Journal of Information Security and Applications最新文献_第2页

Accelerating volatile memory forensics for bare-metal malware analysis with FPGA devices 加速易失性存储器取证裸机恶意软件分析与FPGA器件

IF 3.7 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Journal of Information Security and Applications

Pub Date : 2026-05-01 Epub Date: 2026-02-10 DOI: 10.1016/j.jisa.2026.104393

Dan Cristian Turicu, Florin Oniga

Modern malware often employs anti-analysis techniques to detect virtualized or emulated environments, evading traditional dynamic analysis systems. To address this challenge, bare-metal analysis platforms have emerged as a more transparent alternative. However, efficiently monitoring them while preserving transparency and minimizing interference remains a key challenge. In this paper, we present a proof-of-concept hardware accelerator implemented on an FPGA device, designed for high-speed volatile memory acquisition and on-the-fly pool tag scanning of the memory content to extract information about active and terminated processes on a bare-metal malware execution system running Windows 10. The memory forensics accelerator leverages PCIe-based DMA to acquire the volatile memory from the monitored system and performs the scanning for process structures directly on the FPGA, without requiring any software installation on the monitored system. Our approach improves transparency and isolation, and shows significant speed advantages over conventional snapshot-based memory forensics. We evaluate the prototype and discuss its limitations and applicability in malware analysis workflows.

现代恶意软件通常采用反分析技术来检测虚拟或模拟环境，避开传统的动态分析系统。为了应对这一挑战，裸机分析平台作为一种更透明的替代方案出现了。然而，在保持透明度和尽量减少干扰的同时有效地监测它们仍然是一项关键挑战。在本文中，我们提出了一个在FPGA器件上实现的概念验证硬件加速器，设计用于高速易失性存储器采集和内存内容的动态池标签扫描，以提取有关运行Windows 10的裸机恶意软件执行系统上活动和终止进程的信息。内存取证加速器利用基于pcie的DMA从被监控系统获取易失性内存，并直接在FPGA上执行进程结构扫描，而不需要在被监控系统上安装任何软件。我们的方法提高了透明性和隔离性，并且与传统的基于快照的内存取证相比，显示出显著的速度优势。我们评估了原型，并讨论了它在恶意软件分析工作流程中的局限性和适用性。

{"title":"Accelerating volatile memory forensics for bare-metal malware analysis with FPGA devices","authors":"Dan Cristian Turicu, Florin Oniga","doi":"10.1016/j.jisa.2026.104393","DOIUrl":"10.1016/j.jisa.2026.104393","url":null,"abstract":"<div><div>Modern malware often employs anti-analysis techniques to detect virtualized or emulated environments, evading traditional dynamic analysis systems. To address this challenge, bare-metal analysis platforms have emerged as a more transparent alternative. However, efficiently monitoring them while preserving transparency and minimizing interference remains a key challenge. In this paper, we present a proof-of-concept hardware accelerator implemented on an FPGA device, designed for high-speed volatile memory acquisition and on-the-fly pool tag scanning of the memory content to extract information about active and terminated processes on a bare-metal malware execution system running Windows 10. The memory forensics accelerator leverages PCIe-based DMA to acquire the volatile memory from the monitored system and performs the scanning for process structures directly on the FPGA, without requiring any software installation on the monitored system. Our approach improves transparency and isolation, and shows significant speed advantages over conventional snapshot-based memory forensics. We evaluate the prototype and discuss its limitations and applicability in malware analysis workflows.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"98 ","pages":"Article 104393"},"PeriodicalIF":3.7,"publicationDate":"2026-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"146190336","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Zerovision: A privacy-preserving iris authentication framework using zero knowledge proofs and steganographic safeguards Zerovision：一个保护隐私的虹膜认证框架，使用零知识证明和隐写保护

IF 3.7 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Journal of Information Security and Applications

Pub Date : 2026-05-01 Epub Date: 2026-01-29 DOI: 10.1016/j.jisa.2025.104323

Khushil Godhani , Nihhar Shukla , Janam Patel , Rajesh Gupta , Sudeep Tanwar

Biometric authentication systems, particularly those relying on iris recognition, offer an extremely accurate and secure method of identity verification, but the very fact that such an industry exists has raised issues regarding individual privacy. Biometric data stolen from a system, unlike passwords, cannot be replaced and can be used for identity theft. This paper presents ZeroVision, a novel privacy-preserving iris authentication scheme with a blend of steganography, convolutional neural networks (CNNs), zero-knowledge proofs (zk-SNARKs), and blockchain. ZeroVision conceals iris images in cover facial images through steganography to hide their transmission and provoke transmission security. CNNs are utilized to obtain compact binary feature templates from iris image, whereas zk-SNARKs allow verifiers to authenticate template validity in zero knowledge, which keeps any sensitive information disclosure distant. Blockchain deployment guarantees that the proofs generated are accurate, verified by the verifier, and stored in a decentralized, tamper-proof fashion. Tested on the CASIA Iris Thousand and FFHQ datasets in a simulation of real-world transactions and transmissions, ZeroVision attains 91.41 % accuracy for recognition despite compact template sizes and additional noise, with proof generation and verification times of under 0.6 and 0.25 seconds, respectively. This novel architecture enables secure biometric authentication in high-risk applications where the privacy of personal data is highest priority.

