electronics-logo

Journal Browser

Journal Browser

Cryptography and Computer Security

A special issue of Electronics (ISSN 2079-9292). This special issue belongs to the section "Computer Science & Engineering".

Deadline for manuscript submissions: closed (15 November 2025) | Viewed by 33786

Special Issue Editors


E-Mail Website
Guest Editor
School of Computer Science and Technology, Xidian University, Xi’an 710071, China
Interests: applied cryptography; data security; security of cloud computing and edge computing; wireless communication security
Special Issues, Collections and Topics in MDPI journals

E-Mail Website
Guest Editor
School of Computer Science and Technology, Xidian University, Xi’an 710071, China
Interests: wireless and mobile networks; distributed systems and intelligent terminals with focus on security and privacy issues
Special Issues, Collections and Topics in MDPI journals

Special Issue Information

Dear Colleagues,

With the rapid development of cloud computing, edge computing, big data, artificial intelligence, the Internet of Things, and mobile communication technologies, the development of novel computing platforms, network architectures, and application patterns has increased. However, security issues have become an obstacle to these technologies. The core technology to solve the security problem is cryptography. At present, cryptography has been widely used in various security applications. However, the emergence of quantum computers has brought serious challenges to current key public cryptography. At the same time, many resource-constrained computing platforms have a great demand for lightweight cryptography algorithms. In addition, vulnerabilities in many computing platforms and protocols have also led to attacks on various applications. How to propose more effective anti-quantum cryptography algorithms, lightweight cryptography algorithms, and countermeasures against the vulnerabilities of computer platforms and their protocols has become a challenging problem.

This Special Issue focuses on novel cryptographic algorithms and protocols, computer security and protocol security issues, and all efforts to investigate and address these challenges in current new computing environments.

In particular, topics of interest include but are not limited to the following:

  • Post-quantum cryptography and its applications;
  • Post-quantum cryptographic protocols;
  • Post-quantum blockchain technology;
  • Post-quantum data access control technology;
  • Post-quantum searchable encryption;
  • Post-quantum secure multi-party computing technology;
  • Post-quantum secure storage audit technology;
  • Cryptographic protocol analysis and side channel attack;
  • Lightweight key distribution for IoT environments;
  • Lightweight cryptographic algorithms and cryptographic protocols;
  • Lightweight end-to-end anonymous communication protocol;
  • Computer system security;
  • Computer system anomaly detection;
  • Edge computing equipment for APT detection and protection;
  • Cloud computing intrusion detection;
  • SDN/CDN system and protocol security.

Dr. Jiawei Zhang
Dr. Teng Li
Guest Editors

Manuscript Submission Information

Manuscripts should be submitted online at www.mdpi.com by registering and logging in to this website. Once you are registered, click here to go to the submission form. Manuscripts can be submitted until the deadline. All submissions that pass pre-check are peer-reviewed. Accepted papers will be published continuously in the journal (as soon as accepted) and will be listed together on the special issue website. Research articles, review articles as well as short communications are invited. For planned papers, a title and short abstract (about 250 words) can be sent to the Editorial Office for assessment.

Submitted manuscripts should not have been published previously, nor be under consideration for publication elsewhere (except conference proceedings papers). All manuscripts are thoroughly refereed through a single-blind peer-review process. A guide for authors and other relevant information for submission of manuscripts is available on the Instructions for Authors page. Electronics is an international peer-reviewed open access semimonthly journal published by MDPI.

Please visit the Instructions for Authors page before submitting a manuscript. The Article Processing Charge (APC) for publication in this open access journal is 2400 CHF (Swiss Francs). Submitted papers should be well formatted and use good English. Authors may use MDPI's English editing service prior to publication or during author revisions.

