Named Data Networking (NDN) has been identified as a key paradigm for enhancing data-centric communication, particularly in the Internet of Things (IoT) to address the scalability issues in existing solutions. Caching in NDN is a crucial mechanism for improving network performance by reducing latency and conserving bandwidth. However, it also introduces significant security challenges, making the system vulnerable to attacks like Cache Pollution Attacks and Side-Channel Timing Attacks, which can undermine data integrity and lead to denial-of-service scenarios. Traditional caching strategies, such as the Least Recently Used policy, predominantly rely on data usage frequency and often overlook critical factors including content popularity and data freshness. This oversight leaves the cache susceptible to exploitation, as it cannot effectively distinguish between valuable content and malicious requests. This paper proposes a cache management mechanism that integrates metrics such as content popularity and data freshness, facilitating early detection and mitigation of malicious activities while maximizing cache efficiency. Our results demonstrate a 96 % success rate in early detection and mitigation, significantly improving the security and reliability of the IoT-NDN ecosystem.

The increasing complexity and connectivity of modern vehicles have made automotive networks, particularly the Controller Area Network (CAN) bus, vulnerable to cyberattacks. Fuzzing is a critical technique for proactively finding security weaknesses, but traditional methods are inefficient and struggle to scale with the complexity of modern vehicles. This paper introduces AMCFF-RL, an adaptive framework that uses Deep Reinforcement Learning (DRL) with multi-modal feature extraction to systematically analyse for vulnerabilities. Rather than relying on unguided or purely random fuzzing, AMCFF-RL integrates multi-modal feature extraction with DRL and advanced visualization, allowing it to learn and adapt its strategy based on real-time feedback from the network and thereby improve the efficiency and effectiveness of the fuzzing process. Comprehensive visualization tools serve a dual purpose: they offer human-interpretable insights while also generating rich feature representations that support the anomaly detection pipeline and the DRL agent.

We present a comprehensive analysis of privacy attacks and countermeasures in data-driven systems. We systematically categorize attacks targeting three domains: anonymous data (linkage and structural attacks), statistical aggregates (reconstruction and differential attacks), and privacy-preserving models (extraction, reconstruction, membership inference, and inversion attacks). For each category, we analyze attack methodologies, adversary capabilities, and vulnerability mechanisms. We further evaluate countermeasures including perturbation techniques, randomization methods, query auditing, and model-level defenses, examining their effectiveness and inherent privacy-utility tradeoffs. Our analysis reveals that while differential privacy offers strong theoretical guarantees, it faces implementation challenges and potential vulnerabilities to emerging attacks. We identify critical research directions and provide researchers and practitioners with a structured framework for understanding privacy resilience in increasingly complex data ecosystems.

Existing misbehaviour detection techniques in Cooperative Intelligent Transport Systems (C-ITS) predominantly rely on scrutinising self-reported messages from neighbouring nodes, which introduces inherent limitations in terms of accuracy, robustness, and resilience. Cooperative trust-based approaches attempt to address these limitations by integrating long-term trust information sharing among ITS-S nodes with plausibility checks based on self-reported messages. However, these approaches also have significant drawbacks, such as the potential for trusted nodes to behave maliciously and increased resource utilisation in detection due to trust-threshold dependencies. To overcome these shortcomings, this paper introduces a novel approach based on collaborative monitoring. In this approach, each node in the C-ITS network monitors its closest neighbours and shares pertinent information with other nodes in real-time. Simultaneously, each node performs consensus checks not only on the self-reported information from other nodes but also on the neighbour-reported observations for those nodes. This comprehensive approach significantly enhances misbehaviour detection capabilities by a minimum of 3.05% compared to local misbehaviour detection mechanisms within the C-ITS network, addressing the identified challenges and fostering a more robust, reliable and resilient system. Simulative experiments demonstrate the effectiveness and superiority of the proposed approach over traditional approaches.