生物识别认证系统，特别是那些依赖虹膜识别的系统，提供了一种极其准确和安全的身份验证方法，但事实上，这样一个行业的存在引发了有关个人隐私的问题。与密码不同，从系统中窃取的生物识别数据无法替换，可用于身份盗窃。ZeroVision是一种新型的保护隐私的虹膜认证方案，它融合了隐写术、卷积神经网络（cnn）、零知识证明（zk- snark）和区块链。ZeroVision通过隐写术将虹膜图像隐藏在人脸图像中，以隐藏其传输，提高传输安全性。利用cnn从虹膜图像中获得紧凑的二值特征模板，而zk-SNARKs允许验证者在零知识的情况下验证模板的有效性，从而避免任何敏感信息泄露。区块链部署保证生成的证明是准确的，由验证者验证，并以分散的、防篡改的方式存储。在模拟真实世界交易和传输的CASIA Iris Thousand和FFHQ数据集上进行测试，尽管模板尺寸紧凑且存在额外的噪声，但ZeroVision的识别准确率达到了91.41%，证明生成和验证时间分别低于0.6秒和0.25秒。这种新颖的体系结构可以在个人数据隐私最高优先级的高风险应用中实现安全的生物识别认证。

{"title":"Zerovision: A privacy-preserving iris authentication framework using zero knowledge proofs and steganographic safeguards","authors":"Khushil Godhani , Nihhar Shukla , Janam Patel , Rajesh Gupta , Sudeep Tanwar","doi":"10.1016/j.jisa.2025.104323","DOIUrl":"10.1016/j.jisa.2025.104323","url":null,"abstract":"<div><div>Biometric authentication systems, particularly those relying on iris recognition, offer an extremely accurate and secure method of identity verification, but the very fact that such an industry exists has raised issues regarding individual privacy. Biometric data stolen from a system, unlike passwords, cannot be replaced and can be used for identity theft. This paper presents <em>ZeroVision</em>, a novel privacy-preserving iris authentication scheme with a blend of steganography, convolutional neural networks (CNNs), zero-knowledge proofs (zk-SNARKs), and blockchain. <em>ZeroVision</em> conceals iris images in cover facial images through steganography to hide their transmission and provoke transmission security. CNNs are utilized to obtain compact binary feature templates from iris image, whereas zk-SNARKs allow verifiers to authenticate template validity in zero knowledge, which keeps any sensitive information disclosure distant. Blockchain deployment guarantees that the proofs generated are accurate, verified by the verifier, and stored in a decentralized, tamper-proof fashion. Tested on the CASIA Iris Thousand and FFHQ datasets in a simulation of real-world transactions and transmissions, <em>ZeroVision</em> attains 91.41 % accuracy for recognition despite compact template sizes and additional noise, with proof generation and verification times of under 0.6 and 0.25 seconds, respectively. This novel architecture enables secure biometric authentication in high-risk applications where the privacy of personal data is highest priority.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"98 ","pages":"Article 104323"},"PeriodicalIF":3.7,"publicationDate":"2026-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"146080983","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Semantic characterization of android malware through runtime system call analysis 基于运行时系统调用分析的android恶意软件语义表征

IF 3.7 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Journal of Information Security and Applications

Pub Date : 2026-05-01 Epub Date: 2026-02-14 DOI: 10.1016/j.jisa.2026.104406

Sanaya Malik, Narendra Singh, Somanath Tripathy

The popularity and adoption of smartphones, especially on the Android platform, has led to the rapid growth of malware. Meanwhile, modern malware increasingly employs obfuscation and evasion techniques to bypass signature-based detection models. Malware characterization is essential as it enables understanding of the tactics and techniques that aid in threat attribution and detection of novel variants. Existing malware characterization methods often rely on static features and manually predefined rules to map techniques and procedures, which often leads to inconsistent mapping. In this work, a malware characterization approach is developed which uses system calls to capture the behavior of malicious applications. To provide lower-level abstraction, the system calls are divided into five distinct families. An autoencoder is trained on execution traces to identify the system calls characteristic to malicious operations. In addition, a fine-tuned Mistral model is used to generate system call descriptions, which are mapped with MITRE ATT&CK techniques using Sentence-BERT embeddings. We experimented with 241 different malware families, which shows that our approach achieves high-quality semantic mappings, with a cosine similarity of 0.912, BLEU score of 0.445, and BERT F1 score of 0.827. It is observed that, at the system level, malware executes system calls (across all five categories) at much higher frequencies than benign applications. Also, different malware families show distinct behavioral characteristics, for example, ransomware relied heavily on file system operations, while adware and SMSware emphasized process control. On the top, SMC-SAM achieves better detection accuracy (97.54%) as compared to other approaches.

智能手机的普及和采用，尤其是在Android平台上，导致了恶意软件的快速增长。同时，现代恶意软件越来越多地采用混淆和逃避技术来绕过基于签名的检测模型。恶意软件特征是必不可少的，因为它可以理解有助于威胁归因和检测新变体的策略和技术。现有的恶意软件表征方法通常依赖于静态特征和手动预定义的规则来映射技术和过程，这通常会导致不一致的映射。在这项工作中，开发了一种恶意软件表征方法，该方法使用系统调用来捕获恶意应用程序的行为。为了提供较低级别的抽象，系统调用被分为五个不同的类。在执行轨迹上训练自动编码器，以识别恶意操作的系统调用特征。此外，一个微调的Mistral模型用于生成系统调用描述，这些描述与使用句子- bert嵌入的MITRE att&&； CK技术进行映射。我们对241个不同的恶意软件家族进行了实验，结果表明我们的方法获得了高质量的语义映射，余弦相似度为0.912，BLEU得分为0.445，BERT F1得分为0.827。可以观察到，在系统级别，恶意软件执行系统调用（跨越所有五个类别）的频率比良性应用程序高得多。此外，不同的恶意软件家族表现出不同的行为特征，例如，勒索软件严重依赖于文件系统操作，而广告软件和短信软件强调过程控制。与其他方法相比，SMC-SAM的检测准确率更高（97.54%）。

