Computer Science and Mathematics

Abstract: Low-altitude autonomous mobility research requires unmanned aerial vehicle platforms that are affordable, experimentally transparent, and safe enough for repeated indoor and near-ground validation. This paper presents a reproducible safety-aware ESP32-based quadrotor testbed designed as an open experimental platform rather than a sealed commercial flight product. The system integrates an ESP32 flight controller, an ESP32 remote controller, IMU-based attitude estimation, PID stabilization, PWM motor actuation, ESP-NOW communication, telemetry feedback, parameter synchronization, and over-the-air maintenance support. The platform is structured around three design objectives: reproducibility, firmware-level safety awareness, and blackbox-supported diagnosis . The safety architecture includes arming and disarming logic, throttle initialization checks, communication fail-safe, low-voltage warning, ESC-calibration isolation, visual state indication, and tilt/collision shutdown. The diagnostic layer records runtime variables, including battery voltage, compensation factors, attitude angles, PID outputs, offsets, motor commands, communication status, loop timing, and logging overhead. These data support post-flight analysis, controller tuning, offset correction, and repeatable comparison across experiments. Validation was conducted through staged ground tests and conservative indoor low-altitude hover trials. The results indicate that the platform can support short-duration stable hovering with pitch and roll deviations within approximately ±5°, end-to-end control response of about 50–80 ms, and indoor ESP-NOW latency of about 20–40 ms, while maintaining a total prototype cost below approximately USD 200. The contribution of this work is not maximum flight performance or full autonomous mission execution, but the integration of low cost, transparent firmware, explicit safety logic, and data-driven diagnostic workflow into a coherent quadrotor research testbed. The proposed platform provides a practical foundation for embedded-systems education, low-altitude UAV experimentation, and future extensions toward sensing, autonomy, and comparative controller evaluation.

Abstract: Higher education institutions operate complex digital environments that combine administrative services, research infrastructures, learning platforms, identity systems, and heterogeneous departmental IT. In the European Union, the NIS2 Directive increases the need for structured cybersecurity governance, while ISO/IEC 27001:2022 provides a mature information security management system standard that can support implementation. This paper proposes a design-science artefact for aligning NIS2 obligations with ISO/IEC 27001:2022 clauses and Annex A controls in the context of higher education institutions. The framework organizes cybersecurity governance, asset and service scoping, risk management, incident handling, business continuity, supplier and cloud dependencies, access control, awareness, monitoring, and continual improvement into a staged maturity model. The artefact is instantiated for a Romanian public university context and assessed through internal traceability analysis, including mappings between NIS2 Articles 20, 21, and 23, Romanian NIS2 transposition requirements, and ISO/IEC 27001:2022 control areas. The maturity values used in the institutional illustration are indicative and do not constitute audit findings or empirical validation. The contribution is therefore a structured and reusable compliance-design artefact, together with a transparent mapping method that can support future expert validation, institutional pilots, and audit-oriented refinement.

Abstract: This study introduces a proof-of-concept methodology for hypergraph-based decomposition aimed at identifying coherent thematic structures within OpenAlex bibliometric records on science governance spanning the period from 2022 to 2026. A total of 17,034 records were exported, containing 153,765 keywords, of which 8,153 were unique. The keyword sets of these bibliometric records were conceptualized as hyperedges within a hypergraph. The partitioning of the hypergraph into four balanced blocks was executed using the Mt-KaHyPar algorithm, applying the developer-recommended parameters for high-quality partitioning. The underlying pipeline operations proceed by first applying balanced hypergraph partitioning to extract tightly coupled blocks, and then filtering bibliometric records by three keywords from blocks. To articulate the specific themes of the key terms associated with each block, several highly relevant publications and a concise summary of the potential research topic were generated for each block usingPerplexity.ai. The results demonstrate the rationality of utilizing a co-occurrence criterion based on three or more keywords within a single bibliometric record. Two of the four extracted blocks contain the most frequently occurring terms; one reflects the theme of corporate governance, politics, and sustainability, while the other encompasses business, political science, finance, sociology, and law. Conversely, the remaining two blocks tend to reflect emergent domains that may hold significant future research potential: one centers on landscape assessment, landscape design, and soil water, while the other focuses on digital marketing, tax reform, and customer intelligence. The suggested workflow can serve as a methodological template for mapping science and identifying current research topics.

