Computer Science and Mathematics

Abstract: Intrusion detection systems often operate with incomplete information. Rule bases may contain gaps, attack types may be rare or previously unseen, labels may arrive late, sensors may capture only part of an event, and some observations may be poorly represented in the training data. However, many studies still use static closed-world evaluations and assume that providing an explanation makes a system trustworthy. This structured narrative survey examines explainable intrusion detection using the concept of incomplete information, defined as a lack of evidence needed to justify a label, score, abstention, escalation, or response. It distinguishes incomplete information from uncertainty, class imbalance, concept drift, privacy, federated learning, and adaptation. The review covers fuzzy rule interpolation, network and device evidence, post hoc explainable artificial intelligence, adversarial robustness and recovery, distributed and adaptive learning, and edge/fog/cloud deployment. Three main findings emerge. First, no single method addresses every information gap. Fuzzy rule interpola-tion directly addresses missing coverage in sparse fuzzy rule bases, while other methods are relevant only when they target a clearly defined information problem and are tested under matching conditions. Second, an explanation is credible only when its fidelity, stability, semantic validity, computational cost, and disclosure of information limits are evaluated for the intended task. Third, deployment design and governance determine whether an output can support operational action. The survey proposes a six-axis taxonomy, seven evidence streams, a tiered deployment architecture, an integrated evaluation and benchmarking protocol, design and reporting templates, and a research agenda. The framework links each conclusion to the tested information condition, stress model, computational tier, and authority boundary.

Abstract:

The growing integration of cyber, physical, and operational security functions has created a need for assessment approaches that evaluate security convergence as an organisational capability rather than as a set of isolated controls. This article proposes the Converged Security Maturity Index (CSMI), a conceptual maturity model designed to assess the level of integration among cybersecurity, physical security, and operational security within organisations. The model is developed using a design science research approach grounded in a structured review of converged security literature, cyber-physical system security, and existing maturity frameworks. CSMI comprises five progressive maturity levels—Fragmented, Coordinated, Integrated, Unified, and Optimised—and evaluates organisational capabilities across four dimensions: governance and strategy, processes and incident management, technology and infrastructure integration, and human factors and security culture. The article describes the architecture of the model, the rationale for each maturity level and dimension, and outlines how the framework could be applied in practice through a structured questionnaire in future work. The proposed framework aims to support organisational self-assessment, benchmarking, and identification of convergence gaps across different sectors.

Abstract: Established symmetric encryption schemes rely on short key lengths, typically between 128 and 256 bits. However, well-known physical key exchange schemes such as QKD (Quantum Key Distribution) and RKD (Radio Signal Key Distribution) generate megabits of new key material on a daily, weekly, or other basis. This article presents a new encryption scheme, called OTPH, which was specifically designed for these megabits of regularly generated new key material. In this scheme, the key material is treated as an extremely long key, and the key’s enormous entropy is fully exploited. OTPH first uses a bit-selection procedure that randomly selects bits from the circularly arranged key, thereby extending the key many times over. From this, a HKDF (Hash Key Derivation Function) derives many new keys, and the result is a bit sequence that serves as the key for encryption using an XOR operation. OTPH uses only the XOR operation and hash function, which are also used in QKD and RKD during postprocessing (albeit a different hash function). An initial cryptanalysis has also been performed for OTPH. OTPH operates in a manner entirely contrary to established methods. It requires a completely new perspective. OTPH will not compete with AES, ChaCha20 etc., but will instead be used primarily in the context of QKD and RKD.

Abstract: Decentralized unmanned aerial vehicle (UAV) swarms require low-latency peer communication while remaining resilient to spoofing, replay, command injection, key compromise, and malicious membership changes. This study develops a zero-trust communication framework that separates the real-time swarm data plane from a permissioned Byzantine-fault-tolerant trust ledger. The method is grounded in an existing GPS-denied UAV software baseline implementing canonical packet hashing, HMAC-SHA256 authentication, trust epochs, timestamp and sequence freshness checks, onboard security-state transitions, command-policy gating, and firmware trust records. The proposed extension introduces per-node identities, authenticated session establishment, AEAD-protected peer traffic, and event-sparse ledger anchoring for trust-changing evidence. Formal models are derived for message acceptance, trust dynamics, Byzantine tolerance, consensus traffic, storage growth, processing overhead, and energy cost. Under a representative analytical case of 100 swarm messages/s, a 1% anchoring ratio reduces ledger event rate and modeled consensus-control traffic by 100 times compared with per-packet anchoring. Repository benchmark measurements are reported separately from blockchain projections. The analysis supports using blockchain as a decentralized trust anchor rather than as a transport for flight-critical telemetry.