Keywords

  • applied cryptography
  • post-quantum cryptography
  • lightweight cryptography
  • computer security
  • anomaly detection
  • edge computing security
  • cloud computing security

Benefits of Publishing in a Special Issue

  • Ease of navigation: Grouping papers by topic helps scholars navigate broad scope journals more efficiently.
  • Greater discoverability: Special Issues support the reach and impact of scientific research. Articles in Special Issues are more discoverable and cited more frequently.
  • Expansion of research network: Special Issues facilitate connections among authors, fostering scientific collaborations.
  • External promotion: Articles in Special Issues are often promoted through the journal's social media, increasing their visibility.
  • Reprint: MDPI Books provides the opportunity to republish successful Special Issues in book format, both online and in print.

Further information on MDPI's Special Issue policies can be found here.

Related Special Issue

Published Papers (12 papers)

Order results
Result details
Select all
Export citation of selected articles as:

Research

Jump to: Review

24 pages, 2559 KB  
Article
A Privacy-Preserving Data Sharing Scheme with Traceability and Revocability for Health Data Space
by Zengwen Yu, Jiawei Zhang, Baoxin You and Lin Huang
Electronics 2026, 15(1), 63; https://doi.org/10.3390/electronics15010063 - 23 Dec 2025
Cited by 1 | Viewed by 440
Abstract
The Health Data Space (HDS) is a promising platform for the secure health data sharing among entities including patients and healthcare providers. However, health data is highly sensitive and critical for diagnosis, and unauthorized access or destruction by malicious users can lead to [...] Read more.
The Health Data Space (HDS) is a promising platform for the secure health data sharing among entities including patients and healthcare providers. However, health data is highly sensitive and critical for diagnosis, and unauthorized access or destruction by malicious users can lead to serious privacy leaks or medical negligence. Thus, robust access control, privacy preservation, and data integrity are essential for HDS. Although Ciphertext-Policy Attribute-Based Encryption (CP-ABE) supports secure sharing, it has limitations when directly applied to HDS. Many current schemes cannot simultaneously handle data integrity violations, trace and revoke malicious users, and protect against privacy leaks from plaintext access policies, with key escrow being another major risk. To overcome these issues, we put forward a Traceable and Revocable Privacy-Preserving Data Sharing (TRPPDS) scheme. Our solution uses a novel distributed CP-ABE with a large universe alongside data auditing to provide fine-grained, key-escrow-resistant access control over unbounded attributes and guarantee data integrity. It also features tracing-then-revocation and full policy hiding to thwart malicious users and protect policy privacy. Formal security analysis is presented for our proposal, with thorough performance assessment also demonstrates its feasibility in HDS. Full article
(This article belongs to the Special Issue Cryptography and Computer Security)
Show Figures

Figure 1

30 pages, 526 KB  
Article
Post-Quantum Private Set Intersection with Ultra-Efficient Online Performance
by Yue Qin, Bei Liang, Hongyuan Cai and Jintai Ding
Electronics 2026, 15(1), 13; https://doi.org/10.3390/electronics15010013 - 19 Dec 2025
Viewed by 517
Abstract
While tremendous progress has been made towards achieving highly efficient and practical Private Set Intersection (PSI) protocols during the last decade, the development of post-quantum PSI is still far from satisfactory. Existing post-quantum PSI protocols encounter a dilemma: while those based on fully [...] Read more.
While tremendous progress has been made towards achieving highly efficient and practical Private Set Intersection (PSI) protocols during the last decade, the development of post-quantum PSI is still far from satisfactory. Existing post-quantum PSI protocols encounter a dilemma: while those based on fully homomorphic encryption (FHE) achieve low online communication, they suffer from significant online computation; conversely, protocols based on post-quantum Oblivious Pseudorandom Functions (OPRFs) exhibit excellent online computational performance but incur substantially high online communication. To overcome this dilemma, we present a lattice-based PSI protocol that achieves optimal online performance in both communication and computation. Our solution introduces two core innovations: a robust signal comparison algorithm based on RLWE key exchange, which determines the intersection through signal consistency rather than direct shared key comparison, and an optimized Oblivious Key–Value Stores (OKVS) implementation featuring a composite key–value mapping for efficient handling of high-dimensional RLWE polynomials. We implement the protocol and conduct extensive benchmarks in both symmetric and asymmetric set-size settings. The results show that our construction achieves the lowest online overhead in both computation and communication among all tests. For example, with asymmetric set sizes (212,11041), the online phase requires only 0.132 s, yielding 19× and 282× improvements over FHE-based (CCS’21) and OPRF-based (EUROCRYPT’25) protocols, respectively. Even at (224,11041), our online communication time is only 0.201 s, which is 226× and 184× that of FHE-based and OPRF-based PSI, respectively. Additionally, our online communication overhead is the lowest in all tests; however, this comes at the cost of heavy offline communication overhead for very large set sizes, revealing a clear trade-off between pre-computation and online efficiency. This work addresses a critical gap in post-quantum PSI by delivering a protocol that achieves balanced online communication and computational overhead, thereby enabling broader practical deployment. Full article
(This article belongs to the Special Issue Cryptography and Computer Security)
Show Figures

