Abstract: As the threat landscape advances and pressure to reduce the energy footprint grows, it is crucial to understand how security mechanisms affect the power consumption of cloud-native platforms. Although several studies in this domain have investigated the performance impact of security practices or the energy characteristics of containerized applications, their combined effect remains largely underexplored. This study examines how common Kubernetes (K8s) safeguards influence cluster energy use across varying security configurations and workload conditions. By employing runtime and network monitoring, encryption, and vulnerability-scanning tools under diverse workloads (idle, stressed, realistic application), we compare the baseline system behavior against the energy consumption introduced by each security configuration. Our findings reveal that always-on security mechanisms impose a persistent baseline energy cost—occasionally making an idle protected cluster comparable to a heavily loaded unprotected one, while security under load results in substantial incremental overhead. In particular, service meshes and full-tunnel encryption show the largest sustained overhead, while eBPF telemetry, network security monitoring, and vulnerability scans add modest or short-lived costs. These findings provide useful security-energy insights and trade-offs for configuring K8s in resource-constrained settings, including IoT/smart city deployments.

Abstract: This study presents a quantitative evaluation of the EMBA firmware security analysis tool applied to Internet of Things (IoT) and embedded device firmware in two deployment environments: a standalone personal computer and a Microsoft Azure cloud-based virtual machine. The study addresses a gap in existing research regarding how deployment choices affect performance, cost, and operational characteristics of firmware security analysis. Using identical EMBA configurations and analysis modules, firmware images of varying sizes were analyzed, while execution time, detected vulnerabilities, and resource utilization were systematically recorded. The results demonstrate that scan duration is influenced by both firmware size and deployment environment. Specifically, using EMBA v1.5.0, a 25.5 MB firmware image required approximately 14 hours on a standalone system and over 25 hours on Azure Cloud, whereas a 30.2 MB image completed in approximately 18 hours locally and 17 hours on Azure Cloud. Despite these differences in execution time, the type and number of identified vulnerabilities were largely consistent across both environments, indicating comparable analytical coverage. A cost assessment shows that cloud-based execution incurred approximately US $250 for a limited set of analyses, while standalone deployment required higher initial investment but provided predictable long-term costs. Overall, this deployment-focused evaluation offers empirical information into performance, cost, and operational trade-offs, supporting informed decision-making for IoT security practitioners selecting local or cloud-based firmware analysis environments.

Abstract: Network operators increasingly rely on abstracted telemetry (e.g., flow records and time-aggregated statistics) to achieve scalable monitoring of high-speed networks, but this abstraction fundamentally constrains the forensic and security inferences that can be supported from network data. We present a design-time audit framework that evaluates which threat hypotheses become non-supportable as network evidence is transformed from packet-level traces to flow records and time-aggregated statistics. Our methodology examines three evidence layers (L0: packet headers, L1: IP Flow Information Export (IPFIX) flow records, L2: time-aggregated flows), computes a catalog of 13 network-forensic artifacts (e.g., destination fan-out, inter-arrival time burstiness, SYN-dominant connection patterns) at each layer, and maps artifact availability to tactic support using literature-grounded associations with MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK). Applied to backbone traffic from the MAWI Day-In-The-Life (DITL) archive, the audit reveals non-monotonic transformation: inference coverage decreases from 9 to 7 out of 9 evaluated ATT&CK tactics, while coverage of defensive countermeasures (MITRE D3FEND) increases at L1 (7→8 technique categories) then decreases at L2 (8→7), reflecting a shift from behavioral monitoring to flow-based controls. The framework provides network architects with a practical tool to configure telemetry systems (e.g., IPFIX exporters, P4 pipelines) to reason about and provision minimum forensic coverage.

