Computer Science and Mathematics

Abstract: Intrusion detection in microgrid systems is a cyber-physical task that requires correlating different data from networks, hosts, and endpoints to create actionable evidence. Existing approaches largely treat intrusion detection as a classification problem and provide explanations at the sample or feature level. However, these explanations lack physical interpretability and fail to reveal cross-modal interactions underlying system decisions. As a result, operators cannot reliably trace detected anomalies to the physical layer, limiting the ability to diagnose root causes. This leads to incorrect or delayed responses and potentially compromises the safety of microgrid operations. This work proposes a physical and data-link layer explainable intrusion detection framework via cross-modal evidence reasoning. This framework reformulates intrusion detection as an operation Q\&A task over structured multi-modal evidence, including network flows, Software-Defined Networking (SDN) states, system calls, and power measurements. By designing an evidence-based explanation mechanism, sample importance is aligned with structured evidence and aggregated into physical modalities to construct evidence representations. These representations are further transformed into structured features to build joint decision models, enabling the extraction of decision paths and their conversion into interpretable reasoning processes grounded in physical evidence. The proposed framework is evaluated on realistic cyber–physical microgrid datasets. It provides consistent and physically meaningful explanations, revealing distinct cross-modal evidence patterns across different cyber attacks. This work advances intrusion detection from samples to physical-layer reasoning, enabling trustworthy security analysis in microgrid systems.

Abstract: Recent cyber incidents have become increasingly sophisticated through 'Living-off-the-Land (LotL)' techniques that exploit legitimate behavior and multi-stage attacks. This demands advanced reasoning capabilities to discern attack contexts within fragmented, large-scale logs. However, closed network environments with physical network separation (air-gapped), such as national critical infrastructure, restrict the use of high-performance cloud LLMs, limiting the adoption of cutting-edge AI-based analysis technologies. This research proposes a Local LLM-based intrusion analysis framework that can operate independently within closed networks to overcome these constraints. The proposed framework combines (i) an Offline Knowledge Distillation technique that transfers the analytical reasoning process of external high-performance models to the Local LLM after security review, and (ii) an AI agent orchestration structure that controls the analysis procedure step-by-step and suppresses hallucinations. Experiments and validation using the public dataset (Atomic Red Team) demonstrate that the proposed model achieves significantly higher detection accuracy (88.4%) and MITRE ATT&CK mapping performance (0.91 F1-Score) compared to existing general-purpose Local LLMs. Furthermore, it suppressed hallucination rates to 6.2% through an automated verification mechanism and significantly improved analysis efficiency by refining large-scale logs to focus on core events. This study quantitatively demonstrates that AI-based intrusion incident analysis automation is achievable using a single GPU server even under the resource constraints of closed networks, presenting a practical solution for intelligent security monitoring.

Abstract: Operational technology (OT) and information technology (IT) have become increasingly integrated, expanding the attack surface of OT systems. Power from shore has also become more widespread for offshore critical infrastructure, and has introduced new dependencies and the potential for a single point of failure. In addition, the cyber threat landscape is escalating, with state-sponsored actors demonstrating the capabilities and willingness to target industrial systems. Threat actors have been seen using living off the land techniques, such as with the Industroyer malware, which utilized legitimate but malicious IEC 104 commands. To evaluate these vulnerabilities, this study applies a Design Science Research approach to map a generalized substation and develop a Software in the Loop simulator. The simulator was used to test specific attack vectors against substation automation systems. The results confirm that an adversary with local network access can successfully inject valid IEC 61850 MMS commands to trigger unauthorized circuit breaker operations. Furthermore, the results show that it is possible to use a simulated substation as a tool when developing ICS malware. These findings demonstrate that common operational technology protocols lack fundamental security by design, meaning the technical barrier to execute a disruptive attack is low once network access is achieved. Protecting these critical environments requires a robust defense-in-depth strategy that accounts for supply chain risks and enforces strict network segmentation.