{"title":"Semantic characterization of android malware through runtime system call analysis","authors":"Sanaya Malik, Narendra Singh, Somanath Tripathy","doi":"10.1016/j.jisa.2026.104406","DOIUrl":"10.1016/j.jisa.2026.104406","url":null,"abstract":"<div><div>The popularity and adoption of smartphones, especially on the Android platform, has led to the rapid growth of malware. Meanwhile, modern malware increasingly employs obfuscation and evasion techniques to bypass signature-based detection models. Malware characterization is essential as it enables understanding of the tactics and techniques that aid in threat attribution and detection of novel variants. Existing malware characterization methods often rely on static features and manually predefined rules to map techniques and procedures, which often leads to inconsistent mapping. In this work, a malware characterization approach is developed which uses system calls to capture the behavior of malicious applications. To provide lower-level abstraction, the system calls are divided into five distinct families. An autoencoder is trained on execution traces to identify the system calls characteristic to malicious operations. In addition, a fine-tuned Mistral model is used to generate system call descriptions, which are mapped with MITRE ATT&CK techniques using Sentence-BERT embeddings. We experimented with 241 different malware families, which shows that our approach achieves high-quality semantic mappings, with a cosine similarity of 0.912, BLEU score of 0.445, and BERT F1 score of 0.827. It is observed that, at the system level, malware executes system calls (across all five categories) at much higher frequencies than benign applications. Also, different malware families show distinct behavioral characteristics, for example, ransomware relied heavily on file system operations, while adware and SMSware emphasized process control. On the top, <span>SMC-SAM</span> achieves better detection accuracy (97.54%) as compared to other approaches.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"98 ","pages":"Article 104406"},"PeriodicalIF":3.7,"publicationDate":"2026-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"146190334","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Explainable android malware detection and malicious code localization using graph attention 解释android恶意软件检测和恶意代码定位使用图注意

IF 3.7 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Journal of Information Security and Applications

Pub Date : 2026-05-01 Epub Date: 2026-02-04 DOI: 10.1016/j.jisa.2026.104385

Merve Cigdem Ipek , Sevil Sen

With the escalating threat of mobile malware, there is a growing need for techniques that not only detect malware but also precisely identify and localize the malicious code within applications. Existing security solutions, including AI-based approaches, often function as black boxes, offering limited insights into the actual code responsible for malicious behavior. Manual analysis remains time-consuming and reliant on scarce expertise. To address these challenges, we propose XAIDroid, a novel framework that leverages graph neural networks (GNNs) and graph attention mechanisms to automatically locate malicious code snippets within malware. By representing code as API call graphs, XAIDroid captures semantic context and enhances resilience to obfuscation. Utilizing the Graph Attention Model (GAM) and Graph Attention Network v2 (GATv2), we assign importance scores to API nodes, facilitating focused attention on critical regions for malicious code localization. Evaluation on synthetic and real-world malware datasets demonstrates the efficacy of our approach, achieving high recall and F1-score rates for identifying malicious code. The successful implementation of automatic malicious code localization enhances the interpretability of malware analysis by explicitly identifying malicious code regions, enables scalable analysis by eliminating the need for manual localization baselines during training, and improves reliability through consistent performance on previously unseen malware variants.

随着移动恶意软件的威胁不断升级，人们越来越需要不仅检测恶意软件而且精确识别和定位应用程序中的恶意代码的技术。现有的安全解决方案，包括基于人工智能的方法，通常作为黑盒起作用，对负责恶意行为的实际代码提供有限的见解。手工分析仍然很耗时，并且依赖于稀缺的专业知识。为了应对这些挑战，我们提出了XAIDroid，这是一个利用图神经网络（gnn）和图注意机制来自动定位恶意软件中的恶意代码片段的新框架。通过将代码表示为API调用图，XAIDroid可以捕获语义上下文并增强对混淆的弹性。利用图注意力模型（GAM）和图注意力网络v2 (GATv2)，我们为API节点分配了重要性分数，促进了对恶意代码定位关键区域的关注。对合成和真实恶意软件数据集的评估证明了我们的方法的有效性，在识别恶意代码方面实现了高召回率和f1得分率。自动恶意代码定位的成功实现通过显式识别恶意代码区域来增强恶意软件分析的可解释性，通过在训练期间消除手动定位基线的需要来实现可扩展分析，并通过对以前未见过的恶意软件变体的一致性能来提高可靠性。

{"title":"Explainable android malware detection and malicious code localization using graph attention","authors":"Merve Cigdem Ipek , Sevil Sen","doi":"10.1016/j.jisa.2026.104385","DOIUrl":"10.1016/j.jisa.2026.104385","url":null,"abstract":"<div><div>With the escalating threat of mobile malware, there is a growing need for techniques that not only detect malware but also precisely identify and localize the malicious code within applications. Existing security solutions, including AI-based approaches, often function as black boxes, offering limited insights into the actual code responsible for malicious behavior. Manual analysis remains time-consuming and reliant on scarce expertise. To address these challenges, we propose XAIDroid, a novel framework that leverages graph neural networks (GNNs) and graph attention mechanisms to automatically locate malicious code snippets within malware. By representing code as API call graphs, XAIDroid captures semantic context and enhances resilience to obfuscation. Utilizing the Graph Attention Model (GAM) and Graph Attention Network v2 (GATv2), we assign importance scores to API nodes, facilitating focused attention on critical regions for malicious code localization. Evaluation on synthetic and real-world malware datasets demonstrates the efficacy of our approach, achieving high recall and F1-score rates for identifying malicious code. The successful implementation of automatic malicious code localization enhances the interpretability of malware analysis by explicitly identifying malicious code regions, enables scalable analysis by eliminating the need for manual localization baselines during training, and improves reliability through consistent performance on previously unseen malware variants.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"98 ","pages":"Article 104385"},"PeriodicalIF":3.7,"publicationDate":"2026-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"146190386","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