Abstract: Prompt injection remains a major security challenge for large language model (LLM) applications because untrusted content from retrieval systems, tools, memory, or multi-turn interactions can influence model behaviour without an enforced control–data boundary. This paper presents ChainGuard, a locally executable runtime security architecture that combines provenance-aware input handling, semantic and lexical analysis, lightweight local classification, bounded conversational state, policy enforcement, and output leakage detection. The finalized detector was evaluated on a researcher-authored post-development holdout comprising 80 attack sessions and 100 benign sessions, together with a matched transparent lexical baseline. ChainGuard detected 61 of 80 attack sessions (76.25%; 95% CI: 65.86–84.24%) while falsely blocking 7 of 100 benign sessions (7.0%; 95% CI: 3.43–13.75%). The lexical baseline detected 1.25% of attacks with a 6.0% false-block rate, and paired attack outcomes significantly favoured ChainGuard (exact McNemar p<0.001). Detection was strongest for encoding, obfuscation, and indirect source injection, while multilingual attacks and protected-text transformations remained the main sources of detector escape. These results show that the integrated ChainGuard architecture provides substantially broader detector-level coverage than the evaluated lexical baseline while remaining lightweight, local, and auditable. The study also highlights the need for future validation against learned guard models and independent public benchmarks.

Abstract: The expansion of the industrial internet of things (IIoT) requires real-time intrusion detection systems (IDS) specifically optimized to detect covert man-in-the-middle (MitM)attacks without sacrificing model transparency, while tree ensembles like XGBoost achieves high accuracy on structured network traffic, they works as blurred decision-making function across thousands of repeated splits, it hides why a specific packet window was flagged as malicious. In safety-critical industrial environments, where false positives cause expensive operational downtime and false negatives lead to physical tragic failure, clear explanations are mandatory, existing XAI frameworks relay on computational expensive post-hoc sampling and evaluate network packets as static isolated instances failing to capture temporal sequence dynamics at line-rate gateways. To address these limitations, we present TSAP-AD a native explainer optimized for a tree-based security pipeline that integrates dynamic sequence warping with single-pass native linear attributions; it combines a Numba-accelerated Dynamic Time Warping (DTW) sequence alignment feature operating with Sakoe-Chiba constrained window with a single-pass, scale-normalized baseline-delta attribution engine. Using a threefold time-series-split cross-validation protocol on the sanitized DNN-EdgeIIoT-2022 dataset, we evaluated the proposed hybrid (XGBoost+DTW) pipeline against a standalone XGBoost baseline and a conventional rule-based DTW detector. The practical results show that while rule-based detectors collapse under non-stationary traffic shift (F1-score dropping from 0.8445 to 0.5053, with 181 false negatives), the proposed hybrid model maintains exceptional stability (F1=0.9983, 0 false negatives across all the folds). Furthermore, using a soft-ranked expert alignment metric (Q-score), TSAP-AD reveals that the hybrid model dynamically increases its attribution wight toward temporal domain anchor during traffic shift (Q=0.2460 vs 0.2295 for standalone XGBoost), this confirms that TSAP-AD provides a transparent, adaptive, and line-rate forensic auditing framework for industrial edge security.

