Journal of Cybersecurity and Privacy

MD-Hill-SPN is the first Hill-based construction to combine a multi-tier diffusion mix layer, a memory-hard KDF, and a simultaneous multi-metric empirical evaluation. Two independent runs of the full metric suite yield: (a) full plaintext avalanche from round 1 (mean 63.97–64.67 of 128 bits, ideal 64); (b) the differential-probability sampling floor of 2 × 10⁻⁵ reached at round 4 (50,000 of 50,000 output differences distinct, both sessions); (c) algebraic-degree lower-bound saturation at the maximum observable value from round 1; (d) linear-bias indistinguishable from random (combined exceedance 4.40%, below the 4.55% noise floor); and (e) branch numbers at the Singleton (MDS) bound for every tier (B = 5 for 4 × 4, B = 9 for 8 × 8, B = 17 for 16 × 16), computed exhaustively over weight-1 inputs. MD-Hill-SPN therefore moves beyond theoretical construction to a construction that passes a defined empirical evaluation suite: avalanche, differential sampling, linear-bias probing, algebraic-degree lower bounds, and MDS branch numbers under single-key, known-plaintext conditions with fixed parameters, an evaluation no prior Hill cipher variant has reported in full. Full article

As micro, small and medium-sized enterprises (MSMEs) compete with limited resources, lightweight systems are needed to secure their digital assets. Fuzzy vaults (FVs) are useful for protecting secrets and, when applied to biometric systems, provide error-tolerance and privacy to enrolled biometric features. Combining multiple biometric traits also improves performance against attacks like spoofing in multimodal (MM) authentication systems. However, the design of the FV and the biometric-fusion method applied can limit the system’s effectiveness. This study systematically evaluates recent studies on FVs and MM systems and presents an up-to-date review to identify gaps, give directions for future studies, and, ultimately, improve the design of these systems. The research targeting MSMEs was carried out in two parts, with the first search focused on MM systems and the second on FVs, following the PRISMA guidelines. The main findings include the need to optimise the resource intensity of FV systems for the authentication of large numbers of individuals. It also found the need to make the model compatible with other biometric modalities as greater focus is on minutiae features. By reviewing these systems, we aim to foster the development of lightweight MM FV models to provide privacy and security in MSMEs. Full article

Due to the indispensable use of the internet, malicious actors have exploited URLs as a threat source of network information security and integrity. URL detection based on traditional methods has become inefficient against the uncontrolled increase of URLs, especially when facing dynamic and large-scale threats. To address the limitations of traditional methods and to provide intelligent and scalable detection of malicious URLs, this study proposes the hybrid framework (NetGuard) by integrating probabilistic data structures (PDSs) with machine learning (ML) capabilities. The proposed NetGuard utilizes PDSs to develop a Hybrid Scalable Detection Filter (HSDF), which combines the strengths of counting Bloom filters (CBFs) (deletion capability) and Scalable Bloom filters (SBFs). The proposed HSDF provides efficient membership queries under bounded false-positive rates (approximately 0.01) and ensures efficient data management and low-latency lookups on a scale of 10⁻⁵ s. On the other hand, NetGuard leverages the ML classifier capabilities to train and package a learned classifier for detecting malicious URLs. The proposed framework utilizes Decision Trees (DTs) and Random Forest (RF) classifiers. The proposed classifiers are trained by a novel SupURLsIdDs dataset which includes fifteen distinctive lexical and structural URL features extracted from four URL classes: benign, defacement, malware, and phishing URLs. The experimental results indicated the effectiveness of the HSDF in insertion and deletion operations, with minimal memory consumption (approximately 2.7 MB for 222,000 URLs) while maintaining a controlled false-positive rate (approximately 0.01 on Real-only subset up to 0.12 with synthetic data). The HSDF memory footprint represents a 99.88% enhancement compared to the RF model (which demands 2253.17 MB); thus, the HSDF complements RF as an ultra-lightweight first line of defense. The ML classifiers showed the superiority of RF, which achieved an overall classification accuracy of approximately 96% on large-scale URL data. These experiments are conducted using benchmark datasets constructed from aggregated real and synthetic data to demonstrate the scalability, adaptability, and resource efficiency of the first phase of NetGuard as a practical foundation for real-time web threat detection. The real-time integration and dynamic updates are presented as a deployment architecture and constitute future work. Full article