MoMEP: A formally verified protocol with modifiable signed messages MoMEP：经过正式验证的协议，具有可修改的签名消息

IF 3.7 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Journal of Information Security and Applications

Pub Date : 2026-05-01 Epub Date: 2026-01-23 DOI: 10.1016/j.jisa.2026.104378

Reyhane Falanji, Mikael Asplund, Niklas Carlsson

In this study, we introduce MoMEP, a message transmission protocol relying on chameleon signatures. These signatures allow modification of signed messages while keeping the original signature valid. Despite their useful features, chameleon signatures have received limited use in real-world applications, such as internet protocols. Our work bridges this the gap by presenting a protocol based on chameleon signatures, and formally proving its trustworthiness using symbolic formal verification. In particular, providing accountability guarantees presents unique challenges, as message modifications can erase evidence of misbehavior, breaking traditional assumptions about trace-based accountability. To address this, we define three protocol-level accountability properties (i.e., unforgeability, non-repudiation, and non-frameability) for MoMEP, complementing earlier definitions applicable for cryptographic primitives. These properties are essential to allow symbolic protocol verification and ensure accountability for all relevant entities involved in the message exchange. We also introduce an entity accountability notion that does not rely on storing protocol traces and is based on an evidence-driven verdict function. We model MoMEP in the Tamarin theorem prover and formally verify that it satisfies our accountability properties. Finally, we prove the soundness and completeness of MoMEP’s evidence-based verdict function, reinforcing its correctness and applicability for deciding accountability in real-world scenarios.

在本研究中，我们介绍了一种基于变色龙签名的消息传输协议MoMEP。这些签名允许修改已签名的消息，同时保持原始签名的有效性。尽管变色龙签名有很多有用的特性，但在现实世界的应用中，比如互联网协议，它们的使用却很有限。我们的工作通过提出基于变色龙签名的协议，并使用符号形式验证正式证明其可信度，弥合了这一差距。特别是，提供问责制保证带来了独特的挑战，因为消息修改可以消除不当行为的证据，打破了关于基于跟踪的问责制的传统假设。为了解决这个问题，我们为MoMEP定义了三个协议级责任属性（即不可伪造性、不可抵赖性和不可帧性），以补充适用于加密原语的早期定义。这些属性对于允许符号协议验证和确保消息交换中涉及的所有相关实体的问责制是必不可少的。我们还引入了一个实体问责概念，它不依赖于存储协议跟踪，而是基于证据驱动的判决功能。我们在Tamarin定理证明中建模MoMEP，并正式验证它满足我们的责任属性。最后，我们证明了MoMEP的循证判决功能的健全性和完备性，增强了其在现实场景中决定责任的正确性和适用性。

{"title":"MoMEP: A formally verified protocol with modifiable signed messages","authors":"Reyhane Falanji, Mikael Asplund, Niklas Carlsson","doi":"10.1016/j.jisa.2026.104378","DOIUrl":"10.1016/j.jisa.2026.104378","url":null,"abstract":"<div><div>In this study, we introduce MoMEP, a message transmission protocol relying on chameleon signatures. These signatures allow modification of signed messages while keeping the original signature valid. Despite their useful features, chameleon signatures have received limited use in real-world applications, such as internet protocols. Our work bridges this the gap by presenting a protocol based on chameleon signatures, and formally proving its trustworthiness using symbolic formal verification. In particular, providing accountability guarantees presents unique challenges, as message modifications can erase evidence of misbehavior, breaking traditional assumptions about trace-based accountability. To address this, we define three protocol-level accountability properties (i.e., unforgeability, non-repudiation, and non-frameability) for MoMEP, complementing earlier definitions applicable for cryptographic primitives. These properties are essential to allow symbolic protocol verification and ensure accountability for all relevant entities involved in the message exchange. We also introduce an entity accountability notion that does not rely on storing protocol traces and is based on an evidence-driven verdict function. We model MoMEP in the Tamarin theorem prover and formally verify that it satisfies our accountability properties. Finally, we prove the soundness and completeness of MoMEP’s evidence-based verdict function, reinforcing its correctness and applicability for deciding accountability in real-world scenarios.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"98 ","pages":"Article 104378"},"PeriodicalIF":3.7,"publicationDate":"2026-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"146039807","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Fed-Adapt: A Federated Learning Framework for Adaptive Topology Reconfiguration Against Multi-Rate DDoS and Database Flooding Attacks Fed-Adapt：针对多速率DDoS和数据库泛洪攻击的自适应拓扑重构的联邦学习框架

IF 3.7 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Journal of Information Security and Applications