Abstract: With the rapid advancement of quantum computing technology, IoT edge devices widely deployed in industrial settings are facing severe threats to their quantum-resistant security. this work focuses on the challenges of adapting Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC) for resource-constrained environments. this work systematically identifies four critical obstacles: difficulties in physical integration due to device heterogeneity; constraints imposed by the limited computing power and storage resources of edge nodes on PQC algorithm execution; compatibility gaps between QKD/PQC and existing industrial protocols (such as Modbus and Profinet); and the engineering cost pressures associated with large-scale deployment. To address these issues, the paper proposes three lightweight countermeasures:(1) A tiered deployment architecture for quantum-safe security that accommodates device heterogeneity, enabling dynamic trade-offs between security strength and resource overhead; (2) middleware facilitating the synergy of quantum-classical hybrid network protocols, ensuring seamless integration between QKD/PQC and industrial control protocols; and (3) a distributed key management mechanism featuring three-level collaboration—edge node, network proxy, and central system—which offloads computation- and storage-intensive tasks to high-resource nodes, thereby alleviating bottlenecks at the edge. Experimental validation within a smart manufacturing factory's sensor network demonstrates that this scheme maintains quantum-safe capabilities while reducing per-node deployment costs by approximately 81.7% compared to pure QKD solutions and by about 32% compared to pure PQC solutions, all while facilitating seamless, non-disruptive upgrades. This study indicates that lightweight algorithm design, hardware-software co-optimization, and tiered architectural deployment constitute a viable pathway for advancing IoT edge security into the quantum-safe era.

Abstract: Network intrusion detection requires accurate classification of high-volume network traffic while maintaining reliable evaluation and practical analyst support. This study presents a supervised network anomaly-classification workflow using the BigFlow-NIDS V2 benchmark, integrating leakage-aware data separation, SMOTE-Tomek balancing, FlowTransformer classification, confidence and novelty scoring, bounded Large Language Model (LLM) assistance, and analyst triage. The quantitative experiment uses a controlled binary subset of Benign and Scanning traffic, comprising 3,972 usable flows and 795 independent test observations. On the independent test set, FlowTransformer achieved 0.9107 accuracy, 0.9119 macro-precision, 0.9105 macro-recall, 0.9106 macro-F1, 0.9105 balanced accuracy, MCC of 0.8225, Cohen's kappa of 0.8213, and macro PR-AUC of 0.959. A RandomForest baseline achieved 0.9308 accuracy. Paired McNemar, Wilcoxon, and t-tests indicated a statistically significant difference, with the baseline performing better on this test set. The LLM was restricted to bounded advisory analysis, while analyst triage remained separate from model outputs. The results provide a reproducible binary evaluation and a basis for extending the workflow to the full multiclass benchmark.

Abstract: We present the Defactorized Homomorphic Polynomial Public Key (D-HPPK) Encapsulation Mechanism, a post-quantum cryptosystem whose security reduces to searching over the ephemeral secret x in F_p. Classical secret recovery requires Θ(2^l) field-element trials, with O(L₂) bit operations per trial, yielding l+2log₂L bits of classical security and l/2+log₂L bits of quantum security. The scheme uses a three-layer architecture of additive random masking and hidden ring embeddings. Masking destroys exploitable factorisation structure, while hidden moduli S₁,S₂ and multipliers R₁,R₂ (all coprime to p) prevent adversaries from evaluating the cancellation condition in F_p. Key recovery requires O(p³) operations and is not the bottleneck. Under the Hidden Modulus Product Problem and uniform decryption assumptions, we prove the base PKE satisfies message-recovery security; a double-encryption consistency check yields IND-CCA2 security in the random oracle model. A unified parameter set (n=2,m=3,log₂p=λ) ensures efficient, uniquely invertible decryption at NIST security levels. At Level V (λ=256), D-HPPK achieves a 1234-byte public key and 392-byte CCA2 ciphertext — 21% smaller public keys and 87% smaller ciphertexts than Kyber-1024 — with 8× faster encapsulation and 4× faster decapsulation in reference implementations, all without requiring SIMD or NTT acceleration. A single implementation scales across levels. D-HPPK demonstrates that polynomial-based cryptography can deliver rigorous security, compact footprints, and practical efficiency.

Abstract: Sparse relation tables arise when users contribute sets of user–item, learner–concept, or user location pairs. We study population relation-matrix estimation under personalized local differential privacy with heterogeneous budgets and Byzantine report replacement. The target is globally sparse, without low-rank assumptions. We propose a joint personalized relation sketch (JPRS), a set-level mechanism mapping each capped relation set to one personalized bit through a public pair-safe signed score. Its decoder combines channel amplitude weighting with sparse capped-simplex projection. Two budget functionals distinguish honest channel information from adversarial leverage. Under strong privacy, we establish a contamination-trimmed minimax lower bound over all local channels and an upper bound for JPRS against adaptive valid-output attacks from a precommitted corrupted identity set. The bounds match up to support-search logarithms on regular budget classes. In homogeneous settings, recovery requires the effective private sample size to dominate the structural scale and contamination to vanish relative to epsilon. Experiments on six synthetic scenarios and three processed public datasets show that JPRS achieves the lowest private loss and reduces endpoint loss by 23% relative to the best non-JPRS private comparator. These results characterize how personalized privacy, sparsity, and Byzantine contamination jointly determine recoverability.

