The growing dominance of encrypted network traffic and modern encryption protocols (TLS 1.3, QUIC, DoH) poses significant challenges for accurate network classification, particularly as many existing approaches rely on text- or image-based representations, which fail to adequately capture the inherent structural relationships present in network communication-relationships that are more naturally represented as graphs. In this work, we introduce GraphMux, a graph-based framework that leverages line graph transformations to fuse multiple graph views into a unified representation. We also present three graph-based flow representations (TIG+Chain, StarBurst, and 2Chain) designed to capture both temporal burst dynamics and client-server interaction patterns, using only packet time, direction, and length information, without incorporating any unencrypted statistical features. We evaluate our approach on three datasets: two academic datasets (UTMobileNetTraffic2021 and QUIC PCAP) and a commercial dataset (Flash), using four graph embedding architectures. Across all datasets, GraphMux consistently achieves superior performance, and the proposed graph constructions often yield the best results. Additional experiments examining attribute-selection strategies reveal a strong positive relationship between well-aligned feature assignments and classification accuracy, underscoring the importance of principled attribute design when constructing graph representations for encrypted traffic.

The dominance of encryption and the relentless growth of network traffic have rendered traditional deep packet inspection ineffective and made retraining-based machine learning classifiers operationally costly, as every new application or threat class requires a full model rebuild. In order to overcome this challenge, we present an ultra-fast encrypted traffic classification system based on Classification By Retrieval (CBR): each flow is represented by a fixed-length feature vector extracted from only the first few packets, indexed in a HNSW approximate nearest-neighbor structure, and classified by retrieving its nearest labeled neighbor. New classes are absorbed by inserting a handful of labeled vectors into the running index, with no retraining and no downtime, and out-of-distribution traffic is detected within the same retrieval step using a single global distance threshold. We evaluate handcrafted statistical features and learned CNN and MLP embeddings against a Random Forest baseline on the public CESNET-TLS22 dataset (187 application classes) and a proprietary cellular dataset (Radcom). With CNN embeddings, CBR matches Random Forest accuracy (macro F1 of 0.923 versus 0.925 on CESNET) while training roughly ten times faster, adapts to new classes two to three orders of magnitude faster (seconds versus thousands of seconds), and detects out-of-distribution flows with up to 0.90 AUROC. These results show that retrieval-based classification is a practical and adaptable alternative for real-time encrypted traffic analysis in dynamic network environments.

Software agents are beginning to shop and pay on a person's behalf. Agent payment protocols such as AP2 produce cryptographically valid signatures for completed purchases, yet do not constrain the decisions that lead to them. Consequently, ordinary product-description text can steer a shopping agent into forming a cart that passes every protocol check but no longer matches the user's request. In this paper, we show that this vulnerability enables three related attacks. In the first attack, the agent is steered into fetching another user's payment credentials. In the second, it assembles a cryptographically valid cart whose contents do not match what the user was shown. In the third, a single factual claim about stock or product lineage moves the agent from the cheaper displayed item to a more expensive one, while the resulting cart remains fully consistent with the listing. In experiments using the Gemini Flash-Lite models that AP2's sample agents specify by default, the three attacks succeeded at rates of 90

Application Programming Interfaces (APIs) are essential in software development, enabling web services, mobile apps, and microservices. However, their widespread use introduces significant security risks, highlighting the importance of API security. This paper presents HTTP REST API Learning (HRAL), a novel unsupervised anomaly detection approach that models the structure and behavior of API endpoints directly from network traffic, without relying on predefined rules or documentation. HRAL enables robust detection of malicious activity by understanding how APIs behave and flagging deviations as potential threats. We evaluate HRAL across varying levels of OpenAPI documentation detail and compare it with existing techniques. HRAL achieves strong performance, with an average recall of 82.07

Google's A2A protocol provides a secure communication framework for AI agents, but it has critical limitations when handling highly sensitive information such as payment credentials and identity documents. These gaps increase the risk of unintended harms, including unauthorized disclosure, privilege escalation, and misuse of private data in generative multi-agent environments. In this paper, we identify key weaknesses in A2A: insufficient token lifetime control, lack of strong customer authentication, overbroad access scopes, and missing consent flows. We propose a modular, interceptor-based architecture to address these weaknesses. Our refinements introduce a Zero-Trust Interceptor that enforces explicit consent orchestration, ephemeral scoped tokens, and direct user-to-service data channels to minimize exposure across time, context, and topology. A component-level evaluation of the interceptor's deterministic enforcement logic, conducted across 5,000 protocol-enforcement trials, demonstrates that the enhanced protocol structurally eliminates the sensitive-data leakage paths covered by the tested checks, yielding a 0% structural success rate under the stated enforcement assumptions and keeping enforcement overhead at the sub-millisecond level. Comparative analysis highlights the advantages of our deterministic, protocol-level enforcement over both the original A2A specification and stochastic model-based safeguards. These contributions establish a practical, statistically validated path for evolving A2A into a privacy-preserving framework for multi-agent systems.