Pub Date : 2026-05-01 Epub Date: 2026-02-06 DOI: 10.1016/j.jisa.2026.104384

M. Hormozi , S.H. Erfani , A. Sahafi , M. Moradi

The rise of advanced adversarial methods, especially polymorphic multi-rate Distributed Denial of Service (DDoS) attacks that use TCP congestion control mechanisms and application-layer database flooding attacks that take advantage of query complexity weaknesses, means that we need to move from reactive signature-based defenses to proactive, intelligent mitigation strategies. This study introduces Fed-Adapt, an innovative Byzantine-resilient Federated Learning framework that facilitates real-time Software-Defined Network (SDN) topology reconfiguration through mathematically assured optimization. Our architecture uses a hierarchical deep learning pipeline. Edge-deployed TCNs with dilated causal convolutions are used for real-time feature extraction. Transformer-based attention mechanisms are used for global threat correlation. The framework deals with the basic trilemma of modern network security: keeping cryptographic privacy guarantees, getting close to the best detection accuracy (95.2% F1-score), and allowing mitigation in less than a second (1.8±0.4s end-to-end latency). We present a novel entropy-variance divergence metric that captures both instantaneous statistical anomalies and temporal gradient shifts, demonstrating 40% superior sensitivity (AUC=0.97) compared to traditional Shannon entropy (AUC=0.89) for detecting slow-rate attacks operating below 0.1% of link capacity. Our Byzantine-resilient aggregation protocol uses cryptographic commitment methods (SHA-256 hash chains) and gradient clipping to keep the model converging even while 30% of the participants are trying to mess it up. This was shown through formal verification using TLA+ specifications. The topology reconfiguration engine defines network adaptation as a Mixed-Integer Quadratic Programming (MIQP) problem with 10^4 decision variables, which is addressed using interior-point methods with warm-start initialization that find ε-optimal solutions in 187±23ms. A lot of testing on different testbeds shows that Fed-Adapt is better: it has a detection accuracy of 95.2%, it has an 85% lower false positive rate than threshold-based systems, and it keeps the SLA for service availability at 99.7% during active mitigation. The framework's unique contribution is that it shows that the NP-hard topology reconfiguration problem can be solved in polynomial time (PTAS) under certain network conditions, making it possible to use it on a large scale on the Internet. In comparison with existing models such as SDN-Defend, FlowBlock, FL-Shield, Centra-Guard, and FL-SDN-Sync, Fed-Adapt achieves 95.2% detection accuracy while preserving privacy, clearly outperforming them across both SDN and Database-Flooding scenarios.

高级对抗方法的兴起，特别是使用TCP拥塞控制机制的多态多速率分布式拒绝服务（DDoS）攻击和利用查询复杂性弱点的应用层数据库泛洪攻击，意味着我们需要从基于响应式签名的防御转向主动、智能的缓解策略。本研究介绍了Fed-Adapt，这是一种创新的拜占庭弹性联邦学习框架，通过数学保证优化促进实时软件定义网络（SDN）拓扑重构。我们的架构使用分层深度学习管道。采用扩展因果卷积的边缘部署tcn进行实时特征提取。基于转换器的注意机制用于全局威胁关联。该框架处理现代网络安全的基本三难困境：保持加密隐私保证，接近最佳检测精度（95.2% F1-score），并允许在不到一秒的时间内（1.8±0.4s的端到端延迟）进行缓解。我们提出了一种新的熵方差散度度量，可以捕获瞬时统计异常和时间梯度变化，与传统香农熵（AUC=0.89）相比，在检测运行在链路容量0.1%以下的慢速攻击时，显示出40%的灵敏度（AUC=0.97）。我们的拜占庭弹性聚合协议使用加密承诺方法（SHA-256哈希链）和梯度裁剪来保持模型收敛，即使30%的参与者试图弄乱它。这是通过使用TLA+规范的正式验证显示的。拓扑重构引擎将网络自适应定义为具有10^4个决策变量的混合整数二次规划（MIQP）问题，并使用热启动初始化的内点方法在187±23ms内找到ε-最优解。在不同的测试平台上进行的大量测试表明，Fed-Adapt更好：它的检测准确率为95.2%，误报率比基于阈值的系统低85%，并且在主动缓解期间，它的服务可用性SLA保持在99.7%。该框架的独特贡献在于，它表明在一定的网络条件下，NP-hard拓扑重构问题可以在多项式时间（PTAS）内解决，从而使其在Internet上的大规模应用成为可能。与SDN- defend、FlowBlock、FL-Shield、central - guard和FL-SDN-Sync等现有模型相比，Fed-Adapt在保护隐私的同时实现了95.2%的检测准确率，在SDN和数据库泛滥场景中都明显优于它们。

{"title":"Fed-Adapt: A Federated Learning Framework for Adaptive Topology Reconfiguration Against Multi-Rate DDoS and Database Flooding Attacks","authors":"M. Hormozi , S.H. Erfani , A. Sahafi , M. Moradi","doi":"10.1016/j.jisa.2026.104384","DOIUrl":"10.1016/j.jisa.2026.104384","url":null,"abstract":"<div><div>The rise of advanced adversarial methods, especially polymorphic multi-rate Distributed Denial of Service (DDoS) attacks that use TCP congestion control mechanisms and application-layer database flooding attacks that take advantage of query complexity weaknesses, means that we need to move from reactive signature-based defenses to proactive, intelligent mitigation strategies. This study introduces Fed-Adapt, an innovative Byzantine-resilient Federated Learning framework that facilitates real-time Software-Defined Network (SDN) topology reconfiguration through mathematically assured optimization. Our architecture uses a hierarchical deep learning pipeline. Edge-deployed TCNs with dilated causal convolutions are used for real-time feature extraction. Transformer-based attention mechanisms are used for global threat correlation. The framework deals with the basic trilemma of modern network security: keeping cryptographic privacy guarantees, getting close to the best detection accuracy (95.2% F1-score), and allowing mitigation in less than a second (1.8±0.4s end-to-end latency). We present a novel entropy-variance divergence metric that captures both instantaneous statistical anomalies and temporal gradient shifts, demonstrating 40% superior sensitivity (AUC=0.97) compared to traditional Shannon entropy (AUC=0.89) for detecting slow-rate attacks operating below 0.1% of link capacity. Our Byzantine-resilient aggregation protocol uses cryptographic commitment methods (SHA-256 hash chains) and gradient clipping to keep the model converging even while 30% of the participants are trying to mess it up. This was shown through formal verification using TLA+ specifications. The topology reconfiguration engine defines network adaptation as a Mixed-Integer Quadratic Programming (MIQP) problem with 10^4 decision variables, which is addressed using interior-point methods with warm-start initialization that find ε-optimal solutions in 187±23ms. A lot of testing on different testbeds shows that Fed-Adapt is better: it has a detection accuracy of 95.2%, it has an 85% lower false positive rate than threshold-based systems, and it keeps the SLA for service availability at 99.7% during active mitigation. The framework's unique contribution is that it shows that the NP-hard topology reconfiguration problem can be solved in polynomial time (PTAS) under certain network conditions, making it possible to use it on a large scale on the Internet. In comparison with existing models such as SDN-Defend, FlowBlock, FL-Shield, Centra-Guard, and FL-SDN-Sync, Fed-Adapt achieves 95.2% detection accuracy while preserving privacy, clearly outperforming them across both SDN and Database-Flooding scenarios.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"98 ","pages":"Article 104384"},"PeriodicalIF":3.7,"publicationDate":"2026-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"146190339","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

