Denial-of-Service (DoS) attacks remain one of the most dangerous threats in modern Internet environments. They aim to overwhelm networks, servers, or online services with massive volumes of traffic, and maintaining service availability is a core pillar of cybersecurity. More importantly, DoS attack techniques continue to evolve. However, traditional intrusion detection systems (IDS) trained on fixed attack categories struggle to identify previously unknown DoS attack types and cannot dynamically incorporate newly emerging classes. To address this challenge, this study proposes a stage-wise network intrusion detection framework that integrates unknown attack detection, attack discovery, and class-incremental learning into a unified pipeline. The framework consists of three stages. First, an autoencoder-based anomaly detection approach is used to separate potential unknown DoS attack samples from known classes. Second, a clustering-and-merging strategy is applied to the detected unknown DoS samples to discover emerging attack clusters with similar structural characteristics. Third, the classifier architecture is expanded for each newly discovered cluster through a class-incremental learning mechanism, enabling the continual incorporation of new attack classes while maintaining stable detection performance on previously learned classes. Experimental results on the DoS category of the NSL-KDD dataset demonstrate that the proposed stage-wise framework can effectively isolate samples of unknown DoS attacks, accurately aggregate emerging attack clusters, and incrementally integrate newly discovered attack classes without significantly degrading recognition performance on previously learned classes. These results confirm the capability of the proposed framework to handle progressively emerging unknown DoS attacks.

Effective supply chain traceability is indispensable for ensuring food safety, which is a significant social issue. Traditional traceability systems are mostly based on centralized databases, relying on a single entity or organization and facing problems such as insufficient transparency and the risk of data tampering. To address these issues, many studies have adopted blockchain technology, which offers advantages such as decentralization and immutability. However, challenges such as data credibility and insufficient protection of private data remain. This study proposes a multi-channel architecture based on Blockchain (Hyperledger Fabric in this study), in which data is partitioned and managed across dedicated channels to strengthen the protection of sensitive information. Furthermore, a trust and incentive design is implemented, featuring a trust-value calculation function and a reward–penalty mechanism that encourage participants to upload more truthful data and improve the reliability of data before it is recorded on the blockchain. In this paper, the design and implementation of the proposed system are explained in detail, and its performance is examined using Hyperledger Caliper, a blockchain performance benchmark framework. Functional evaluations indicate that the proposed system can be correctly implemented and that it correctly supports supply chain traceability, trust- and incentive-related, privacy protecting and other functions as designed, while performance evaluations indicate that it can maintain stable performance under higher workloads, suggesting that the proposed approach is practical and applicable to food supply chain traceability scenarios.

With the widespread application of federated learning (FL) in data security scenarios, striking a balance between communication efficiency, system robustness, and data privacy has become a key challenge. Existing FL frameworks typically rely on a central server, which introduces single points of failure and potential privacy risks. Although communication compression can improve convergence efficiency, its application in decentralized scenarios remains limited, and it lacks rigorous privacy protection mechanisms. This paper proposes a new decentralized federated learning algorithm framework, DeFL-VP, which integrates communication compression, client-side variance reduction, and differential privacy (DP) mechanisms within a graph-structured network. Specifically, we introduce local control variables into the underlying architecture of decentralized federated learning to reduce gradient variance among clients, while designing a differential privacy algorithm based on a random response mechanism to protect user privacy. Theoretically, we prove the convergence of the proposed algorithm under non-convex smoothness conditions and provide an upper bound on the impact of privacy noise on the convergence rate. Experimental results under a decentralized non-IID setting show that DeFL-VP achieves stable convergence performance, maintains model utility, and obtains a lower attack AUC under membership inference attacks compared with the baseline methods.

Ad hoc multi-hop communication enables flexible connectivity but introduces challenges in securely joining the network without direct access to infrastructure. In such environments, nodes may frequently lose connectivity to an access point (AP) due to mobility or environmental factors, requiring efficient mechanisms to re-establish secure participation without overloading intermediate nodes. Prior work addressed proxy assisted secure bootstrap using proxy nodes (PNs) and client puzzles to throttle request traffic. However, computational throttling is less suitable in modern environments due to increased processing capabilities and the resulting need for larger puzzle parameters to achieve comparable delays, leading to higher computational overhead and limited adaptability. This letter proposes an authorization-based relay admission scheme, in which an AP issues short-lived relay tokens to previously authenticated nodes to control PN-assisted forwarding during re-bootstrap attempts. A PN for wards a request only when a valid token is presented, while authentication and network admission remain AP-terminated. The proposed approach replaces computational throttling with authorization-based control, reducing unnecessary request propagation while preserving the original bootstrap architecture. Furthermore, the proposed scheme enables lightweight and policy-based control of relay usage without imposing additional computa tional burden on legitimate nodes.