The increasing sophistication and frequency of cyberattacks have made Network Intrusion Detection Systems (NIDS) a critical component of modern cybersecurity. This work presents D-MAGIC, a novel real-time NIDS that leverages zero-shot learning and graph-based dynamic clustering to detect both known and unknown threats. Unlike traditional systems that rely on labeled datasets and predefined attack signatures, D-MAGIC operates unsupervised, identifying anomalies by detecting deviations from normal network behavior. D-MAGIC employs dynamic clustering to identify coordinated attacks and emerging threats by embedding network flow relationships into a graph structure and clustering similar patterns. Additionally, a second anomaly detection method, called SAGA, is introduced. SAGA enhances detection by using approximate nearest neighbor (ANN) analysis to evaluate isolated nodes, which clustering alone cannot classify. By leveraging information from a node’s neighbors, SAGA improves the identification of subtle or emerging threats. This hybrid approach ensures more comprehensive detection, capturing both clustered anomalies and isolated outliers. Experimental results on the CIC-IDS-2017 and CSE-CIC-IDS-2018 datasets demonstrate that D-MAGIC achieves up to 12% improvement in F1 score over state-of-the-art methods, significantly reduces false positives, and ensures rapid, real-time detection with minimal latency. Furthermore, on the CIC-IDS-2017 dataset, SAGA achieves up to a 6% improvement in accuracy, showcasing its effectiveness in handling diverse attack scenarios.

The increasing sophistication and frequency of cyberattacks have made Network Intrusion Detection Systems (NIDS) a critical component of modern cybersecurity. This work presents D-MAGIC, a novel real-time NIDS that leverages zero-shot learning and graph-based dynamic clustering to detect known and unknown threats. Unlike traditional systems that rely on labeled datasets and predefined attack signatures, D-MAGIC operates unsupervised, identifying anomalies by detecting deviations from normal network behavior. By embedding the relationships between network flows into a graph structure and dynamically clustering similar patterns, D-MAGIC can detect coordinated attacks and emerging threats with minimal delay. Experimental results on the CIC-IDS-2017 and CSE-CIC-IDS-2018 datasets demonstrate that D-MAGIC achieves an improvement of up to 12 % based on the standard F1 score compared to state-of-the-art methods, while significantly reducing false positives and ensuring rapid, real-time detection with minimal detection latency.

Latency is the most impactful on fairness and Quality of Experience (QoE) in First-Person Shooter (FPS) games. High latency degrades the QoE of players, who may leave the game if unsatisfied with their QoE. Modern FPS games make great efforts to maintain an excellent QoE even under a poor Internet connection with high latency. Those efforts include the wide distribution of game servers and many software optimizations to smooth the effect of lags in the games. This study aims to provide insights into QoE estimation for network-intensive applications by examining one of the most prominent FPS games of the past two decades: Call of Duty. We observed that the game dynamically adjusts its network traffic behavior, including packet size and transmission rate, in response to variations in network quality. However, the ISP does not have this capability since the network traffic is encrypted; observing the game’s network traffic does not expose its nature and most certainly does not expose the game player’s intensity, latency, or QoE. We propose a novel technique for estimating latency and QoE in FPS games from an ISP-level perspective. In our evaluation, the model detected problematic latency in near real-time with 81% accuracy and an 80% F1 on a 10-second window, highlighting a trade-off between responsiveness and predictive performance. The dataset generated for this study is publicly available to support further research.

