Journal of Information Security and Applications最新文献_第3页

A lattice-based dual blockchain anonymous authentication scheme with forward security and revocability for VANETs 一种基于格的双向区块链匿名认证方案，具有前向安全性和可撤销性

IF 3.7 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Journal of Information Security and Applications

Pub Date : 2026-01-07 DOI: 10.1016/j.jisa.2025.104369

Xiuhua Lu , Jingzhuo Zhang , Shuanggen Liu , Yanzhe Dong , Xijie Lu , Junzhong Liu

Vehicular Ad-hoc Networks (VANETs) play a vital role in Intelligent Transportation Systems (ITS) by improving traffic safety and efficiency. However, its open communication channels and high-speed mobility introduce privacy and security vulnerabilities, which makes anonymous authentication particularly important for privacy protection and secure communication. Nevertheless, existing anonymous authentication schemes face significant limitations in resisting single point of failure and supporting distributed storage of authentication messages. Moreover, most of these schemes rely on traditional number-theoretic assumptions, and lack resistance to quantum attacks. We propose a lattice-based dual blockchain anonymous authentication scheme with forward security and revocability for VANETs. The dual blockchain framework logically decouples vehicle identities from their mobility patterns, thereby enhancing anonymity. Forward security is obtained by leveraging bonsai trees structure, ensuring that exposure of current secret key of a vehicle does not affect the authenticity of previously transmitted messages. To address the issue of vehicle misbehavior or credential compromise, the scheme also supports revocability, allowing the system to efficiently and anonymously exclude malicious vehicles from the network without affecting honest participants. Our scheme is rigorously proven to achieve correctness, full anonymity and forward secure traceability. Experimental evaluations show its balanced performance in terms of security and efficiency.

车辆自组织网络（VANETs）通过提高交通安全和效率在智能交通系统（ITS）中发挥着至关重要的作用。然而，其开放的通信通道和高速的移动性带来了隐私和安全漏洞，这使得匿名认证对隐私保护和安全通信尤为重要。然而，现有的匿名身份验证方案在抵抗单点故障和支持身份验证消息的分布式存储方面面临着很大的限制。此外，这些方案大多依赖于传统的数论假设，缺乏对量子攻击的抵抗力。提出了一种基于格的双区块链匿名认证方案，具有前向安全性和可撤销性。双区块链框架从逻辑上将车辆身份与其移动模式解耦，从而增强了匿名性。前向安全性是利用盆景树结构实现的，确保车辆当前密钥的暴露不会影响先前传输消息的真实性。为了解决车辆不当行为或凭证泄露的问题，该方案还支持可撤销性，允许系统在不影响诚实参与者的情况下有效和匿名地从网络中排除恶意车辆。我们的方案被严格证明可以实现正确性、完全匿名性和前向安全可追溯性。实验结果表明，该算法在安全性和效率方面达到了平衡。

{"title":"A lattice-based dual blockchain anonymous authentication scheme with forward security and revocability for VANETs","authors":"Xiuhua Lu , Jingzhuo Zhang , Shuanggen Liu , Yanzhe Dong , Xijie Lu , Junzhong Liu","doi":"10.1016/j.jisa.2025.104369","DOIUrl":"10.1016/j.jisa.2025.104369","url":null,"abstract":"<div><div>Vehicular Ad-hoc Networks (VANETs) play a vital role in Intelligent Transportation Systems (ITS) by improving traffic safety and efficiency. However, its open communication channels and high-speed mobility introduce privacy and security vulnerabilities, which makes anonymous authentication particularly important for privacy protection and secure communication. Nevertheless, existing anonymous authentication schemes face significant limitations in resisting single point of failure and supporting distributed storage of authentication messages. Moreover, most of these schemes rely on traditional number-theoretic assumptions, and lack resistance to quantum attacks. We propose a lattice-based dual blockchain anonymous authentication scheme with forward security and revocability for VANETs. The dual blockchain framework logically decouples vehicle identities from their mobility patterns, thereby enhancing anonymity. Forward security is obtained by leveraging bonsai trees structure, ensuring that exposure of current secret key of a vehicle does not affect the authenticity of previously transmitted messages. To address the issue of vehicle misbehavior or credential compromise, the scheme also supports revocability, allowing the system to efficiently and anonymously exclude malicious vehicles from the network without affecting honest participants. Our scheme is rigorously proven to achieve correctness, full anonymity and forward secure traceability. Experimental evaluations show its balanced performance in terms of security and efficiency.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"97 ","pages":"Article 104369"},"PeriodicalIF":3.7,"publicationDate":"2026-01-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145926040","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

LTMIA: a loss trajectory-based membership inference attack method in federated learning LTMIA：联邦学习中一种基于损失轨迹的隶属推理攻击方法

IF 3.7 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Journal of Information Security and Applications