In the rapidly evolving field of artificial intelligence, machine learning emerges as a key technology characterized by its vast potential and inherent risks. The stability and reliability of these models are important, as they are frequent targets of security threats. Adversarial attacks, first rigorously defined by Ian Goodfellow et al. in 2013, highlight a critical vulnerability: they can trick machine learning models into making incorrect predictions by applying nearly invisible perturbations to images. Although many studies have focused on constructing sophisticated defensive mechanisms to mitigate such attacks, they often overlook the substantial time and computational costs of training and maintaining these models. Ideally, a defense method should be able to generalize across various, even unseen, adversarial attacks with minimal overhead. Building on our previous work on image-to-image translation-based defenses, this study introduces an improved model that incorporates residual blocks to enhance generalizability. The proposed method requires training only a single model, effectively defends against diverse attack types, and is well-transferable between different target models. Experiments show that our model can restore the classification accuracy from near zero to an average of 72% while maintaining competitive performance compared to state-of-the-art methods.

A prominent countermeasure against side-channel attacks, the hiding countermeasure, typically involves shuffling operations using a permutation algorithm. This is especially crucial in the era of Post-Quantum Cryptography, where computational characteristics of lattice and code-based cryptography heighten the need for robust defenses. In this context, securely and efficiently generating permutations is critical for an algorithm’s overall security and performance. Among the various approaches, the Fisher-Yates shuffle is widely adopted due to its security and ease of implementation. However, it is limited by a complexity of \(\mathcal {O}(N)\) due to its sequential nature. In response, we propose a time-area trade-off swap algorithm, \(\mathsf {FSS}\), that leverages a Butterfly Network structure, achieving only log (N) depth, log (N) work, and \(\mathcal {O}(1)\) operation time in parallel. Our analysis calculates the maximum gain an attacker can achieve through butterfly operations with log (N) depth, from a side-channel analysis perspective. Notably, we derive a generalized formula for the attack complexity of higher-order side-channel attacks for arbitrary input sizes, utilizing the fractal structure of the butterfly network. Moreover, our research demonstrates the efficiency and security of this permutation approach across different platforms. We include practical implementation results on ASIC, as well as on CPU and GPU architectures, which underscore the algorithm’s performance advantages and robustness across diverse hardware environments. Through this exploration, we show that efficient and secure permutations can indeed be achieved with minimal randomness requirements.

Recently, adversarial attacks against machine learning-based network intrusion detection systems (NIDS) have gained significant attention in cybersecurity. This study investigates the transferability of these adversarial attacks in the context of NIDS. In addition, most existing studies in adversarial learning against NIDS adopted attack strategies designed originally for image classification without considering network traffic characteristics. However, this is impractical and will fail in the real world as network traffic features are constrained, and ignoring the functional behavior of the network traffic features leads to invalid network traffic flow or produces adversarial samples that do not retain their original functionality (malicious or benign). To address these issues, we propose a constrained momentum iterative fast gradient sign method (C-MIFGSM) to generate adversarial network flows that can successfully evade an ML-based IDS through transfer-based attacks while preserving the functional behavior of the network traffic. Our approach was validated using several target NIDS models built with the NSLKDD benchmark dataset. Experimental results demonstrate that even without knowledge of the target model and under feature constraints, it is possible to generate adversarial network traffic flows that achieve a high evasion attack success rate against NIDS built with deep learning and classical ML models. For example, the attack degraded the detection rate of the DoS traffic drops from 92.35

Hiding countermeasures are the most widely utilized techniques for thwarting side-channel attacks. Commonly, the Fisher-Yates algorithm is adopted in hiding countermeasures with permuted operation for its security and efficiency in implementation, yet the inherently sequential nature of the algorithm imposes limitations on hardware acceleration. In this work, we propose a novel method named Addition Round Rotation (ARR), which can introduce a time-area trade-off with block-based permutation. Our findings indicate that this approach can achieve a permutation brute force complexity level ranging from 2(128), with the modified version achieving up to 2(288) in a single clock cycle, while maintaining substantial resistance against second-order analysis. To substantiate the security of our proposed method, we introduce a new validation technique-Identity Verification. This technique allows theoretical validation of the proposed algorithm's security and is consistent with the experimental results. Finally, we introduce an actual hardware design and provide the implementation results on Application-Specific Integrated Circuit (ASIC). The measured performance demonstrates that our proposal fully supports the practical applicability.