Traffic encryption is vital for internet security but complicates analytical applications like video delivery optimization or quality of experience (QoE) estimation, which often rely on clear text data. While many models address the problem of QoE prediction in video streaming, the video conferencing (VC) domain remains underexplored despite rising demand for these applications. Existing models often provide low-resolution predictions, categorizing QoE into broad classes such as “high” or “low”, rather than providing precise, continuous predictions. Moreover, most models focus on clear-text rather than encrypted traffic. This paper addresses these challenges by analyzing a large dataset of Zoom sessions and training five classical machine learning (ML) models and two custom deep neural networks (DNNs) to predict three QoE indicators: frames per second (FPS), resolution (R), and the naturalness image quality evaluator (NIQE). The models achieve mean error rates of 8.27%, 7.56%, and 2.08% for FPS, R, and NIQE, respectively, using a 10-fold cross-validation technique. This approach advances QoE assessment for encrypted traffic in VC applications.

The increasing popularity of online services has made Internet Traffic Classification a critical field of study. However, the rapid development of internet protocols and encryption limits usable data availability. This paper addresses the challenges of classifying encrypted internet traffic, focusing on the scarcity of open-source datasets and limitations of existing ones. We propose two Data Augmentation (DA) techniques to synthetically generate data based on real samples: Average augmentation and MTU augmentation. Both augmentations are aimed to improve the performance of the classifier, each from a different perspective: The Average augmentation aims to increase dataset size by generating new synthetic samples, while the MTU augmentation enhances classifier robustness to varying Maximum Transmission Units (MTUs). Our experiments, conducted on two well-known academic datasets and a commercial dataset, demonstrate the effectiveness of these approaches in improving model performance and mitigating constraints associated with limited and homogeneous datasets. Our findings underscore the potential of data augmentation in addressing the challenges of modern internet traffic classification. Specifically, we show that our augmentation techniques significantly enhance encrypted traffic classification models. This improvement can positively impact user Quality of Experience (QoE) by more accurately classifying traffic as video streaming (e.g., YouTube) or chat (e.g., Google Chat). Additionally, it can enhance Quality of Service (QoS) for file downloading activities (e.g., Google Docs).

The proliferation of the Internet of Things (IoT) has reshaped the way we interact with technology, propelling the Routing Protocol for Low-Power and Lossy Networks (RPL) into a critical role as a communication framework. Amid this transformative landscape, security vulnerabilities within RPL-based IoT networks emerge as a substantial concern. This survey delves into these vulnerabilities, offering insights into their intricacies, potential consequences, and robust mitigation strategies. Commencing with a foundational understanding of IoT networks and their real-world applications, the survey sets the stage for comprehending the significance of Routing Protocol for Low-Power and Lossy Networks (RPL). It unravels the unique characteristics of RPL networks, their Destination-Oriented Directed Acyclic Graph (DODAG) topologies, and their pivotal role in enabling seamless device communication. The survey then delves into the heart of RPL security vulnerabilities. It navigates through diverse attack vectors, such as rank attacks and version number attacks. Each vulnerability is scrutinized, unraveling its technical mechanisms and implications for network stability. Transitioning from vulnerabilities to resilience, the survey offers a panoramic view of mitigation strategies. It dissects the nuances of intrusion detection systems (IDS), exploring trust models, location-based approaches, and hybrid systems. Signature-based, anomaly-based, and specification-based detection mechanisms are evaluated for their potential to mitigate threats within RPL networks. As standards shape the IoT landscape, the survey underscores the pivotal role of RPL within this framework. It emphasizes the necessity of secure standards in mitigating vulnerabilities across interconnected IoT devices.

Application Programming Interface (API) Injection attacks refer to the unauthorized or malicious use of APIs, which are often exploited to gain access to sensitive data or manipulate online systems for illicit purposes. Identifying actors that deceitfully utilize an API poses a demanding problem. Although there have been notable advancements and contributions in the field of API security, there remains a significant challenge when dealing with attackers who use novel approaches that don't match the well-known payloads commonly seen in attacks. Also, attackers may exploit standard functionalities unconventionally and with objectives surpassing their intended boundaries. Thus, API security needs to be more sophisticated and dynamic than ever, with advanced computational intelligence methods, such as machine learning models that can quickly identify and respond to abnormal behavior. In response to these challenges, we propose a novel unsupervised few-shot anomaly detection framework composed of two main parts: First, we train a dedicated generic language model for API based on FastText embedding. Next, we use Approximate Nearest Neighbor search in a classification-by-retrieval approach. Our framework allows for training a fast, lightweight classification model using only a few examples of normal API requests. We evaluated the performance of our framework using the CSIC 2010 and ATRDF 2023 datasets. The results demonstrate that our framework improves API attack detection accuracy compared to the state-of-the-art (SOTA) unsupervised anomaly detection baselines.

