Search Results (22)

With increasing system complexity and attack sophistication, autonomous cyber defense has become essential in edge–cloud Internet of Things (IoT) ecosystems, requiring intelligent, secure, and scalable agent communication frameworks. This paper proposes FMAD (Federated Multi-Agent Defense), a conceptual federated multi-agent framework that enables intelligent agent communication for autonomous cyber defense through collaborative sensing and federated learning, with a design emphasis on security and privacy preservation. The proposed framework defines a set of specialized intelligent agents responsible for distributed traffic sensing, threat intelligence analysis, federated model optimization, secure agent-to-agent communication, and adaptive mitigation. As an initial proof of concept, the Threat Intelligence Agent (TIA) was implemented using an xLSTM-based temporal intrusion detection model developed in this study and trained on the CIC-IoT-2023 dataset, achieving a detection accuracy of 99.89% while efficiently identifying temporal traffic anomalies at edge nodes. The FMAD framework integrates multiple collaborative agents for secure communication, federated learning, and coordinated cyber defense in edge–cloud IoT environments. The experimental evaluation focuses on the xLSTM-based Threat Intelligence Agent (TIA) for DDoS detection, while the remaining components are assessed at the design level. However, empirical validation in the current study is limited solely to the TIA. To support trustworthy collaboration among distributed agents, the framework further proposes a secure communication architecture based on Elliptic Curve Cryptography (ECC) key agreement, ChaCha20-Poly1305 authenticated encryption, and a permissioned blockchain ledger, which are designed to provide secure interaction management and traceability within the stated security assumptions. This federated multi-agent approach provides a promising foundation for intelligent agent communication and scalable autonomous cyber defense in real-world edge–cloud IoT environments. Full article

Web applications increasingly handle sensitive data in diverse use cases, but conventional encryption implementations apply a uniform level of cryptographic protection to all traffic, regardless of the associated risk. This static approach results in either excessive computational overhead when applying maximum encryption universally, or inadequate protection when using lightweight encryption to preserve performance. This paper proposes an Adaptive Encryption Framework (AEF) designed to bridge the gap between performance and security in web applications. Rather than relying on a static protocol, AEF dynamically adjusts encryption algorithms based on a real-time composite risk score (0–100). This score is derived from six weighted variables: network risk (25%), authentication strength (20%), behavioral risk (20%), device trust (15%), data sensitivity (15%), and temporal risk (5%). Depending on the calculated risk, the system automatically transitions between three distinct security tiers: GREEN (utilizing ChaCha20-Poly1305), YELLOW (AES-256-GCM), or RED (AES-256-GCM with per-request HKDF key derivation for key isolation). All three profiles use exclusively standardized cryptographic primitives. The proposed weighting distribution was evaluated through sensitivity analysis on 27 framework-executed scenarios and further calibrated using 40,000 labeled application requests. Within these experimental conditions, it achieved complete agreement with the expected scenario classifications, and no alternative weight configuration produced better held-out performance. Additional validation on 61,065 HTTP requests from the CSIC 2010 dataset yielded an area under the ROC curve (ROC AUC) of 0.860, with no attack request assigned to the lightweight profile under the evaluated operating conditions. Across three hardware platforms and four payload sizes, all encryption profiles maintained sub-millisecond latency. Extended load testing showed that a four-worker Node.js cluster sustained 4948 requests per second at 2000 concurrent connections, a 7.1-fold improvement over a single process. When hardware cryptographic acceleration was disabled, ChaCha20-Poly1305 became up to 9.1 times faster than AES-256-GCM, supporting its use as the lightweight profile. The framework proposed in this paper operationalizes the qualitative risk assessment guidelines from NIST SP 800-30 and SP 800-63 into a quantitative, automated encryption selection mechanism for web applications, evaluated under the hardware platforms, concurrency levels and traffic assumptions described in this study. Full article

Low Earth orbit (LEO) satellites are increasingly required to process and securely stream video data for remote sensing, surveillance, and onboard perception applications. However, the strict constraints of onboard computing capability, power budget, and thermal dissipation make conventional encryption schemes difficult to apply to real-time video streaming tasks. To address this challenge, this paper proposes a low-complexity real-time video encryption algorithm for resource-constrained LEO satellites. The proposed method integrates selective encryption with a lightweight permutation–diffusion mechanism to reduce computational overhead while maintaining effective protection of continuous video streams. To enhance security, a chaotic pseudo-random sequence generator is employed to improve encryption randomness, and a dynamic key scheduling strategy is introduced to increase temporal key variability and strengthen resistance to statistical and differential attacks across successive frames. The algorithm is further designed for efficient deployment on embedded onboard platforms with limited hardware resources. Experimental results show that the proposed method achieves favorable performance in encryption speed, computational complexity, information entropy, adjacent pixel correlation, and differential attack resistance. Compared with conventional full-encryption methods, the proposed algorithm offers a more balanced trade-off between security and real-time efficiency, demonstrating its potential for secure video streaming in resource-constrained LEO satellite systems. Full article