Advanced Persistent Threat (APT) presents a significant challenge to the cybersecurity of contemporary organizations. This challenge is further exacerbated when APT actors collaborate with malicious insiders. The involvement of the insider transforms a bilateral adversarial scenario into a triadic strategic interaction, introducing additional layers of complexity in modeling and defense planning. Effective defense against insider-facilitated APT necessitates a comprehensive treatment of two critical aspects: (i) the dynamic strategic interactions among the three players—the defender, the insider, and the APT actor—and (ii) the impact of these interactions on the evolving state of the intranet. However, both dimensions are insufficiently addressed in existing research. To bridge this gap, we first develop an expected state evolution model that captures the real-time influence of the dynamic strategies of the players on the expected compromise state of the intranet. Building upon this, we formulate a three-player differential game model that explicitly incorporates the dynamic interactions of all participants. The associated optimality system is derived and numerically solved using a proposed iterative algorithm. The proposed algorithm achieves a 27.5% improvement in the organization’s expected payoff compared to baseline permissible strategies. Subsequently, we analyze key properties of the proposed framework and empirically evaluate the cost-effectiveness of the resulting defense strategy. To the best of our knowledge, this work represents the first application of three-player differential game theory in the domain of cybersecurity, offering a novel approach to defending against insider-facilitated APT.

This paper presents a framework for LLM-assisted digital forensic investigations of prompt injection attacks, focusing on evidence analysis and ontology-compliant forensic timeline reconstruction, using an evaluation of 12 state-of-the-art LLMs across 1,046 indirect prompt injection scenarios. Our confidence threshold-based analysis approach demonstrates that while increasing thresholds improves specificity (up to 1.00), it also creates a trade-off with recall, offering investigators a mechanism to prioritise high-confidence findings. Anti-forensics techniques also impact detection performance, with varying effects across different LLMs. For forensic timeline reconstruction, frontier LLMs achieve up to 0.86 validity scores in capturing temporal markers and critical entities, with significant variability across scenarios and parameters. This work bridges emerging LLM capabilities with traditional digital forensic practices, while seeking to explore approaches towards addressing key challenges of non-determinism, hallucinations, and evidential integrity.

Cyber threats have evolved in complexity, aiming at a wide range of sectors using advanced methods and tools. This evolving threat landscape challenges existing cybersecurity frameworks, many of which lack the adaptability to counteract the complex tactics of sophisticated adversaries. Developing robust cyber defense strategies requires simulating dynamic interactions between attackers and defenders across high, moderate, and low-impact scenarios. The Flip-It cyber game serves as an intelligent framework for simulating these interactions, enabling the analysis of adaptive strategies in cybersecurity. This paper aims to address the problem of mitigating malware prevalence with full consideration of attack/defense capabilities in arbitrary network topologies. This paper proposes a sophisticated discrete-time epidemic model to characterize security state transitions over time for all three scenarios within the Flip-It game framework. On this basis, the original problem is modeled as a closed-loop control problem to seek the optimal containment strategy. Deep Reinforcement Learning (DRL) is then used to tackle the problem, generating efficient defense strategies that are well-adapted to changing cybersecurity environments. Numerical simulations based on small-world networks, scale-free networks, and router networks are then carried out to generate corresponding strategies. Additionally, we have evaluated the performance of the proposed method against the State-Of-The-Art (SOTA) in terms of attack/defense objective function, control actions, number of devices under the control of the attacker and defender, stability, execution time, and scalability. This comprehensive approach integrates epidemiological modeling, game theory, and advanced machine learning to effectively tackle the complexities of contemporary cybersecurity threats.

We propose a novel adaptive weighting mechanism for missing data imputation using Generative Adversarial Networks (GANs) that dynamically adjusts the contribution of each imputed value to the training objective. Our approach integrates three complementary factors into the weighting scheme: (1) the confidence of the generator in each imputed value, (2) the temporal proximity of the missing data to nearby observed data, and (3) feedback from the discriminator, which reflects the realism of the imputation. Experiments on benchmark time series dataset demonstrate that our method significantly improves imputation accuracy and temporal consistency.

