Smart grids enable advanced functions like power dispatching, real-time pricing, and electricity theft detection. However, these capabilities have also raised significant concerns about user privacy. Privacy-preserving data aggregation technology enables the collection and utilization of users’ power consumption data without compromising their privacy. However, existing multidimensional data aggregation approaches fail to ensure user privacy and provide query services for data consumers in different roles. To address these problems, a multidimensional data aggregation scheme with function query (MDA-FQ) is proposed to realize the value of the multidimensional consumption data while safeguarding user privacy. First, MDA-FQ employs inner-product functional encryption and the Chinese Remainder Theorem to securely encrypt users’ multidimensional power consumption data. Second, a role-based data access mechanism is introduced to enable data consumers with varying permissions to request different types of data from cloud service providers, thus maximizing the utility of multidimensional data under privacy constraints. Third, MDA-FQ incorporates differential privacy on multidimensional data to ensure that each data dimension is protected against differential attacks, thereby enhancing overall privacy protection. Security analyses indicate that MDA-FQ can effectively counter differential attacks and other privacy risks. Extensive experimental evaluations further demonstrate that MDA-FQ not only supports versatile queries on multidimensional data but also significantly reduces computation and communication overhead, making it both practical and scalable.
Physical-layer authentication (PLA) provides an important approach to achieve secure access by exploiting the inherent hardware characteristics of devices. Radio frequency (RF) fingerprinting-based PLA emerges as a cost-effective solution to counter identity spoofing threats. Although deep learning (DL) has been widely adopted for RF fingerprint extraction and device identification, existing methods typically require complex DL models with massive parameters to achieve high accuracy, making applying them to resource-constrained devices impractical. Furthermore, most approaches focus on closed-set recognition scenarios, failing to address practical environments containing unknown devices. To overcome these limitations, we propose LRF-KDTL, a novel lightweight DL-based RF fingerprint identification method leveraging knowledge distillation and transfer learning. Specifically, LRF-KDTL employs a teacher-student framework for feature distillation and subsequently retrains the student model through transfer learning, achieving precise device identification with significantly reduced complexity. Extensive experiments in open-set scenarios demonstrate that the proposed method reaches 90.21
Recently, Karmakar et al. designed a mutual authentication and key agreement mechanism for an unmanned aerial vehicle (UAV) and the ground station. They claimed that their mechanism is resilient against common security threats. However, our analysis reveals that their mechanism fails to resist eavesdropping attack and ephemeral secret leakage attack. Moreover, this mechanism further becomes vulnerable to the impersonation attack when the ephemeral secret is leaked. Specifically, an adversary can obtain the session key established in the current session in the event that an ephemeral secret is leaked. After identifying the root causes of these vulnerabilities, we propose targeted countermeasures to strengthen protocol security.
The paper presents the microeconomic theory of marginal utility altered according to the terms of cybersecurity investment in healthcare. As part of the paper, cooperation was initiated with a Czech hospital which unsuccessfully applied for a subsidy from the National Recovery Plan. Due to the rejection of the subsidy, but the still underdeveloped state of cybersecurity in the healthcare facility, the author was approached with a request for assistance in negotiating financial support with the hospital’s top management from its own resources. The paper alters the ROSI model of return on security investment in order to clearly show the impact of the proposed investments on each protected person, and especially their marginal financial burden on the entire facility. The presented alteration of the ROSI model is applicable across the healthcare sector and beyond, especially in the industries that face difficulties counting the exact cost of data loss.
With the rapid advancement of network technology, incidents of network attacks are increasingly frequent, and malware has become a commonly used tool in such attacks. Dynamic analysis plays a crucial role for security professionals in understanding and assessing malware, allowing for the capture of dynamic behaviors within a sandbox environment. However, determining the maliciousness of these behaviors often requires substantial expert knowledge, making the process both time-consuming and challenging. To address this, we propose an automated technique for determining sandbox analysis reports as malicious or benign. Our approach combines dynamic features extracted from sandbox reports with a large language model. By fine-tuning a model based on Llama3, we achieve accurate determination between malicious and benign samples, reaching a precision of 96.82