Pub Date : 2026-01-07 DOI: 10.1016/j.jisa.2025.104364

Jia Song , Jianting Yuan , Guanxin Chen , Yipeng Liu , Nan Yang

Federated Learning (FL) preserves privacy by avoiding direct data sharing, yet trained models remain vulnerable to information leakage through Membership Inference Attacks (MIAs) and Source Inference Attacks (SIAs). Existing MIA methods in FL demand substantial storage space and computational resources by requiring complete client updates across multiple rounds, while SIAs typically depend on impractical assumptions such as auxiliary datasets. To address these limitations, we propose LTMIA (Loss Trajectory-based Membership Inference Attack), a unified framework capable of performing both MIA and SIA efficiently. Our method exploits loss trajectory discrepancies during early FL training stages. By extracting temporal loss patterns from initial rounds, LTMIA trains a lightweight inference model for membership prediction. For SIA, we introduce a statistical averaging strategy that enables accurate source attribution without requiring auxiliary datasets. Experimental results demonstrate that LTMIA achieves more than 94% attack accuracy in MIA while using only the first half of client updates. For SIA tasks, LTMIA consistently surpasses state-of-the-art baselines across various configurations. The method shows particular strength in scenarios with limited computational resources and storage capacity. These findings underscore LTMIA’s effectiveness, efficiency, and practicality for assessing privacy risks in FL systems.

联邦学习（FL）通过避免直接的数据共享来保护隐私，但是经过训练的模型仍然容易受到成员推理攻击（mia）和源推理攻击（SIAs）的信息泄露。FL中现有的MIA方法需要跨多轮完整的客户端更新，需要大量的存储空间和计算资源，而sia通常依赖于不切实际的假设，如辅助数据集。为了解决这些限制，我们提出了LTMIA（基于损失轨迹的成员推理攻击），这是一个能够有效执行MIA和SIA的统一框架。我们的方法利用了早期FL训练阶段的损失轨迹差异。通过从初始回合中提取时间损失模式，LTMIA训练轻量级推理模型用于成员预测。对于SIA，我们引入了一种统计平均策略，可以在不需要辅助数据集的情况下实现准确的来源归属。实验结果表明，LTMIA在只使用客户端更新的前半部分的情况下，在MIA中实现了94%以上的攻击准确率。对于SIA任务，LTMIA在各种配置中始终超过最先进的基线。该方法在计算资源和存储容量有限的情况下表现出特别的优势。这些发现强调了LTMIA在FL系统中评估隐私风险的有效性、效率和实用性。

{"title":"LTMIA: a loss trajectory-based membership inference attack method in federated learning","authors":"Jia Song , Jianting Yuan , Guanxin Chen , Yipeng Liu , Nan Yang","doi":"10.1016/j.jisa.2025.104364","DOIUrl":"10.1016/j.jisa.2025.104364","url":null,"abstract":"<div><div>Federated Learning (FL) preserves privacy by avoiding direct data sharing, yet trained models remain vulnerable to information leakage through Membership Inference Attacks (MIAs) and Source Inference Attacks (SIAs). Existing MIA methods in FL demand substantial storage space and computational resources by requiring complete client updates across multiple rounds, while SIAs typically depend on impractical assumptions such as auxiliary datasets. To address these limitations, we propose LTMIA (Loss Trajectory-based Membership Inference Attack), a unified framework capable of performing both MIA and SIA efficiently. Our method exploits loss trajectory discrepancies during early FL training stages. By extracting temporal loss patterns from initial rounds, LTMIA trains a lightweight inference model for membership prediction. For SIA, we introduce a statistical averaging strategy that enables accurate source attribution without requiring auxiliary datasets. Experimental results demonstrate that LTMIA achieves more than 94% attack accuracy in MIA while using only the first half of client updates. For SIA tasks, LTMIA consistently surpasses state-of-the-art baselines across various configurations. The method shows particular strength in scenarios with limited computational resources and storage capacity. These findings underscore LTMIA’s effectiveness, efficiency, and practicality for assessing privacy risks in FL systems.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"97 ","pages":"Article 104364"},"PeriodicalIF":3.7,"publicationDate":"2026-01-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145926105","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

CallTrust: A federated system for call authentication in telephony networks CallTrust：在电话网络中用于呼叫身份验证的联邦系统

IF 3.7 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Journal of Information Security and Applications

Pub Date : 2026-01-07 DOI: 10.1016/j.jisa.2025.104365

Francesco Buccafurri , Vincenzo De Angelis , Sara Lazzaro , Carmen Licciardi

Voice phishing (vishing) remains a critical security threat in telephone communications, where users cannot reliably authenticate calling parties. Despite technical efforts like STIR/SHAKEN, traditional telephony still lacks application-layer mechanisms to detect spoofed or hijacked calls. In this paper, we present CallTrust, a novel, deployable, and infrastructure-agnostic solution that enables real-time verification of incoming and outgoing calls between users and Certified Services, i.e., trusted entities publicly certified to own specific phone numbers. Our protocol operates entirely at the application layer and leverages time-slotted, privacy-preserving credentials published by Certified Services to detect spoofed or hijacked calls. We detail the protocol design and show that it satisfies the intended security properties. To demonstrate the practical relevance of our approach, we propose a federated design that enables cross-realm (i.e., cross-border) adoption. As a concrete example, we apply it to the European eIDAS framework by extending Qualified Website Authentication Certificates (QWACs) to support the binding of telephone numbers to legally recognized entities. Through a mobile-based proof-of-concept implementation, we show that call authentication can be completed in under two seconds, thus providing users with timely warnings before engaging with potentially phone scammers. Experimental results confirm the practicality of our approach, offering a viable path toward securing telephony communication against impersonation-based threats.