AMF-CFL: Anomaly model filtering based on clustering in federated learning AMF-CFL：联邦学习中基于聚类的异常模型过滤

IF 3.7 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Journal of Information Security and Applications

Pub Date : 2026-05-01 Epub Date: 2026-01-29 DOI: 10.1016/j.jisa.2026.104387

Bo Wang , Xiaorui Dai , Wei Wang , Zi Yang , Zhaoning Wang , Maozhen Zhang

Federated learning (FL) allows multiple participants to collaboratively train a shared model without exposing their local data, thereby mitigating the risk of data leakage. Despite its advantages, FL is vulnerable to attacks by malicious clients, and existing defense mechanisms, while effective under independent and identically distributed (i.i.d.) settings, often exhibit degraded performance in non-i.i.d. scenarios where client data distributions differ. To overcome this limitation, we propose AMF-CFL, a robust aggregation algorithm specifically designed for federated learning under non-i.i.d. conditions. AMF-CFL reduces the influence of malicious updates through a two-step filtering strategy: it first applies multi-k-means clustering to identify anomalous update patterns, followed by z-score-based statistical analysis to refine the selection of benign updates. Comprehensive evaluations against four untargeted and two targeted attack types demonstrate that AMF-CFL effectively preserves the integrity and robustness of the global model, offering a reliable defense in challenging federated learning environments.

联邦学习（FL）允许多个参与者在不暴露本地数据的情况下协作训练共享模型，从而降低了数据泄漏的风险。尽管具有优势，但FL很容易受到恶意客户端的攻击，现有的防御机制虽然在独立和同分布（i.i.d）设置下有效，但在非i.i.d设置下往往表现出性能下降。客户端数据分布不同的场景。为了克服这一限制，我们提出了AMF-CFL算法，这是一种专门为非id下的联邦学习设计的鲁棒聚合算法。条件。AMF-CFL通过两步过滤策略来减少恶意更新的影响：首先应用多k均值聚类来识别异常更新模式，然后使用基于z分数的统计分析来优化良性更新的选择。针对四种非目标攻击和两种目标攻击类型的综合评估表明，AMF-CFL有效地保持了全局模型的完整性和鲁棒性，在具有挑战性的联邦学习环境中提供了可靠的防御。

{"title":"AMF-CFL: Anomaly model filtering based on clustering in federated learning","authors":"Bo Wang , Xiaorui Dai , Wei Wang , Zi Yang , Zhaoning Wang , Maozhen Zhang","doi":"10.1016/j.jisa.2026.104387","DOIUrl":"10.1016/j.jisa.2026.104387","url":null,"abstract":"<div><div>Federated learning (FL) allows multiple participants to collaboratively train a shared model without exposing their local data, thereby mitigating the risk of data leakage. Despite its advantages, FL is vulnerable to attacks by malicious clients, and existing defense mechanisms, while effective under independent and identically distributed (i.i.d.) settings, often exhibit degraded performance in non-i.i.d. scenarios where client data distributions differ. To overcome this limitation, we propose AMF-CFL, a robust aggregation algorithm specifically designed for federated learning under non-i.i.d. conditions. AMF-CFL reduces the influence of malicious updates through a two-step filtering strategy: it first applies multi-<em>k</em>-means clustering to identify anomalous update patterns, followed by <em>z</em>-score-based statistical analysis to refine the selection of benign updates. Comprehensive evaluations against four untargeted and two targeted attack types demonstrate that AMF-CFL effectively preserves the integrity and robustness of the global model, offering a reliable defense in challenging federated learning environments.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"98 ","pages":"Article 104387"},"PeriodicalIF":3.7,"publicationDate":"2026-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"146080917","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Decoupled framework for non-additive adversarial image steganography 非加性对抗图像隐写的解耦框架

IF 3.7 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Journal of Information Security and Applications

Pub Date : 2026-05-01 Epub Date: 2026-01-27 DOI: 10.1016/j.jisa.2026.104376

Junfeng Zhao , Shen Wang

Adversarial image steganography aims to introduce a small amount of perturbations during the data embedding to improve security performance, while existing works are typically based on additive model under the framework of distortion minimization. Different from additive model, non-additive model assumes that the modification of adjacent elements will interact with each other. If adversarial perturbations are introduced on this basis, the performance of adversarial stegos against re-trained steganalyzers will be further improved. In this paper, we point out the reasons why the existing coupled framework causes the actual embedding structure to fail to fully meet the constraints of the non-additive embedding structure. Then, we decouple the two methods according to their roles, making them independent in structure and more flexible in combination. However, since non-additive adversarial image steganography have to follow the constraints, if the steganographer still aims to successfully attack the target model, excessive perturbations will be occurred. To avoid this phenomenon, we propose a mechanism based on the difference in the attack threshold between the two methods. Extensive experimental results show that if the steganographer uses the decoupled framework to reconstruct the methods, an adversarial stego that satisfies the non-additive constraints can be generated, and the security performance against re-trained steganalyzers in the spatial domain is improved by about 1% ~3% compared with the additive model-based method.