Encrypted storage systems increasingly rely on governance mechanisms such as delegation, revocation, key updates, and policy evolution. While existing approaches provide strong guarantees for access enforcement, integrity, and transparency, they do not address a fundamental question: under which conditions can an observed sequence of governance events be accepted as a semantically valid evolution of authorization state? This work introduces a formal semantic framework for governance validity based on observable evidence. Governance is modeled as an admissibility-constrained state transition system in which events are accepted only if they satisfy explicit authorization, reference, temporal, revocation, and evidence conditions. The framework defines valid governance histories as sequences of admissible events; characterizes the conditions for deterministic state reconstruction; and establishes invariants capturing correctness properties such as revocation soundness, policy-constrained evolution, evidence completeness, non-equivocation, and temporal coherence. It also defines event-specific evidence obligations that support independent verification. The proposed approach is architecture-independent and does not prescribe specific enforcement or logging mechanisms, focusing instead on the semantic conditions required for accepting governance histories as valid from observable evidence. In addition, the framework can be instantiated as an independent verification layer that operates over observable governance traces without requiring access to internal system states. Full article

Physically unclonable functions (PUFs) are critical security primitives used in authentication and cryptographic key generation. Among these, structural color-based PUFs offer distinct advantages, including fade resistance and the ability to conceal multi-dimensional information. However, current fabrication methods rely heavily on wet processes and laser ablation. Consequently, there is a significant need for flexible PUF labels capable of being produced through a facile and dry process. Here, we present stress-relief modulated photonic crystal PUF labels designed for multi-level dynamic encryption. We achieve random patterning of nanograting-based photonic crystals by leveraging curved pinning edge-induced interruptions and the uncontrolled bulking of the polymeric elastomer due to the uneven adhesion force from the tape. Using artificial intelligence-based deep learning algorithms, we authenticate the labels by extracting structural color, brightness, and saturation, which are determined by the grating periodicity, depth, and orderliness of each pixel. Furthermore, we integrated these photonic crystal patterns with dynamically modulated optical erasure to extend encryption capacity from the spatial to the temporal dimension. We anticipate this approach will enable advanced wearable anti-counterfeiting labels and multi-level digital encryption systems. Full article

While Federated Learning (FL) and Split Learning (SL) aim to uphold data confidentiality by localized training, they remain susceptible to adversarial threats such as model poisoning and sophisticated inference attacks. To mitigate these vulnerabilities, we propose $\mathbf{SplitML}$, a secure and privacy-preserving framework for Federated Split Learning (FSL). By integrating $IND-CP{A}^D$ secure Fully Homomorphic Encryption (FHE) with Differential Privacy (DP), $\mathbf{SplitML}$ establishes a defense-in-depth strategy that minimizes information leakage and thwarts reconstructive inference attempts. The framework accommodates heterogeneous model architectures by allowing clients to collaboratively train only the common top layers while keeping their bottom layers exclusive to each participant. This partitioning strategy ensures that the layers closest to the sensitive input data are never exposed to the centralized server. During the training phase, participants utilize multi-key CKKS FHE to facilitate secure weight aggregation, which ensures that no single entity can access individual updates in plaintext. For collaborative inference, clients exchange activations protected by single-key CKKS FHE to achieve a consensus derived from Total Labels (TL) or Total Predictions (TP). This consensus mechanism enhances decision reliability by aggregating decentralized insights while obfuscating soft-label confidence scores that could be exploited by attackers. Our empirical evaluation demonstrates that $\mathbf{SplitML}$ provides substantial defense against Membership Inference (MI) attacks, reduces temporal training costs compared to standard encrypted FL, and improves inference precision via its consensus mechanism, all while maintaining a negligible impact on federation overhead. Full article

This paper addresses the confidentiality of wireless communications in industrial internet-of-things environments by investigating the feasibility of secret key generation for link-layer encryption using ultra wideband (UWB) signals. Taking advantage of the nanosecond-level temporal resolution offered by ultra wideband, we exploit channel reciprocity to extract highly detailed, noise-like channel measurements, in line with the physical-layer security paradigm. Three key generation algorithms, operating in both the time and frequency domains, are evaluated using real-world data collected through a dedicated measurement campaign in an industrial setting. The analysis, conducted under realistic conditions, examines the impact of practical impairments, such as imperfect channel reciprocity and timing misalignments, on the key agreement rate and the length of the generated keys. The results confirm the strong potential of ultra wideband technology to enable robust physical-layer security, offering a viable and efficient solution for securing wireless communications in complex and dynamic industrial internet-of-things environments. Full article

