This work proposes a structural approach to concept drift detection in malware classification using decision tree rulesets. Classifiers are trained across temporal windows on the EMBER2024 dataset, and drift is quantified by comparing extracted rule representations using feature importance, prediction agreement, activation stability, and coverage metrics. These metrics are correlated with both accuracy degradation and data distribution shift as complementary drift indicators. The approach is evaluated across six malware families using fixed-interval and clustering-based windowing in family-vs-benign and family-vs-family settings, and compared against RIPPER and Transcendent baselines. Results show that fixed two-month windowing with feature-level Pearson correlation is the most reliable configuration, being the only one where all family pairs produce positive drift-accuracy correlations. The methods are complementary - no single approach dominates across all pairs.
Prose2Policy (P2P) is a LLM-based practical tool that translates natural-language access control policies (NLACPs) into executable Rego code (the policy language of Open Policy Agent, OPA). It provides a modular, end-to-end pipeline that performs policy detection, component extraction, schema validation, linting, compilation, automatic test generation and execution. Prose2Policy is designed to bridge the gap between human-readable access requirements and machine-enforceable policy-as-code (PaC) while emphasizing deployment reliability and auditability. We evaluated Prose2Policy on the ACRE dataset and demonstrated a 95.3% compile rate for accepted policies, with automated testing achieving a 82.2% positive-test pass rate and a 98.9% negative-test pass rate. These results indicate that Prose2Policy produces syntactically robust and behaviorally consistent Rego policies suitable for Zero Trust and compliance-driven environments.
The Automatic Identification System (AIS) is critical in maritime operations, military, law enforcement, and other fields. However, its security has been weak, particularly in terms of authentication. Despite efforts to improve AIS security, a standard has not yet been established. This paper assesses the current state of research and proposes an authentication scheme that uses certificateless cryptography compatible with standard AIS versions. Simulations and theoretical analysis demonstrate that this proposed scheme provides strong security guarantees and efficient performance, making it a promising candidate for authenticating AIS signals.
The research field of software protections—including code obfuscation and software tamperproofing—has introduced many new concepts and methodologies over the past three decades. However, while in other research fields (such as cryptography) the strength of new approaches can be accurately measured, evaluations in the field of software protections are often less methodologically sound due to several challenges. One major problem is the poor availability of samples. The majority of evaluations in the field of software protections is based on small, single-function toy programs or benchmarks borrowed from other domains and do not represent very well the variety of programs that are to be protected in practice. Furthermore, most measurements performed on these samples focus on evaluating the costs (i. e. negative effects on runtime performance) and not the strength of a protection. In this paper, we present OSAGE, a novel, open framework for creating and evaluating appropriate samples for software protections research. It combines a hand-crafted set of 141 programs including individual test cases as a foundation for sample generation, several different compilers and obfuscators, as well as a set of 16 static code analysis methods in a fully automated sample generation and analysis framework. OSAGE enables software protection researchers to easily conduct sound evaluations of their methodologies in regard to costs, protection strength, and stealth and helps compare the results with other protections. In a large-scale evaluation of the framework we demonstrate its practicality in software protections research as well as the reproducibility and comparability of research utilizing OSAGE.
The Internet of Things (IoT) is evolving rapidly in many sectors, including personal health, home automation, industrial controls, and smart city infrastructures, with the number of connected devices constantly increasing. However, this growth has also increased the vulnerability space for Distributed Denial of Service (DDoS) attacks, which are becoming more frequent and sophisticated, making it difficult to detect them using conventional methods. To address this issue, machine learning approaches, especially deep learning-based techniques, have emerged as powerful tools for detecting and mitigating DDoS attacks. This paper reviews the state-of-the-art deep learning techniques for detecting DDoS attacks in the IoT. We have analyzed the origin, evolution, and taxonomy of DDoS attacks, benchmark datasets, ongoing research challenges, and future research directions.