Abstract: Network intrusion detection systems (NIDS) play a crucial role in modern network environments where diverse and rapidly evolving traffic patterns are observed. Although deep learning-based NIDS have demonstrated strong performance within specific datasets, their effectiveness significantly degrades when applied to unseen network environments due to domain discrepancies. In this paper, we first experimentally demonstrate the performance degradation of time-series-based NIDS under cross-domain conditions using multiple benchmark datasets. Then, we propose a LoRA-based domain adaptation framework for time-series-based NIDS models. Instead of retraining the entire model, the proposed approach freezes the backbone network and applies low-rank updates to selected layers, enabling parameter-efficient adaptation to new domains. Experimental results show that the proposed method consistently improves cross-domain detection performance across multiple dataset combinations, particularly in terms of recall, while requiring only a small number of additional parameters.

Abstract: Digital transformation has become a major strategic priority for organizations seeking operational efficiency, automation, scalability, and modernization. Despite significant investments in digital infras-tructure and enterprise technologies, many transformation initiatives continue to face organizational resistance, legacy system dependency, cybersecurity exposure, and governance limitations. This study investigates the relationship between digital infrastructure growth, cybersecurity governance, human resistance, and modernization readiness within enterprise digital transformation environments. The analysis integrates publicly available statistical datasets, governance reports, cybersecurity studies, and comparative organizational evaluation methods to examine how technical, organizational, and governance-related factors influence transformation outcomes. The findings indicate that increasing digital connectivity and dependence on interconnected technologies significantly expand operational complexity and cybersecurity risk, while legacy systems continue to limit organizational adaptabil-ity and modernization flexibility. The study further demonstrates that organizations with stronger governance maturity, improved cybersecurity readiness, and lower legacy infrastructure dependency generally exhibit higher modernization readiness and operational resilience. Human resistance and limited organizational adaptation were also identified as major barriers to successful transformation initiatives. Overall, the findings emphasize that sustainable digital transformation depends not only on technological adoption, but also on governance integration, cybersecurity planning, workforce adaptation, and long-term organizational strategy.

Abstract: Cyber wargaming serves as a core tool for simulating cyber confrontations and supporting operational decision verification. Existing multi-agent methods face issues such as the absence of cross-level mechanisms, poor adaptability to dynamic environments, and inefficient collaboration when applied to cyber wargaming. To address these challenges, we innovatively propose HC-MARL, a general hierarchical cascaded multi-agent reinforcement learning architecture tailored for cyber wargaming. Agents are modeled as hierarchical cascaded units to achieve structural decoupling, while a cross-level bidirectional information transfer and threat-sharing mechanism enables command propagation and adaptation to dynamic node changes. Specifically, a Transformer-based message transformation function is designed to resolve bottom-up information fusion and alignment; a policy function integrating neural networks with empirical knowledge is constructed to enhance threat response efficiency while ensuring smooth transmission of up-level commands; and a reward mechanism combining global and local rewards as well as outcome-based and staged rewards is introduced to improve the stability of multi-agent policy learning. To the best of our knowledge, the proposed HC-MARL framework is a novel general hierarchical collaborative multi-agent architecture for cyber wargaming. Experimental results demonstrate that the architecture effectively addresses the challenges associated with cross-level information transfer and dynamic agent changes in cyber wargaming. Compared with methods such as Singh et al., the 10-episode average reward is improved approximately by 30%, and the policy converges faster and more smoothly.

Abstract: The use of Artificial Intelligence (AI) and Machine Learning (ML) in cybersecurity, especially for creating Intrusion Detection Systems (IDS), has become increasingly important. These systems are essential for detecting malicious behaviour, identifying network issues, and stopping cyberattacks in real time. Although extensive research has been conducted on various ML and Deep Learning (DL) models for IDS, the current literature remains incomplete. It has many different datasets, methods, and evaluation standards. As cyber threats become more advanced, it is crucial to conduct a thorough analysis of ML techniques for intrusion detection. The goal of this Systematic Literature Review (SLR) is to give a full picture of the most recent academic articles on ML-based IDS. The study addresses important research questions about the most widely used algorithms, the types of attacks and network environments covered, the methodological problems that remain unsolved, and the new trends that should shape future research. Following the PRISMA framework, we conducted a systematic review of peer-reviewed articles published between January 2022 and May 2025. We searched IEEE Xplore, ACM Digital Library, and SpringerLink, yielding 22,558 initial records. After carefully applying strict inclusion criteria, 125 papers were selected for the final analysis. We created a standardised data extraction form (i.e., using MS Excel) to gather bibliographic details, research emphasis, methodological strategies, datasets, evaluation criteria, and recognised constraints. We employed thematic analysis to develop a clear taxonomy. We identified five main research themes in our analysis: (1) ensemble and hybrid learning pipelines focused on performance optimisation (30 papers), (2) context-specific IDS designs for Internet of Things (IoT), cloud, and Software-Defined Networking (SDN) environments (34 papers), (3) data-centric engineering that deals with class imbalance and feature selection (20 papers), (4) deep neural architectures for representation learning (31 papers), and (5) trustworthiness concerns like adversarial robustness, zero-day detection, and Explainable AI (XAI) (10 papers). Convolutional Neural Networks (CNNs), Long Short-Term Memory (LSTM), and Random Forests are the most commonly used algorithms, often combined. Nonetheless, significant deficiencies remain: about 2% of papers incorporate XAI, only 4% focus on adversarial robustness, and none validate their models in real-world production settings. Denial of Service (DoS) and Distributed DoS (DDoS) are the most common types of attacks in the literature, while Web attacks, ransomware, and advanced persistent threats remain poorly studied. The number of publications grows at an average of 30.2% annually, but the field still relies on legacy benchmark datasets rather than operational validation.