Most image encryption schemes exhibit one or more of the following limitations: keystream bias, high residual pixel correlation, pattern leakage, low sensitivity to key changes, or a security-efficiency trade-off. We present a robust image encryption framework based on a chaotic system that operates across the red, green, and blue color channels and mitigates all of the above vulnerabilities. The scheme consists of a novel integration of strong bidirectional modular diffusion, inter-channel confusion using a six-state permutation table, and Secure Hash Algorithm 256-based key derivation. Thus, we achieve the following: lossless reconstruction, near-ideal entropy, negligible adjacency correlation, high sensitivity to infinitesimal changes in both the plaintext and the secret key, a complete diffusion effect confirmed by standard differential metrics, and resilience against known- and chosen-plaintext attacks. Furthermore, the results comply with the National Institute of Standards and Technology randomness tests. These results are obtained with competitive encryption times (∼0.37 s for 512 × 512 images) without any code optimization. All of these features make the scheme promising for secure real-time visual data transmission, particularly in telemedicine and Internet of Things surveillance. Full article

The rise of capture-the-flag (CTF) competitions and offensive security training requires the deployment of systems that are, by design, flawed. This creates a unique architectural paradox: how does one host a system intended to be compromised without compromising the host itself? This paper classifies the security principles of “range engineering”—the discipline of engineering the environment. This research study synthesizes evidence across the cyber-range, honeypot, ICS/OT testbed, and cloud-isolation literature to derive a containment-focused classification of threat planes, security invariants, boundary mechanisms and properties, and operational controls for intentionally vulnerable environments used in education, training, and research. Five security invariants are derived under the assumption of expected compromise and mapped to boundary families and measurable operational objectives. The analysis further identifies under-evidenced areas, particularly control-plane isolation, corrective controls for cross-tenant failures, and systematic validation of externalization defenses. Full article

The increase and professionalization of cyberattacks calls for the development of relevant defense-in-depth mechanisms of which intrusion detection systems (IDSs) are essential components. This paper provides an in-depth analysis of system call-based IDSs as intelligence for detecting malicious activities. A systematic analysis of 209 publications from the scientific literature between 1996 and early 2026 highlights trends in this field of research and defines a taxonomy presenting the different approaches proposed by researchers. Eighteen state-of-the-art methods, representative of the diversity of approaches proposed in the literature, were reproduced and evaluated on two public datasets, ADFA-LD and NGIDS-DS. The detection performance and overhead of each method are examined in great detail, opening discussions on the shortcomings of the state of the art, limitations of system call-based IDSs, and lines of research that would enable this type of detection system to meet the challenges of deployment in a real-world environment. Finally, recommendations for future work are derived from these findings. Full article

The trustworthiness of AI-powered network security auditing depends not only on detection accuracy but on the faithfulness of the explanations that support compliance verdicts. In IoT network security, Large Language Models (LLMs) are increasingly utilized to produce natural-language security assessments from raw network traffic, yet the extent to which these explanations are grounded in retrieved evidence is rarely measured. This paper presents the Retrieval-Augmented Generation Assessment Suite (RAGAS) as an evaluation framework that compares three retrieval paradigms—rule-based heuristic scoring, dense vector retrieval, and knowledge graph traversal—on the task of explaining network compliance against ETSI EN 303 645 IoT cybersecurity provisions. Using 30 human expert-validated compliance scenarios derived from the CIC-IoT2023 dataset and three LLMs (DeepSeek-R1, Qwen-2.5, Llama-3.2), we find that graph-based retrieval achieves the highest faithfulness (0.570), outperforming rule-based (0.524) and vector retrieval (0.509). All methods, however, exhibit low context recall (≤22.4%), and we highlight that high detection F1 scores do not guarantee faithful explanations; over 40% of statements in compliance answers are unsupported by retrieved evidence. A proof-of-concept prototype, Security Audit Compliance Agent (SACA), demonstrates how knowledge graph traversal can be integrated with interactive visualization to support human auditor oversight. We argue that, in adherence to responsible AI principles, faithfulness measurement should become a standard complement to accuracy reporting for an AI-driven network audit or forensic analysis. Full article