Abstract: E-Payment has become popular in mobile com-merce, can provide consumers with a convenient way to makepurchases electronically. Currently, however, all too many E-Payment systems are primarily focused on securing a consumer’sfinancial information and do little to prevent privacy leaks andAI-generated scams. This paper defines AEP-M, a novel AI-enhanced anonymous e-payment scheme developed for mobiledevices that uses TrustZone and divisible e-cash. Since mobiledevices have very limited processing power and each transactionmust be performed in real time, the proposed solution combinesan efficient divisible e-cash system with AI-powered anomalydetection techniques to improve both the security, privacy andfraud detection in mobile payments. In addition to enablingusers to divide a single withdrawal of an e-coin of a largeamount into multiple transactions without disclosing their iden-tity to either banks or merchants, AEP-M integrates AI-basedrisk assessment to identify suspicious spending behaviors torapidly mitigate fraud and continuously monitor transactions.By employing a combination of bit decomposition and pre-computation to minimize the computational overhead of thetransaction process, AEP-M provides the optimal performancein terms of minimizing the max number of exponentiationoperations required to perform the frequent online spendingprocess on elliptic curves. Finally, AEP-M also incorporates anARM TrustZone to protect a user’s financial data and importantprivate data; an SRAM PUF is used as a Root of Trust to deriveAI-powered keys and manage sensitive data, thereby increasingboth the security and reliability of the system. A prototype ofAEP-M was implemented and evaluated using the BN curve ata 128-bit security level. The experimental results demonstratedthat AEP-M is capable of improving the Security, Efficiency andFraud Detection capabilities of Mobile Digital Payments whilemaintaining User Privacy and Anonymity.

Abstract: Industrial Internet of Things (IIoT) and SCADA-connected networks face disruptive DDoS events where detection must be both accurate and low-latency at the edge. This study benchmarks deep reinforcement learning (DRL) for real-time binary attack detection and proposes a Proximal Policy Optimisation (PPO) detector tailored for deployment. Five DRL agents—DQN, Double DQN, Duelling DQN, DDPG, and PPO—are trained under a unified preprocessing pipeline (automatic label mapping, numeric-feature selection, robust scaling, and class balancing) and evaluated on three representative datasets: KDDCup99, CIC-DDoS2019, and Edge-IIoTset. We report accuracy, precision/recall, F1-score, false-positive/false-negative rates, and AUC-ROC, alongside CPU latency to reflect operational constraints. Across all datasets, PPO achieves the best accuracy–latency trade-off, reaching 99.3% accuracy on KDDCup, 99, 93.7% on CIC-DDoS2019, and 95.5% on Edge-IIoTset, while maintaining inference latency below 0.23 ms per sample. PPO also converges faster and is more sample-efficient than value-based alternatives. For practical adoption, the trained PPO policies are exported to ONNX (one model per dataset), enabling lightweight, PyTorch-independent inference on resource-constrained industrial gateways.

Abstract: Identity and Access Management (IAM) increasingly relies on adaptive controls—step-up challenges, recovery verification, device and behavior signals, and continuous authorization—to reduce account takeover and misuse. At the same time, IAM systems must prepare for post-quantum cryptography (PQC) transitions that affect credentials, signing, and verification paths. These shifts create a practical governance problem: when an identity action is allowed, challenged, denied, or escalated (e.g., passwordless enrollment, recovery credential release, privileged step-up, or machine key rotation), teams must be able to explain why the decision happened, what evidence was considered, and how the decision can be independently verified later. This paper introduces Decision Receipts (DR): a verifiable, privacy-aware record produced at decision time that captures (i) policy context and versioning, (ii) normalized evidence descriptors (not raw personal data), (iii) action outcomes and reason codes, and (iv) cryptographic signatures supporting long-term auditability under PQC. We propose an open receipt schema, canonicalization rules, and verifier workflows using widely deployed identity standards (OAuth 2.0, OpenID Connect, JWT) and modern signing containers (JWS/COSE), with optional anchoring into transparency logs for tamper-evidence. The approach is intentionally IP-safe and adoptable as an audit overlay independent of any specific orchestrator implementation.