语音网络钓鱼（vishing）在电话通信中仍然是一个严重的安全威胁，因为用户无法可靠地验证呼叫方的身份。尽管有诸如STIR/SHAKEN之类的技术努力，传统电话仍然缺乏应用层机制来检测欺骗或劫持电话。在本文中，我们介绍了CallTrust，这是一种新颖的、可部署的、与基础设施无关的解决方案，可以实时验证用户和认证服务（即公开认证为拥有特定电话号码的受信任实体）之间的呼入和呼出呼叫。我们的协议完全在应用层运行，并利用认证服务发布的时隙、隐私保护凭证来检测欺骗或劫持呼叫。我们详细介绍了协议设计，并说明它满足预期的安全属性。为了演示我们的方法的实际相关性，我们提出了一个支持跨领域（即跨界）采用的联邦设计。作为一个具体的例子，我们通过扩展合格网站认证证书（QWACs）将其应用于欧洲eIDAS框架，以支持将电话号码绑定到法律认可的实体。通过基于手机的概念验证实现，我们展示了呼叫身份验证可以在两秒钟内完成，从而在与潜在的电话诈骗者接触之前为用户提供及时的警告。实验结果证实了我们方法的实用性，为保护电话通信免受基于模拟的威胁提供了可行的途径。

{"title":"CallTrust: A federated system for call authentication in telephony networks","authors":"Francesco Buccafurri , Vincenzo De Angelis , Sara Lazzaro , Carmen Licciardi","doi":"10.1016/j.jisa.2025.104365","DOIUrl":"10.1016/j.jisa.2025.104365","url":null,"abstract":"<div><div>Voice phishing (vishing) remains a critical security threat in telephone communications, where users cannot reliably authenticate calling parties. Despite technical efforts like STIR/SHAKEN, traditional telephony still lacks application-layer mechanisms to detect spoofed or hijacked calls. In this paper, we present CallTrust, a novel, deployable, and infrastructure-agnostic solution that enables real-time verification of incoming and outgoing calls between users and Certified Services, i.e., trusted entities publicly certified to own specific phone numbers. Our protocol operates entirely at the application layer and leverages time-slotted, privacy-preserving credentials published by Certified Services to detect spoofed or hijacked calls. We detail the protocol design and show that it satisfies the intended security properties. To demonstrate the practical relevance of our approach, we propose a federated design that enables cross-realm (i.e., cross-border) adoption. As a concrete example, we apply it to the European eIDAS framework by extending Qualified Website Authentication Certificates (QWACs) to support the binding of telephone numbers to legally recognized entities. Through a mobile-based proof-of-concept implementation, we show that call authentication can be completed in under two seconds, thus providing users with timely warnings before engaging with potentially phone scammers. Experimental results confirm the practicality of our approach, offering a viable path toward securing telephony communication against impersonation-based threats.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"97 ","pages":"Article 104365"},"PeriodicalIF":3.7,"publicationDate":"2026-01-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145926039","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

γ-M2I: Image-based malware classification via feature spatial transformation γ-M2I：基于图像特征空间变换的恶意软件分类

IF 3.7 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Journal of Information Security and Applications

Pub Date : 2026-01-07 DOI: 10.1016/j.jisa.2025.104355

Wanhu Nie, Changsheng Zhu

In recent years, the surge in malware variants has made fast and accurate classification a critical cybersecurity challenge. Visualization-based deep learning methods offer promising solutions, among which the State Transition Probability Matrix (STPM) effectively reduces redundancy by modeling binaries as Markov chains. However, STPM is inherently a mathematical statistical model that disregards visual characteristics, resulting in Markov images with inherent flaws such as sparse pixel distribution and insufficient brightness. This paper reveals the fundamental conflict between mathematical semantics and visual perception requirements in STPM visualization and proposes a feature spatial transformation method, γ-M2I, for visual malware classification. The core idea of γ-M2I is to introduce a plug-and-play feature spatial transformation module into traditional STPM visualization schemes to mitigate its intrinsic visual limitations, utilizing spatial transformations (γ-mapping) to optimize feature distribution and enhance the representational capacity of feature maps. This stems from the feature space transformation’s ability to preserve low-frequency state transitions while relatively suppressing high-frequency noise. γ-M2I operates independently of STPM and can be seamlessly integrated into STPM-based frameworks and convolutional neural network architectures. This modular design supports rapid adaptation to advanced models. Extensive experiments conducted on benchmark malware classification datasets, including Malimg and BIG-2015, demonstrate that the proposed method achieves high accuracy rates of 99.82% and 99.46%, with F₁-scores of 99.73% and 99.22%, respectively, outperforming existing state-of-the-art approaches. Moreover, it exhibits robustness against evasion techniques employed by malware variants, such as packing, encryption and obfuscation.

