850.7962) with hybrid keys. The proposed method shows the strongest resistance against the cryptanalytic attacks such as chosen plaintext and ciphertext attacks. The analysis of the quantum intercept-resend attack on the proposed method reveals an increase in QBER and reduced CHSH value thereby confirming the presence of an eavesdropper and discarding the keys. The runtime analysis validates the computational complexity and the learning based attack using neural networks exhibits the resistance with evaluation metrics such as MSE, PSNR and SSIM. The cryptanalytic performance metrics indicate that the proposed method offers strong confusion and diffusion properties thereby ensuring high security against statistical, differential and quantum attacks compared to the existing algorithms.
With the advent of the big data era, the speed of data generation in human society has been accelerating. Traditional storage methods have been gradually replaced by more convenient and efficient cloud storage technology. However, as users lose physical control over their outsourced data, data auditing for cloud storage has increasingly become a research focus. Unfortunately, traditional data auditing schemes still suffer from several limitations in terms of security and data deduplication. To address these issues, this paper proposes a backdoor-resistant certificateless multi-cloud data auditing and deduplication scheme based on blockchain, which introduces blockchain as a core evidence-preserving and automatic arbitration layer, leveraging its tamper-proof property to ensure transparency and traceability of the auditing process, and realizing fair settlement of storage fees via smart contracts. Specifically, the scheme leverages cryptographic reverse firewall technology and a threshold secret sharing algorithm to overcome the problem of single-point trust. Convergent encryption is adopted to achieve data deduplication. Meanwhile, users perform batch auditing and broadcast the results to the blockchain to improve auditing efficiency. Finally, security proof and performance analysis demonstrate that the proposed BR-CMDS scheme achieves high security and relatively low computational overhead, making it suitable for real-world deployment requirements.
Insider threats remain one of the most difficult problems in enterprise cybersecurity, as malicious behavior is often subtle, evolves over time, and rarely comes with reliable labels. Although modern organizations collect large volumes of behavioral telemetry, transforming such data into trustworthy and interpretable security alerts remains challenging. In this paper, we propose a fully unsupervised, explainable, and reproducible User and Entity Behavior Analytics (UEBA) framework for insider-threat anomaly screening.The proposed contribution is defined at the framework level rather than as a single fixed detector architecture. The framework models user activity at a per-user, per-day level and combines complementary unsupervised detectors with method-specific fusion or consensus-based alerting rules. To make heterogeneous detector outputs comparable across users and detector families, raw anomaly scores are aligned using percentile-based calibration over a reference score distribution. For analyst-facing interpretation, feature-level explanations are complemented with short behavior-oriented summaries describing the main factors behind a flagged user–day.The framework is evaluated through three experimental instantiations. Method 1 and Method 2 are evaluated on private anonymized enterprise activity logs without reliable insider-threat labels; their results are therefore interpreted as deployment-oriented anomaly-screening evidence rather than direct validation of detection accuracy. Method 3 applies the counts-only framework variant to the publicly available CERT R4.2 insider-threat benchmark, where ground-truth labels are used only for post-hoc evaluation. On CERT R4.2, the framework achieves strong benchmark performance, while on the private enterprise logs it produces concentrated, stable, and interpretable anomaly-screening outputs consistent with operational triage goals.
As key techniques for covert communication, image steganography and steganalysis have attracted extensive attention and achieved significant progress in recent years. Most existing steganalysis methods focus on the binary classification task of distinguishing cover images from stego images, primarily aiming to improve classification performance. Consequently, these methods rely on binary image-level supervision and mainly capture global statistical discrepancies between cover and stego images, rather than modeling the pixel-level embedding preferences of steganographic algorithms. Furthermore, existing steganalysis methods are generally evaluated under matched settings, with little attention paid to their generalization performance under algorithm-mismatch and payload-mismatch scenarios. To address these limitations, we propose SLNet (Steganographic Localization Network), a steganalysis framework that jointly performs image-level classification and pixel-level embedding localization for adaptive spatial-domain steganography. In SLNet, we propose a Dual-Receptive-Field Spatial Rich Model (SRM) Processing module, a Temperature-Squeeze-and-Excitation (T-SE) enhanced Residual Stem Block, Deepened Residual Feature Extraction modules, a Multi-Scale Atrous Convolution (MSAC) module, and attention-guided feature reconstruction modules. Different from existing approaches, SLNet is trained using direct supervision from steganographic embedding regions, enabling the model to explicitly learn the embedding patterns of steganographic algorithms and accurately localize embedding modifications. Experimental results demonstrate that SLNet achieves state-of-the-art steganalysis classification performance, exhibits strong generalization under algorithm-mismatch and payload-mismatch conditions, and enables effective localization of steganographic embedding regions.