The explosive growth in Internet of Things (IoT) technologies has given rise to significant security concerns, especially with the emergence of sophisticated and zero-day malware attacks. Conventional malware detection methods based on static or dynamic analysis often fail to meet the real-time operational needs and limited-resource constraints typical of IoT systems. This paper proposes TRIM-SEC (Transformer-Integrated Malware Security and Encryption for IoT), a lightweight and scalable framework that unifies intelligent threat detection with secure data transmission. The framework begins with Autoencoder-Based Feature Denoising (AEFD) to eliminate noise and enhance input quality, followed by Principal Component Analysis (PCA) for efficient dimensionality reduction. Malware classification is performed using a Transformer-Augmented Neural Network (TANN), which leverages multi-head self-attention to capture both contextual and temporal dependencies, enabling accurate detection of diverse threats such as Zero-Day, botnets, and zero-day exploits. For secure communication, TRIM-SEC incorporates Lightweight Elliptic Curve Cryptography (LECC), enhanced with Particle Swarm Optimization (PSO) to generate cryptographic keys with minimal computational burden. The framework is rigorously evaluated against advanced baselines, including LSTM-based IDS, CNN-GRU hybrids, and blockchain-enhanced security models. Experimental results show that TRIM-SEC delivers higher detection accuracy, fewer false alarms, and reduced encryption latency, which makes it well-suited for real-time operation in smart IoT ecosystems. Its balanced integration of detection performance, cryptographic strength, and computational efficiency positions TRIM-SEC as a promising solution for securing next-generation IoT environments. Full article

In the booming digital economy, data circulation—particularly for massive multimodal data generated by IoT sensor networks—faces critical challenges: ambiguous ownership and broken cross-domain traceability. Traditional property rights theory, ill-suited to data’s non-rivalrous nature, leads to ownership fuzziness after multi-source fusion and traceability gaps in cross-organizational flows, hindering marketization. This study aims to establish native ownership confirmation capabilities in trusted IoT-driven data ecosystems. The approach involves a dual-factor system: the collaborative extraction of text (from sensor-generated inspection reports), numerical (from industrial sensor measurements), visual (from 3D scanning sensors), and spatio-temporal features (from GPS and IoT device logs) generates unique SHA-256 fingerprints (first factor), while RSA/ECDSA private key signatures (linked to sensor node identities) bind ownership (second factor). An intermediate state integrates these with metadata, supported by blockchain (consortium chain + IPFS) and cross-domain protocols optimized for IoT environments to ensure full-link traceability. This scheme, tailored to the characteristics of IoT sensor networks, breaks traditional ownership confirmation bottlenecks in multi-source fusion, demonstrating strong performance in ownership recognition, anti-tampering robustness, cross-domain traceability and encryption performance. It offers technical and theoretical support for standardized data components and the marketization of data elements within IoT ecosystems. Full article

Federated learning promotes the development of cross-domain intelligent applications under the premise of protecting data privacy, but there are still problems of sensitive parameter information leakage of multi-party data temporal alignment and resource scheduling process, and traditional symmetric encryption schemes suffer from low efficiency and poor security. To this end, in this paper, based on the modified NTRU-type multi-key fully homomorphic encryption scheme, an asymmetric algorithm, a secure computation scheme of multi-party least common multiple and greatest common divisor without full set under the semi-honest model is proposed. Participants strictly follow the established process. Nevertheless, considering that malicious participants may engage in poisoning attacks such as tampering with or uploading incorrect data to disrupt the protocol process and cause incorrect results, a scheme against malicious spoofing is further proposed, which resists malicious spoofing behaviors and not all malicious attacks, to verify the correctness of input parameters or data through hash functions and zero-knowledge proof, ensuring it can run safely and stably. Experimental results show that our semi-honest model scheme improves the efficiency by 39.5% and 45.6% compared to similar schemes under different parameter conditions, and it is able to efficiently process small and medium-sized data in real time under high bandwidth; although there is an average time increase of 1.39 s, the anti-malicious spoofing scheme takes into account both security and efficiency, achieving the design expectations. Full article

To meet the growing demand for secure and reliable image protection in digital communication, this paper proposes a novel image encryption framework that addresses the challenges of high plaintext sensitivity, resistance to statistical attacks, and key security. The method combines a two-dimensional dynamically coupled map lattice (2D DCML) with elementary cellular automata (ECA) to construct a heterogeneous chaotic system with strong spatiotemporal complexity. To further enhance nonlinearity and diffusion, a multi-source perturbation mechanism and adaptive DNA encoding strategy are introduced. These components work together to obscure the image structure, pixel correlations, and histogram characteristics. By embedding spatial and temporal symmetry into the coupled lattice evolution and perturbation processes, the proposed method ensures a more uniform and balanced transformation of image data. Meanwhile, the method enhances the confusion and diffusion effects by utilizing the principle of symmetric perturbation, thereby improving the overall security of the system. Experimental evaluations on standard images demonstrate that the proposed scheme achieves high encryption quality in terms of histogram uniformity, information entropy, NPCR, UACI, and key sensitivity tests. It also shows strong resistance to chosen plaintext attacks, confirming its robustness for secure image transmission. Full article