Abstract: Maritime operations rely on the Automatic Identification System (AIS), an open broadcast protocol whose unauthenticated, self-reported Messages are easily abused. This survey takes an AIS-first, security-focused view, grounded in a comprehensive review of prior AIS-security research. We (i) explain how AIS works and use that to expose fundamental weaknesses; (ii) synthesize from the literature the main threats and their technical and operational impacts; (iii) categorize, from the surveyed works and operational practice, mitigations by the layers they target and, for each mitigation, indicate whether it primarily prevents, detects, responds, or supports recovery; and (iv) provide practical recommendations. Bringing together cybersecurity, maritime operations, and data-science perspectives, we consolidate recommendations for securing AIS-based systems and assess their current use in practice, thus highlighting the gaps that standards and implementations still need to address.

Abstract: Federated learning lets organizations train a shared model without pooling private data. The standard method, Federated Averaging, requires all participants to use the same input features, a condition that fails in cross-sector phishing detection, where banks analyze URL structure and hospitals analyze email content. We present RankBridge, a system that groups participants by comparing ranked lists of SHapley Additive exPlanations (SHAP) feature importance rather than model weights or gradients. Each participant trains a local LightGBM model, extracts the top-K features by SHAP importance, and sends only 60 bytes of ranked indices to a central server. The server applies rank correlation and Ward’s hierarchical clustering to identify similarly threatened organizations, then combines models only within each discovered group. Across 32 participants in five organization types, RankBridge achieves F1 =0.854 on synthetic data and F1 =0.775 on real phishing data. Federated Averaging collapses to F1 =0.278 on the same data. RankBridge recovers the correct organizational groupings with Normalized Mutual Information (NMI) =0.978 while each participant transmits roughly 10,000× less data per round than a full model upload.

Abstract: Critical National Infrastructures (CNIs) have evolved over the last years through the digitization of their services, which simultaneously led to an increase of their threat surface. Meanwhile the exponential rise of Artificial Intelligence (AI) technologies has given the means to adversaries to perform targeted attacks against high impact systems as the ones found in CNIs. Current regulation directives as the NIS2 or the Cyber Resilience Act (CRA) focus on the presence of Security Operation Centers (SOC), which include different security technologies for the detection and response to cyber-attacks. Nevertheless, such baseline SOCs do not provide the ability to perform a coordinated and orchestrated detection and response cycle for existing cyber threats, but also do not provide proactive measures for zero-day threats. To this end, this paper presents a new approach for automating the orchestration of the incident lifecycle through Next Generation SOC services able to detect/mitigate sophisticated attacks against CNIs, but also implement proactive detection measures against zero-day threats.