对抗图像隐写的目的是在数据嵌入过程中引入少量的扰动以提高安全性能，而现有的工作通常是基于失真最小化框架下的加性模型。与加性模型不同，非加性模型假设相邻元素的修改会相互作用。如果在此基础上引入对抗性扰动，对抗性隐写算法对重新训练的隐写分析器的性能将进一步提高。本文指出了现有耦合框架导致实际嵌入结构不能完全满足非加性嵌入结构约束的原因。然后，我们根据两种方法的作用进行解耦，使它们在结构上独立，在组合上更加灵活。然而，由于非加性对抗性图像隐写必须遵循约束，如果隐写者仍然以成功攻击目标模型为目标，则会产生过多的扰动。为了避免这种现象，我们提出了一种基于两种方法攻击阈值差异的机制。大量的实验结果表明，如果隐写者使用解耦框架重构方法，可以生成满足非加性约束的对抗隐写，并且与基于加性模型的方法相比，在空间域中对重新训练的隐写分析器的安全性能提高了约1% ~3%。

{"title":"Decoupled framework for non-additive adversarial image steganography","authors":"Junfeng Zhao , Shen Wang","doi":"10.1016/j.jisa.2026.104376","DOIUrl":"10.1016/j.jisa.2026.104376","url":null,"abstract":"<div><div>Adversarial image steganography aims to introduce a small amount of perturbations during the data embedding to improve security performance, while existing works are typically based on additive model under the framework of distortion minimization. Different from additive model, non-additive model assumes that the modification of adjacent elements will interact with each other. If adversarial perturbations are introduced on this basis, the performance of adversarial stegos against re-trained steganalyzers will be further improved. In this paper, we point out the reasons why the existing coupled framework causes the actual embedding structure to fail to fully meet the constraints of the non-additive embedding structure. Then, we decouple the two methods according to their roles, making them independent in structure and more flexible in combination. However, since non-additive adversarial image steganography have to follow the constraints, if the steganographer still aims to successfully attack the target model, excessive perturbations will be occurred. To avoid this phenomenon, we propose a mechanism based on the difference in the attack threshold between the two methods. Extensive experimental results show that if the steganographer uses the decoupled framework to reconstruct the methods, an adversarial stego that satisfies the non-additive constraints can be generated, and the security performance against re-trained steganalyzers in the spatial domain is improved by about 1% ~3% compared with the additive model-based method.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"98 ","pages":"Article 104376"},"PeriodicalIF":3.7,"publicationDate":"2026-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"146080984","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Evaluating lightweight unsupervised online IDS for masquerade attacks in CAN 对CAN中伪装攻击的轻量级无监督在线IDS进行评估

IF 3.7 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Journal of Information Security and Applications

Pub Date : 2026-05-01 Epub Date: 2026-02-04 DOI: 10.1016/j.jisa.2026.104392

Pablo Moriano , Steven C. Hespeler , Mingyan Li , Robert A. Bridges

Vehicular controller area networks (CANs) are susceptible to masquerade attacks by malicious adversaries. In masquerade attacks, adversaries silence a targeted ID and then send malicious frames with forged content at the expected timing of benign frames. As masquerade attacks could seriously harm vehicle functionality and are the stealthiest attacks to detect in CAN, recent work has devoted attention to compare frameworks for detecting masquerade attacks in CAN. However, most existing works report offline evaluations using CAN logs already collected using simulations that do not comply with the domain’s real-time constraints. Here we contribute to advance the state of the art by presenting a comparative evaluation of four different non-deep learning (DL)-based unsupervised online intrusion detection systems (IDS) for masquerade attacks in CAN. Our approach differs from existing comparative evaluations in that we analyze the effect of controlling streaming data conditions in a sliding window setting. In doing so, we use realistic masquerade attacks being replayed from the ROAD dataset. We show that although evaluated IDS are not effective at detecting every attack type, the method that relies on detecting changes in the hierarchical structure of clusters of time series produces the best results at the expense of higher computational overhead. We discuss limitations, open challenges, and how the evaluated methods can be used for practical unsupervised online CAN IDS for masquerade attacks.

车载控制器局域网（can）容易受到恶意攻击者的伪装攻击。在伪装攻击中，攻击者沉默目标ID，然后在良性帧的预期时间发送带有伪造内容的恶意帧。由于伪装攻击可能严重损害车辆功能，并且是CAN中检测到的最隐蔽的攻击，最近的工作主要集中在比较CAN中检测伪装攻击的框架。然而，大多数现有的工作报告使用已经使用模拟收集的CAN日志进行离线评估，这些日志不符合领域的实时约束。在这里，我们通过对CAN中伪装攻击的四种不同的基于非深度学习（DL）的无监督在线入侵检测系统（IDS）进行比较评估，为推进最新技术做出了贡献。我们的方法不同于现有的比较评估，因为我们分析了在滑动窗口设置中控制流数据条件的效果。在这样做的过程中，我们使用了从ROAD数据集中重播的真实伪装攻击。我们表明，尽管评估的IDS不能有效地检测每一种攻击类型，但依赖于检测时间序列簇的层次结构变化的方法以更高的计算开销为代价产生了最好的结果。我们讨论了限制，开放的挑战，以及如何将评估的方法用于实际的无监督在线can IDS用于伪装攻击。