Abstract: Traditional kernel fuzzers rely on coarse-grained coverage metrics that cannot reflect complex microarchitectural behaviors. We present a hardware-assisted fuzzing framework that leverages branch buffer telemetry from modern CPUs (LBR, BTB sampling) to refine fuzzing feedback. A model-based inference algorithm aggregates branch-data patterns to estimate microarchitectural novelty and guides seed prioritization. Experiments on Intel Ice Lake and AMD Zen 3 systems demonstrate 27% improvement in unique path coverage, with 11 newly identified concurrency bugs across filesystem and scheduler subsystems. Compared with coverage-only fuzzing, our method reduces time-to-crash by 46% while keeping overhead below 12%. This work shows microarchitectural-level signals can significantly boost kernel fuzzing’s effectiveness.

Abstract: We integrate static taint analysis with dynamic fuzzing to target high-impact kernel code paths. A pruning mechanism removes irrelevant taint propagation, while symbolic constraints are applied only to tainted regions to control overhead. Evaluated on 18 kernel subsystems, the hybrid fuzzer achieves 44% more taint-relevant path hits, identifying 13 bugs, including buffer overflows and pointer dereferences. Symbolic overhead remains limited (≤18%) through selective propagation. This hybrid design efficiently directs fuzzing toward semantically meaningful kernel logic, demonstrating a productive balance of taint tracking and dynamic mutation.

Abstract: The evolution of quantum computing represents one of the most significant technological transformations of this century, with direct implications for cryptographic systems currently in use, especially in the field of asymmetric cryptography. This article develops a prospective study on the impact of quantum computing on asymmetric cryptographic infrastructures, presenting the central problem and proposing the implementation of a structured solution in the form of a transition roadmap. This approach enables the anticipation of technological scenarios and the identification of appropriate mitigation strategies, based on scientific evidence and expert projections. The results obtained highlight the vulnerability of classical cryptographic algorithms, based on complex mathematical problems, such as RSA and ECC, demonstrating that the technological and cryptographic transition is inevitable. However, this transition should not be exclusively algorithmic, it must integrate technical training policies, regulatory compliance, interoperability between hybrid systems, and continuous monitoring mechanisms. The proposed solution stands out from the others due to its methodological and operational approach, offering a dynamic, detailed, and adaptable model applicable to different organizational and sectoral contexts. The proposed roadmap is structured in sequential and interdependent phases, allowing for practical and strategic guidance of the transition process. The contributions of this research include the systematization of the phases of the post-quantum transition process, the introduction of a resilient and evolutionary model capable of responding to technological uncertainty, and the consolidation of an integrated approach that combines academic, scientific, organizational, and technical rigor. Planning and adopting a proactive stance are crucial factors in ensuring the operational continuity and resilience of digital infrastructures in a potential quantum era. The article therefore constitutes a relevant contribution to the academic debate on post-quantum information security, offering practical guidance and concepts applicable to the protection of digital infrastructures in the context of profound technological transformation.

Abstract: Industrial control systems (ICSs) are increasingly interconnected with enterprise IT networks and remote services, which expands the attack surface of operational technology (OT) environments. However, collecting sufficient attack traffic from real OT/ICS networks is difficult, and the resulting scarcity and class imbalance of malicious data hinder the development of intrusion detection systems (IDSs). At the same time, large language models (LLMs) have shown promise for security analytics when system events are expressed in natural language. This study investigates an LLM-based network IDS for a smart-factory OT/ICS environment and proposes a synthetic data generation method that injects domain knowledge into attack samples. Using the ICSSIM simulator, we construct a bottle-filling smart factory, implement six MITRE ATT&CK for ICS based attack scenarios, capture Modbus/TCP traffic, and convert each request–response pair into a natural-language description of network behavior. We then generate synthetic attack descriptions with GPT by combining (1) statistical properties of normal traffic, (2) MITRE ATT&CK for ICS tactics and techniques, and (3) expert knowledge obtained from executing the attacks in ICSSIM. The Llama 3.1 8B Instruct model is fine-tuned with QLoRA on a seven-class classification task (Benign vs. six attack types) and evaluated on a test set composed exclusively of real ICSSIM traffic. Experimental results show that synthetic data generated only from statistical information or from statistics plus MITRE descriptions yield limited performance, whereas incorporating environment-specific expert knowledge enables the model to achieve 99.61% accuracy in binary detection and 95.63% accuracy with a macro F1-score of 0.952 in attack-type classification. These results demonstrate that domain-knowledge–infused synthetic data and natural-language traffic representations can make LLM-based IDSs a practical option for deployment in OT/ICS smart-factory environments.