The prompt spread of misleading information through recent information and communication technologies (ICT) admonishes social convention and credence. Developing trustworthy algorithms that can automatically identify fake content becomes increasingly difficult. We investigate a hybrid artificial intelligence (AI) strategy that integrates machine learning (ML) and deep learning (DL) to enhance fake news detection. The model’s deep learning entity evaluates confined text arrangements and inclusive text values using a Convolutional Neural Network (CNN) and Bidirectional Long Short-Term Memory (BiLSTM) with an attention layer. Conventional machine learning classifiers, mostly Support Vector Machine (SVM), Random Forest (RF), and Logistic Regression (LR), are trained synchronously employing Term Frequency–Inverse Document Frequency (TF-IDF). A simple ensemble averaging strategy is used on both machine learning and deep learning predictions. The model demonstrates strong generalization across various text types when evaluated on the LIAR dataset and a Kaggle-style fake news dataset. The combined system performs noticeably better than each of the separate models in terms of accuracy, precision, recall, F1, and AUC. Full article

Large language models (LLMs) require a significant redesign in solutions to preserve privacy in data-intensive applications due to their text-generation capabilities. Indeed, LLMs tend to memorize and emit private information when maliciously prompted. In this paper, we introduce Private Association Editing (PAE) as a novel defense approach for private data leakage. PAE is designed to effectively remove Personally Identifiable Information (PII) without retraining the model. We experimented on three open-weight, open-data models—GPT-Neo 1.3B, GPT-Neo 2.7B, and GPT-J—by applying Training Data Extraction (TDE) attacks to retrieve hundreds of PII, including email addresses, phone numbers, and Twitter handles. Since these models were trained on Pile, an openly available pre-training dataset, it is possible to verify the true extent of the data leakage. While all three models tend to leak PII under TDE attacks, experimental results demonstrate the effectiveness of PAE with respect to alternative baseline methods in defending against those attacks. In fact, unlike other techniques that tend to degrade model performance, our experiments show that PAE consistently reduces the number of leakages without affecting the model’s utility. We believe PAE will serve as a practical tool for removing memorized PII from deployed LLMs without retraining. Full article

This work presents a Fourier-domain encryption scheme for multiplexed image databases that integrates virtual-optical multiplexing with chaotic diffusion. By combining chaotic encryption with spectral-domain symmetry reduction, the proposed approach secures large multiplexed image datasets while reducing memory requirements and preserving reconstruction fidelity. A dataset of 2025 grayscale images ($512\times 512$ pixels) is multiplexed and encrypted using linear chaotic transformations applied separately to the amplitude (A) and phase ($\varphi$) components. To improve storage efficiency, the symmetry conditions of both spectral components are exploited, allowing a reduced portion of the Fourier plane to be stored while preserving accurate reconstruction. A performance landscape relating the correlation coefficient (CC), memory consumption, and the retained Fourier-plane percentage (FPP) is constructed to identify stable operating regions that balance reconstruction fidelity and compression under increasing multiplexing load. The encryption key consists of a 22-symbol ASCII string from which 84 seed parameters for a deterministic pseudorandom chaotic map are derived. Security and sensitivity analyses demonstrate strong key dependence and resistance to statistical attacks, while maintaining high reconstruction fidelity. The proposed scheme provides an efficient and scalable solution for secure large-scale image repositories. Full article