Remote Identity Proofing (RIDP) underpins digital onboarding for essential services, yet existing standards and assurance frameworks assume that remotely captured visual and audio evidence remains trustworthy and that synthetic manipulation is detectable. Earlier approaches relied on a combination of automated detection, biometric liveness checks, redundancy, and human oversight to achieve higher assurance. Recent advances in generative artificial intelligence have fundamentally undermined these assumptions. High-fidelity synthetic humans can now be produced with minimal detectable artefacts, which makes both human review and AI-based detection increasingly unreliable. This paper argues that RIDP models centred on media authenticity are no longer viable and proposes a post-artifact approach that shifts trust toward cryptographic provenance and temporal identity continuity. The proposed framework integrates device attestation, longitudinal behavioural consistency, multi-device corroboration, and privacy-preserving biometrics, and motivates corresponding updates to identity assurance criteria, governance, and evaluation practices. The goal is to ensure that remote identity proofing remains trustworthy in an era of indistinguishable synthetic media.

Traceability systems have become prevalent in supply chains because of the rapid development of RFID and IoT technologies. These systems facilitate product recall and mitigate problems such as counterfeiting, tampering, and theft by tracking the manufacturing and distribution life-cycle of a product. Therefore, traceability systems are a defense mechanism against supply chain attacks and, consequently, have become a target for attackers to circumvent. For example, a counterfeiter may change the trace of a fake product for the trace of an authentic product, fooling the system into accepting a counterfeit product as legit and thereby giving a false sense of security. This systematic analysis starts with the observation that security requirements in existing traceability solutions are often unstructured or incomplete, leaving critical vulnerabilities unaddressed. We synthesized the properties of current state-of-the-art traceability solutions within a single security framework that allows us to analyze and compare their security claims. Using this framework, we objectively compared the security of 17 traceability solutions and identified several weaknesses and vulnerabilities. This article reports on these flaws, the methodology we used to identify them, and the first security evaluation of traceability solutions on a large scale.

The rapid advancement of large language models (LLMs) has simultaneously created opportunities and challenges for digital forensic science. This survey systematically examines the emerging intersection between generative artificial intelligence and digital forensics through our analysis of 33 peer-reviewed works. We map LLM capabilities across the established Digital Forensic Research Workshop (DFRWS) process model, identifying three strategic integration points where these technologies demonstrate measurable benefits - pattern recognition during the examination phase, evidence analysis during the analysis phase, and evidence presentation and reporting during the presentation phase. Our findings show that LLMs achieve substantial performance improvements across diverse forensic tasks, but critical challenges persist, including the fundamental tension between the probabilistic nature of LLM outputs and deterministic forensic requirements, alongside concerns regarding explainability, reproducibility, and legal admissibility. We identify significant research gaps in validation frameworks, forensic-ready architectures, and standardised evaluation protocols. The survey establishes a comprehensive research agenda spanning technical, methodological, and legal domains, emphasising the necessity for interdisciplinary collaboration and human-AI collaborative approaches to preserve forensic integrity when leveraging LLM capabilities.

Low Earth Orbit (LEO) satellite networks have become the main differentiator in achieving global connectivity, augmenting terrestrial networks through wider coverage, lower latency, and native integration with 5G/6G, the Internet of Things (IoT), and edge services. However, the expansion of LEO constellations introduces substantial security challenges, mainly ensuring robust authentication under dynamic, resource and bandwidth constrained conditions. In many practical architectures, authentication is performed indirectly, with satellites forwarding verification material to ground infrastructure rather than authenticating autonomously. Despite its prevalence, indirect authentication in LEO networks lacks a dedicated, up-to-date survey and a consistent way to compare designs. This paper reviews 69 indirect authentication protocols published between 1996 and 2024 and introduces a role-based taxonomy that distinguishes relay-based schemes from schemes where satellites provide limited assistance prior to ground-based verification. Each protocol is analysed in terms of architecture, cryptographic approach, security properties, validation practices, and efficiency trade-offs. Emerging directions are also synthesized, including blockchain-based designs, quantum security, physical-layer authentication, and Zero Trust-inspired approaches. The survey consolidates fragmented terminology, clarifies design choices and trade-offs, and highlights open research problems towards scalable authentication for future LEO constellations that reflect operational realities.

