Journal of Science and Technology on Information security
About the Journal Edit About the JournalInformation Security Journal publishes a periodical academic, scientific, specialized journal in the field of information security named “Journal of Science and Technology on Information security”. The publication aims to create a forum to discuss scientific and technological issues in the field of information security, to support of researching science and technology in this field, and contribute to connecting research, trainning and applications deployment. The Journal of Science and Technology on Information Security - abbreviated name ISJ, with index ISSN 2615-9570 is a publication of Information Security Journal, Vietnam Government Information Security Commission. This is an academic, scientific, specialized magazine and is also a place to discuss scientific and technological issues in the field of information security, support scientific and technological research in this field, and contribute connecting research, training and application deployment. Helpful for leaders, managers, scientific and technical staff, teachers, students... The Journal of Science and Technology on Information Security has been published since 2015 with 2 issues/year (1 issue in Vietnamese and 1 issue in English). By 2022, the publication has increased the number of publications to 3 issues/year with 2 English issues (published in June and December) and 1 Vietnamese issue (published in September). From 2024, the Journal's installments will be published entirely in English. The Journal of Science and Technology on Information security in the field of Information Security is recognized as high quality according to Decision No. 22/QĐ-HĐGSNN of the State Council for Professorship (http://hdgsnn.gov.vn/tin-tuc/quyet-dinh-so-25-qd-hdgsnn-phe-duyet-danh-muc-tap-chi-khoa-hoc-duoc-tinh-diem-nam-2024_788/). According to The State Council for Professorship of Vietnam, the paper are counted 0.75 score by The Council for Professorship in Information Technology and 0.75 score by The Interdisciplinary Council for Professorship in Electrical-Electronics-Automation. The papers published in the Journal are scientific research works, new technologies applications, scientific achievements and new techniques in the field of information security. They have not been published or sent to any magazines or any conference proceedings. The papers are sent to scientists for strict assessment and criticism and to be counted points, according to the process of publishing scientific works of The State Council for Professor Title of Vietnam. The authors whose papers are published will receive royalties according to the provisions of the Journal, along with the issues including their papers and soft copies (PDFs) of other issues if needed. Authors do not have to submit any fees when submitting articles. All cost for the publication process is supported by Journal of Science and Technology on Information security. Call for scientific papers for 2026 Dear professionals! To prepare for publishing the Journal of Science and Technology on Information security 2026 in English and aim to become a prestigious, quality magazine with unique characteristics in the field of information security and safety. The Journal respectfully invites and calls on all domestic and foreign scientists to submit quality articles to the Journal. The release schedule for 3 issues in 2026 is as follows: No. 1.CS(27) 2026 is expected to be published: June 2026 No. 2.CS(28) 2026 is expected to be published: September 2026 No. 3.CS(29) 2026 is expected to be published: December 2026 Authors please submit the manuscript according to the format of the Journal provided at https://isj.vn/index.php/journal_STIS/information/authors. Article submission rules and guidelines for presenting articles are posted on the website https://isj.vn/index.php/journal_STIS/about/submissions. For support, please contact us via email at thukychuyensan@bcy.gov.vn or reach out to the Administrative Secretary, Hoang Thi Thu Hang (mobile phone at +84 914372016). Sincerely./.
Vietnam Government Information Security Commission
Open Access Policy The Journal of Science and Technology on Information Security provides open access to its published articles to broaden opportunities for high-quality research findings to be available and widely disseminated free of charge, contributing to the greater exchange of knowledge. Open access statement: CTUJoS permits everyone to read, download, copy, distribute, print, search, or link to the full texts of the published articles without registration, price barriers, or asking for permission from the Journal or the author. Proposed Policy for Journals That Offer Delayed Open Access Authors who publish with this journal agree to the following terms: 1. Authors retain copyright and grant the journal right of first publication, with the work [SPECIFY PERIOD OF TIME] after publication simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal. 2. Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal. 3. Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) prior to and during the submission process, as it can lead to productive exchanges, as well as earlier and greater citation of published work (See The Effect of Open Access).