Users encounter privacy and permission settings across digital platforms, yet often struggle to understand, locate, and manage them effectively. Despite regulatory efforts such as the General Data Protection Regulation (GDPR) and platform mechanisms like App Tracking Transparency, these challenges persist due to interface design limitations rather than solely user capability. This study evaluates the My Information and Data Access (MIDA) framework, a user-centred privacy interface designed to support users with different levels of expertise. A between-subjects usability study was conducted with 44 participants (novice n = 15, intermediate n = 14, advanced n = 15), combining System Usability Scale (SUS) scores, task completion rates, error rates, and think-aloud protocols. The results show high usability across all groups, with SUS scores of 80 (novice), 84 (intermediate), and 92 (advanced), all exceeding the acceptability threshold of 68. Task completion rates exceeded 80%, whilst error rates remained below 25% across most tasks. These findings indicate that MIDA can support users in understanding, configuring, and managing privacy settings across different levels of expertise. This study builds on prior HCI research linking privacy management challenges to interface design limitations and provides empirical evidence that an expertise-adaptive interface can improve users’ ability to understand and manage privacy settings. Full article

Digital identity is increasingly treated as foundational infrastructure for digital economies and public services, yet national approaches remain fragmented and difficult to compare. This study presents a PRISMA-guided systematic artefact-based review of government digital identity programmes, using programme-relevant government artefacts as the review corpus, including strategies, trust frameworks, guidance, service documentation, and identity-enabled public-service materials. Adapting an NLP pipeline for large-scale digital identity text analysis, the study identifies recurring themes, constructs comparative programme profiles, and operationalises three artefact-based measures: alignment, transparency, and maturity. Rather than assessing innovation performance or operational system quality directly, it examines the documentary layer through which programmes are described, justified, and made comparable. The analysis reveals substantial variation in how highly digitalised societies articulate governance, trust, interoperability, security, privacy, and service delivery. The review contributes a repeatable artefact-based framework for cross-jurisdictional comparison and provides a baseline for ontology development and future triangulation against citizen perception, expert assessment, and technical evaluation. Full article

A microgrid is a localized distribution network composed of electricity users who have access to local renewable and other energy sources. While the utility grid plays a critical role in the nation’s economy, security, and the well-being of its residents, connecting microgrids to the wider network via utility substations can introduce significant cybersecurity risks. Unlike most existing studies that rely on simulation, this research designs and implements a physical microgrid testbed to examine cybersecurity vulnerabilities in microgrid systems. We examine the impact of various cyberattacks—including denial of service (DoS) and communication hijacking—on microgrid operations, with a particular focus on system stability and communication networks. The findings reveal critical weaknesses within the existing communication infrastructure, providing valuable insights for designing more resilient and secure microgrids. This work offers a practical framework for addressing cybersecurity challenges in real-world industrial utility networks. Full article

The incorporation of Artificial Intelligence (AI) into cybersecurity has become widespread, largely propelled by the emergence of Generative AI (GenAI) and Large Language Models (LLMs). While these technologies promise to revolutionize threat detection, they introduce profound challenges regarding explainability, trust, and deployment feasibility in resource-constrained environments. Current research often exhibits a form of technological determinism, prioritizing algorithmic performance over the operational realities of Security Operations Centers (SOCs). This paper presents a hybrid qualitative Systematic Literature Review (SLR) and Mapping Study, adhering to the Preferred Reporting Items for Systematic reviews and Meta-Analyses (PRISMA) 2020 guidelines. Our research questions are narrowly focused, seeking to explore how four key domains intersect: (1) Explainable AI (XAI) methods; (2) cybersecurity operations; (3) human-centered design; and (4) the constraints inherent to edge computing. From an initial corpus of 385 records drawn from Scopus and OpenAlex (spanning a search window from 2014 to 2025, with relevant findings heavily clustered in the 2020–2025 period), included studies were evaluated using a quality assessment protocol adapted from Kitchenham’s guidelines, scoring each study on a 0–24 scale across four dimensions (Venue Quality, Methodological Rigor, Dataset Realism, and Depth of XAI/Human Validation). The results reveal a significant “validation gap”: while 63% of studies claim human-centric relevance, only ~22% incorporate empirical validation with human operators. Furthermore, we identify a critical trade-off between the reasoning power of cloud-based LLMs and the privacy requirements of Edge security. We conclude by proposing a research agenda for “Cognitive SOCs”, emphasizing the need for Small Language Models (SLMs), standardized human-centric metrics, and robust hallucination detection mechanisms. Full article