近年来，恶意软件变体的激增使得快速准确的分类成为一项关键的网络安全挑战。基于可视化的深度学习方法提供了很好的解决方案，其中状态转移概率矩阵（STPM）通过将二进制文件建模为马尔可夫链有效地减少了冗余。然而，STPM本质上是一种忽略视觉特征的数学统计模型，导致马尔可夫图像具有像素分布稀疏、亮度不足等固有缺陷。本文揭示了STPM可视化中数学语义与视觉感知需求之间的根本冲突，提出了一种用于可视化恶意软件分类的特征空间变换方法γ-M2I。γ-M2I的核心思想是在传统的STPM可视化方案中引入即插即用的特征空间转换模块，利用空间转换（γ映射）优化特征分布，增强特征映射的表示能力，以缓解其固有的视觉局限性。这源于特征空间变换在相对抑制高频噪声的同时保持低频状态转换的能力。γ-M2I独立于STPM工作，可以无缝集成到基于STPM的框架和卷积神经网络架构中。这种模块化设计支持快速适应先进的模型。在Malimg和BIG-2015等基准恶意软件分类数据集上进行的大量实验表明，该方法的准确率高达99.82%和99.46%，f1得分分别为99.73%和99.22%，优于现有的最先进方法。此外，它还展示了对恶意软件变体所采用的规避技术的鲁棒性，例如打包、加密和混淆。

{"title":"γ-M2I: Image-based malware classification via feature spatial transformation","authors":"Wanhu Nie, Changsheng Zhu","doi":"10.1016/j.jisa.2025.104355","DOIUrl":"10.1016/j.jisa.2025.104355","url":null,"abstract":"<div><div>In recent years, the surge in malware variants has made fast and accurate classification a critical cybersecurity challenge. Visualization-based deep learning methods offer promising solutions, among which the State Transition Probability Matrix (STPM) effectively reduces redundancy by modeling binaries as Markov chains. However, STPM is inherently a mathematical statistical model that disregards visual characteristics, resulting in Markov images with inherent flaws such as sparse pixel distribution and insufficient brightness. This paper reveals the fundamental conflict between mathematical semantics and visual perception requirements in STPM visualization and proposes a feature spatial transformation method, <em>γ</em>-M2I, for visual malware classification. The core idea of <em>γ</em>-M2I is to introduce a plug-and-play feature spatial transformation module into traditional STPM visualization schemes to mitigate its intrinsic visual limitations, utilizing spatial transformations (<em>γ</em>-mapping) to optimize feature distribution and enhance the representational capacity of feature maps. This stems from the feature space transformation’s ability to preserve low-frequency state transitions while relatively suppressing high-frequency noise. <em>γ</em>-M2I operates independently of STPM and can be seamlessly integrated into STPM-based frameworks and convolutional neural network architectures. This modular design supports rapid adaptation to advanced models. Extensive experiments conducted on benchmark malware classification datasets, including Malimg and BIG-2015, demonstrate that the proposed method achieves high accuracy rates of 99.82% and 99.46%, with <em>F</em><sub>1</sub>-scores of 99.73% and 99.22%, respectively, outperforming existing state-of-the-art approaches. Moreover, it exhibits robustness against evasion techniques employed by malware variants, such as packing, encryption and obfuscation.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"97 ","pages":"Article 104355"},"PeriodicalIF":3.7,"publicationDate":"2026-01-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145926053","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A Novel Privacy-Preserving user information queries scheme with functional policy 一种新的带功能策略的保隐私用户信息查询方案

IF 3.7 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Journal of Information Security and Applications

Pub Date : 2026-01-05 DOI: 10.1016/j.jisa.2025.104359

Yuhang Lei , Rui Shi , Yang Yang , Chunjie Cao , Huamin Feng

Privacy-preserving information queries enable a requester to obtain only the value f(x) computed over sensitive data x, while preventing disclosure of the underlying records. Existing approaches typically reveal full data, incur high on-chain overhead, or lack fair and verifiable delivery of function outputs. We propose a general-purpose, blockchain-compatible framework that ensures the requester learns only f(x) with no extra leakage and that the provider receives fair payment. The design integrates Adaptor Signatures (AS) for fair exchange and Inner-Product Functional Encryption (IPFE) for fine-grained function extraction. The framework is domain-agnostic and applicable to privacy-sensitive applications such as medical insurance and financial risk assessment. We formally prove advertisement soundness, unforgeability, witness extractability, and witness privacy. A prototype demonstrates linear scalability up to ℓ=100,000. We conduct a comparative evaluation between our scheme and related works under typical attribute dimensions

ℓ = 10, 20, 30

. The results show that, under the same dimensional settings, our scheme achieves a 2.5×-6× performance improvement. Meanwhile, the storage overhead of our solution ranges from 1.6 KB to 4.1 KB, which is slightly lower than that of existing schemes (2.7-4.0 KB), and the on-chain cost consistently remains a fixed 64 bytes. These findings demonstrate that our approach provides significant practical advantages in low-dimensional, high-frequency medical query scenarios.

保护隐私的信息查询使请求者只能获得对敏感数据x计算的值f(x)，同时防止底层记录的泄露。现有的方法通常会显示完整的数据，导致高链上开销，或者缺乏公平和可验证的功能输出交付。我们提出了一个通用的、区块链兼容的框架，确保请求者只学习f(x)，没有额外的泄漏，并且提供者收到公平的支付。该设计集成了用于公平交换的适配器签名（AS）和用于细粒度功能提取的内部产品功能加密（IPFE）。该框架与领域无关，适用于隐私敏感的应用程序，如医疗保险和金融风险评估。我们正式证明广告的稳健性、不可伪造性、证人可提取性和证人隐私性。一个原型演示了线性可扩展性，最高可达100,000。在典型属性维数=10、20、30的情况下，我们将我们的方案与相关工作进行了比较评价。结果表明，在相同的维度设置下，我们的方案实现了2.5×-6×性能提升。同时，我们的解决方案的存储开销范围从1.6 KB到4.1 KB，略低于现有方案（2.7-4.0 KB），并且链上成本始终保持固定的64字节。这些发现表明，我们的方法在低维、高频医疗查询场景中具有显著的实用优势。