{"title":"Evaluating lightweight unsupervised online IDS for masquerade attacks in CAN","authors":"Pablo Moriano , Steven C. Hespeler , Mingyan Li , Robert A. Bridges","doi":"10.1016/j.jisa.2026.104392","DOIUrl":"10.1016/j.jisa.2026.104392","url":null,"abstract":"<div><div>Vehicular controller area networks (CANs) are susceptible to masquerade attacks by malicious adversaries. In masquerade attacks, adversaries silence a targeted ID and then send malicious frames with forged content at the expected timing of benign frames. As masquerade attacks could seriously harm vehicle functionality and are the stealthiest attacks to detect in CAN, recent work has devoted attention to compare frameworks for detecting masquerade attacks in CAN. However, most existing works report offline evaluations using CAN logs already collected using simulations that do not comply with the domain’s real-time constraints. Here we contribute to advance the state of the art by presenting a comparative evaluation of four different non-deep learning (DL)-based unsupervised online intrusion detection systems (IDS) for masquerade attacks in CAN. Our approach differs from existing comparative evaluations in that we analyze the effect of controlling streaming data conditions in a sliding window setting. In doing so, we use realistic masquerade attacks being replayed from the ROAD dataset. We show that although evaluated IDS are not effective at detecting every attack type, the method that relies on detecting changes in the hierarchical structure of clusters of time series produces the best results at the expense of higher computational overhead. We discuss limitations, open challenges, and how the evaluated methods can be used for practical unsupervised online CAN IDS for masquerade attacks.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"98 ","pages":"Article 104392"},"PeriodicalIF":3.7,"publicationDate":"2026-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"146190337","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

ML-CLSCKS: Module lattice based certificateless signcryption with keyword search in cloud storage ML-CLSCKS：在云存储中使用关键字搜索的基于模块格的无证书签名加密

IF 3.7 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Journal of Information Security and Applications

Pub Date : 2026-05-01 Epub Date: 2026-02-05 DOI: 10.1016/j.jisa.2026.104386

Sudeep Guntuka , Syam Kumar Pasupuleti , Satish Narayana Srirama

Public Key Authenticated Encryption with Keyword Search (PAEKS) allows keyword searches over encrypted data in the cloud without revealing actual data and the receiver can verify the sender’s authenticity or detect tampering. However, the existing PAEKS schemes are based on classical hard problems that are vulnerable to quantum attacks. To overcome these issues, lattice-based PAEKS schemes have been proposed, which provide post quantum security but incur high computational overhead and suffer from inherent issues such as the Certificate Management Problem (CMP) or Key Escrow Problem (KEP). To address the above problems, in this paper, we introduce a Module Lattice-based Certificateless Signcryption with Keyword Search (ML-CLSCKS), which relies on Module Learning with Errors (MLWE) and Module Short Integer Solution (MSIS). The security analysis proves that ML-CLSCKS achieves both confidentiality and unforgeability against Type I and Type II adversaries in the Random Oracle Model (ROM). The performance analysis shows that ML-CLSCKS outperforms than existing lattice-based PAEKS schemes and makes the practical quantum-resistant scheme suitable for searchable encryption in cloud environments.

使用关键字搜索的公钥认证加密（PAEKS）允许对云中的加密数据进行关键字搜索，而不会泄露实际数据，接收方可以验证发送方的真实性或检测篡改。然而，现有的PAEKS方案是基于容易受到量子攻击的经典难题。为了克服这些问题，提出了基于格子的PAEKS方案，该方案提供后量子安全，但会产生很高的计算开销，并且存在诸如证书管理问题（CMP）或密钥托管问题（KEP）等固有问题。为了解决上述问题，本文引入了一种基于错误模块学习（MLWE）和模块短整数解决方案（MSIS）的基于模块格的关键字搜索无证书签名加密（ML-CLSCKS）。安全性分析证明，ML-CLSCKS在随机Oracle模型（Random Oracle Model， ROM）中对类型I和类型II的攻击者实现了保密性和不可伪造性。性能分析表明，ML-CLSCKS方案优于现有的基于格子的PAEKS方案，使该方案适用于云环境下的可搜索加密。

{"title":"ML-CLSCKS: Module lattice based certificateless signcryption with keyword search in cloud storage","authors":"Sudeep Guntuka , Syam Kumar Pasupuleti , Satish Narayana Srirama","doi":"10.1016/j.jisa.2026.104386","DOIUrl":"10.1016/j.jisa.2026.104386","url":null,"abstract":"<div><div>Public Key Authenticated Encryption with Keyword Search (PAEKS) allows keyword searches over encrypted data in the cloud without revealing actual data and the receiver can verify the sender’s authenticity or detect tampering. However, the existing PAEKS schemes are based on classical hard problems that are vulnerable to quantum attacks. To overcome these issues, lattice-based PAEKS schemes have been proposed, which provide post quantum security but incur high computational overhead and suffer from inherent issues such as the Certificate Management Problem (CMP) or Key Escrow Problem (KEP). To address the above problems, in this paper, we introduce a Module Lattice-based Certificateless Signcryption with Keyword Search (ML-CLSCKS), which relies on Module Learning with Errors (MLWE) and Module Short Integer Solution (MSIS). The security analysis proves that ML-CLSCKS achieves both confidentiality and unforgeability against Type I and Type II adversaries in the Random Oracle Model (ROM). The performance analysis shows that ML-CLSCKS outperforms than existing lattice-based PAEKS schemes and makes the practical quantum-resistant scheme suitable for searchable encryption in cloud environments.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"98 ","pages":"Article 104386"},"PeriodicalIF":3.7,"publicationDate":"2026-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"146190340","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0