Automated deep learning (AutoDL) aims to automatically discover optimal architectures of deep neural networks (DNNs) for secure inference without the studies for time-consuming and error-prone manual design. Privacy concerns have increasingly motivated the studies for privacy-preserving AutoDL (PrivAutoDL), where DNN architectures are searched directly on encrypted data without revealing the client's confidential inputs and well-trained DNN architectures. However, existing studies encounter problems in achieving a balance between provable security and efficiency while avoiding significant degradation of model utility. To tackle these problems, we design a privacy-preserving AutoDL scheme, named 2PCAutoDL, utilizing a two-party (two non-colluding cloud servers) computation model. Based on the two-server model, efficient and secure computation protocols are customized layer by layer to protect DNN models associated with client's data. In particular, we reduce the computational overhead of secure DNN: our optimized protocols achieve $1.34\times \sim 2.05\times$1.34x similar to 2.05x speedup for linear layers and $1.33 \times \sim 45 \times$1.33x similar to 45x speedup for non-linear layers, compared to a range of existing secure implementations in the literature. Moreover, our fresh alternative to approximate Softmax avoids the drawbacks of approximating exponential operation and yields slightly higher accuracy under appropriate configurations. The security of 2PCAutoDL is formally analyzed under the semi-honest adversary model. Extensive experiments demonstrate that the searched models from 2PCAutoDL improve the inference accuracy by 0.6% on MNIST and by 0.5% on CIFAR-10 when compared to state-of-the-art (SOTA) PrivAutoDL.

Deep reinforcement learning (DRL) has gained widespread adoption in control and decision-making tasks due to its strong performance in dynamic environments. However, DRL agents are vulnerable to noisy observations and adversarial attacks, and concerns about the adversarial robustness of DRL systems have emerged. Recent efforts have focused on addressing these robustness issues by establishing rigorous theoretical guarantees for the returns achieved by DRL agents in adversarial settings. Among these approaches, policy smoothing has proven to be an effective and scalable method for certifying the robustness of DRL agents. Nevertheless, existing certifiably robust DRL relies on policies trained with simple Gaussian augmentations, resulting in a suboptimal trade-off between certified robustness and certified return. To address this issue, we introduce a novel paradigm dubbed Certified-rAdius-Maximizing Policy (CAMP) training. CAMP is designed to enhance DRL policies, achieving better utility without compromising provable robustness. By leveraging the insight that the global certified radius can be derived from local certified radii based on training-time statistics, CAMP formulates a surrogate loss related to the local certified radius and optimizes the policy guided by this surrogate loss. We also introduce policy imitation as a novel technique to stabilize CAMP training. Experimental results demonstrate that CAMP significantly improves the robustness-return trade-off across various tasks. Based on the results, CAMP can achieve up to twice the certified expected return compared to that of baselines. Our code is available at https://github.com/NeuralSec/camp-robust-rl.

Given the widespread issues with passwords, Multi-Factor Authentication (MFA) is crucial for protecting online services. Despite vulnerabilities in widely used OTP and app-based MFAs, more secure methods, such as Physical Authentication Devices (PADs), have not garnered widespread adoption. This study aims to understand why the adoption of PADs has lagged behind other forms of MFA. We conducted a two-phase study examining the usability features and subsequent user sentiment towards mainstream PAD devices. In Phase I, participants were sent three commercial PADs to use for two weeks, helping to identify key usability features of these devices. In Phase II, we contextualized these features within commercial PADs and examined user sentiment towards their usability and security features. Our results suggest that different demographic groups preferred different usability and security features, significantly influencing their decision to adopt PADs. Based on the results of our study, we propose methods to enhance the usable security features of PADs, thereby improving their usability and security while assisting with their adoption.

