Cybersecurity最新文献

{"title":"IReCAPTCHA: a robust image-reasoning CAPTCHA system.","authors":"Bidyut Das, Dilip K Prasad, Arif Ahmed Sekh","doi":"10.1186/s42400-025-00484-0","DOIUrl":"10.1186/s42400-025-00484-0","url":null,"abstract":"<p><p>CAPTCHAs are widely used as authentication methods in mobile applications and web-based services to prevent AI bots from gaining unauthorized access. Early CAPTCHAs relied on image-based techniques, distorting text within images to make it difficult for bots to decipher. However, modern AI-powered optical character recognition (OCR) systems can now easily bypass these measures. To address this limitation, image-reasoning CAPTCHAs were introduced. Basic versions of these rely solely on object detection, rendering them vulnerable to advanced AI attacks. In response, we propose a novel image-reasoning CAPTCHA, called IReCAPTCHA, which integrates image understanding, noise mitigation, and mathematical reasoning. Unlike traditional object detection-based CAPTCHAs, our approach challenges users with tasks that require the comprehension of multiple objects, counting, and color recognition. Additionally, we apply noise mitigation techniques to obscure visual information, thereby enhancing resistance to AI-based deciphering. To evaluate the effectiveness of our CAPTCHA, we developed a comprehensive dataset specifically designed to test its robustness against AI attacks. The results are highly promising, demonstrating significantly greater resistance compared to existing image-reasoning CAPTCHAs. These findings suggest that our approach has strong potential to enhance online security by effectively deterring automated access attempts by malicious bots.</p>","PeriodicalId":36402,"journal":{"name":"Cybersecurity","volume":"9 1","pages":"54"},"PeriodicalIF":4.1,"publicationDate":"2026-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://www.ncbi.nlm.nih.gov/pmc/articles/PMC13070986/pdf/","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147692470","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"A socio-technical framework for cyber-resilience in hybrid oil-renewable energy grids.","authors":"Bryan Anderson, Gahangir Hossain","doi":"10.1186/s42400-026-00619-x","DOIUrl":"10.1186/s42400-026-00619-x","url":null,"abstract":"<p><p>Combining traditional oil infrastructure with distributed renewable energy resources (DERs), including critical grid-edge assets like electric vehicle (EV) charging infrastructure that link transportation and power systems, has created hybrid energy systems that are more connected and digitally complex. These systems integrate legacy operational technologies (OT), such as SCADA, with decentralized, IoT-enabled assets that often rely on cloud-based analytics and remote connectivity. This conjunction introduces cybersecurity risks by linking historically isolated OT environments to modern, internet-exposed components, creating more entry points, inconsistent security baselines, and new attack surfaces. The resulting vulnerabilities extend beyond traditional IT-centric threat models. Conventional cybersecurity strategies, which prioritize technical controls in isolation, often fail to address systemic risks stemming from institutional fragmentation, regulatory gaps, and third-party dependencies. This study introduces a Socio-Technical Resilience Framework grounded in the Systems-Theoretic Accident Model and Processes (STAMP) and Socio-Technical Systems (STS) theory to access and mitigate cyber risks in hybrid grids. Through comparative case studies of the Colonial Pipeline ransomware event and cyber disruptions in European DER infrastructure, the paper finds that fragmented coordination, isolated threat intelligence, and weak human-system integration significantly amplify cyber impacts that undermine static, perimeter-based defense models. The study contributes a layered framework for cyber resilience that operates across three domains: (1) technical (via zero-trust architecture and distributed anomaly detection), (2) organizational (through shared situational awareness and cognitive decision-support tools), and (3) governance (by leveraging federated threat intelligence and regulatory harmonization). This multi-domain approach enhances both operational flexibility and long-term sustainability. Ultimately, the paper demonstrates that enduring cyber resilience in hybrid energy systems requires more than patching vulnerabilities. It demands a systemic rethinking of control, coordination, and design. The framework and findings offer a forward-looking roadmap for securing the energy sector against evolving threats in an era of distributed complexity.