Abstract: Unmanned Aerial Vehicle (UAV) swarms are an essential asset in mission-critical and tactical environments due to their low cost, mass production, portability, and mobility compared to other assets. Their low-resource nature may lead to unstable computation and network delays in contested areas, making the UAV nodes unresponsive. Thus, ensuring secure, low-latency collective communication and authentication is of main interest. More importantly, ensuring decentralised and autonomous swarms model requires lightweight cryptographic protocols, which are one of the critical barriers to the widespread adoption. Threshold signature schemes, such as FROST, typically necessitate multiple rounds of communication to coordinate ephemeral nonces, introducing prohibitive latency and high energy consumption in bandwidth-limited UAV networks. In this work, we specify and evaluate SRTS, a Shoup-aligned, batch-extracted threshold Schnorr composition whose online signing stage requires one signature-share round after a presignature slot has been irrevocably assigned and a unique finalization certificate is available. We compare SRTS with FROST, tBLS, and MuSig2.

Abstract: This work presents a complete power side-channel evaluation of the MAYO secret linear map on a constrained embedded target, together with a first-order countermeasure evaluated on the same hardware. While MAYO ranks among the most embedded-friendly candidates in the National Institute of Standards and Technology (NIST) additional signatures call, its defensive counterpart remains underdeveloped, as few countermeasures are quantified against an explicit leakage threshold. A two-fold study is realized, where the unprotected map O·xi over GF(16) is evaluated against a masked and row-shuffled variant under an identical acquisition procedure. Test Vector Leakage Assessment (TVLA) of the unprotected map peaks at |t|=53.7 fixed-versus-random and at |t|=195.7 under a secret-dependent fixed-versus-fixed test, while a non-profiled Correlation Power Analysis (CPA) resolving the multiplicative-identity alias and temporal row-mixing recovers 5 of 8 first-row nibbles, thus collapsing the row search space from 168 to 24 candidates. The proposed countermeasure combines masking with per-pass row shuffling, in order to suppress the micro-architectural residue that masking alone leaves. The proposed countermeasure realizes a leakage reduction approaching 54×, to |t|=3.62 with no failing point out of 24,000, at roughly 2.22× cycles. The experimental evaluations were performed in a real-world deployment on an STM32F303 (ARM Cortex-M4) measured with a ChipWhisperer-Lite.

Abstract: The rapid development of artificial intelligence (AI)-driven edge sensing is transforming the intelligent healthcare paradigms that are based on Internet of Things (IoT) networks, supporting both real-time patient monitoring and autonomous clinical decision-making at an unparalleled level. Although there are many unaddressed threats with the current transformation (healthcare IoT sensing), it is still vulnerable to those threats. The current security frameworks individually mitigate each of those unaddressed threats; however, they create multiple vulnerabilities throughout the entire lifecycle of an operational healthcare sensing system. In this paper, we present a novel, quantum-resistant, forensic-aware security lifecycle framework for AI-edge sensing in intelligent healthcare IoT applications. This new framework includes four independent but related lifecycle elements, which include: 1) designing with quantum-resistant security features, 2) secure operation of AI edge sensing on healthcare IoT devices, 3) AI-driven threat detection of healthcare IoT systems, 4) forensic-aware incident investigation. The three cross-cutting layers, which provide quantum resistance, forensic awareness, and AI-driven edge intelligence, support these life cycles. Furthermore, this paper also conducted multiple scenario-based assessments of the framework’s applicability and identified a structure for a future research agenda. All these activities illustrate how the proposed framework can provide a comprehensive platform for designing next-generation IoT sensing systems in healthcare that are intelligent, quantum-safe and forensically accountable.