Ransomware has emerged as a significant security threat in cyberspace, inflicting severe economic losses and privacy breaches on individual users and organizations. Ransomware typically encrypts critical user files and demands a ransom for decryption. Traditional signature-based defense methods effectively identify known ransomware but perform poorly when confronting unknown zero-day attacks. Addressing this challenge, a ransomware detection framework called ‘RansoGuard’ is proposed. This framework aims to achieve timely identification and defense against ransomware by capturing and analyzing the sensitive Application Programming Interface (API) call behavior exhibited before the encryption attack is launched. A real-world ransomware sample dataset was constructed. The dynamic behavioral data during the pre-attack stage was analyzed, and natural language processing techniques were used to represent and extract key features from API call sequences. A Recurrent Neural Network (RNN) classifier was trained on these features to distinguish ransomware from benign software. Experimental results demonstrate that the RansoGuard framework exhibits outstanding early ransomware detection performance across different datasets, achieving a recall of 96.18% and an accuracy of 94.26%. Furthermore, it exhibits robustness in effectively countering zero-day attacks.

Efficient clustering algorithms are critical for enabling the timely dissemination of emergency messages across maximum coverage areas in vehicular networks. While existing clustering approaches demonstrate stability and scalability, there has been a limited amount of work focused on leveraging roadside units (RSUs) for cluster head selection. This research proposes a novel framework that utilizes RSUs to facilitate cluster head election, mitigating the cluster head selection process, clustering overhead, and broadcast storm problem. The proposed scheme mandates selecting an optimal number of cluster heads to maximize information coverage and prevent traffic congestion, thereby enhancing the quality of service through improved cluster head duration, reduced cluster formation time, expanded coverage area, and decreased overhead. The framework comprises three key components: (I) an acknowledgment-based system for legitimate vehicle entry into the RSU for cluster head selection; (II) an authoritative node behavior mechanism for choosing cluster heads from received notifications; and (III) the role of bridge nodes in maximizing the coverage of the established network. The comparative analysis evaluates the clustering framework’s performance under uniform and non-uniform vehicle speed scenarios for time-barrier-based emergency message dissemination in vehicular ad hoc networks. The results demonstrate that the proposed model’s effectiveness for uniform highway speed scenarios is 100% whereas for non-uniform scenarios 99.55% information coverage is obtained. Furthermore, the clustering process accelerates by over 50%, decreasing overhead and reducing cluster head election time using RSUs. The proposed approach outperforms existing methods for the number of cluster heads, cluster head election time, total cluster formation time, and maximum information coverage across varying vehicle densities.

Network traffic anomaly detection is a critical cy- bersecurity challenge requiring robust solutions for complex Internet of Things (IoT) environments. We present a novel hybrid quantum-classical framework integrating an enhanced Quantum Support Vector Machine (QSVM) with the Quantum Haar Wavelet Packet Transform (QWPT) for superior anomaly classification under realistic noisy intermediate-scale Quantum conditions. Our methodology employs amplitude-encoded quan- tum state preparation, multi-level QWPT feature extraction, and behavioral analysis via Shannon Entropy profiling and Chi-square testing. Features are classified using QSVM with fidelity-based quantum kernels optimized through hybrid train- ing with simultaneous perturbation stochastic approximation (SPSA) optimizer. Evaluation under noiseless and depolarizing noise conditions demonstrates exceptional performance: 96.67

Industrial Control Systems (ICS) are increasingly targeted by distributed denial-of-service (DDoS) attacks, posing significant risks to system availability and reliability. This research proposes a novel defensive framework for ICS networks based on Software-Defined Networking (SDN). The main objectives are to enhance resilience against DDoS attacks and maintain critical system functions. Our framework combines automated traffic control (ATC) to filter and bypass malicious traffic dynamically, and Moving Target Defense techniques such as proactive IP shuffling and network redundancy to protect critical nodes. Experimental results show that the proposed approach effectively reduces CPU load, improves round-trip time (RTT), lowers packet drop rate (PDR) during DDoS scenarios. These findings demonstrate that integrating SDN-based ATC and MTD strategies can significantly strengthen ICS security and ensure system availability, providing robust solution for critical infrastructure protection.