Abstract: To address API abuse and unauthorized data access in multi-tenant systems, this paper proposes a full-stack security gateway framework based on zero-trust access and policy verification. The system integrates Envoy Gateway and the OPA (Open Policy Agent) policy engine at the API ingress layer, combining the OAuth 2.1 authorization protocol with JWT token authentication to achieve fine-grained tenant identity management. To support dynamic resource access, a policy inheritance mechanism based on GraphQL Schema injection is designed, enabling millisecond-level data access permission validation. Experiments demonstrate that under million-request-level testing, the model achieves an average authentication latency of 74.2 ms, with a 28% increase in security event detection rate and a false positive rate reduced to 1.9%. This research provides a highly scalable, auditable security baseline architecture for data security governance in multi-tenant web platforms.

Abstract: This contribution outlines a completely new, fully local approach for secure web-based device control based on browser inter-window messaging. Modern smart home IoT (Internet of Things) devices are commonly controlled with proprietary mobile applications via remote servers, which can have significant adverse implications for the end user. Given that many IoT devices in use today are limited both in available memory and processing speed, standard approaches such as HTTPS-based transport security are not always feasible and a need for more suitable alternatives for such constrained devices arises. This local method for lightweight and secure web-based device control using inter-window messaging leverages existing standard web technologies to enable a maximum degree of privacy, choice and sustainability within the smart home ecosystem. The implemented proof-of-concept shows that it is feasible to meet essential security objectives in a local web IoT control context while utilizing less than a kilobyte of additional memory compared to an unsecured solution; thus promoting sustainability through hardening the control protocols used by existing devices with too little resources for implementing standard web cryptography. Therefore this work contributes to achieving the vision of a fully open and secure local smart home.

Abstract: The Internet of Things (IoT) is increasingly embedded in critical infrastructures across healthcare, energy, transportation, and industrial automation, yet its pervasiveness introduces substantial security and resilience challenges. This paper presents a comprehensive review of recent advances in IoT resilience, focusing on developments reported between 2022 and 2025. A layered taxonomy is proposed to organize resilience strategies across hardware, network, learning, application, and governance layers, addressing adversarial, environmental, and hybrid stressors. The survey systematically classifies and compares more than forty representative studies encompassing deep learning under adversarial attack, generative and ensemble intrusion detection, hardware- and protocol-level defenses, federated and distributed learning, and trust- and governance-based approaches. A comparative analysis shows that while adversarial training, GAN-based augmentation, and decentralized learning improve robustness, they often have limitations, being confined to specific datasets or attack scenarios without extensive validation in large-scale deployments. The study highlights challenges in adaptive benchmarking, cross-layer integration, and explainable resilience, concluding with future directions for creating antifragile IoT systems that can self-heal and adapt to evolving cyber-physical threats.

Abstract:

The expansion of the Internet of Things (IoT) devices in domestic smart homes has created new conveniences but also significant security risks. Insecure firmware, weak authentication and encryption leave households exposed to privacy breaches, data leakage, and systemic attacks. Although research has addressed several challenges contributions remain fragmented and difficult for non-technical users to apply. This work addresses the research question: How can a theoretical framework be developed to enable automated vulnerability scanning and prioritisation for non-technical users in domestic IoT environments? A Systematic Literature Review of 40 peer-reviewed studies, conducted under PRISMA 2020 guidelines, identified four structural gaps: dispersed vulnerability knowledge, fragmented scanning approaches, over-reliance on technical severity in prioritisation and weak protocol standardisation. The paper introduces a four-module framework: a Vulnerability Knowledge Base, an Automated Scanning Engine, a Context-Aware Prioritisation Module and a Standardisation and Interoperability Layer. The framework advances knowledge by integrating previously siloed approaches into a layered and iterative artefact tailored to households. While limited to conceptual evaluation, the framework establishes a foundation for future work in prototype development, household usability studies and empirical validation. By addressing fragmented evidence with a coherent and adaptive design, the study contributes to both academic understanding and practical resilience, offering a pathway toward more secure and trustworthy domestic IoT ecosystems.