Post-quantum cryptography (PQC) is expected to revolutionize secure communications in next-generation digital ecosystems. Previous and ongoing activities demonstrate that different PQC algorithms significantly impact traffic latency, but they do not yet provide a scheme to assess the existence of the PQC algorithm or its identification when encrypted traffic is analyzed for traffic engineering purposes. Hence, this work is the first to propose a novel PQClass pipeline for classifying encrypted Internet traffic of recently NIST-approved PQC algorithms. Hence, it establishes solid grounds for enabling engineers to optimize their networks and, in parallel, for cybersecurity practitioners to familiarise themselves with PQC algorithmic properties for enhancing or devising security architectures in diverse setups. Our pipeline demonstrates impressive performance on real-world data, achieving 86% accuracy in detecting the presence of a PQC algorithm and 91% and 98% accuracy in identifying the browser and OS, respectively, based on PQC-based traffic.

Multi-agent systems (MAS) powered by artificial intelligence (AI) are increasingly foundational to complex, distributed workflows. Yet, the security of their underlying communication protocols remains critically under-examined. This paper presents the first empirical, comparative security analysis of the official CORAL implementation and a high-fidelity, SDK-based ACP implementation, benchmarked against a literature-based evaluation of A2A. Using a 14 point vulnerability taxonomy, we systematically assess their defenses across authentication, authorization, integrity, confidentiality, and availability. Our results reveal a pronounced security dichotomy: CORAL exhibits a robust architectural design, particularly in its transport-layer message validation and session isolation, but suffers from critical implementation-level vulnerabilities, including authentication and authorization failures at its SSE gateway. Conversely, ACP's architectural flexibility, most notably its optional JWS enforcement, translates into high-impact integrity and confidentiality flaws. We contextualize these findings within current industry trends, highlighting that existing protocols remain insufficiently secure. As a path forward, we recommend a hybrid approach that combines CORAL's integrated architecture with ACP's mandatory per-message integrity guarantees, laying the groundwork for resilient, next-generation agent communications.

Mobile ad-hoc networks (manets) are everywhere. They are the basis for many current technologies (including vanets, iot, etc.), and used in multiple domains (including military, disaster zones, etc.). For them to function, routing protocols have been defined, taking into account the high mobility of network nodes. These protocols, however, are vulnerable to devastating attacks. Many solutions have been proposed for various attacks, including dcfm (Denial Contradictions with Fictitious nodes Mechanism) for the node isolation and gray-hole variants. In this work we present a refinement for dcfm, calculate its cost, and compare alternative algorithms. It will be shown that the entire fictitious mechanism is superfluous for some required security level. Examination of the results when under attack show that using dcfm’s contradiction rules alone achieves the best cost-benefit ratio for networks with and without movement. In terms of packet delivery ratio (pdr), however, the proposed algorithm achieves 93% for a 50-node static network, stabilizing on 100% for 90 nodes and above. When movement is present, the success drops to 67%, which is slightly better than the alternatives examined.

In today’s digital landscape, ensuring the security of cloud environments is critical for organizational resilience, growth, and operational efficiency. As cloud services become more prevalent, so do sophisticated attacks targeting cloud users, making early detection essential. This paper introduces a novel time-based embedding approach for Cloud Services Graph-based Anomaly Detection (CS-GAD) that leverages a Graph Neural Network (GNN) to detect anomalous user behavior. We propose a dynamic tripartite graph to model interactions among users, actions, and cloud services over time. Using behavioral patterns, our GNN generates user embeddings to enable early detection of anomalies. We evaluate this approach on a novel dataset simulating five real-world attacks: cryptojacking, billing abuse, lateral movement, monitor exploitation, and service targeting. The dataset comprises 107,116 Application Programming Interface (API) calls over 32 days, tracking 79 AWS services, with attacks embedded within legitimate cloud traffic. Our results demonstrate that the proposed method achieves a lower false positive rate and higher detection accuracy than a prevailing method, as evidenced by improved accuracy, precision, recall, and F1-score.