{"title":"A Novel Privacy-Preserving user information queries scheme with functional policy","authors":"Yuhang Lei , Rui Shi , Yang Yang , Chunjie Cao , Huamin Feng","doi":"10.1016/j.jisa.2025.104359","DOIUrl":"10.1016/j.jisa.2025.104359","url":null,"abstract":"<div><div>Privacy-preserving information queries enable a requester to obtain only the value <em>f</em>(<em>x</em>) computed over sensitive data <em>x</em>, while preventing disclosure of the underlying records. Existing approaches typically reveal full data, incur high on-chain overhead, or lack fair and verifiable delivery of function outputs. We propose a general-purpose, blockchain-compatible framework that ensures the requester learns only <em>f</em>(<em>x</em>) with no extra leakage and that the provider receives fair payment. The design integrates Adaptor Signatures (AS) for fair exchange and Inner-Product Functional Encryption (IPFE) for fine-grained function extraction. The framework is domain-agnostic and applicable to privacy-sensitive applications such as medical insurance and financial risk assessment. We formally prove advertisement soundness, unforgeability, witness extractability, and witness privacy. A prototype demonstrates linear scalability up to ℓ=100,000. We conduct a comparative evaluation between our scheme and related works under typical attribute dimensions <span><math><mrow><mi>ℓ</mi><mo>=</mo><mrow><mn>10</mn><mo>,</mo><mn>20</mn><mo>,</mo><mn>30</mn></mrow></mrow></math></span>. The results show that, under the same dimensional settings, our scheme achieves a 2.5×-6× performance improvement. Meanwhile, the storage overhead of our solution ranges from 1.6 KB to 4.1 KB, which is slightly lower than that of existing schemes (2.7-4.0 KB), and the on-chain cost consistently remains a fixed 64 bytes. These findings demonstrate that our approach provides significant practical advantages in low-dimensional, high-frequency medical query scenarios.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"97 ","pages":"Article 104359"},"PeriodicalIF":3.7,"publicationDate":"2026-01-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145926104","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

FedDNA: Behavioural based approach for byzantine defense in federated learning via model fingerprinting and adaptive thresholding 基于模型指纹和自适应阈值的联邦学习拜占庭防御行为方法

IF 3.7 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Journal of Information Security and Applications

Pub Date : 2026-01-02 DOI: 10.1016/j.jisa.2025.104358

Aditya Garg , Naman Bansal , Sumit Yadav , Nisha Kandhoul , Sanjay K. Dhurandher , Isaac Woungang

Federated Learning presents a distributed system approach that is capable of achieving higher pri- vacy and security guarantees by not sharing its local data. However, federated learning is vulnerable to Byzantine faults, where unreliable or malicious agents can disrupt the central aggregation process and degrade performance. Existing Byzantine-resilient algorithms often face challenges of lim- ited effectiveness under non-independent and identically distributed (non-IID) data distribution. This paper presents the FedDNA Algorithm, a novel adaptive aggregation algorithm that enhances robust- ness by focusing on the internal behaviour of client models rather than just their parameters. FedDNA is based on the concept of a model fingerprint, a unique signature of a machine learning model’s inter- but this manipulation will almost always cause a sudden, detectable change in the model’s internal computations, which is captured by the fingerprint. Another distinguishing feature of FedDNA is its adaptive threshold mechanism based on Median Absolute Deviation (MAD), which dynamically adjusts in response to the internal consistency of client updates, thereby enhancing the algorithm’s robustness against Byzantine behaviour. To evaluate the effectiveness of the proposed approach, an extensive feasibility study was conducted comparing it with existing algorithms. Experimental results indicate that FedDNA achieves good accuracy and stability under Byzantine attacks, outperforming state-of-the-art methods by effectively identifying and mitigating the influence of faulty nodes in both independent and identically distributed (IID) and non-independent and identically distributed (non-IID) data distributions.

联邦学习提出了一种分布式系统方法，能够通过不共享其本地数据来实现更高的隐私性和安全性保证。然而，联邦学习容易受到拜占庭错误的影响，其中不可靠或恶意的代理可能会破坏中心聚合过程并降低性能。现有的拜占庭弹性算法在非独立和同分布（non-IID）数据分布下常常面临有效性有限的挑战。本文提出了一种新的自适应聚合算法FedDNA算法，该算法通过关注客户端模型的内部行为而不仅仅是它们的参数来增强鲁棒性。FedDNA基于模型指纹的概念，这是机器学习模型内部的独特特征，但这种操作几乎总是会导致模型内部计算发生突然的、可检测的变化，这些变化会被指纹捕获。FedDNA的另一个显著特征是其基于中值绝对偏差（MAD）的自适应阈值机制，该机制根据客户端更新的内部一致性动态调整，从而增强了算法对拜占庭行为的鲁棒性。为了评估所提出方法的有效性，将其与现有算法进行了广泛的可行性研究。实验结果表明，FedDNA在拜占庭攻击下具有良好的准确性和稳定性，能够有效识别和减轻独立与同分布（IID）和非独立与同分布（non-IID）数据分布中故障节点的影响，优于现有方法。