Figure 1

21 pages, 2001 KB  
Article
A Unified Fault-Tolerant Batch Authentication Scheme for Vehicular Networks
by Yifan Zhao, Hu Liu, Xinghua Li, Yunwei Wang, Zhe Ren and Peiyao Wang
Electronics 2025, 14(24), 4973; https://doi.org/10.3390/electronics14244973 - 18 Dec 2025
Viewed by 400
Abstract
This paper proposes a unified fault-tolerant batch authentication scheme for vehicular networks, designed to address key limitations in existing approaches, namely the segregation between in-vehicle and V2I authentication scenarios and the lack of fault tolerance in traditional batch authentication methods. Based on a [...] Read more.
This paper proposes a unified fault-tolerant batch authentication scheme for vehicular networks, designed to address key limitations in existing approaches, namely the segregation between in-vehicle and V2I authentication scenarios and the lack of fault tolerance in traditional batch authentication methods. Based on a hardware–software co-design philosophy, the scheme deeply integrates the security features of hardware such as Tamper-Proof Devices (TPDs) and Physical Unclonable Functions (PUFs) with the efficiency of cryptographic primitives like Aggregate Message Authentication Codes (MACs) and the Chinese Remainder Theorem (CRT). It establishes an end-to-end, integrated authentication framework spanning from in-vehicle electronic control units (ECUs) to external roadside units (RSUs), effectively meeting the diverse requirements for secure and efficient authentication among the three core entities involved in Internet of Vehicles (IoV) data collection: in-vehicle ECUs, vehicle gateways, and RSUs. Security analysis demonstrates that the proposed scheme fulfills the necessary security requirements. And extensive experimental results confirm its high efficiency and practical utility. Full article
(This article belongs to the Special Issue Cryptography and Computer Security)
Show Figures

Figure 1

15 pages, 632 KB  
Article
Efficient Fine-Grained LuT-Based Optimization of AES MixColumns and InvMixColumns for FPGA Implementation
by Oussama Azzouzi, Mohamed Anane, Mohamed Chahine Ghanem, Yassine Himeur and Hamza Kheddar
Electronics 2025, 14(24), 4912; https://doi.org/10.3390/electronics14244912 - 14 Dec 2025
Viewed by 500
Abstract
This paper presents fine-grained Field Programmable Gate Arrays (FPGA) architectures for the Advanced Encryption Standard (AES) MixColumns and InvMixColumns transformations, targeting improved performance and resource utilization. The proposed method reformulates these operations as boolean functions directly mapped onto FPGA Lookup-Table (LuT) primitives, replacing [...] Read more.
This paper presents fine-grained Field Programmable Gate Arrays (FPGA) architectures for the Advanced Encryption Standard (AES) MixColumns and InvMixColumns transformations, targeting improved performance and resource utilization. The proposed method reformulates these operations as boolean functions directly mapped onto FPGA Lookup-Table (LuT) primitives, replacing conventional xor-based arithmetic with memory-level computation. A custom MATLAB-R2019a-based pre-synthesis optimization algorithm performs algebraic simplification and shared subexpression extraction at the polynomial level of Galois Field GF(28), reducing redundant logic memory. This architecture, LuT-level optimization minimizes the delay of the complex InvMixColumns stage and narrows the delay gap between encryption (1.305 ns) and decryption (1.854 ns), resulting in a more balanced and power-efficient AES pipeline. Hardware implementation on a Xilinx Virtex-5 FPGA confirms the efficiency of the design, demonstrating competitive performance compared to state-of-the-art FPGA realizations. Its fast performance and minimal hardware requirements make it well suited for real-time secure communication systems and embedded platforms with limited resources that need reliable bidirectional data processing. Full article
(This article belongs to the Special Issue Cryptography and Computer Security)
Show Figures