Abstract: The task of training machines to “understand” legal language has proven to be non-trivial. Large language models (LLMs) represent a cutting-edge breakthrough in the deep learning models designed for processing human languages. A private LLM is a controlled AI system that uses proprietary data to generate responses while enforcing security, access control, and governance. This study created a retrieval-augmented generation (RAG) local LLM to ensure accurate and traceable outputs: several chat models were locally installed, including Reasoner v1, Llama 3 8B Instruct, DeepSeek-R1-Distill-Qwen-14B, Mistral Instruct, Orca2 (Full), Wizard v1.2, Hermes, Snoozy, and Phi-3 Mini Instruct. All models were tested, but final analysis was performed using Llama 3 8B Instruct. The LLM based on Llama 3 8B Instruct indexed Book Four of the Civil Code of Catalonia relating to Successions and the regulations of the Notary Profession of Spain for summarization and answering questions in a context of increased security. The model summarized and replied to specific questions in a reasonable manner in terms of fluency (3+, 80%), coherence (3+, 80%), factuality (3+, 40%; 2+, 60%), and relevance (3+, 60%) metrics, but was not absent of information loss and contextual misinterpretation in complex questions. In comparison with Grok 4.2 and GPT5, the local LLM had comparable content quality, it was characterized by answers of less length and less sources, but replies of higher similarity to human (% human similarity) (all P values < 0.005). In conclusion, in the field of legal sciences, this technology represents an opportunity. However, only precise information and secure legal reliability should be considered valid.

Abstract: This work introduces a framework in which signals are represented as probability distributions over a generalized phase space, and organization is defined as a measure of structured conformity relative to an expected distribution. Existing approaches based on energy and entropy characterize magnitude and statistical dispersion but do not explicitly describe the persistence of structural configurations. The proposed methodology defines organization through occupancy deviation using divergence measures and introduces a recognition boundary that determines whether a structured configuration remains identifiable. The framework is illustrated through conceptual and quantitative examples, including structured pattern degradation, visual acuity limits, and channel constraints modeled as restricted observable regions. The results demonstrate that entropy and organization can evolve independently, with structural identity degrading even when entropy remains approximately constant. Additionally, observability is shown to be a critical factor, as insufficient contrast or measurement sensitivity may prevent structure recognition despite its physical presence. These findings support the interpretation of communication and sensing systems as processes governed by the preservation of recognizable structure rather than energy alone. The proposed formulation provides a complementary perspective to entropy-based methods for analyzing signal processing, detection, and communication systems.

Abstract: Traffic inside a cloud Virtual Private Cloud (VPC) is filtered by two layers with fun-damentally different semantics: a stateless, ordered, first-match Network ACL (NACL) and a stateful, unordered, allow-only Security Group (SG). Existing analyzers decide point-to-point reachability using SMT, Datalog, or BDD search, but do not identify, at the rule level, which rules are dead, redundant, or dominated, nor explain why. We give a closed-form set algebra over the two layers. Representing each rule field by its boundaries makes a rule a hyper-rectangle and a layer a union of boxes; the effective admitted region Phi = A(N) ∩ A(G) is then a finite union of disjoint boxes computable from rule endpoints alone. We define a taxonomy of cross-layer anomalies-dead SG rules, Phi-redundant rules, Phi-ineffective NACL allows, and layer disagree-ment-characterize each by a decidable region predicate, and prove an exact iff-condition for SG Phi-redundancy. A boundary-only detection algorithm is sound and complete, running in O((k+t)^d) time for fixed dimension d, and the disjoint box decomposition of Phi gives a canonical, anomaly-free normal form. A single-file im-plementation matches brute force on millions of packets, staying orders of magnitude below the worst-case bound; the parametric model extends unchanged to IPv6 and ICMP.