</p>","PeriodicalId":36402,"journal":{"name":"Cybersecurity","volume":"9 1","pages":"185"},"PeriodicalIF":4.1,"publicationDate":"2026-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://www.ncbi.nlm.nih.gov/pmc/articles/PMC13323197/pdf/","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148377047","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Smartphone barometer can hear, and sense finger taps.","authors":"Alireza Hafez, Dorsa Nahid, Majid Khabbazian","doi":"10.1186/s42400-025-00401-5","DOIUrl":"10.1186/s42400-025-00401-5","url":null,"abstract":"<p><p>Nearly all modern smartphones are now equipped with a barometer to sample air pressure. Accessing these samples is deemed harmless, hence does not require permission. In this work, we demonstrate that barometer samples can reveal sensitive information, particularly in smartphones with ingress protection. Using a support-vector machine (SVM) classifier, we demonstrate for the first time that barometer readings, even at a low sampling rate (25 Hz), can reveal smartphone speaker activity. In particular, our classifier achieves <math><mrow><mo>≥</mo> <mn>95</mn> <mo>%</mo></mrow> </math> accuracy in detecting whether the speaker is silent or playing a ringtone. In addition, we show that low-rate barometer samples can be used to 1) detect touchscreen finger taps with nearly <math><mrow><mn>100</mn> <mo>%</mo></mrow> </math> accuracy, and 2) gain information about the approximate position of finger taps. Our findings underscore that the barometer sensor, often considered harmless, should be recognized as sensitive with regard to user privacy, and access to this sensor should be carefully managed.</p>","PeriodicalId":36402,"journal":{"name":"Cybersecurity","volume":"9 1","pages":"15"},"PeriodicalIF":3.7,"publicationDate":"2026-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://www.ncbi.nlm.nih.gov/pmc/articles/PMC12819426/pdf/","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"146030842","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Cloud EMRs auditing with decentralized (t, n)-threshold ownership transfer","authors":"Yamei Wang, Weijing You, Yuexin Zhang, Ayong Ye, Li Xu","doi":"10.1186/s42400-024-00246-4","DOIUrl":"https://doi.org/10.1186/s42400-024-00246-4","url":null,"abstract":"<p>In certain cloud Electronic Medical Records (EMRs) applications, the data ownership may need to be transferred. In practice, not only the data but also the auditing ability should be transferred securely and efficiently. However, we investigate and find that most of the existing data ownership transfer protocols only work well between two individuals, and they become inefficient when dealing between two communities. The proposals for transferring tags between communities are problematic as well since, they require all members get involved or a fully trusted aggregator facilitates ownership transfer, which are unrealistic in certain scenarios. To alleviate these problems, in this paper we develop a secure auditing protocol with decentralized (<i>t</i>, <i>n</i>)-threshold ownership transfer for cloud EMRs. This protocol is designed to operate efficiently without requiring the mandatory participation of every user or the involvement of any trusted third-party. It is achieved by employing the threshold signature. Rigorous security analyses and comprehensive performance evaluations illustrate the security and practicality of our protocol. Specifically, according to the evaluations and comparisons, the communication and computational consumption is independent of the file size, i.e., it is constant in our protocol for both communities.</p>","PeriodicalId":36402,"journal":{"name":"Cybersecurity","volume":"23 1","pages":""},"PeriodicalIF":3.1,"publicationDate":"2024-09-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142249405","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"SIFT: Sifting file types—application of explainable artificial intelligence in cyber forensics","authors":"Shahid Alam, Alper Kamil Demir","doi":"10.1186/s42400-024-00241-9","DOIUrl":"https://doi.org/10.1186/s42400-024-00241-9","url":null,"abstract":"<p>Artificial Intelligence (AI) is being applied to improve the efficiency of software systems used in various domains, especially in the health and forensic sciences. Explainable AI (XAI) is one of the fields of AI that interprets and explains the methods used in AI. One of the techniques used in XAI to provide such interpretations is by computing the relevance of the input features to the output of an AI model. File fragment classification is one of the vital issues of file carving in Cyber Forensics (CF) and becomes challenging when the filesystem <i>metadata is missing</i>. Other major challenges it faces are: <i>proliferation of file formats</i>, <i>file embeddings</i>, <i>automation</i>, We leverage and utilize interpretations provided by XAI to optimize the classification of file fragments and propose a novel sifting approach, named SIFT (Sifting File Types). SIFT employs TF-IDF to assign weight to a byte (feature), which is used to select