Abstract: The merging of the Internet of Things (IoT) and Artificial Intelligence (AI) advances has intensified challenges related to data authenticity and security. These advancements necessitate a multi-layered security approach in ensuring security, reliability and integrity of critical infrastructure and intelligent surveillance systems. This paper proposes a two-layered security approach combining a discrete cosine transform least significant bit 2 (DCT-LSB-2) – with artificial neural networks (ANN) for data forensic validation and mitigating deepfakes. The proposed model encodes validation codes within the LSBs of cover images captured by an IoT camera on the sender side, leveraging the DCT approach to enhance the resilience against steganalysis. On the receiver side, a reverse DCT-LSB-2 process decodes the embedded validation code, which is subjected to authenticity verification by a pre-trained ANN model. The ANN validates the integrity of the decoded code, and ensures that only device-originated, untampered images are accepted. The proposed framework achieved an average SSIM of 0.9927 across the entirely investigated embedding capacity of between 0 to 1.988 bpp. DCT-LSB-2 showed a stable Peak Signal-to-Noise Ratio (average 42.44 dB) under different evaluated payloads of between 0 to 100 kB. The proposed model achieved a resilient and robust multi-layered data forensic validation system.

Abstract:

Marine scientific research missions often face challenges such as heterogeneous multi-source data, unstable links, and high packet loss rates. Traditional approaches decouple integrity verification from encryption, rely on full-packet processing, and depend on synchronous sessions, making them inefficient and insecure under fragmented and out-of-order transmissions. The HMR+EMR mechanism proposed in this study integrates “block-level verification” with “hybrid encryption collaboration” into a unified workflow: HMR employs entropy-aware adaptive partitioning and chain-based indexing to enable incremental verification and breakpoint recovery, while EMR decouples key distribution from parallelized encryption, allowing encryption and verification to proceed concurrently under unstable links and reducing redundant retransmissions or session blocking. Experimental results show that the scheme not only reduces hashing latency by 45%–55% but also maintains a 94.1% successful transmission rate under 20% packet loss, demonstrating strong adaptability in high-loss, asynchronous, and heterogeneous network environments. Overall, HMR+EMR provides a transferable design concept for addressing integrity and security issues in marine data transmission, achieving a practical balance between performance and robustness.

Abstract: Modern multi-cloud and edge-cloud systems replicate both data and access control policies across geographically distributed nodes under weak consistency models. In asynchronous environments with possible network partitions, policy updates (additions and revocations of rules, delegation and revocation of privileges) may occur concurrently, causing conflicts and potential privilege escalation when naïve conflict resolution schemes such as last-writer-wins (LWW) or add-wins are used. This paper proposes a formal model of Policy-CRDT, a conflict-free replicated data type (CRDT) for sets of access control policies with a remove-wins strategy, based on the two-phase set (2P-Set) and a join-semilattice structure on replica states. At the CRDT abstraction level, each replica state is represented by a pair of monotonically growing sets of added and revoked policy identifiers, and state merging is defined as a commutative, associative, and idempotent union operator. We show that the proposed data type satisfies the standard Strong Eventual Consistency (SEC) conditions for state-based CRDTs: replica states form a join-semilattice, local updates are monotone, and the merge function computes least upper bounds, which ensures convergence of replicas once they have received the same set of updates. We formally prove that the remove-wins strategy guarantees inevitable suppression of any policy for which at least one revocation exists in the global history, in contrast to LWW and add-wins schemes that can admit dangerous states with excessive permissions. We further propose an architecture for deploying Policy-CRDT in a distributed PDP/PEP infrastructure in the spirit of Zero Trust and NIST SP 800-207/800-207A, and we present an analytical evaluation of convergence latency and the probability of potentially dangerous states compared to alternative strategies. The results demonstrate that Policy-CRDT provides formally grounded convergence of access control policies at reasonable overhead and is semantically safe in multi-cloud and edge deployment scenarios.