Figure 1

26 pages, 831 KB  
Article
An Efficient and Fair Map-Data-Sharing Mechanism for Vehicular Networks
by Kuan Fan, Qingdong Liu, Chuchu Liu, Ning Lu and Wenbo Shi
Electronics 2025, 14(12), 2437; https://doi.org/10.3390/electronics14122437 - 15 Jun 2025
Viewed by 861
Abstract
With the rapid advancement in artificial intelligence, autonomous driving has emerged as a prominent research frontier. Autonomous vehicles rely on high-precision high-definition map data, necessitating timely map updates by map companies to accurately reflect road conditions. This paper proposes an efficient and fair [...] Read more.
With the rapid advancement in artificial intelligence, autonomous driving has emerged as a prominent research frontier. Autonomous vehicles rely on high-precision high-definition map data, necessitating timely map updates by map companies to accurately reflect road conditions. This paper proposes an efficient and fair map-data-sharing mechanism for vehicular networks. To encourage vehicles to share data, we introduce a reputation unit to resolve the cold-start issue for new vehicles, effectively distinguishing legitimate new vehicles from malicious attackers. Considering both the budget constraints of map companies and heterogeneous data collection capabilities of vehicles, we design a fair incentive mechanism based on the proposed reputation unit and a reverse auction algorithm, achieving an optimal balance between data quality and procurement costs. Furthermore, the scheme has been developed to facilitate mutual authentication between vehicles and Roadside Unit(RSU), thereby ensuring the security of shared data. In order to address the issue of redundant authentication in overlapping RSU coverage areas, we construct a Merkle hash tree structure using a set of anonymous certificates, enabling single-round identity verification to enhance authentication efficiency. A security analysis demonstrates the robustness of the scheme, while performance evaluations and the experimental results validate its effectiveness and practicality. Full article
(This article belongs to the Special Issue Cryptography and Computer Security)
Show Figures

Figure 1

31 pages, 3222 KB  
Article
Comparative Analysis of Security Features and Risks in Digital Asset Wallets
by Hyung-Jin Lim, Sokjoon Lee, Moonseong Kim and Woochan Lee
Electronics 2025, 14(12), 2436; https://doi.org/10.3390/electronics14122436 - 15 Jun 2025
Cited by 2 | Viewed by 13518
Abstract
This paper examines the concepts, technologies, and services of various types of electronic wallets and compares and analyzes their security features. Additionally, it presents specialized security threats through cases of breaches of key information that need to be managed according to the type [...] Read more.
This paper examines the concepts, technologies, and services of various types of electronic wallets and compares and analyzes their security features. Additionally, it presents specialized security threats through cases of breaches of key information that need to be managed according to the type of electronic wallet. One of the main contributions of this paper is that, unlike existing studies, it provides explanations and discussions encompassing both traditional e-wallets and cryptocurrency-based wallets. It identifies and insightfully examines the functions of electronic wallets according to the type of digital asset while also incorporating scenario-based quantitative analysis to assess how effectively certain security requirements mitigate identified risks. In particular, the classification of wallet types in this paper is based on an analysis of the existing literature that has studied the services, functionality, and security of each wallet. Through this, we suggest a future direction for universal wallets by highlighting critical security requirements that may arise when identity (ID), payment, and cryptocurrency services converge in a single interface. Rather than proposing an exhaustive universal wallet architecture, this paper focuses on key technical elements that future e-wallet environments should consider to withstand the multifaceted threat landscape posed by integrated digital asset management. Full article
(This article belongs to the Special Issue Cryptography and Computer Security)
Show Figures