Throughput Optimization of the ASCON Lightweight Cryptographic Algorithm on IoT Devices
ASCON is a lightweight authenticated encryption algorithm standardized by NIST for securing constrained IoT environments. This study presents the implementation of ASCON-128a in a practical IoT architecture, where the ESP32 serves as the central microcontroller at the IoT node and the Raspberry Pi 4 acts as the central microcontroller at the IoT gateway. The ESP32 is chosen for its low-power operation, integrated wireless communication, and suitability for embedded edge processing. At the same time, the Raspberry Pi 4 is selected to support higher computational demands and data aggregation at the network edge. To improve performance, optimization strategies such as CPU frequency scaling, IRAM execution, dual-core parallelism, and cache warm-up were applied on the ESP32, alongside frequency stabilization and cache warm-up on the Raspberry Pi 4. Experimental results indicate that the ESP32 achieves an encryption throughput of 2.42 MB/s, while the Raspberry Pi 4 reaches 124 MB/s. These results validate ASCON-128a as an efficient and secure cryptographic solution for heterogeneous IoT systems.
Copyright (c) 2025 Journal of Science and Technology on Information security
AI-Enhanced SQL Injection Detection Framework: A Novel Approach Combines LLMs with Traditional Fuzzing to Improve Web Application Vulnerability Detection
SQL injection affects 65% of web applications, yet traditional tools often miss context-specific vulnerabilities. We propose AESIDF, a hybrid framework that integrates Large Language Models with parallel fuzzing for semantic vulnerability analysis. Evaluated on 26 benchmark scenarios from PortSwigger, DVWA, and OWASP Juice Shop, our approach achieves a 92.3% detection rate compared to SQLMap’s 76.9%, while reducing request volume by approximately 68.8%. These preliminary results suggest that LLM-powered contextual reasoning can enhance automated security testing; however, broader validation on larger and more diverse datasets is required to confirm generalizability.
Weak Links in Smart Surveillance: An Empirical Security Evaluation of Evil Twin Attacks on IoT Cameras
Wireless IP cameras are vital in IoT ecosystems but remain vulnerable to Evil Twin attacks that enable device compromise and data interception. This study empirically demonstrates how Deauthentication combined with rogue access points can coerce WPA2-based cameras into attacker-controlled networks, enabling MITM interception of unencrypted streams. Experiments using a controlled testbed reveal weaknesses in AP authentication, session management, and reconnection logic. To mitigate these threats, we recommend WPA3-SAE adoption, AP fingerprinting, stronger traffic encryption, and rogue AP detection. The results highlight systemic flaws in consumer IoT cameras and outline practical defenses to enhance Wi-Fi security in surveillance systems.
Proposal of an End-to-End Encrypted Chat System with Digital Signature and Vietnamese Character Support Based on Elliptic Curve
The paper proposes an End-to-End Encrypted (E2EE) chat system based on Elliptic Curve Cryptography (ECC), using Elliptic Curve Digital Signature Algorithm (ECDSA) for authentication and Elliptic Curve Diffie-Hellman (ECDH) for encryption key generation. The system is designed as a lightweight web widget, easily embeddable into websites, with full support for Vietnamese characters (UTF-8) without compromising performance. The solution employs the Web Crypto API to perform AES-GCM encryption and ECDSA digital signatures, combined with a nonce mechanism to prevent replay attacks. Experimental results demonstrate high performance (encryption/decryption time <1ms for long messages) and resilience against MITM and spoofing attacks.
A Blockchain-Based Chain of Custody for Digital Evidence: Design and Evaluation
Maintaining a trustworthy chain of custody is essential to ensure the integrity, provenance, and admissibility of digital evidence. However, traditional evidence-management systems often suffer from opacity, limited auditability, and susceptibility to insider abuse or procedural errors. To address these gaps, we propose a blockchain-based chain-of-custody framework built on Hyperledger Fabric. In this design, the full lifecycle of evidence is logged as immutable, permissioned ledger entries, while artefacts themselves remain protected in secure off-chain repositories. Each event is captured through signed metadata and cryptographically time-stamped records, providing tamper-evident traceability. Custody workflows are encoded in Fabric chaincode, with role-based, multi-party authorization required for sensitive transitions. Moreover, Fabric’s privacy channels and fine-grained access controls enable cross-agency collaboration without unnecessary data exposure. A prototype implementation shows that the system achieves end-to-end accountability, practical throughput, and sub-second median latency on commodity hardware-demonstrating that stronger evidentiary assurance can be achieved for law-enforcement and forensic applications without incurring prohibitive operational costs.