{"title":"FedDNA: Behavioural based approach for byzantine defense in federated learning via model fingerprinting and adaptive thresholding","authors":"Aditya Garg , Naman Bansal , Sumit Yadav , Nisha Kandhoul , Sanjay K. Dhurandher , Isaac Woungang","doi":"10.1016/j.jisa.2025.104358","DOIUrl":"10.1016/j.jisa.2025.104358","url":null,"abstract":"<div><div>Federated Learning presents a distributed system approach that is capable of achieving higher pri- vacy and security guarantees by not sharing its local data. However, federated learning is vulnerable to Byzantine faults, where unreliable or malicious agents can disrupt the central aggregation process and degrade performance. Existing Byzantine-resilient algorithms often face challenges of lim- ited effectiveness under non-independent and identically distributed (non-IID) data distribution. This paper presents the FedDNA Algorithm, a novel adaptive aggregation algorithm that enhances robust- ness by focusing on the internal behaviour of client models rather than just their parameters. FedDNA is based on the concept of a model fingerprint, a unique signature of a machine learning model’s inter- but this manipulation will almost always cause a sudden, detectable change in the model’s internal computations, which is captured by the fingerprint. Another distinguishing feature of FedDNA is its adaptive threshold mechanism based on Median Absolute Deviation (MAD), which dynamically adjusts in response to the internal consistency of client updates, thereby enhancing the algorithm’s robustness against Byzantine behaviour. To evaluate the effectiveness of the proposed approach, an extensive feasibility study was conducted comparing it with existing algorithms. Experimental results indicate that FedDNA achieves good accuracy and stability under Byzantine attacks, outperforming state-of-the-art methods by effectively identifying and mitigating the influence of faulty nodes in both independent and identically distributed (IID) and non-independent and identically distributed (non-IID) data distributions.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"97 ","pages":"Article 104358"},"PeriodicalIF":3.7,"publicationDate":"2026-01-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145884190","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Seeing the invisible: Detection of stealth DoS attacks using variational U-Net-like models 看到不可见的：使用变分u - net样模型检测隐形DoS攻击

IF 3.7 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Journal of Information Security and Applications

Pub Date : 2025-12-31 DOI: 10.1016/j.jisa.2025.104356

Enrico Cambiaso , Francesco Folino , Massimo Guarascio , Angelica Liguori , Antonino Rullo

The increasing sophistication of cyberattacks targeting companies and organizations continues to challenge the effectiveness of modern defense systems. Among these threats, slow Denial-of-Service (slow DoS) attacks are particularly difficult to detect, as they rely on evasion strategies that add significant complexity to cybersecurity efforts. Modern intrusion detection systems, especially those based on deep learning, have become essential tools in combating such attacks. However, their performance is often hindered by challenges such as limited data availability, noisy inputs, and the presence of out-of-distribution samples. Furthermore, their dependence on large labeled datasets makes detecting subtle or rare attack patterns particularly challenging. To overcome these limitations, this work proposes a novel unsupervised deep learning framework for detecting slow DoS attacks. The proposed approach incorporates a customized preprocessing pipeline to improve input data quality and leverages a sparse variational U-Net-like architecture for robust anomaly identification. Extensive experiments conducted on three real-world datasets demonstrate the ability of the framework to accurately and efficiently detect slow DoS attacks, highlighting its robustness, generalizability, and practical suitability for deployment in operational environments.

针对公司和组织的网络攻击越来越复杂，继续挑战现代防御系统的有效性。在这些威胁中，慢速拒绝服务（slow DoS）攻击尤其难以检测，因为它们依赖于规避策略，这大大增加了网络安全工作的复杂性。现代入侵检测系统，特别是基于深度学习的入侵检测系统，已经成为打击此类攻击的重要工具。然而，它们的性能经常受到诸如有限的数据可用性、噪声输入和分布外样本的存在等挑战的阻碍。此外，它们对大型标记数据集的依赖使得检测微妙或罕见的攻击模式特别具有挑战性。为了克服这些限制，本工作提出了一种新的无监督深度学习框架，用于检测慢速DoS攻击。该方法采用自定义预处理管道来提高输入数据质量，并利用稀疏变分u - net类架构进行鲁棒异常识别。在三个真实数据集上进行的大量实验证明了该框架能够准确有效地检测慢速DoS攻击，突出了其鲁棒性、通用性和在操作环境中部署的实际适用性。

{"title":"Seeing the invisible: Detection of stealth DoS attacks using variational U-Net-like models","authors":"Enrico Cambiaso , Francesco Folino , Massimo Guarascio , Angelica Liguori , Antonino Rullo","doi":"10.1016/j.jisa.2025.104356","DOIUrl":"10.1016/j.jisa.2025.104356","url":null,"abstract":"<div><div>The increasing sophistication of cyberattacks targeting companies and organizations continues to challenge the effectiveness of modern defense systems. Among these threats, slow Denial-of-Service (slow DoS) attacks are particularly difficult to detect, as they rely on evasion strategies that add significant complexity to cybersecurity efforts. Modern intrusion detection systems, especially those based on deep learning, have become essential tools in combating such attacks. However, their performance is often hindered by challenges such as limited data availability, noisy inputs, and the presence of out-of-distribution samples. Furthermore, their dependence on large labeled datasets makes detecting subtle or rare attack patterns particularly challenging. To overcome these limitations, this work proposes a novel unsupervised deep learning framework for detecting slow DoS attacks. The proposed approach incorporates a customized preprocessing pipeline to improve input data quality and leverages a sparse variational <em>U-Net-like</em> architecture for robust anomaly identification. Extensive experiments conducted on three real-world datasets demonstrate the ability of the framework to accurately and efficiently detect slow DoS attacks, highlighting its robustness, generalizability, and practical suitability for deployment in operational environments.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"97 ","pages":"Article 104356"},"PeriodicalIF":3.7,"publicationDate":"2025-12-31","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145884191","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