Abstract: The DR Code (Data Restorable Code), originally proposed by Sriphum (2013), is a two-dimensional barcode that achieves a 33% data-recovery rate against six distinct cases of strip-shaped data loss using simple XOR-based parity. The original work presented a single 3×3 arrangement of nine logical blocks (A0, A1, A2, B0, B1, B2, C0, C1, C2) in which each row and each column contains exactly one element from each of the three data classes (A, B, C). This paper systematically enumerates every 3×3 arrangement that satisfies this recoverability property and proves, by exhaustive search released as an open-source program (DR15.py), that exactly 2,592 such arrangements exist. We then introduce five structural theorems—mirror reflection, vertical flipping, Tetris-style rotation, cyclic column rotation, and cyclic row rotation—and prove that each preserves recoverability. We show that these five generators, viewed as a group action, produce a finite group of order 72 isomorphic to D₄ × C₃ × C₃, which partitions the 2,592 patterns into exactly 36 absolute equivalence classes. We further explore the partial-quotient structure under D₄ alone (yielding 324 classes, the case the practitioner is most likely to encounter) and under cyclic-only quotient (yielding 288 classes). As practical contributions, we propose (i) a compact equivalence-class encoding that reduces the storage cost of one DR Code template from a naïve 36 bits to 12 bits, and (ii) a canonical-form deduplication scheme suitable for cloud and embedded storage systems. Additionally, we propose two further contributions: a fast pattern-validity oracle based on canonical lookup, and a randomization-friendly DR Code variant for security-aware barcode applications. Empirical results confirm all theorems on the full enumeration of 2,592 patterns.

Abstract: The unauthorized internal movement of classified documents represents a significant threat to information security because it compromises accountability, traceability, and document control mechanisms. This case study examines a fictional but operationally realistic incident involving the informal transfer of a NATO “Confidential” document within a Portuguese government institution. The document was moved between departments without a transfer form, prior authorization, receipt, or signature, with poor registry update, resulting in a six-day discrepancy between the document's physical location and its recorded location in the Central Registry. Using a technical-operating approach, the study analyses the sequence of events, identifies procedural failures, evaluates the resulting risks, and examines their impact on the chain of custody and organization accountability. Attention is given to the risks of document loss, unauthorized access, registry inaccuracy, and weakened auditability. The study proposes a formal document movement framework based on mandatory transfer documentation, centralized real-time recording, dual validation by sender and receiver, return deadlines, automated escalation mechanisms, and periodic audits. The findings demonstrate that effective protection of classified information depends not only on regulatory requirements but also on the consistent application of enforceable procedural controls capable of preventing and rapidly detecting non-compliant document movements.

Abstract: This paper presents a structured technical-operational case study concerning the improper use of a personal mobile device within a classified communications operations centre. The scenario examines an incident in which an operator connected a personal mobile phone to a classified workstation through a USB interface, intending only to charge the device. However, the workstation operating system automatically mounted the device and established an unauthorised data communication interface. A later routine audit identified evidence of a data transfer between the classified workstation and the personal device, raising concerns regarding potential exposure of classified information. The investigation was significantly constrained by the absence of real-time connection logs, device authentication records, a complete audit trail, and a documented chain of custody for any data potentially transferred. The analysis identifies technical, procedural, and human failures, including unrestricted USB ports, lack of removable media control, insufficient logging, absence of formal personal device policies, and inadequate operator awareness. Corrective and preventive measures are proposed across access control, media protection, monitoring, incident response, evidence preservation, and auditable compliance. The expected outcome of these measures is the restoration of operational control, the enforcement of accountability, the strengthening of continuous monitoring, and the establishment of verifiable evidence that classified information is handled in accordance with security requirements. As a simulated and anonymised scenario, the case does not involve real classified information but provides a transferable model for analysing comparable risks in sensitive or regulated environments. The findings are particularly relevant for critical systems environments, where the improper connection of personal mobile devices to classified workstations may affect operational continuity, resilience, accountability, auditability, and the protection of sensitive or classified information.