Enhancing MITM Attack Detection Mechanism for ICS using LSTM-based Hybrid Ensemble Learning
With the rapid development of Information Technology (IT), the integration of IT with Industrial Control System (ICS) makes it susceptible to cybersecurity threats, including Man-in-the-Middle (MITM) attacks. Many studies focus on MITM attack detection approaches that include rule-based methods and those using Machine Learning (ML). However, these approaches suffer from two main limitations: a lack of a dataset for MITM attack detection in ICS networks and an effective MITM attack detection method due to the ever-increasing complexity of ICS networks. In this paper, we propose a novel MITM attack detection framework using an ensemble learning algorithm for large-scale ICS networks. Concretely, we propose a novel ICS simulation framework for large-scale networks using Software-Defined Networking to facilitate ICS studies. Moreover, a novel lightweight MITM attack detection mechanism using an enhanced pre-processing technique and a hybrid ensemble learning algorithm using Long Short-Term Memory (LSTM) is proposed to detect MITM attacks with high accuracy while requiring suitable processing time. Experimental results show that the proposed MITM attack detection mechanism can achieve an f1 score of 91.91% while requiring only 8.91 microseconds for inference time.
Memory-Resident Malware Detection via a Hybrid Deep Learning Framework
Memory-resident malware detection is a critical cybersecurity challenge, particularly with stealth techniques like Living-off-the-Land (LotL). This paper proposes a hybrid deep learning framework to detect malware from memory-behavior data represented as fixed-length tabular features. The framework emphasizes an effective data processing pipeline rather than a complex model architecture. It has three stages: (1) feature selection and Z-score standardization using Extreme Gradient Boosting (XGBoost) and StandardScaler, (2) data balancing and cleaning using Synthetic Minority Over-sampling Technique (SMOTE) and Edited Nearest Neighbor (ENN), and (3) training a Transformer Encoder-based classifier to extract high-level non-linear representations from the stabilized feature space, utilizing robust Feed-Forward Networks, Layer Normalization, residual connections, and Focal Loss to enhance training stability under class imbalance. Training further employs a StepLR Scheduler and Early Stopping to ensure convergence and prevent overfitting. On the CIC-MalMem-2022 dataset, which comprises one benign class and 15 malware classes, the proposed framework achieves 76.62% Accuracy and 76.35% F1-score, outperforming traditional baselines. These results demonstrate the framework’s effectiveness for proactive malware defense based on memory behavioral analysis.
FPGA-Based inline encryption bridge using AES-XTS for storage systems
This paper presents a hardware-based AES-256 XTS encryption system implemented on FPGA, providing a complete inline bridge between a storage controller and the storage device. Unlike prior works that focused only on AES core optimization, this design integrates the core into the full SATA protocol and evaluates end-to-end storage-path performance. The pipelined XTS-AES core enables high-throughput, real-time sector-level encryption with minimal performance impact. FPGA implementation offers flexibility in key sizes and encryption modes, supports algorithm updates through partial reconfiguration, and allows scalability to various storage systems, including NAS storage systems. The main contributions are: (i) proposing an FPGA-based inline encryption architecture with an AES-XTS core fully integrated into the SATA protocol; (ii) implementing and evaluating the encryption performance on a real storage system, demonstrating practical feasibility and transparency in real-time operations.
Generating evasive payloads for assessing Web Application Firewalls with Reinforcement Learning and Pre-trained Language Models
Web Application Firewalls (WAFs) serve as a critical defense mechanism against various web-based attacks such as SQL Injection (SQLi), Cross-Site Scripting (XSS), Server-Side Request Forgery (SSRF), Remote Code Execution (RCE), and NoSQL Injection. However, modern adversaries often craft evasive and obfuscated payloads capable of bypassing traditional WAF rules. To effectively assess and challenge the robustness of WAFs, we propose DEG-WAF, a Deep Evasion Generation framework that leverages Large Language Models (LLM) in conjunction with Reinforcement Learning (RL) to generate evasive payloads against WAFs. The system consists of four core components: a payload generation agent based on a pre-trained LLM (OPT-125M), a reward model that approximates WAF behavior, a grammar-based sampling agent that ensures syntactic validity, and an RL agent trained with either Proximal Policy Optimization (PPO) or Advantage Actor-Critic (A2C) to fine-tune generation strategies. Experimental evaluations on real-world WAFs, including ModSecurity and SafeLine, demonstrate that the A2C-based model significantly outperforms baseline LLMs—achieving a bypass success rate of 80.16% on SQLi and 74.70% on NoSQLi for ModSecurity, and 97.8% on RCE for SafeLine. These results underscore the potential of our LLM-RL framework to serve as a robust foundation for evaluating and enhancing the resilience of WAF systems under adversarial conditions.