Inner product encryption (IPE) is an advanced cryptographic primitive in which the ciphertext is tagged with an attribute vector, while the secret key is associated with a predicate vector. The decryption algorithm succeeds if the inner product between the corresponding predicate and the attribute vector vanishes. The predicate encryption (PE) is an emerging cryptographic primitive designed to provide flexibility in access control over encrypted data. It has been extensively adopted in cloud storage environments, where it enables users to retrieve authorized data while preserving confidentiality. Revocable predicate encryption extends the PE paradigm to support revocation. Immediate revocation in PE is another exciting property which removes the requirement of updating the secret key. This paper introduces a new primitive, namely public revocable predicate encryption for inner products using dual pairing vector space. The scheme achieves security in the standard model grounded in the decisional linear assumption. The security model guarantees that an adversary gains no information about the attribute or plaintext from ciphertext even after getting secret keys of unauthorized users. The scheme further enables a designated third party to remove users from encrypted content. This enhanced feature of PE broadens its applicability, including pay-per-view TV services and secure patient data-sharing in hospitals and other privacy-preserving access control applications.
Ensuring secure image transmission is increasingly vital in multimedia and cloud environments. This paper presents a novel reversible image encryption algorithm that integrates a three-dimensional chaotic system (3DCS), cellular automata (CA), a Feistel network, and dynamic S-boxes. The 3DCS, notable for its conditional switching and hybrid coupling, is rigorously analyzed for its strong cryptographic properties, including initial value sensitivity, topological transitivity, Lyapunov exponents, and bifurcation analysis. A 256-bit key seed is adaptively generated from the image and a timestamp via hybrid fingerprinting and cryptographic hashing (SHA-3-256 truncated to 64 bits). The image is processed by a dual-stage CA and then used to drive the 3DCS for keystream generation. Encryption employs a double-round Feistel structure with reversible CA rules and dynamic S-box substitution. Comprehensive experimental analyses, including key space, statistical tests, correlation, differential metrics (NPCR/UACI), information entropy, and resilience against various attacks, confirm the scheme’s superior security and computational efficiency over conventional chaos-based methods. The reversible design enables lossless decryption, making this approach highly suitable for secure multimedia transmission and privacy-preserving applications.
Federated Learning (FL) enables collaborative model training without sharing raw data. However, it remains vulnerable to gradient inversion attacks and unauthorized access to model updates. Homomorphic Encryption (HE) protects gradients during aggregation, but existing schemes have limitations. Single-key approaches provide limited access control, whereas multi-key schemes incur communication overhead that grows with the number of clients and require interactive decryption. This paper proposes CP-ABHE-FL, a federated learning framework based on Ciphertext-Policy Attribute-Based Homomorphic Encryption. The framework combines a Linear Secret Sharing Scheme (LSSS) with lattice-based additive homomorphism to support secure aggregation and fine-grained access control. Only users whose attributes satisfy the access policy can decrypt global model updates. Differential Privacy (DP) is incorporated by adding calibrated Gaussian noise before encryption. CP-ABHE-FL supports OR, AND, and THRESHOLD policies, enables non-interactive decryption, and achieves IND-CPA security under the Decisional Ring Learning With Errors (DRLWE) assumption. Experiments on EMNIST-Digits, QMNIST, and three MedMNIST datasets show that CP-ABHE-FL achieves accuracy comparable to plaintext federated averaging. LeNet-5 attains 99.48% accuracy without DP and 98.71% under (ε=5,δ=10−5) DP, and on the medical benchmarks ResNet-18 attains the highest accuracy on PathMNIST (85.61%) among five compared schemes. With 1, 000 clients, the broadcast cost remains fixed at 40 KB per round, reducing communication overhead by up to 140 × compared with multi-key baselines, and server-side aggregation completes in 19.4 ms. Client-side encryption also runs efficiently on ARM-class IoT hardware, demonstrating the practicality of CP-ABHE-FL for large-scale, resource-constrained, privacy-preserving FL.