Abstract: Smart microgrids depend on continuous communication between controllers, sensors, and actuators over industrial protocols like Modbus TCP, MQTT, and DNP3, that were designed without built-in security mechanisms. The gateway that aggregates this traffic represents a single point of failure vulnerable to distributed denial-of-service (DDoS) attacks. Most existing detection methods require labeled attack data for training, a condition rarely met in operational OT environments. This paper presents an unsupervised CNN-LSTM model trained exclusively on normal microgrid gateway traffic to predict the next traffic window; anomalies are flagged when prediction error exceeds a threshold derived from the training distribution. A dual-branch architecture processes metric time-series through LSTM layers and flow aggregate features through CNN layers, fusing both representations for prediction. The model is evaluated against three protocol-specific DDoS attack scenarios, Modbus SCADA flooding, MQTT publish storm, and DNP3 response flooding - none of which are seen during training. Compared against an Isolation Forest baseline under identical unsupervised conditions, the CNN-LSTM achieves higher precision and recall on all attack types. The framework is deployed within a web-based monitoring platform that supports real-time detection and anomaly logging.

Abstract: Federated learning (FL) enables distributed model training in IoT environments while keeping raw data on local devices. However, protecting model-update exchange is difficult on microcontroller-class devices due to strict latency, memory, and energy constraints. Existing studies often evaluate lightweight cryptography outside complete FL pipelines or on more powerful hardware, leaving its practical overhead on MCU-class devices insufficiently explored. This paper presents an end-to-end, hardware-validated secure framework for exchanging model updates in federated learning on resource-constrained IoT microcontrollers. Implemented on ESP32-based edge devices, the framework combines light-weight block ciphers (SPECK, SIMON, and PRESENT), HMAC-SHA256 for integrity verification, and ECDH-HKDF for session-key establishment. The evaluation assessed latency, throughput, RAM/ROM footprint, and energy consumption. Results show that SPECK provides the lowest overhead (0.13 µs/byte, 8.68 MB/s, 138.3 mJ), SIMON offers intermediate performance (0.41 µs/byte, 1.96 MB/s, 184.9 mJ), and PRESENT incurs the highest computational cost (89.37 µs/byte, 0.011 MB/s, 446.2 mJ). In the CICIoT2023 federated intrusion detection evaluation, the secure model maintained stable convergence and achieved 85.43% accuracy after 20 rounds, remaining close to the centralized baseline. These findings demonstrate the practical feasibility of secure model-update exchange in FL on real IoT microcontrollers and provide hardware-grounded guidance for cipher selection under tight resource budgets.

Abstract: Graph neural networks have been increasingly explored for network intrusion detection, yet the effect of graph construction strategy on detection performance remains underexamined, particularly for IoMT networks. In this study, we systematically investigate how data representation, graph construction, evaluation protocol, and task formulation shape the effectiveness of graph-based intrusion detection on the CICIoMT2024 benchmark data. We compare three representation strategies: flow-level tabular features, feature-similarity graphs, and PCAP-derived communication-topology graphs constructed from raw packet captures. We further examine the effect of domain-typed edge augmentation, PCAP-level validation protocols, and task decomposition into topology-heavy and protocol-heavy attack categories. Our results show that feature-similarity graphs provide no reliable advantage over Random Forest baselines, whereas PCAP-derived communication topology enables GNNs to become competitive on topology-heavy attacks. Third, domain-aware edge typing improves both performance and stability. Fourth, under proper PCAP-level validation with session-aware splits, previously reported gains diminish substantially, underscoring the importance of evaluation protocol. Fifth, in our experiments on this dataset, GNN effectiveness depends on attack category: topology-heavy attacks (DDoS, DoS, Recon) benefit from graph modeling, while protocol-heavy attacks (MQTT, Spoofing) do not. Across five random seeds, a domain-typed Adaptive Edge-Weighted GAT achieves a macro-F1 of 0.800 ± 0.026 on the topology-heavy subset, compared with 0.784 ± 0.020 for Random Forest. These results suggest that in IoMT intrusion detection, representation of choice and evaluation protocol matter more than architectural complexity.

Abstract: In-vehicle intrusion detection systems (IDSs) are increasingly proposed to protect automotive networks, yet most prior work emphasizes detection accuracy while overlooking system-level constraints that determine real-world deployability. This paper addresses the mismatch between IDS design assumptions and the computational, architectural, and real-time limitations of production automotive electronic control units (ECUs). This issue is particularly critical in safety-critical automotive systems, where security mechanisms must operate within strict timing and resource bounds without interfering with control functions. The objective of this work is to provide a deploymentaware feasibility analysis of in-vehicle IDS techniques across heterogeneous automotive computing platforms. We introduce a baseline-driven methodology that defines two representative ECU tiers: microcontroller-based safety ECUs operating under AUTOSAR Classic and higher-performance domain or zonal controllers based on AUTOSAR Adaptive and POSIX-compliant operating systems. IDS approaches are evaluated against nonnegotiable constraints including processing capacity, memory availability, worst-case execution time, operating system compatibility, and in-vehicle network technology. The results show that microcontroller-based ECUs support only lightweight, messagelevel IDS mechanisms with strictly bounded execution behavior, while machine learning–based IDSs require controller-class platforms and remain constrained by determinism and interference requirements. This work demonstrates that feasibility, rather than accuracy alone, must be treated as a first-class criterion in automotive IDS design.