Abstract: This paper presents a study on the use of a microservices-based composite architecture for building a digital twin. It substantiates the importance of consciously choosing an architecture for a digital twin system. It proposes considering the twin as a high-order, multi-agent, distributed system that incorporates similar systems. It proposes using a microservices-based composite architecture as the foundation for building such systems. The key aspects and advantages of using such an architecture are described, noting its flexibility, scalability, and integrability with existing solutions. Potential for reducing cognitive complexity and building a conveyor-based organization for the production of the system itself is highlighted. A digital twin architecture is proposed, accompanied by a diagram and additional clarification of internal rules. The need for system components to comply with a number of responsibilities for the correct operation of such architectures is noted: contract persistence, environmental persistence, responsibility persistence, versioned changes persistence, and documentation completeness persistence. The possibility of using Domain-Driven Design (DDD) as a basis for dividing the system into subsystems is separately noted.

Abstract: In a simulated scenario involving a Portuguese company cleared to provide technological infrastructure and communications services to a public entity in an environment supporting critical systems, a newly hired technician entered a restricted technical room that was also being used for document storage, using an access card lent by his supervisor. While on site, he opened an unlocked cabinet, photographed part of a logical network diagram, and shared the image in an internal WhatsApp group, exposing documentation marked, for the purposes of the scenario, as RESERVADO (RESTRICTED) and CONFIDENCIAL (CONFIDENTIAL). The incident affected confidentiality, access traceability, and the chain of custody. The case is framed by the Portuguese regime for the protection of classified material, supported by SEGNAC and GNS guidance, and is analysed with complementary reference to ISO/IEC 27001:2022, ISO/IEC 27002:2022, ISO/IEC 27005:2022, NIST SP 800-116 Rev. 1, and NIST SP 800-53 Rev. 5. The main failures include the informal lending of an access card, insufficient authentication, absence of CCTV and alarm mechanisms, logs associated only with the credential, insufficiently reviewed access permissions, inadequate storage, and insufficient training. The proposed measures involve containment, preservation of evidence, physical inventory, access review, strengthened authentication, document segregation, control of mobile devices, training, and periodic auditing, with the aim of strengthening physical access control, compliance, accountability, and operational security.

Abstract: Indoor passage monitoring requires people-count estimation, behavior recognition and identity association while avoiding privacy-invasive sensing. This paper presents an identity-aware RFID sensing framework that combines wearable EPC identity tags, a wall-mounted passive tag array and distance-aware RSSI temporal modeling. Identity-tag readings and multi-channel tag-array RSSI sequences are aligned on a unified reader-timestamp timeline. An effective behavior duration (EBD) mechanism removes invalid or weak-occlusion windows before model inference. Target count, behavior state and identity association are then estimated using a three-branch LSTM constrained by physical RSSI attenuation priors. A subject-independent dataset was collected with 18 array tags and 18 volunteers across single-person, multi-person, crossing and following scenarios, yielding 11,148 EBD-valid windows. On the test set, the proposed method achieves a mean absolute error (MAE) of 0.226, a root mean square error (RMSE) of 0.357, a Macro-F1 of 0.934 and an identity-association accuracy of 0.961. Relative to threshold rules, traditional machine learning and a single-branch LSTM, the MAE is reduced by 59.5%, 46.1% and 28.9%, respectively, and the RMSE is reduced by 55.8%, 43.5% and 28.9%, respectively. The results show that native RFID identity, spatial tag-array sensing, EBD screening and distance-aware temporal modeling can jointly support low-cost, reproducible and privacy-preserving people-flow monitoring in smart-building environments.

Abstract: Modern LLM-powered question answering (QA) systems are no longer merely single-step generators. They increasingly operate as analytical pipelines that interpret user intents from natural language questions, plan reasoning steps, bind them to tools or computational resources, execute workflows adaptively, and synthesize verified conclusions. Recent research has introduced a wide range of methods to improve different stages of this process, but these contributions are often studied in isolation or organized around specific application scenarios and generation paradigms. To provide a structured view of this rapidly evolving landscape, we adopt a pipeline-oriented perspective inspired by database query processing. We propose a unified five-stage abstraction: Query Rewriting, Logical Planning, Physical Planning, Execution & Adaptation, and Synthesis & Verification. We focus on QA systems over textual and tabular data, two fundamental modalities that represent unstructured and structured information processing. Within this framework, we develop a taxonomy that maps existing methods to their corresponding stages, distills stage-specific design objectives, and analyzes cross-stage interactions. By reframing LLM-powered QA as an optimizable, engineered pipeline, this survey identifies key research gaps and outlines a principled roadmap for the design of next-generation QA systems.