Figure 1

19 pages, 889 KB  
Article
Privacy Protection Anomaly Detection in Smart Grids Based on Combined PHE and TFHE Homomorphic Encryption
by Yongcai Xiao, Jian Xu, Zejian Lin, Yaxuan Xie, Ruitong Liu, Li Yan and Pengbin Feng
Electronics 2025, 14(12), 2386; https://doi.org/10.3390/electronics14122386 - 11 Jun 2025
Cited by 1 | Viewed by 1379
Abstract
With the growing scale and complexity of smart grids, ensuring both effective anomaly detection and robust privacy protection has become increasingly critical. This paper proposes a ciphertext-based anomaly detection model built upon a collaborative architecture between edge computing and public cloud, integrating a [...] Read more.
With the growing scale and complexity of smart grids, ensuring both effective anomaly detection and robust privacy protection has become increasingly critical. This paper proposes a ciphertext-based anomaly detection model built upon a collaborative architecture between edge computing and public cloud, integrating a hybrid homomorphic encryption scheme that combines partial homomorphic encryption (PHE) and fully homomorphic encryption over torus (TFHE). The encryption method is selected based on the task type: TFHE is used for complex anomaly detection tasks requiring encrypted computation in the cloud, while PHE is applied to cross-regional data aggregation tasks for secure homomorphic addition. Edge nodes handle low-latency, lightweight tasks locally, whereas complex encrypted tasks are processed in the cloud using an enhanced Isolation Forest model adapted for homomorphic computation. Extensive experiments on three benchmark datasets demonstrate that the proposed model achieves anomaly detection performance comparable to plaintext-based models, while significantly outperforming existing homomorphic encryption-based methods in terms of accuracy and ROC-AUC. This work provides a scalable and practical solution for secure and efficient anomaly detection in smart grids. Full article
(This article belongs to the Special Issue Cryptography and Computer Security)
Show Figures

Figure 1

26 pages, 1789 KB  
Article
Dynamic Vulnerability Knowledge Graph Construction via Multi-Source Data Fusion and Large Language Model Reasoning
by Ruitong Liu, Yaxuan Xie, Zexu Dang, Jinyi Hao, Xiaowen Quan, Yongcai Xiao and Chunlei Peng
Electronics 2025, 14(12), 2334; https://doi.org/10.3390/electronics14122334 - 7 Jun 2025
Cited by 1 | Viewed by 3218
Abstract
With the increasing number of network security threats and the frequent occurrence of software vulnerability attacks, the effective management and large-scale retrieval of vulnerability data have become urgent needs. Existing vulnerability information is scattered across heterogeneous sources and is difficult to integrate, which [...] Read more.
With the increasing number of network security threats and the frequent occurrence of software vulnerability attacks, the effective management and large-scale retrieval of vulnerability data have become urgent needs. Existing vulnerability information is scattered across heterogeneous sources and is difficult to integrate, which in turn makes it hard for security analysts to quickly retrieve and analyze relevant security knowledge. To address this problem, this paper proposes a method to construct a vulnerability knowledge graph by integrating multi-source vulnerability data, combining graph embedding technology with large language model reasoning to aggregate, infer, and enrich vulnerability knowledge. Experiments demonstrated that our domain-tuned Bidirectional Long Short-Term Memory–Conditional Random Field (BiLSTM-CRF) named entity recognition (NER), enhanced with a cybersecurity dictionary, achieved a 90.1% F1-score for entity extraction. For link prediction, a hybrid Graph Attention Network fused with GPT-3 reasoning boosted Hits1 by 0.137, Hits3 by 0.116, and Hits10 by 0.101 over the baseline. These results confirm that our approach markedly enhanced entity identification and relationship inference, yielding a more complete and dynamically updatable cybersecurity knowledge graph. Full article
(This article belongs to the Special Issue Cryptography and Computer Security)
Show Figures