Abstract: Manual compliance auditing in cloud environments consumes up to 40% of IT security budgets annually, yet existing approaches verify control presence rather than effectiveness, leaving institutions vulnerable to adversarial evasion. This paper presents an AI-augmented hybrid ML–LLM compliance auditing system evaluated on a national cybersecurity standards framework (143 controls, 200,000 training events). The system combines multi-label XGBoost classification with LLM-based semantic log analysis, grounded in a formal effectiveness model. Key findings: XGBoost achieves 99.88% F1 after 5% domain fine-tuning but collapses to 7.98% zero-shot, a 92-point generalization gap bridged by the hybrid LLM path; adversarial validation exposes effectiveness deficits invisible to checkbox auditing (SI-3: 20%detection rate; SI-10: 32% XSS bypass); GPT-4o-mini achieves 93.5% zero-shot accuracy across four log types (n=200), while Llama-3.2-3B on CPU-only hardware achieves 84.0%, validating on-premise deployment viability. A vocabulary-coverage gating router achieves 94.5% accuracy at $0.15/10K logs. The system runs at 2.0 CPU cores, $50/month, producing audit reports in 0.77s, demonstrating that effectiveness-based compliance auditing is accessible without enterprise-grade infrastructure.

Abstract: Secure large-scale data processing (Big Data) in distributed environments such as Hadoop MapReduce poses a constant challenge of balancing performance and security. While recent approaches (MR-LWT) have demonstrated the effectiveness of lightweight cryptography (LWC) in reducing computational overhead, they generally rely on a static selection of algorithms. This paper proposes Adaptive-Crypto-RL, a dynamic selection system based on a Deep Q-Network (DQN). By integrating directly into the existing MR-LWT architecture, our reinforcement learning agent evaluates the cluster state (CPU, RAM, network load) and data characteristics in real-time to select the optimal algorithm (Chacha20, Rabbit, NOEKEON, or AES-CTR). Experiments demonstrate that this adaptive selection improves overall performance by up to 75% compared to AES(CBC) and 50% compared to HC-128, with a negligible inference overhead of 2 to 4 seconds.

Abstract: Autonomous AI agents operating in high-stakes domains—financial trading, medical diagnostics, autonomous code execution—lack formal safety guarantees for their core operational loops, including memory management, tool invocations, and human interactions. Current verification approaches either fail to scale to neural components or ignore the structured control flow of agentic systems entirely. We introduce AgentVerify (Compositional Formal Verification of AI Agent Safety Properties via LTL Model Checking), a model checking framework that specifies and verifies safety properties for agent architectures using temporal logic. AgentVerify defines compositional specifications for memory integrity, tool call pro tocols, MCP/skill invocations, and human-in-the-loop boundaries, enabling rigorous runtime monitoring and post-hoc behavioral analysis. In an empirical evaluation across 15 diverse agent scenarios (low- and high-difficulty), our post-hoc behavioral analysis component achieved a verification accuracy of 86.67% (mean over 3 seeds, σ=0.00), outperforming a monolithic contract verification baseline (80.00%) and a runtime monitoring baseline without temporal logic (46.67%). A monolithic neural verifier, which attempts to verify the LLM outputs directly, performed poorly at 13.33%, confirming that end-to-end neural verification is currently intractable for production-scale agents. These results demonstrate that formal methods applied to the agent’s observable control flow provide a tractable and effective path to safety assurance, complementing rather than replacing neural-centric efforts to align large language models.