RL-IDS: A robust and lightweight intrusion detection system for in-vehicle network RL-IDS：一种鲁棒且轻量级的车载网络入侵检测系统

IF 3.7 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Journal of Information Security and Applications

Pub Date : 2025-12-30 DOI: 10.1016/j.jisa.2025.104361

Jianjun Yuan, Hong Sun, Rong Cao, Guojun Huang

As a standard protocol for in-vehicle networks, the Controller Area Network (CAN) effectively facilitates communication among electronic control units. However, due to the lack of necessary security mechanisms in CAN, hackers can exploit the CAN bus to launch various attacks on vehicles. To enhance vehicle security, an intrusion detection system (IDS) can be deployed to detect attacks in the CAN bus. This paper proposes a robust and lightweight intrusion detection system (RL-IDS) for detecting attacks in CAN traffic. RL-IDS is built upon an unsupervised learning model to address the limitation of supervised methods, which cannot detect previously unknown attacks. Furthermore, to address the issue that unsupervised models are difficult to use in-vehicle networks due to their high complexity, we utilize the teacher-student network architecture to perform lightweight optimization of RL-IDS. Experimental results on real in-vehicle network intrusion detection datasets (car hacking dataset and survival analysis dataset) demonstrate that compared with state-of-the-art methods, RL-IDS achieves competitive attack detection performance while ensuring a higher degree of lightweight.

控制器局域网（CAN）作为车载网络的标准协议，有效地促进了电子控制单元之间的通信。然而，由于CAN缺乏必要的安全机制，黑客可以利用CAN总线对车辆发动各种攻击。为了提高车辆的安全性，可以部署入侵检测系统（IDS）来检测can总线上的攻击。本文提出了一种鲁棒、轻量级的入侵检测系统（RL-IDS），用于检测CAN通信中的攻击。RL-IDS建立在无监督学习模型之上，以解决监督方法的局限性，即无法检测到先前未知的攻击。此外，为了解决无监督模型由于其高复杂性而难以使用车载网络的问题，我们利用师生网络架构对RL-IDS进行轻量级优化。在真实车载网络入侵检测数据集（汽车黑客数据集和生存分析数据集）上的实验结果表明，与最先进的方法相比，RL-IDS在确保更高轻量化程度的同时，实现了具有竞争力的攻击检测性能。

{"title":"RL-IDS: A robust and lightweight intrusion detection system for in-vehicle network","authors":"Jianjun Yuan, Hong Sun, Rong Cao, Guojun Huang","doi":"10.1016/j.jisa.2025.104361","DOIUrl":"10.1016/j.jisa.2025.104361","url":null,"abstract":"<div><div>As a standard protocol for in-vehicle networks, the Controller Area Network (CAN) effectively facilitates communication among electronic control units. However, due to the lack of necessary security mechanisms in CAN, hackers can exploit the CAN bus to launch various attacks on vehicles. To enhance vehicle security, an intrusion detection system (IDS) can be deployed to detect attacks in the CAN bus. This paper proposes a robust and lightweight intrusion detection system (RL-IDS) for detecting attacks in CAN traffic. RL-IDS is built upon an unsupervised learning model to address the limitation of supervised methods, which cannot detect previously unknown attacks. Furthermore, to address the issue that unsupervised models are difficult to use in-vehicle networks due to their high complexity, we utilize the teacher-student network architecture to perform lightweight optimization of RL-IDS. Experimental results on real in-vehicle network intrusion detection datasets (car hacking dataset and survival analysis dataset) demonstrate that compared with state-of-the-art methods, RL-IDS achieves competitive attack detection performance while ensuring a higher degree of lightweight.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"97 ","pages":"Article 104361"},"PeriodicalIF":3.7,"publicationDate":"2025-12-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145884192","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

FRIDA: Free-rider detection using privacy attacks FRIDA：使用隐私攻击的搭便车检测

IF 3.7 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Journal of Information Security and Applications

Pub Date : 2025-12-30 DOI: 10.1016/j.jisa.2025.104357

Pol G. Recasens , Ádám Horváth , Alberto Gutierrez-Torre , Jordi Torres , Josep Ll Berral , Balázs Pejó

Federated learning is increasingly popular as it enables multiple parties with limited datasets and resources to train a machine learning model collaboratively. However, similar to other collaborative systems, federated learning is vulnerable to free-riders — participants who benefit from the global model without contributing. Free-riders compromise the integrity of the learning process and slow down the convergence of the global model, resulting in increased costs for honest participants. To address this challenge, we propose FRIDA: free-rider detection using privacy attacks. Instead of focusing on implicit effects of free-riding, FRIDA utilizes membership and property inference attacks to directly infer evidence of genuine client training. Our extensive evaluation demonstrates that FRIDA is effective across a wide range of scenarios.