Figure 1

17 pages, 297 KB  
Article
A Transformation Approach from Constrained Pseudo-Random Functions to Constrained Verifiable Random Functions
by Pu Li, Muhua Liu and Youlin Shang
Electronics 2025, 14(11), 2194; https://doi.org/10.3390/electronics14112194 - 28 May 2025
Viewed by 659
Abstract
Constrained pseudorandom functions (CPRFs) are fundamental cryptographic primitives used in broadcast encryption and attributed-based encryption. Constrained verifiable random functions (CVRFs) extend CPRFs by incorporating verifiability. A constrained key skS, derived from the master secret key sk, restricts computation [...] Read more.
Constrained pseudorandom functions (CPRFs) are fundamental cryptographic primitives used in broadcast encryption and attributed-based encryption. Constrained verifiable random functions (CVRFs) extend CPRFs by incorporating verifiability. A constrained key skS, derived from the master secret key sk, restricts computation to a set Sf with correct evaluation. This allows holders of skS to compute function values only for inputs in S. Prior constructions of CVRFs rely on strong assumptions like multilinear maps or indistinguishability obfuscation, which often suffer from theoretical or practical limitations. In this work, we introduce a simple, generic approach for building CVRFs from basic cryptographic primitives. Specifically, we give a general transformation from any CPRF to a CVRF, achieving provability, uniqueness, and pseudorandomness. We demonstrate that CVRFs can be generically constructed from the following cryptographic primitives: CPRFs, perfectly binding commitment schemes, and non-interactive proof systems. Compared to previous schemes, our approach features a fixed-length public key independent of the circuit depth, improving efficiency and scalability. Full article
(This article belongs to the Special Issue Cryptography and Computer Security)
15 pages, 388 KB  
Article
Anonymous Networking Detection in Cryptocurrency Using Network Fingerprinting and Machine Learning
by Amanul Islam, Nazmus Sakib, Kelei Zhang, Simeon Wuthier and Sang-Yoon Chang
Electronics 2025, 14(11), 2101; https://doi.org/10.3390/electronics14112101 - 22 May 2025
Viewed by 2092
Abstract
Cryptocurrency such as Bitcoin supports anonymous routing (Tor and I2P) due to the application requirements of anonymity and censorship resistance. In permissionless and open networking for cryptocurrency, an adversary can spoof to pretend to use Tor or I2P for anonymity and privacy protection, [...] Read more.
Cryptocurrency such as Bitcoin supports anonymous routing (Tor and I2P) due to the application requirements of anonymity and censorship resistance. In permissionless and open networking for cryptocurrency, an adversary can spoof to pretend to use Tor or I2P for anonymity and privacy protection, while, in reality, it is not using anonymous routing and is forwarding its networking directly to the destination peer to reduce networking overheads. Using profile detection based on deterministic features to detect anonymous routing and false claims is vulnerable to spoofing, especially in permissionless cryptocurrency bypassing registration control. We thus designed and built a method of network fingerprinting, using networking behaviors to detect and classify networking types. We built a network sensor to collect data on an active Bitcoin node connected to the Mainnet and applied supervised machine learning to identify whether a peer node was using IP (direct forwarding without the relays for anonymity protection), Tor, or I2P. Our results show that our scheme is effective in accurately detecting networking types and identifying spoofing attempts through supervised machine learning. We tested our scheme using multiple supervised learning models, specifically CatBoost, Random Forest, and HistGradientBoosting. CatBoost and Random Forest performed best and had comparable accuracy performance in effectively detecting false claims, i.e., they classified the networking types and detected fake claims of Tor usage with 93% accuracy and false claims of I2P with 94% accuracy in permissionless Bitcoin. However, CatBoost-based detection was significantly quicker than Random Forest and HistGradientBoosting in real-time testing and detection. Full article
(This article belongs to the Special Issue Cryptography and Computer Security)
Show Figures