Abstract: In the contemporary cybersecurity landscape, the detection of code-mixed malicious scripts embedded within high-trust domains (e.g., governmental and academic websites) constitutes a critical defensive challenge. Traditional Transformer-based models, while effective in natural language processing, often exhibit "Structural Bias," where they erroneously interpret the benign complexity of legacy HTML structures as malicious obfuscation, resulting in elevated false positive rates. To address this limitation, this study proposes an XAI-Driven Hybrid Architecture that synergizes context-aware semantic embeddings from WangChanBERTa with outlier-robust structural features. Validated on a rigorously curated high-fidelity corpus of 5,000 samples, our model achieves a state-of-the-art F1-Score of 0.9908. Beyond standard metrics, Explainable AI (XAI) diagnosis reveals a critical "Dual-Validation" mechanism: structural features effectively veto semantic hallucinations triggered by benign complexity, acting as a crucial safety net. Crucially, the proposed architecture functions as a 'Dual-Validation' mechanism, where structural features effectively veto semantic hallucinations triggered by benign complexity. The integration of these components leads to a 50% reduction in the False Positive Rate (FPR), decreasing from 0.024 in baseline scenarios to 0.012, thereby confirming the operational significance of Selective Integration. This method effectively reduces 'alert fatigue,' providing a scalable solution for SOC analysts tasked with protecting critical infrastructure from advanced code-mixed threats.

Abstract: Federated Learning (FL) and Split Learning (SL) maintain client data privacy during collaborative training by keeping raw data on distributed clients and only sharing model updates (FL) or intermediate results (SL) with the centralized server. However, this level of privacy is insufficient, as both FL and SL remain vulnerable to security risks like poisoning and various inference attacks. To address these flaws, we introduce SplitML, a secure and privacy-preserving framework for Federated Split Learning (FSL). SplitML generalizes and formalizes FSL using IND−CPAD secure Fully Homomorphic Encryption (FHE) combined with Differential Privacy (DP) to actively reduce data leakage and inference attacks. This framework allows clients to use different overall model architectures, collaboratively training only the top (common) layers while keeping their bottom layers private. For training, clients use multi-key CKKS FHE to aggregate weights. For collaborative inference, clients can share gradients encrypted with single-key CKKS FHE to reach a consensus based on Total Labels (TL) or Total Predictions (TP). Empirical results show that SplitML significantly improves protection against Membership Inference (MI) attacks, reduces training time, enhances inference accuracy through consensus, and incurs minimal federation overhead.

Abstract: The 5G network adopts a cloud-native, service-based architecture (SBA) that enables support for diverse services via virtualized Network Functions (NFs). A key advantage of this architecture is its decoupling of the control plane and user plane, which enhances network flexibility and scalability. However, the reliance on virtualized implementations and cloud processing also expands the network’s attack surface. For example, the centralized Network Repository Function (NRF) inherently faces the risk of single points of failure. Additionally, the processes for authorizing and accessing services across network functions (NFs) remain susceptible to a variety of security threats. Addressing these gaps requires a resilient security architecture that builds on the existing 5G security framework; yet, current research on security and privacy management for network function services remains relatively limited. To fill this research gap, this paper proposes 5G-DAuth: a decentralized security management scheme for NF services in 5G networks. 5G-DAuth is built on a consortium blockchain and integrates a trusted off-chain Trusted Execution Environment (TEE) pool. The consortium blockchain forms the foundation of a decentralized cross-domain security management platform for NF services, enabling automated registration, authentication, authorization, and access control for NFs. This design directly resolves the single-point failure risk associated with the centralized NRF. To ensure the confidentiality and integrity of service data, the off-chain TEE pool is specifically designed to support smart contract execution and secure service data storage. Additionally, we enhance access tokens using digital signature to achieve fine-grained access control for service authorization while protecting against man-in-the-middle (MITM) attacks and replay attacks during service access. We validate the security of 5G-DAuth through two complementary approaches: informal security analysis and formal verification via a dedicated verification tool. Experimental results further demonstrate that 5G-DAuth delivers high performance across different service management operations, with strong performance in terms of latency and throughput.