The accurate identification of internet traffic is crucial for network management. However, the use of encryption techniques and constant changes in network protocols make it difficult to extract useful features for traffic classification. Additionally, there may be limited data availability and a lack of diversity within the dataset, which poses further challenges. To address these issues, our research proposes a novel solution that uses an innovative data augmentation technique. This approach leverages the capabilities of LSTM networks to create synthetic data points that closely resemble real traffic data. By doing so, we can significantly enrich the dataset used for training and improve classification efficiency. We conducted thorough experiments to validate our approach and found that combining LSTM-generated data with actual traffic data leads to notable improvements in classification efficiency. We demonstrated the effectiveness of our methodology using academic and commercial datasets. Our classifier, trained on the generated data, showed a performance boost of 6%. Moreover, when classifying with only half of the time, thus utilizing half of the signal, our approach achieved a notable 4% improvement compared to the original classifier. The inclusion of augmented samples within the training set led to a noticeable improvement in both accuracy and F1-score. These findings compellingly demonstrate our data augmentation strategy’s practical utility and efficiency in earlier prediction with improved performance for encrypted traffic classification systems.

Internet traffic classification plays a key role in network visibility, Quality of Services (QoS), intrusion detection, Quality of Experience (QoE) and traffic-trend analyses. In order to improve privacy, integrity, confidentiality, and protocol obfuscation, the current traffic is based on encryption protocols, e.g., SSL/TLS. With the increased use of Machine-Learning (ML) and Deep-Learning (DL) models in the literature, comparison between different models and methods has become cumbersome and difficult due to a lack of a standardized framework. In this paper, we propose an open-source framework, named OSF-EIMTC, which can provide the full pipeline of the learning process and simulation reproducibility. From well-known datasets to extracting new and well-known features, it provides implementations of well-known ML and DL models (from the traffic classification literature) as well as experimental test-beds and their evaluation. By providing a standardized platform, OSF-EIMTC enables repeatable, reproducible, and accurate comparisons of both established and novel features and models. As part of our framework evaluation, we demonstrate the reproducibility of a variety of cases where the framework can be of use, utilizing multiple datasets, models, and feature sets. We show analyses of publicly available datasets and invite the community to participate in our open challenges using OSF-EIMTC, fostering collaborative advancements in encrypted traffic classification.

Short Message Service (SMS) spamming is a harmful phishing attack on mobile phones. That is, fraudsters are trying to misuse personal user information, using tricky text messages, sometimes included with a fake URL that asks for this personal information, such as passwords, usernames, etc. In the world of Machine Learning, several approaches have tried to attitudinize this problem, but the lack of available data resources was commonly the main drawback towards a good enough solution. Therefore, in this paper, we suggest a dataset extension technique for small datasets, based on an Out Of Distribution (OOD) metric. Hence, different approaches such as Generative Adversarial Networks (GANs) were suggested, yet GANs are hard to train whenever datasets are limited in terms of sample size. In this paper, we present a GAN-like method that imitates the generator concept of GANs for the purpose of limited datasets extension, using the OOD concept. By using a sophisticated text generation method, we show how to apply it over datasets from the domain of fraud and spam detection in SMS messages, and achieve over 25% relative improvement, compared to two other solutions. In addition, due to the class imbalance in typical spam datasets, our approach is being examined over another dataset, in order to verify that the false alarm rate is low enough.

With the emergence of new and exciting wireless technologies and capabilities, Unmanned Aerial Vehicles (uavs) and the services they allow, stand to be a major influencer in our daily lives. Unfortunately, they are also prone to a plethora of security issues. Existing studies propose both prevention and identification schemes for various routing attacks. They do not, however, preclude future malicious attempts. Hence, in this work we identify the specific uav that is compromising the network, with the specific purpose of flushing it out. The proposed solution combines secret sharing and cheating identification schemes with multi-path routing protocols, to deterministically pinpoint the compromised node that is cheating the uav flock. It assures a quiet identification of the adversary creating new opportunities for its attack, even when facing a sophisticated adversary that selectively modifies data messages or re-routes them in within the network. We took special care to allow for applicability in existing networks by adhering to two basic principles: only using pre-existing standard routing protocols and not relying on a centralized or trusted third party node such as a base station. All information must be gleaned by each node using only primitives which already exist in the underlying communication protocols. We provide a rigorous mathematical proof of the cost bounds, and run simulations to prove feasibility. Moreover, the simulations show a 100% detection rate and message delivery rate. The communication overhead varies, on average, between 0.4∙106-0.8∙106 bytes, depending on various parameters such as the network size and the reception rate of network nodes. The time required varies between 0.2-0.4 seconds, depending mainly on the network size.