Encrypted network traffic classification remains a critical component in network security monitoring. However, existing approaches face two fundamental limitations: (1) conventional methods rely on manual feature engineering and are inadequate in handling high-dimensional features; and (2) they lack the capability to capture dynamic temporal patterns. This paper introduces TransECA-Net, a novel hybrid deep learning architecture that addresses these limitations through two key innovations. First, we integrate ECA-Net modules with CNN architecture to enable automated feature extraction and efficient dimension reduction via channel selection. Second, we incorporate a Transformer encoder to model global temporal dependencies through multi-head self-attention, supplemented by residual connections for optimal gradient flow. Extensive experiments on the ISCX VPN-nonVPN dataset demonstrate the superiority of our approach. TransECA-Net achieved an average accuracy of 98.25% in classifying 12 types of encrypted traffic, outperforming classical baseline models such as 1D-CNN, CNN + LSTM, and TFE-GNN by 6.2–14.8%. Additionally, it demonstrated a 37.44–48.84% improvement in convergence speed during the training process. Our proposed framework presents a new paradigm for encrypted traffic feature disentanglement and representation learning. This paradigm enables cybersecurity systems to achieve fine-grained service identification of encrypted traffic (e.g., 98.9% accuracy in VPN traffic detection) and real-time responsiveness (48.8% faster than conventional methods), providing technical support for combating emerging cybercrimes such as monitoring illegal transactions on darknet networks and contributing significantly to adaptive network security monitoring systems. Full article

Distributed photovoltaic (PV) power stations generally lack historical meteorological data, which is one of the main reasons for their insufficient power prediction accuracy. To address this issue, this paper proposes a power prediction method for regional distributed PV power stations based on meteorological encryption and spatio-temporal graph networks. First, inverse distance weighted meteorological encryption technology is used to achieve the comprehensive coverage of key meteorological resources based on the geographical locations of PV power stations and the meteorological resources of weather stations. Next, the historical power correlations between PV power stations are analyzed, and highly correlated stations are connected to construct a topological graph structure. Then, an improved spatio-temporal graph network model is established based on this graph to deeply mine the spatio-temporal characteristics of regional PV power stations. Furthermore, a dual-layer attention mechanism is added to further learn the feature attributes of nodes and enhance the spatio-temporal features extracted by the spatio-temporal graph network, ultimately achieving power prediction for regional PV power stations. The simulation results indicate that the proposed model demonstrates excellent prediction accuracy, robustness, extensive generalization capability, and broad applicability. Full article

Low Earth Orbit (LEO) satellite communication systems typically achieve identity authentication through the encryption and decryption of two-way information, which requires complex key management systems. In contrast, the integration of navigation and communication (NavCom) signals provides novel opportunities for physical observation and authentication solutions due to its measurement functions. This paper introduces a novel signal authentication scheme based on twice two-way satellite time transfer (TWSTT) for LEO satellite systems. It leverages the non-mutated nature of the clock difference to ascertain the legitimacy of the signal by measuring the clock difference of signals at different instances. Unlike traditional authentication methods, this approach directly exploits the temporal and spatial characteristics of the signal, negating the necessity for intricate authorization key systems. Additionally, it adeptly tackles the challenges posed by spoofing interference. The performance analysis indicates that this scheme can achieve a high detection probability for the repeater spoofing signal in the low carrier-to-noise ratio conditions. Full article

Ransomware is a type of malware that employs encryption to target user files, rendering them inaccessible without a decryption key. To combat ransomware, researchers have developed early detection models that seek to identify threats before encryption takes place, often by monitoring the initial calls to cryptographic APIs. However, because encryption is a standard computational activity involved in processes, such as packing, unpacking, and polymorphism, the presence of cryptographic APIs does not necessarily indicate an imminent ransomware attack. Hence, relying solely on cryptographic APIs is insufficient for accurately determining a ransomware pre-encryption boundary. To this end, this paper is devoted to addressing this issue by proposing a Temporal Data Correlation method that associates cryptographic APIs with the I/O Request Packets (IRPs) based on the timestamp for pre-encryption boundary delineation. The process extracts the various features from the pre-encryption dataset for use in early detection model training. Several machine and deep learning classifiers are used to evaluate the accuracy of the proposed solution. Preliminary results show that this newly proposed approach can achieve higher detection accuracy compared to those reported elsewhere. Full article