Abstract: Microsoft Windows remains the dominant desktop operating system and, therefore a frequent focus of digital forensic and incident response investigations. Windows Registry analysis is particularly valuable because it captures persistence mechanisms, execution traces, user activity, device usage, and system configuration changes that are often central to incident reconstruction. Nevertheless, modern investigations are challenged by the scale of Registry data, the fragmentation of evidence across hives and complementary sources, and the need to prioritise investigative actions under time pressure. This paper presents WinRegRL, a hybrid framework that combines Reinforcement Learning (RL) with Rule-based Artificial Intelligence (RB-AI) for automated Windows Registry and timeline-centred forensic analysis. The framework models the investigation process as a Markov Decision Process (MDP) with explicitly defined states, actions, transition dynamics, and reward design, and incorporates expert-derived policy graphs to initialise and refine the search strategy. We evaluate the framework on four heterogeneous forensic datasets spanning multiple Windows versions and incident scenarios, and we compare it against analyst-assisted baselines and controlled examiner-led workflows. Under the evaluation protocol adopted in this study, WinRegRL reduced investigation time by up to 68%, increased the number of adjudicated relevant artefacts identified by up to 35%, and achieved high artefact-level precision on the evaluated datasets. Rather than claiming universal superiority, we show that the proposed framework provides a reproducible and explainable decision-support mechanism that improves investigation efficiency while maintaining strong evidential coverage in the tested scenarios. These findings position WinRegRL as a promising decision-support framework for large-scale and time-critical Windows incident response.

Abstract: This paper studies the probability of a double-spend attack in an Ouroboros-like Proof-of-Stake (PoS) setting when confirmation decisions must be made for a finite number of blocks. Existing security analyses of Ouroboros-family protocols are mainly asymptotic and therefore do not directly provide the attack probability for a fixed confirmation depth. We consider an analytically tractable model that allows empty slots and multiple slot leaders, and assumes fixed stake distribution within an epoch, one-block growth of the public longest chain in any slot containing at least one honest leader, and next-slot block visibility. These assumptions hold when the time slot length is much greater than the network delay, and are applicable to practical deployment scenarios such as Cardano. Under these assumptions, for the first time, an exact closed-form solution for the success probability of a double-spend attack considering a realistic model with multiple leaders and empty time slots. Numerical examples illustrate how the required confirmation depth depends on the adversarial stake ratio and the active slot coefficient. The results apply to the stated analytical model and do not yet cover delayed fork resolution or the full protocol-level fork-choice and finality mechanisms of Ouroboros Praos.

Abstract: TLS 1.3 zero-round-trip-time (0-RTT) resumption reduces reconnection latency by allowing clients to transmit early application data using pre-shared keys (PSK) derived from previously established session tickets. This mechanism is pivotal for latency-sensitive web services, API gateways, and IoT applications. However, the cryptographic foundations of current session tickets—symmetric keys derived from classical X25519 key exchange—are fundamentally vulnerable to Harvest-Now-Decrypt-Later (HNDL) quantum attacks: an adversary capturing session ticket exchanges today can retroactively decrypt PSKs and all 0-RTT early data once a cryptographically relevant quantum computer (CRQC) becomes available. This paper introduces HQRT (Hybrid Quantum-Resistant Resumption for TLS 1.3), a protocol-level framework that embeds a hybrid X25519 + ML-KEM-768 key encapsulation into the TLS 1.3 NewSessionTicket lifecycle, producing quantum-safe session tickets without additional handshake round trips. HQRT defines a Hybrid Resumption Master Secret (HRMS) derived from both classical and post-quantum shared secrets and integrates it into the TLS 1.3 key schedule as a drop-in extension of the Resumption Master Secret. We provide: (i) a formal security model for quantum-safe 0-RTT resumption with game-based HNDL-resistance proofs; (ii) an extended replay protection analysis under quantum adversaries; (iii) a proof-of-concept implementation on OpenSSL 3.x with the OQS provider; and (iv) comprehensive benchmarks across server, desktop, and IoT platforms demonstrating only 4–9% latency overhead and 6.5% throughput reduction relative to classical 0-RTT, versus the 81–89% overhead of full post-quantum handshakes. A cumulative cost-benefit analysis over multi-session workloads demonstrates 34–97% amortised overhead reduction compared to per-reconnection PQC handshakes, with latency distributions exhibiting sub-millisecond tail divergence from classical baselines. HQRT provides a practical, incrementally deployable pathway for quantum-safe TLS resumption compatible with existing certificate infrastructure.