Research on the Design and Development of a Secure Cold Wallet Device for Blockchain
Cold Wallet is a specialized hardware device designed to store private keys and perform digital signing in an isolated (offline) environment, ensuring maximum security for digital assets. This paper presents a comprehensive design of a secure cold wallet device for Blockchain, focusing on security requirements and cryptographic processing capabilities.
A secure image steganography based on Hamming codes and image block complexity estimation using a zig-zag order
Data hiding in digital images has received considerable attention in recent years. Research efforts have primarily focused on increasing embedding capacity while preserving the visual quality of stego-images. In this paper, we propose a data hiding scheme based on Hamming codes. To enhance visual quality, the scheme estimates block complexity from pairs of adjacent pixels arranged in zig-zag order and uses this measure to identify high-texture regions for embedding message bits. To further minimize distortion, secret bits are embedded using the proposed Hamming code-based method. Moreover, embedding capacity is increased by utilizing multiple pixel bit-planes. A Canonical Gray Code (CGC) is employed in the bit-plane decomposition process to improve the accuracy of texture characterization in data hiding. Experimental results demonstrate that the proposed scheme achieves higher embedding capacity, improved visual quality, and stronger resistance to detection attacks.
FedPC Cloud CPU Forecasting using Federated Learning and Periodicity-based Clustering
Accurate CPU workload forecasting is vital for efficient resource management and system availability in cloud computing, yet faces challenges in data privacy, security, and the "cold start"problem for new Virtual Machines (VMs). Traditional methods risk privacy and struggle with limited data. We propose FedPC, a novel framework leveraging privacy-preserving Federated Learning (FL) with Periodicity-based Clustering. FedPC enables collaborative training without exposing local data, crucially supporting effective forecasting for new VMs with minimal historical information. It clusters VMs by workload periodicity, training tailored LSTMs within each cluster to handle heterogeneity securely. Evaluated on Azure Public Dataset V1, FedPC surpasses FedAvg in privacy and matches state-of-the-art methods in accuracy. This demonstrates FedPC’s efficacy in securely, adaptively managing resources, thereby enhancing system availability, especially in dynamic cloud environments with frequent VM creation and scarce initial data.
Federated Trust-Based Authentication for Secure Mobile Cloud Access
The proliferation of mobile cloud services significantly increases the complexity and risks associated with user authentication. Traditional password-based authentication methods are vulnerable to credential theft and account takeover attacks. Although centralized Risk-Based Authentication (RBA) methods enhance security by evaluating login attempt risks, they often compromise user privacy by aggregating sensitive authentication data. To overcome these challenges, this paper proposes a federated trust-based authentication framework utilizing federated learning (FL) integrated with an Artificial Neural Network enhanced by Batch Normalization (ANN-BN). Specifically, our framework calculates a trust score for each login attempt based on user behavior patterns and contextual threat indicators. This trust-based approach enables accurate detection of malicious login attempts while preserving user privacy by performing decentralized model training across multiple client devices. Experiments conducted on a real-world login dataset demonstrate that the proposed federated ANN-BN approach achieves high detection accuracy with a low false-alarm rate, effectively balancing security enhancement and privacy preservation. Our results confirm the effectiveness and practicality of federated learning for secure authentication in mobile cloud environments, highlighting its potential for real-world deployment and motivating future research directions.