Abstract: Large language model (LLM)-based agents are evolving from conversational assistants into agents for computer use (ACUs) that read files, invoke applications, communicate over networks, and operate graphical interfaces. This transition moves the effective security boundary from model inputs and outputs to autonomous actions that alter endpoint state. Existing controls, including prompt filters, tool allowlists, network data loss prevention, and endpoint monitoring, provide only partial protection because they do not jointly evaluate task intent, resource sensitivity, destination trust, and the provenance of instructions propagated across agents. This paper presents ARES (Agent Resource Enforcement and Security), an action-centric endpoint security framework that inserts enforceable authorization between agent-generated tool calls and protected resources. ARES combines a Resource Proxy Layer for resource-specific interception, a Behavioral Guardrail Engine for task- and context-aware authorization, and a Multi-Agent Trust Boundary Manager for provenance and taint propagation. We implement ARES-lite with file and network proxies, deterministic pre-execution policies, inter-agent taint tracking, and structured audit logging, and evaluate it in a controlled synthetic workspace against file exfiltration through indirect prompt injection, prompt infection propagation, and internal-network access abuse. The integrated design interrupts the evaluated attack paths while preserving expected benign handling with low measured local decision latency in the controlled prototype, supporting action-centric mediation as a practical complement to prompt-centric safeguards.

Abstract: The rapid evolution of Large Language Models (LLMs) from static text generators to autonomous agents has revolutionized their ability to perceive, reason, and act within complex environments. However, this transition shifts the security problem from model-level robustness to system-level engineering. The conflation of instructions and data, persistent cognitive states, and untrusted coordination create structural risks that are not adequately captured by traditional adversarial robustness. To address the fragmented nature of the existing literature, this article presents a comprehensive and systematic survey of the security landscape for LLM-based agents. We propose a novel, structure-aware taxonomy that categorizes threats into three distinct paradigms: (1) External Interaction Attacks, which exploit vulnerabilities in perception interfaces and tool usage; (2) Internal Cognitive Attacks, which compromise the integrity of reasoning chains and memory mechanisms; and (3) Multi-Agent Collaboration Attacks, which manipulate communication protocols and collective decision-making. Adapting to this threat landscape, we systematize existing mitigation strategies into a unified defense framework that includes input sanitization, cognitive fortification, and collaborative consensus. In addition, we provide an in-depth comparative analysis of agent-specific security evaluation benchmarks. The survey concludes by outlining critical open problems and future research directions, aiming to foster the development of next-generation agents that are not only autonomous but also secure and trustworthy. The companion repository is available at https://github.com/sunyinggang/LLM-Agent-Security-Survey.

Abstract: Task offloading in vehicular edge networks must satisfy strict latency limits. At the same time, it must resist security threats such as replay attacks. Existing offloading models treat cryptographic settings as fixed, separate from the scheduling decision. This is a real gap, and it exists in part because jointly choosing the best node and the best cryptographic curve for each task is computationally hard. We prove that this joint problem reduces to a generalized assignment problem, a well-known NP-hard problem, once curve-selection variables are fixed. Because of this hardness, we design a polynomial-time greedy heuristic as a practical approximation. Our model treats Elliptic Curve Cryptography (ECC) curve selection as an adaptive decision, and jointly optimizes it together with latency, CPU load, and bandwidth, using one unified scoring function. Results: Task success rate (TSR) with dynamic ECC is within 0.3 percentage points of latency-only scheduling (85.27% vs. 85.58%), while replay success falls from 100% to 8.93%, more than a 10-fold reduction. A single fixed curve that never refreshes (static ECC) performs far worse on both counts (40.29% TSR, 84.54% replay success), since it cannot serve tasks needing stronger security and accumulates staleness without bound. Measured cryptographic overhead is 0.34–1.19 ms per task depending on curve, and the heuristic runs within roughly 2.34% of an exact ILP bound at full scale. These results, from an openly available Python simulation, confirm real-time feasibility for IoT-enabled vehicular deployments.