The rapid expansion of Internet of Things (IoT) devices and advancements in mobile computing have underscored the significance of edge computing in addressing data processing and analytics challenges at the network. Federated Learning (FL) emerges as a strategic response, enabling collaborative model training across multiple participants without necessitating the sharing of raw data, thus preserving privacy and effectively leveraging decentralized data. However, FL's architecture presents distinct security challenges, particularly in safeguarding data and models against unauthorized access and manipulation. This paper presents a FL framework that integrates Attribute-Based Encryption (ABE) to provide fine-grained data access control while ensuring data security. In addition, we employ device fingerprints to enhance user authentication and device security, ensuring that only verified devices can participate in the model training process, thereby minimizing the risks of malicious access and data breaches. This paper delineates our contributions towards enhancing FL security, including the deployment of encryption methodologies, access management, and a comprehensive discussion on security mechanisms.

Cloud-Fog assisted Industrial Internet of Things (IIoT) has emerged as a core enabling technology for Industry 5.0, driving innovations in smart manufacturing by facilitating real-time interactions among industrial devices, fog nodes, and cloud platforms. However, inherent limitations in computational power and adaptability of IIoT terminals pose significant challenges to data security protection. This special issue focuses on addressing critical data security issues in Cloud-Fog IIoT systems.

The rapid growth of the Internet of Vehicles (IoV) requires secure, efficient, and reliable data exchanges among multiple stakeholders. Traditional centralized database systems can hardly address the challenges associated with data privacy, integrity, and scalability in this decentralized ecosystem. In this paper, we propose a Hyperledger Fabric-Based Multi-Channel Structure to overcome these limitations. By leveraging the blockchain architecture, the system ensures data confidentiality and integrity by segregating data into exclusive channels and enabling different organizations to collaborate. Cross-channel communication ensures security when data are interacted with. Chaincodes automate transactions and enhance trust between participants. Our functional tests and performance tests by using Hyperledger Caliper verified the effectiveness of the system in real-world scenarios, highlighting its advantages over traditional systems in terms of decentralization, transparency, and security. Future work will focus on enhancing the user experience and integrating the system with edge computing. Eventually, attempts will be made to operationalize it in real-world environments.

This survey systematizes the evolution of network intrusion detection systems (NIDS), from conventional methods such as signature-based and neural network (NN)-based approaches to recent integrations with large language models (LLMs). It clearly and concisely summarizes the current status, strengths, and limitations of conventional techniques, and explores the practical benefits of integrating LLMs into NIDS. Recent research on the application of LLMs to NIDS in diverse environments is reviewed, including conventional network infrastructures, autonomous vehicle environments and IoT environments. From this survey, readers will learn that: 1) the earliest methods, signature-based IDSs, continue to make significant contributions to modern systems, despite their well-known weaknesses; 2) NN-based detection, although considered promising and under development for more than two decades, and despite numerous related approaches, still faces significant challenges in practical deployment; 3) LLMs are useful for NIDS in many cases, and a number of related approaches have been proposed; however, they still face significant challenges in practical applications. Moreover, they can even be exploited as offensive tools, such as for generating malware, crafting phishing messages, or launching cyberattacks. Recently, several studies have been proposed to address these challenges, which are also reviewed in this survey; and 4) strategies for constructing domain-specific LLMs have been proposed and are outlined in this survey, as it is nearly impossible to train a NIDS-specific LLM from scratch.

The development of the Internet of Things (IoT) has led to the widespread use of WiFi-enabled consumer electronic devices, which are now common in everyday life. These advancements in IoT have greatly improved data collection and analysis capabilities, especially for health monitoring applications. However, traditional centralized machine learning methods often fall short, raising significant privacy concerns and requiring extensive data collection, which is inefficient. To address these limitations within the distributed IoT environment, this article presents a federated learning (FL)-based WiFi sensing system specifically designed for health monitoring. By enabling local model training, our system prevents the sharing of sensitive data, thus reducing the risk of privacy breaches. We further enhance our system with a secret sharing mechanism coupled with model sparsification to significantly improve privacy. Additionally, our improved top-k model sparsification algorithm, equipped with adaptive residuals, reduces communication overhead while ensuring high accuracy. Extensive testing across various datasets and models confirms that our system outperforms existing benchmarks in terms of privacy protection and communication efficiency, marking a substantial advancement in health monitoring within the IoT.