A Scalable Telegram-Based Botnet Framework for Stealthy Remote Command and Control
In this study, we analyze how Telegram Bots can be abused as a Command and Control (C2) infrastructure in cyberattacks. We propose a Telegram-based C2 model that enables attackers to control compromised systems without relying on a centralized server, thereby enhancing anonymity and evasion capabilities. Furthermore, we introduce detection and defense strategies based on network behavior monitoring and encrypted message analysis.
A Novel Approach for 1D-CNN Hyperparameter Optimization in IoT Attack Detection using Particle Swarm Optimization
This study proposes a hyperparameter optimization method for one-dimensional convolutional neural network using the Particle Swarm Optimization algorithm based on a Pareto multi-objective approach to improve the performance of IoT attack detection systems. Specifically, this study enhances the PSO algorithm by introducing an automatic termination criterion for optimization loops and proposes an early stopping mechanism, along with the optimization of the early stopping patience during the 1D-CNN model training process, thereby reducing computational costs and aligning with the resource-constrained hardware conditions of IoT. Additionally, a multi-objective optimization function is developed to balance detection performance and resource efficiency by combining validation accuracy with the 1D-CNN's execution time. The proposed method is evaluated on the Edge-IIoTset dataset. Experimental results demonstrate that the optimized model reduces execution time by 48-63% compared to the baseline model while maintaining high accuracy (over 94%). This research not only provides a practical solution for IoT security but also pioneers a novel approach to integrating evolutionary algorithms into adaptive deep learning systems and introduces a flexible method for hardware-constrained devices.
one-dimensional convolutional neural network (1D-CNN)
An Efficient Framework for Multi-Class Malware Classification in Cloud Environments
Malware classification in cloud environments remains a critical challenge due to the increasing complexity and volume of cyber threats. This paper proposes CMC (Cloud-based Malware Classification), a novel framework that enhances multi-class malware classification efficiency through the integration of feature selection, dimensionality reduction, and imbalanced data handling techniques. The CMC framework aims to improve classification accuracy and computational efficiency by optimizing feature representation and addressing class imbalance, which are common issues in real-world malware datasets. To evaluate its effectiveness, we apply the proposed model to two public benchmark datasets: CMD_2024 and CIC-MalMem-2022. Experimental results demonstrate that CMC outperforms existing approaches in terms of classification accuracy, F1-score, and computational efficiency, proving its potential for real-world deployment in cloud-based security solutions. These findings highlight the importance of intelligent data preprocessing and feature optimization in enhancing malware classification on cloud platforms.
A Combinational Model-Based APT Attack Detection Approach
In the context of a world increasingly reliant on digital technology, Advanced Persistent Threats (APT) pose a significant challenge to global cybersecurity. To address this issue, this paper introduces a novel approach called BiLSTM-Attention-GCN (BiLAG), an advanced model combining Bidirectional Long Short-Term Memory (BiLSTM) networks, Attention mechanisms, and Graph Convolutional Networks (GCN). The goal of BiLAG is to provide an effective and accurate method for detecting APT. BiLSTM is employed to capture temporal features related to event sequences, enabling the detection of anomalies over time. The Attention mechanism focuses on the most critical aspects of the dataset, allowing the model to identify hidden signals that indicate potential attacks. Lastly, GCN is utilized to explore complex relationships among network entities, enhancing APT detection by constructing a detailed and precise relational graph. Experimental results demonstrate that BiLAG achieves an accuracy of 99%, with high recall and significantly reduced false positive rates.