The growth of Internet of Things (IoT) environments has expanded the attack surface of modern systems. Trojan attacks are a major challenge as they evade conventional detection mechanisms and operate silently within legitimate processes. This paper presents an automated Trojan detection framework for Windows-based IoT gateways. The framework combines custom dataset generation informative feature engineering and deep learning-driven analysis. A dataset of 3000 real world executable samples was created through controlled sandbox execution and forensic monitoring. The process captured behavioral static and network-level characteristics. An initial set contained 146 extracted features. A multi-stage feature selection process identified 33 informative attributes. This step allowed efficient learning and preserved discriminative power. A custom deep neural network model named TrDNN was developed using these features. The model captures complex nonlinear patterns linked to Trojan activity. The framework was evaluated against five classical machine learning models. It was also compared with five deep learning baselines. Results show that TrDNN achieves strong detection performance. The accuracy is 0.975. The precision is 0.972. The recall is 0.969. The F1 score is 0.970. The study also examines inference time and energy consumption. The model shows a balance between detection effectiveness, computational cost and energy efficiency. This makes it suitable for resource-constrained IoT gateway deployment. The detection model was integrated into an automated real-time monitoring pipeline. The system enables continuous process surveillance through Windows command line automation with minimal operational overhead. Statistical validation used paired t tests, Wilcoxon signed rank tests and McNemar chi-square test. The performance gains are statistically significant and do not indicate overfitting. The framework provides a reliable, efficient and deployable solution for Trojan detection in modern IoT systems. Full article

This work considers the performance and feasibility of a challenge-response pair (CRP)-based key generation method integrated with multi-wavelength Quantum Key Distribution (QKD). In this design, Alice and Bob use independently derived information from the CRP mechanism to encode and recover the key without disclosing helper data. Simulations show that even when up to 40% of the data is corrupted, error-free key recovery is possible with longer response lengths. Another new advantage of this method is that eavesdropper detection is performed using only the statistics of the received quantum stream, as opposed to sacrificing a portion of the key for public comparison, as is required in other QKD schemes. The CRP mechanism and encoding scheme are explained, and the results of key recovery and error detection across various levels of data corruption are presented. The results show that according to the studied conditions, reliable key recovery and eavesdropper detection are possible without publicly comparing the key or using helper data, and it suggests that this approach can reduce classical reconciliation reliance and allow for reliable key recovery in noisy settings without extending security thresholds. Full article

A robust authentication and authorization mechanism is imperative in modular system development, where modularity and modular thinking are pivotal. Traditional systems often employ identity modules responsible for authentication and token issuance. Tokens, representing user credentials, offer advantages such as reduced reliance on passwords, limited lifespan, and scoped access. Despite these benefits, the “bearer token” problem persists, leaving systems vulnerable to abuse if tokens are compromised. We propose a token-based authentication mechanism addressing the critical bearer token problem in modular systems. The proposed mechanism includes a novel RAF (Recursive Augmented Fernet) token, a blacklist component, and a policy enforcer component. RAF tokens are one-time-use tokens, like tickets. They carry commands, and the receiver of an RAF token can issue new tokens using the received RAF token. The blacklist component guarantees an RAF token cannot be validated more than once, and the policy enforcer checks the compatibility of commands carried by an RAF token. We introduce two variations of RAF tokens: user-tied RAF, offering simplicity and compatibility, and fully-tied RAF, providing enhanced security through service-specific secret keys. We thoroughly discuss the security guarantees, technical definitions, and construction of RAF tokens backed by game-based proofs. We demonstrate a proof of concept in the context of OpenStack, involving modifications to Keystone and the creation of an RAFT library. The experimental results reveal minimal overhead in typical scenarios, establishing the practicality and effectiveness of RAF. Our experiments show that the RAF mechanism outperforms the use of short-life Fernet tokens while providing much better security. Full article