Abstract: Autonomous AI agents now hold funds, delegate authority to other agents, and transact at machine speed; the governance apparatus meant to constrain them—policies, audits, compliance—remains documentation-based and human-latency. This mismatch cannot be closed by better monitoring or filtering: compliance must become a runtime, compositional, proof-carrying property of computation itself. We call the resulting discipline computational jurisprudence. This article surveys the four literatures the discipline must synthesize: object-capability security; verifiable, proof-carrying, and zero-knowledge computation; policy-as-code and computational law; and agentic AI with its emerging payment protocols. Each supplies a mature mechanism the others lack; none supplies a complete normative substrate. The synthesis is organized in three pillars: (i) a delegation calculus under which authority can only attenuate as it propagates between agents; (ii) runtime compliance proofs, a three-tier evidence regime (attested, optimistic, and zero-knowledge); and (iii) sealed delegation chains with graduated attribution, which reconcile the privacy of capability-based authority with the accountability that adjudication requires. A case study on agentic payment protocols grounds the architecture and reports first measurements: capability verification versus a centralized policy decision point, end-to-end enforcement on the x402 payment path, and accumulator-based revocation. Seven open problems define the research agenda.

Abstract: This article presents the development of an optimized cross-platform post-quantum cryptographic (PQC) library that enhances the cryptographic security of data, networks and IT infrastructures in real-world organizational environments. Classical cryptographic standards such as RSA and ECC face existential threats from the advent of quantum computing, necessitating an urgent transition to quantum-resistant cryptographic algorithms. By optimizing execution speed through AVX2 vectorization via compiler intrinsics and ensuring portability across different operating environments, this work demonstrates the feasibility of deploying high-performance PQC in today's operational systems. The approach bridges PQC research to practical systems by integrating ML-DSA and ML-KEM implementations into a single compiled library, while adapting PQC implementations for cross-platform portability. Benchmarking results demonstrate up to a fourfold improvement in execution speed over reference implementations. This work strengthens an organization's security posture in the face of quantum computing threats and enables long-term cryptographic resiliency across diverse platform environments.

Abstract: While Federated Learning offers a decentralized approach to model training, ensuring the integrity of the information from each IoT client remains a challenge. This work delves into the dynamics of Multi-Stage Federated Learning, its susceptibility to information integrity attacks, and how to defend against such threats. A comprehensive understanding of data uncertainty and the challenges of poisoning attacks is discussed, laying a solid groundwork for the proposed defense mechanisms. At its core, this paper introduces a novel Multi-Stage Federated Learning model that segments the Federated Learning process into distinct phases with a novel approach of inertial momentum aware Inexact Augmented Lagrange Multiplier Robust PCA with constant momentum factor and unaltered norm of the traditional one, each tailored to optimize for both efficiency and security. This robust framework is then tested against data injection based poisoning attacks, using sparse noise, and demonstrates the effectiveness of the proposed recovery techniques like Robust PCA. Performance results highlight the resilience and efficacy of the introduced model with novel reconstruction algorithm, emphasizing the importance of this approach in real-world IoT settings. Data analysis, model summaries, and impacts of adversarial attacks further reinforce the findings, which are evaluated using rigorous statistical metrics and machine learning algorithms. The paper concludes by acknowledging its efficacy in detection and recovery from data poisoning attacks, improving robustness and data reconstruction in IoT environments while highlighting opportunities for further security enhancements.

Abstract: Proactive cyber defense requires defenders to anticipate attacker behavior and respond before breaches occur. However, existing game-theoretic models rarely integrate attack behavior simulation with temporal-aware payoff structures. This paper proposes a Stackelberg game framework for proactive cyber defense that combines Monte Carlo-based attack behavior simulation with a multi-stage, time-discounted payoff function. The defender, modeled as the Stackelberg leader, commits to an optimal mixed strategy by leveraging simulation-derived attack path predictions across five Cyber Kill Chain (CKC) stages over a 5-action defense space (|A_D| = 5) against five attacker actions (|A_A| = 5). A simulation confidence factor S quantifies prediction accuracy and is embedded directly into the defender payoff function, creating incentive-compatible alignment between simulation quality and strategic gain. Bayesian belief updates—augmented with simulation evidence—enable real-time attacker type inference under incomplete information. A fictitious play algorithm with provable convergence computes the Strong Stackelberg Equilibrium (SSE). Experimental results on a 10-node network demonstrate that the proposed framework reduces response latency by 22.9% and achieves a 4.9% payoff gain compared to Bayesian Nash Equilibrium (BNE) baselines, with convergence at 199 iterations versus 354 for BNE—a 43.8% reduction.