Cryptographic processing devices leak physical information, such as power consumption waveforms. Attacks using power consumption waveforms of cryptographic processing are called Power Analysis Attacks (PAAs). Against PAAs, many software-based countermeasures have been proposed. Generally, conventional software-based countermeasures are widely known to require modification to cryptographic source codes for countermeasures. In conventional countermeasures, when cryptographic processing devices only have cryptographic binary codes, i.e., do not have source codes for cryptographic processing, it is difficult to implement countermeasures. To address this, we propose a countermeasure that modifies the Operating System (OS) code rather than the cryptographic source code. Our countermeasure does not have to modify source codes, it is easy to implement countermeasures when cryptographic processing devices only have cryptographic binary codes. Our countermeasure periodically inserts interruption handlers into cryptographic processing, thereby randomly shifting the power consumption waveform to disrupt PAAs. In evaluation, this countermeasure demonstrates that only two partial round keys of 128-bit AES are leaked, and the execution time of cryptographic processing only increased by about 8.6% compared to 128-bit AES without countermeasures.

Backdoor attacks pose a significant threat to deep neural networks, especially as recent advances have enabled increasingly subtle implantations, making defense more challenging. Existing defense mechanisms typically rely on additional clean data for calibration and require high computational costs for retraining, which limits their applicability in real-world scenarios. In this paper, we propose a lightweight and effective defense mechanism, termed PAD-FT. Unlike existing approaches that require additional clean data, we introduce a simple-yet-effective data self-purification module that distills the most likely clean data from the poisoned dataset, eliminating the need for extra clean data. Moreover, in contrast to existing methods with high computational demands, our method only needs to fine-tune the last classification layer of the victim model for sterilization in a lightweight manner. Through extensive experimental evaluations, our PAD-FT method demonstrates superior effectiveness in various backdoor attack scenarios.

Digital signatures are one of the most basic cryptographic building blocks, which are utilized to provide attractive security features such as authenticity, unforgeability, and undeniability. To make public key infrastructure more simple and to circumvent the need for certificates, Shamir in 1984 developed the first identity-based signature (IBS). Nearly all of the existing IBS protocols rely on number theoretic assumption-based hard problems. Unfortunately, these hard problems are insecure and face a threat in the quantum world. Thus, it is high time we designed IBS algorithms that can resist quantum attacks and provide long-term security. Quantum cryptography (QC) is one such technique. In this paper, we design an IBS based on QC. The security of our scheme depends on the principle of quantum mechanics and quantum computing. As a consequence, it attains long-term security and remains secure against quantum attacks. We verified the correctness and feasibility of the proposed design by simulating it in a prototype quantum device and the IBM Qiskit quantum simulator.

Federated learning (FL) has become an essential enabler of distributed intelligence in cyber-physical-social systems (CPSSs), facilitating decentralized collaboration while upholding data privacy. As CPSS applications increasingly rely on federated models for tasks such as predictive analytics and decision-making, safeguarding the intellectual property of these models has emerged as a pressing concern. To address this, we propose MarkFL, an efficient and easy-to-implement watermarking approach tailored for federated models in CPSS environments. MarkFL enables clients to locally train their models on original tasks while the server simultaneously trains its model on a watermark set. During the weighted averaging phase, a new global model embedded with the watermark is generated. This approach ensures no additional time overhead and offers precise control over its impact on the primary tasks, making MarkFL both efficient and practical for diverse applications. Through experiments on the CIFAR-10 dataset, we demonstrate that MarkFL seamlessly integrates into the FL process while maintaining resilience against watermark removal attacks. To further optimize its performance, we introduced a watermark set generated using minimal training samples, showcasing its potential as a robust and practical solution for real-world FL scenarios.

Formal verification is a method used to verify the security of cryptographic protocols. In formal verification, the specifications of a protocol and its security properties are described using the input language of a software tool called a verification tool, enabling automated verification. However, protocol specifications and security properties are generally described and explained in natural language, and rewriting them in the tool's language requires specialized knowledge and time. This study attempts to efficiently make formal descriptions of cryptographic protocols by utilizing an LLM chatbot. Specifically, it explains the process by which the LLM chatbot understands protocol specifications described in natural language and converts them into formal descriptions. By using this approach, we aim to support the initial step of creating inputs for formal verification tools and reduce the effort required when starting to use such tools.