Enhancing SPN ciphers: Dynamic substitution-key addition layers via binary block circulant matrices
The SPN (Substitution-Permutation Network) block cipher is one of the fundamental and important structures in the field of symmetric encryption, widely used in modern encryption algorithms such as AES. Due to its ability to efficiently diffuse and obscure data, SPN plays a key role in building secure and reliable encryption systems. However, with the development of the SPN block cipher, many studies have been conducted to identify cryptanalytic attack methods to break this cipher. To enhance the security of the SPN block cipher, recent research has focused on dynamic transformations of its components and often relies on the secret component, the key. In this study, we propose a new method that combines the dynamicization of two key components: the substitution layer and the key addition layer of the SPN block cipher. This method is based on using a binary block circular shift matrix, formed by combining a binary circular shift matrix with a binary Hadamard matrix. Our algorithm only requires the use of 26 additional key bits but can generate up to 228 key-dependent S-boxes with strong cryptographic properties and 233 key-dependent XOR tables. When applying these key-dependent S-boxes and XOR tables to dynamically modify the AES block cipher, it can increase the security level of the dynamic AES block cipher by 233 compared to AES
Large-scale Android malware detection by integrating Blockchain and IPFS for secure virus signature distribution
The growing threat of Android malware underscores the limitations of centralized antivirus systems, which face challenges such as latency, single points of failure, and susceptibility to attacks. To address these issues, this paper introduces a decentralized framework leveraging blockchain technology via Hyperledger Fabric and the InterPlanetary File System (IPFS). The system, HypatiaX, provides secure, efficient, and transparent virus signature distribution while ensuring scalable and resilient data storage. By utilizing blockchain for virus signature management and IPFS for decentralized storage, HypatiaX supports real-time updates in distributed environment. Performance evaluations reveal low resource consumption, near-instantaneous query responses, and efficient virus scanning under diverse conditions. Advanced components, including a ledger controller, signature crawler, key manager, and IPFS client, further strengthen decentralized storage, secure key management, and automatic signature updates. This framework demonstrates significant improvements in combating Android malware while addressing the inherent flaws of traditional antivirus solutions.
Malware Analysis: A Perspective from Dynamic Symbolic Execution of Binary Code
Malware analysis typically involves three steps: obfuscation, infection, and malicious action. Many antivirus methods fail because obfuscation hides control structures. This paper provides an overview of dynamic symbolic execution (DSE) applied to binary code, especially x86. DSE is considered the most powerful technique for deobfuscation and can automatically recover control structures such as control‑flow graphs. Several DSE tools target x86 (e.g., angr, Mayhem, S2E, KLEE‑MC, and BE‑PUM); we examine their design choices and trade‑offs. Finally, we evaluate the effectiveness of control‑flow graph similarity for tasks such as packer identification and original entry point (OEP) detection.
Secure Implementation of Post-Quantum Cryptography
Post-Quantum Cryptography (PQC) is now required by several institutions and vendors, especially for applications related to low-level security functions (secure boot, firmware management, secure channels establishment, etc.). Not only standardized PQC algorithms must match correctly their specification, but also they must be implemented in accordance with market requirements. Those mostly consist of Performance-Power-Area (PPA) and certification constraints. In turn, the PPA encompasses tradeoffs between speed and implementation size, but also optimal adequation with available resources (vectorization in software, parallelism in hardware, dedicated accelerators in embedded systems, etc.) The certification relates to secure implementation in the context of adversaries trying to gain information on the secrets, exploiting for instance some surreptitious information leakage (secret-dependent timing or power consumption). There is an interplay between PPA and certification aspects that we detail in this paper, for different classes of PQC algorithms. We also give some insights on the order in which PQC algorithms will be rolled-out, dictated by the requirements to implement in hardware some services which cannot be retrofitted later on in software, namely those that are in charge of firmware lifecycle management
Detection of source code vulnerabilities using Nature language processing and deep graph network