Abstract: This case study analyses a simulated failure in the certified destruction of classified material within a fictional national defence intelligence processing unit. Four SECRET-level printed pages survived a recorded shredding event, and three flash-based USB drives were returned to circulation after logical deletion and quick-formatting rather than verified sanitisation. The central problem was not a single mechanical or technical error; it was a workflow that allowed destruction to be certified without evidence adequate to prove completion. The study reconstructs the event from an intentionally bounded evidence set, separates observed facts from unresolved questions, and maps the failures to procedural, technical, physical, human, and governance controls. Public standards are used as reference points for control design, while the local thresholds and fictional forms remain scenario assumptions. Risk is assessed through explicit likelihood and impact criteria rather than statistical probability. Pre-treatment risk is rated high because material accountability was lost, intact classified pages remained outside the verified destruction chain for approximately two days, and residual digital artefacts were identified on all three drives. The article proposes corrective and preventive controls focused on written authorisation, count reconciliation, witness verification, media-specific sanitisation, quarantine of uncertain media, training, and audit evidence. The findings should be read as a training and control-analysis model, not as proof of a real compromise or as a universal statement of national classification requirements.The findings are particularly relevant for critical information systems environments, where failures in certified destruction processes may affect operational continuity, accountability, resilience, and trust in security governance mechanisms.

Abstract: Meeting the legal reporting deadline after a cybersecurity incident is, for many organizations, harder than the law suggests. The General Data Protection Regulation requires personal data breaches to be reported to the competent authorities within 72 hours; the NIS2 Directive adds a 24-hour early warning for essential and important entities. Despite the clarity of these deadlines, delayed reporting remains a systemic problem with significant legal, reputational and human consequences. This article analyzes its causes and consequences based on a review of 14 recent academic sources. The results identify three categories of factors: the technical distance between forensic investigation and the legal reporting format; organizational barriers, aggravated in small and medium-sized enterprises; and the ambiguity of regulatory requirements. The consequences include regulatory penalties, aggravated harm to data subjects and chronic under-reporting. The article concludes with recommendations aimed at organizations and legislators. The findings are particularly relevant for critical information systems environments, where delayed incident reporting may affect operational continuity, resilience, regulatory compliance, and coordinated response capabilities.

Abstract: Permission Misconfigurations in Critical Information Systems: A Sociotechnical ReviewAbstract: Why do permission misconfigurations on classified servers keep happening, even after decades of research into access control? This paper digs into that question through a sociotechnical lens. We argue that the root causes stretch well past simple technical mistakes: privilege creep, sloppy change management, legacy constraints, auditing blind spots, murky accountability, and organizational culture all feed the problem. The consequences can be devastating. Accidental spillage of classified material, insider threats that balloon out of proportion, privilege escalation opening doors to lateral movement, and broadened pathways for wholesale data exfiltration. Drawing on standards from NIST, ISO, and NATO, together with documented breaches involving classified information, we make the case that no single technical fix will do the job. Instead, what is needed is an integrated strategy coupling mandatory access control enforcement with continuous monitoring, privileged access management, and a governance culture that treats permission correctness as a first-order security concern, not something to tick off a checklist and forget about. Although the analysis focuses on classified servers, the risks discussed are also relevant to critical information systems more broadly, where incorrect permission configurations may compromise confidentiality, operational continuity, institutional trust and national security.