联邦学习越来越受欢迎，因为它使具有有限数据集和资源的多方能够协作训练机器学习模型。然而，与其他协作系统类似，联邦学习很容易受到搭便车者的影响——参与者从全球模式中受益，却没有做出贡献。搭便车者损害了学习过程的完整性，减缓了全球模式的趋同，导致诚实参与者的成本增加。为了应对这一挑战，我们提出了FRIDA：使用隐私攻击的搭便车检测。FRIDA没有关注搭便车的隐性影响，而是利用成员资格和财产推理攻击来直接推断真实客户培训的证据。我们的广泛评估表明，FRIDA在各种情况下都是有效的。

引用次数: 0

A high efficiency AVX2-optimized engineering of the post-quantum digital signature CROSS 后量子数字签名CROSS的高效avx2优化工程

IF 3.7 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Journal of Information Security and Applications

Pub Date : 2025-12-29 DOI: 10.1016/j.jisa.2025.104331

Alessandro Barenghi, Marco Gianvecchio, Gerardo Pelosi

Post-quantum cryptosystems are currently attracting a significant amount of research efforts due to the continuous improvements in quantum computing technologies, and the inherent high inertia characterizing the replacement of cryptographic standards. This situation has pushed large standardization bodies, such as the USA National Institute of Standards and Technology (NIST), to open standardization competitions to foster proposals and public scrutiny of new quantum-resistant cryptosystems and digital signatures. Whilst NIST has chosen, after four selection rounds (November 2017 - June 2023), three digital signature algorithms, in July 2023 it started a new selection process as the chosen candidates either rely exclusively on lattice-based computationally hard problems, or have unsatisfactory performance figures. In this work, we tackle the performance engineering of the Codes and Restricted Objects Signature Scheme (CROSS), which has been admitted to the second round of selection by NIST in October 2024. We propose a set of techniques to optimize software realizations of CROSS, targeting the AVX2 ISA extension by Intel, as requested by NIST; exploiting fully our choices on the signature scheme parameters, as part of the design team. We note that these techniques are general enough to be ported to other vector ISA extensions (e.g., ARM Neon). We provide a complete performance validation of our realization both with dedicated microbenchmarks as well as full end-to-end TLS benchmarks with realistic network delays. Our results show that CROSS is competitive with each of the already standardized post-quantum signature schemes as well as with the other schemes still under evaluation in the second selection round.

由于量子计算技术的不断改进，以及加密标准替换所固有的高惯性，后量子密码系统目前吸引了大量的研究工作。这种情况促使大型标准化机构，如美国国家标准与技术研究所（NIST），开放标准化竞赛，以促进新的抗量子密码系统和数字签名的提案和公众监督。经过四轮（2017年11月至2023年6月）的选拔，NIST选择了三种数字签名算法，但在2023年7月，它开始了一个新的选择过程，因为被选中的候选算法要么完全依赖于基于格子的计算难题，要么性能不理想。在这项工作中，我们解决了代码和受限对象签名方案（CROSS）的性能工程，该方案已于2024年10月被NIST录取进入第二轮选择。根据NIST的要求，我们提出了一套技术来优化CROSS的软件实现，针对英特尔的AVX2 ISA扩展；作为设计团队的一部分，充分利用我们对签名方案参数的选择。我们注意到，这些技术足够通用，可以移植到其他矢量ISA扩展（例如，ARM Neon）。我们通过专用的微基准测试和具有实际网络延迟的完整端到端TLS基准测试对我们的实现进行了完整的性能验证。我们的研究结果表明，CROSS与每个已经标准化的后量子签名方案以及仍在第二轮评选中评估的其他方案具有竞争力。

{"title":"A high efficiency AVX2-optimized engineering of the post-quantum digital signature CROSS","authors":"Alessandro Barenghi, Marco Gianvecchio, Gerardo Pelosi","doi":"10.1016/j.jisa.2025.104331","DOIUrl":"10.1016/j.jisa.2025.104331","url":null,"abstract":"<div><div>Post-quantum cryptosystems are currently attracting a significant amount of research efforts due to the continuous improvements in quantum computing technologies, and the inherent high inertia characterizing the replacement of cryptographic standards. This situation has pushed large standardization bodies, such as the USA National Institute of Standards and Technology (NIST), to open standardization competitions to foster proposals and public scrutiny of new quantum-resistant cryptosystems and digital signatures. Whilst NIST has chosen, after four selection rounds (November 2017 - June 2023), three digital signature algorithms, in July 2023 it started a new selection process as the chosen candidates either rely exclusively on lattice-based computationally hard problems, or have unsatisfactory performance figures. In this work, we tackle the performance engineering of the Codes and Restricted Objects Signature Scheme (CROSS), which has been admitted to the second round of selection by NIST in October 2024. We propose a set of techniques to optimize software realizations of CROSS, targeting the AVX2 ISA extension by Intel, as requested by NIST; exploiting fully our choices on the signature scheme parameters, as part of the design team. We note that these techniques are general enough to be ported to other vector ISA extensions (e.g., ARM Neon). We provide a complete performance validation of our realization both with dedicated microbenchmarks as well as full end-to-end TLS benchmarks with realistic network delays. Our results show that CROSS is competitive with each of the already standardized post-quantum signature schemes as well as with the other schemes still under evaluation in the second selection round.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"97 ","pages":"Article 104331"},"PeriodicalIF":3.7,"publicationDate":"2025-12-29","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145884189","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0