The software production sector gains advantages from automated code generating techniques, yet encounters issues related to vulnerabilities in the resulting code. This research presents a hybrid paradigm, termed GBD, for detecting vulnerabilities in software written in C and C++. It integrates Graph Convolution Network (GCN), Bidirectional Encoder Representations from Transformers (BERT), and Dropout. During Phase 2 of the GBD model, the subsequent tasks are executed concurrently: (i) obtaining node and edge features utilizing the GCN graph convolution network; (ii) deriving segment features employing the BERT model; (iii) constructing a source code profile via the Code Property Graph (CPG). Phase 3 of the model implements the Dropout strategy to mitigate overfitting. Phase 4 is the classifier that ascertains the presence of vulnerabilities in the source code. Experimental findings demonstrate the superiority of the proposed model relative to alternative methods, attaining a prediction accuracy of 61.21% for vulnerable code and 88.94% for normal files. Additionally, the classification outcomes demonstrate that with a token length of 512, the GBD model yields the most uniform results across all metrics: Accuracy (86.65%), Precision (38.59%), Recall (66.21%), and F1-score (48.76%). This corresponds with our analysis of the Verum experimental dataset, indicating that over 70% of the source code files have lengths exceeding 256 but less than 512. Furthermore, the GBD model exhibits strong performance across both individual and multiple datasets. For example, in the Verum dataset, the GBD model surpasses five alternative methodologies—REVEAL [1], Russell [2], VulDeePecker [3], SySeVR [4], and Devign [5] - by 4% in Accuracy and between 15% and 57% in Precision, Recall, and F1-score. In comparison to SySeVR [4], the GBD model exceeds it by 3% to 25% across all metrics. In comparison to Devign [5], GBD achieves improvements of 5% to 39% in Precision, Recall, and F1-score. Upon assessment of the FFmpeg+Qume dataset, the GBD model attains an Accuracy improvement ranging from 0.2% to 10% above all other studies. In terms of precision, GBD surpasses alternative methods by 0.3% to 9%. In terms of Recall, GBD is marginally worse than REVEAL by 1.5%, although surpasses all other methodologies by 10% to over 31%. In terms of F1-score, GBD is 0.3% inferior to REVEAL but surpasses other studies by 7% to 30%. The results indicate that the GBD model is effective on both individual and multiple datasets
Copyright (c) 2024 Journal of Science and Technology on Information security
Amplified Gradient Inversion Attacks on Federated Learning Frameworks
Federated Learning (FL) facilitates collaborative model training while safeguarding data privacy, making it ideal for sensitive fields such as finance, education, and healthcare. Despite its promise, FL remains vulnerable to privacy breaches, particularly through gradient inversion attacks that can reconstruct private data from shared model updates. This research introduces a nonlinear amplification strategy that enhances the potency of such attacks, revealing heightened risks of data leakage in FL environments. Additionally, we evaluate the resilience of privacy-preserving mechanisms, such as Differential Privacy (DP) and Homomorphic Encryption (HE), by employing two proposed metrics AvgSSIM and AvgMSE to measure both the severity of attacks and the efficacy of defenses.
Proposed Optimized Hardware Implementation for the S-box of the PRESENT Algorithm Using Combinational Logic Circuits
The lightweight block cipher PRESENT has been standardized by ISO/IEC 29192-2:2012 and TCVN 12854-2:2020. It is a lightweight block cipher with a block size of 64 bits and key sizes of either 80 or 128 bits. For lightweight block ciphers commonly deployed in resource-constrained embedded and IoT devices, resource optimization is a top priority. The S-box, as the only nonlinear component, plays a crucial role in ensuring the security of the cryptographic algorithm by providing resistance against nonlinear and differential attacks. The S-box also consumes the most resources compared to other components of the algorithm, making the optimization of the S-box implementation essential for minimizing the overall resource usage of the algorithm. The S-box of the PRESENT algorithm is used in many other block cipher algorithms. By surveying existing research on PRESENT implementations and analyzing S-box deployment methods based on combinational logic circuits, this paper proposes new architectures for implementing S-boxes using the lowest resource-consuming logic gates, such as 2-input NAND gates, 2-input NOR gates, and NOT gates. The results demonstrate that the proposed methods achieve reduced resources compared to other designs
Paradigms in Security Protocol Verification: A Multi-Tool Analysis
In the realm of internet security, ensuring the robustness and integrity of communication protocols is paramount. This paper offers a comprehensive analysis of four leading tools for security protocol verification: Scyther, ProVerif, CryptoVerif, and Tamarin. Each tool is evaluated for its unique strengths and applications, particularly in the contexts of cloud computing and IoT. The study begins with Scyther, highlighting its proficiency in automated falsification and multi-protocol verification. Next, ProVerif is examined for its capabilities in symbolic reasoning and its efficiency in handling complex security protocols. The paper then explores CryptoVerif’s computational approach to protocol verification, focusing on how it models and verifies protocols under a variety of cryptographic assumptions. Finally, Tamarin’s advanced features in symbolic analysis and its ability to manage intricate security properties are discussed, emphasizing its depth in formal protocol verification. This comparative analysis not only underscores the distinct contributions of each tool but also provides a broader perspective on their effectiveness in addressing both current and emerging security challenges. By dissecting the methodologies and limitations of these tools, the paper aims to offer valuable insights into the evolving landscape of security protocol verification and potential future directions in this critical area of cybersecurity research.