Abstract: The use of unauthorised communication channels has become a growing security concern inenvironments handling sensitive and operational information. This study analyses the risksassociated with the improper use of non-approved communication platforms through a technical-operational case study based on the 2025 “Signal group chat leak” involving senior United Statesgovernment officials. The study examines how sensitive military-related information was exchangedthrough an unauthorised messaging application, resulting in unintended exposure to an externalparty. The analysis focuses on the operational context of the incident, the sequence of events and theprocedural, technical and human failures that contributed to the breach. Attention is given toweaknesses in communication security policies, lack of monitoring and auditing mechanisms,insufficient participant validation procedures and the influence of operational pressure on userbehaviour. The study also evaluates the risks associated with the incident, especially regardingconfidentiality, accountability and organisational oversight. Based on the identified failures, a set ofcorrective and preventive measures is proposed. The findings highlight the importance of combiningtechnical safeguards, operational discipline and effective policy enforcement to maintain securecommunication environments and reduce the likelihood of similar incidents. Although the case isbased on a governmental and military-related incident, the lessons identified are also applicable tocritical systems and critical infrastructure environments, where communication failures maycompromise operational continuity, institutional accountability and security.

Abstract: In conditions of increasing traffic and limited parking options, mobile apps for real-time monitoring and booking of available spots in public parking lots are becoming an indispensable tool for making our daily lives easier. They offer convenience, save time, and reduce the hassles associated with finding a parking spot, while also contributing to a more efficient and organized urban space. Additionally, they help reduce traffic congestion and lower pollution levels by encouraging users to make more rational use of available parking resources, which benefits all city residents. This article describes the development of a mobile application for real-time parking spot booking. It integrates useful features from existing mobile apps, adds its own new features, and is adapted to the conditions of life in Bulgaria. Its main advantage is that it is available completely free of charge. It ensures the following functionalities: booking or recommending parking; checking vacancies of the parking spot and returning feedback about all current and past parking spot bookings, information for ratings and comments about the respective parking spots. The application's interface is intuitive, which makes it easy to use. The following technologies were used in its development: Java, Android Studio, XML, Gradle, Android SDK, and Firebase. The application has been compared to similar ones, incorporating their best features and adding new ones that improve them. Based on this overview, the current work expands on them and aims to help Bulgarian users to save time and money looking for a parking spot.

Abstract: This paper presents Bit-Pi, a web-based asynchronous learning platform designed to support computer science students beyond the classroom at Paragon International University in Cambodia. Motivated by prior institutional findings that approximately 10% of first-year Computer Science students changed to other majors and that many faced challenges in mathematics, coding, peer pressure, and lack of external support and motivation, [2] the platform operationalizes recommendations from the “Computer Science Playbook” framework. [2] Bit-Pi integrates modular learning material authoring, block-level threaded discussion, search, notifications, and course management into a single institutionally hosted environment for mathematics and programming courses. The system was developed using Rapid Application Development and evaluated through user acceptance testing based on the Technology Acceptance Model (TAM) and basic technical performance tests. [5], [16], [17] Results from 96 students and 4 instructors indicate high perceived usefulness and ease of use, strong intention to continue using the platform, and acceptable performance under typical load. These findings show that a context-specific asynchronous platform can effectively complement existing tools and provide structured beyond-classroom support for computer science students.

Abstract: The rapid expansion of wearable fitness devices has generated an unprecedented volume of personal health data, promoting self-awareness and helping users make healthier lifestyle decisions. Artificial intelligence (AI) is increasingly being embedded in wearable fitness devices, thereby turning passive self-monitoring into personalised coaching with adaptable goals, real-time feedback, and behavioural nudges. Nonetheless, sustained use of these devices remains inconsistent despite their health advantages. This study adopts an interpretive socio-technical perspective to explain how social and technical factors influence sustained use of wearable fitness devices. Drawing on socio-technical theory, analysis of eighteen semi-structured interviews with users of wearable fitness devices for health and fitness tracking provided insights into their lived experiences, which are influenced by their interactions and integration into daily routines. A layered analysis revealed the dynamic complexities that emerge when the social and technical elements interplay, shaping users’ interpretations of the data provided by these devices and their consequent decision to continue using them. A visual thematic map represents a range of patterns and interpretations of social and technical factors derived from users’ lived experiences, shaped by their interplay. The study’s findings suggest that AI-driven features can be an enabler of translating health data into meaningful, actionable feedback, thereby unlocking personalised and contextual coaching capabilities for sustained use.