Figure 1

24 pages, 2511 KB  
Article
Efficient Post-Quantum Cryptography Algorithms for Auto-Enrollment in Public Key Infrastructure
by Rehab Al-Dabbagh, Mohammad Alkhatib and Tahani Albalawi
Electronics 2025, 14(10), 1980; https://doi.org/10.3390/electronics14101980 - 13 May 2025
Cited by 6 | Viewed by 3971
Abstract
The security of the digital certificates used in authenticating network devices relies on cryptographic algorithms like the RSA and ECC, which are vulnerable to quantum attacks. This study addresses the urgent need to secure the Simple Certificate Enrollment Protocol (SCEP), widely used in [...] Read more.
The security of the digital certificates used in authenticating network devices relies on cryptographic algorithms like the RSA and ECC, which are vulnerable to quantum attacks. This study addresses the urgent need to secure the Simple Certificate Enrollment Protocol (SCEP), widely used in PKI-based systems, by integrating post-quantum cryptographic (PQC) algorithms—Dilithium, Falcon, and SPHINCS+. The experimental results show that Dilithium2 (1312 bytes) and Falcon512 (897 bytes) offer the best performance and throughput, with Falcon512 also being the most efficient in terms of the storage consumption. This research represents the first integration of PQC algorithms into the SCEP, establishing a foundation for scalable, quantum-resilient certificate enrollment in future PKI systems. Full article
(This article belongs to the Special Issue Cryptography and Computer Security)
Show Figures

Figure 1

Review

Jump to: Research

27 pages, 1021 KB  
Review
A Survey on Reinforcement Learning-Driven Adversarial Sample Generation for PE Malware
by Yu Tong, Hao Liang, Hailong Ma, Shuai Zhang and Xiaohan Yang
Electronics 2025, 14(12), 2422; https://doi.org/10.3390/electronics14122422 - 13 Jun 2025
Cited by 2 | Viewed by 5127
Abstract
Malware remains a central tool in cyberattacks, and systematic research into adversarial attack techniques targeting malware is crucial in advancing detection and defense systems that can evolve over time. Although numerous review articles already exist in this area, there is still a lack [...] Read more.
Malware remains a central tool in cyberattacks, and systematic research into adversarial attack techniques targeting malware is crucial in advancing detection and defense systems that can evolve over time. Although numerous review articles already exist in this area, there is still a lack of comprehensive exploration into emerging artificial intelligence technologies such as reinforcement learning from the attacker’s perspective. To address this gap, we propose a foundational reinforcement learning (RL)-based framework for adversarial malware generation and develop a systematic evaluation methodology to dissect the internal mechanisms of generative models across multiple key dimensions, including action space design, state space representation, and reward function construction. Drawing from a comprehensive review and synthesis of the existing literature, we identify several core findings. (1) The scale of the action space directly affects the model training efficiency. Meanwhile, factors such as the action diversity, operation determinism, execution order, and modification ratio indirectly influence the quality of the generated adversarial samples. (2) Comprehensive and sensitive state feature representations can compensate for the information loss caused by binary feedback from real-world detection engines, thereby enhancing both the effectiveness and stability of attacks. (3) A multi-dimensional reward signal effectively mitigates the policy fragility associated with single-metric rewards, improving the agent’s adaptability in complex environments. (4) While the current RL frameworks applied to malware generation exhibit diverse architectures, they share a common core: the modeling of discrete action spaces and continuous state spaces. In addition, this work explores future research directions in the area of adversarial malware generation and outlines the open challenges and critical issues faced by defenders in responding to such threats. Our goal is to provide both a theoretical foundation and practical guidance for building more robust and adaptive security detection mechanisms. Full article
(This article belongs to the Special Issue Cryptography and Computer Security)
Show Figures

Figure 1

Back to TopTop