Intrusion Detection Using Federated Learning in Non-IID Data Environments
Intrusion Detection Systems (IDS) are essential for protecting networks by detecting threats. Machine learning (ML) based approaches have enhanced the effectiveness for IDS. However, it raises privacy concerns for IDS based on ML approaches due to the need for centralized data. To address this issue, Federated Learning (FL) has been applied to IDS. It allows ML models to be trained on decentralized devices/clients without sharing raw data. However, FL faces challenges with non-independent and identically distributed (non-IID) data, which reduces the performance of intrusion detection models. This paper introduces a loss function that jointly learns compact local representations on each client and a global model across all clients, enhancing the robustness of FL in non-IID data environments. Experimental results demonstrate that our method significantly improves the accuracy and robustness of FL systems for IDS in non-IID environments.
A Reversible Data Hiding Scheme with Security Enhancement Using a Secure Bit Selection Strategy for AMBTC-Compressed Images
Reversible Data Hiding (RDH) is an approach that has garnered significant attention from researchers over the past two decades. In this paper, an Absolute Moment Block Truncation Coding (AMBTC)-based RDH approach is proposed. To increase the embedding capacity (EC), the approach utilizes the high mean and low mean values for data hiding. Additionally, a binary matrix from the AMBTC compressed code is employed to embed the given message bits into encrypted information arrays using the XOR (exclusive OR) operator. This mechanism enhances the security of the hidden message through a secure bit selection method. Consequently, the embedding capacity of the proposed RDH scheme can exceed 98,301 bits when an image block of size 4 × 4 pixels is used. Moreover, the visual quality of the stego-images produced by the proposed RDH scheme surpasses that of state-of-the-art RDH approaches.
A Robust Watermarking Method Based on RDWT-DCT-SVD in the YCbCr Color Space
In digital copyright protection, watermarking plays a crucial role, particularly in ensuring the watermark remains imperceptible, robust against attacks, and has a high embedding capacity. The new method proposed in this paper utilizes Redundant Discrete Wavelet Transform (RDWT), Discrete Cosine Transform (DCT), and Singular Value Decomposition (SVD) to embed the watermark into a color image. Instead of using traditional methods, this approach calculates the Bhattacharyya distance between the original image and the watermark to determine the embedding factor automatically. The watermark is hidden in the Cb channel of the YCbCr color space, which minimizes the impact on the original image quality and enhances both the imperceptibility and robustness of the watermark. Experimental results show that this method not only preserves the original image quality but also withstands various types of attacks, ensuring the watermark retains its integrity and high recoverability.
Research on 5G mobile networks in Vietnam, design selection and testing of 5G Mobile Communications Jamming Device
According to the research presented by the authors in [1], we propose research content, applying new technical technologies to research and design 5G mobile communications jamming devices. The goal of research and product design is to meet the basic requirements of technical indicators, operating features as well as specific requirements of the Public Security. In this article, the authors introduce some initial results of testing and evaluating 5G mobile communications jamming devices in frequency bands n28, n40, n41 (in which, n41 is divided into two frequency bands n41A and n41B) and n77. This not only has practical significance in scientific research and technology mastery, but also serves as a basis for the authors to continue developing products applying SDR technology to design and manufacture intelligently controlled, adaptive jamming devices in the future, meet work requirements of the Public Security, while diversifying the methods of operation for the Public Security force in practice
DSViT: An Enhanced Transformer Model for Deepfake Detection
The rapid development of artificial intelligence and deep learning models has enabled the creation of highly realistic fake images and videos, posing significant threats to information security and safety. Accurate detection of these forged contents is crucial to prevent the spread of misinformation and to protect the integrity of digital media. Although several advanced studies in this field, such as Vision Transformer (ViT) and Convolutional Vision Transformer (CViT), have been conducted, there remain limitations that need to be addressed. In this paper, we introduce a novel model, improved from CViT, designed to optimize the process of deepfake detection, named DSViT (Deepfake Detection with SC-based Convolutional Vision Transformer). This model judiciously integrates Convolutions and a SCConvolution block with the ViT architecture. We conducted experiments on the Deepfake Detection Challenge (DFDC) dataset and compared the results with the CViT model to demonstrate the effectiveness of the proposed model