Continuous-variable quantum communication (CVQC) operates under finite-resolution inference (finite data windows, calibration uncertainty, and estimator tolerances) and hardware control/readout limits that can be exploited by structured and adversarial disturbances. We study a feedback-inspired phase-space modulation strategy for implementation-layer resilience under DoS-like receiver-observable stress (e.g., fluctuation inflation, phase reference destabilization, or interface non-idealities), rather than proposing a protocol-level security proof. We propose a phase-first framework in which the defender selects a phase-space rotation angle $\theta$ (and, in principle, a squeezing parameter r) to minimize a receiver-observable centered second-moment degradation proxy, emphasizing containment rather than disturbance inversion. Because platforms expose different native observables, we evaluate phase-first modulation using two complementary tracks: (i) in theory/simulation, we monitor basis-dependent quadrature variance and covariance-derived summaries formed from mean-subtracted second moments so that $\Delta E_{\mathrm{cov}}$ reflects covariance inflation rather than coherent displacement; (ii) in the X8_01 hardware workflow, the readout is Fock sampling; thus, we use the shot-to-shot standard deviation ${\sigma }_N\left(\theta \right):=\sqrt{\widehat{Var}\left(N\left(\theta \right)\right)}$, where $N\left(\theta \right)$ denotes the shot-level detected count random variable at fixed $\theta$. In the reported hardware workflow, this shot-level count is formed by aggregating the returned Fock counts prior to postprocessing. We emphasize that ${\sigma }_N\left(\theta \right)$ is not claimed to estimate $Tr\left(V\right)$; it is an implementation-layer variability proxy aligned with the available readout. Our experimental validation is restricted to phase-only control instantiated as offline phase selection via one-dimensional grid search over $\theta$. Across numerical simulations and hardware phase-angle scans on Xanadu’s X8_01 photonic quantum processor, we find that static operating points can be brittle under strong DoS-like stress, whereas optimized phase selection can materially reduce a receiver-observed degradation proxy even without real-time feedback. Since $Tr\left(V\right)$ is invariant under pure rotations for phase-independent additive noise and ideal photon-number probabilities are invariant under a terminal Fock-basis phase gate, any observed $\theta$-dependence is interpreted operationally as evidence of a phase-dependent effective disturbance/measurement channel at the receiver interface. Simulation-only analyses indicate additional upside when squeezing is available, motivating future extensions incorporating higher-rate re-optimization, feedback-assisted architectures, and extended Gaussian control when available. Full article

Processing sensitive data in cloud-based neural networks raises privacy concerns, which Homomorphic Encryption addresses by enabling privacy-preserving machine learning. In our previous work, we introduced CryptoKANs, enabling efficient Kolmogorov–Arnold Network (KAN) inference over encrypted data via polynomial approximation of spline-based activation functions using KAN symbolization. To avoid performance degradation, CryptoKAN required min–max scaling of pre-activation inputs to a small interval—a requirement that could negatively affect training. In addition, a direct theoretical structural comparison with Multi-Layer Perceptron (MLP)-based solutions, such as CryptoNets, was missing. In this work, we address these limitations by presenting CryptoKAN+, a KAN-inspired network integrating self-learned polynomial activations through a Fully Connected Quadratic Transformation (FCQT) layer. By enforcing polynomial activations during training, this design replaces spline functions without post-training symbolization, eliminates the need for interval scaling, absorbs subsequent linear transformations, and reduces multiplicative depth for efficient encrypted inference. Experiments show that CryptoKAN+ achieves competitive accuracy while slightly improving encrypted inference efficiency—a natural consequence of compacting weights with self-learned activations. Overall, this work provides a formal analysis of the structural relationship between KANs and MLPs and demonstrates how enforcing polynomial activations during training enables efficient encrypted inference while preserving accuracy. Full article