features from a file fragment. Threshold-based LIME and SHAP (the two XAI techniques) feature relevance values are computed for the selected features to optimize file fragment classification. To improve multinomial classification, a Multilayer Perceptron model is developed and optimized with five hidden layers, each layer with <span>(i times n)</span> neurons, where <i>i</i> = the layer number and <i>n</i> = the total number of classes in the dataset. When tested with 47,482 samples of 20 file types (classes), SIFT achieves a detection rate of 82.1% and outperforms the other state-of-the-art techniques by at least 10%. To the best of our knowledge, this is the first effort of applying XAI in CF for optimizing file fragment classification.</p>","PeriodicalId":36402,"journal":{"name":"Cybersecurity","volume":"17 1","pages":""},"PeriodicalIF":3.1,"publicationDate":"2024-09-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142181192","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Modelling user notification scenarios in privacy policies","authors":"Mikhail Kuznetsov, Evgenia Novikova, Igor Kotenko","doi":"10.1186/s42400-024-00234-8","DOIUrl":"https://doi.org/10.1186/s42400-024-00234-8","url":null,"abstract":"<p>The processing of personal data gives a rise to many privacy concerns, and one of them is to ensure the transparency of data processing to end users. Usually this information is communicated to them using privacy policies. In this paper, the problem of user notification in case of data breaches and policy changes is addressed, besides an ontology-based approach to model them is proposed. To specify the ontology concepts and properties, the requirements and recommendations for the legislative regulations as well as existing privacy policies are evaluated. A set of SPARQL queries to validate the correctness and completeness of the proposed ontology are developed. The proposed approach is applied to evaluate the privacy policies designed by cloud computing providers and IoT device manufacturers. The results of the analysis show that the transparency of user notification scenarios presented in the privacy policies is still very low, and the companies should reconsider the notification mechanisms and provide more detailed information in privacy policies.</p>","PeriodicalId":36402,"journal":{"name":"Cybersecurity","volume":"115 1","pages":""},"PeriodicalIF":3.1,"publicationDate":"2024-09-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142181193","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"FLSec-RPL: a fuzzy logic-based intrusion detection scheme for securing RPL-based IoT networks against DIO neighbor suppression attacks","authors":"Chenset Kim, Chakchai So-In, Yanika Kongsorot, Phet Aimtongkham","doi":"10.1186/s42400-024-00223-x","DOIUrl":"https://doi.org/10.1186/s42400-024-00223-x","url":null,"abstract":"<p>The Internet of Things (IoT) has gained popularity and is widely used in modern society. The growth in the sizes of IoT networks with more internet-connected devices has led to concerns regarding privacy and security. In particular, related to the routing protocol for low-power and lossy networks (RPL), which lacks robust security functions, many IoT devices in RPL networks are resource-constrained, with limited computing power, bandwidth, memory, and battery life. This causes them to face various vulnerabilities and potential attacks, such as DIO neighbor suppression attacks. This type of attack specifically targets neighboring nodes through DIO messages and poses a significant security threat to RPL-based IoT networks. Recent studies have proposed methods for detecting and mitigating this attack; however, they produce high false-positive and false-negative rates in detection tasks and cannot fully protect RPL networks against this attack type. In this paper, we propose a novel fuzzy logic-based intrusion detection scheme to secure the RPL protocol (FLSec-RPL) to protect against this attack. Our method is built of three key phases consecutively: (1) it tracks attack activity variables to determine potential malicious behaviors; (2) it performs fuzzy logic-based intrusion detection to identify malicious neighbor nodes; and (3) it provides a detection validation and blocking mechanism to ensure that both malicious and suspected malicious nodes are accurately detected and blocked. To evaluate the effectiveness of our method, we conduct comprehensive experiments across diverse scenarios, including Static-RPL and Mobile-RPL networks. We compare the performance of our proposed method with that of the state-of-the-art methods. The results demonstrate that our method outperforms existing methods in terms of the detection accuracy, F1 score, power consumption, end-to-end delay, and packet delivery ratio metrics.</p>","PeriodicalId":36402,"journal":{"name":"Cybersecurity","volume":"48 1","pages":""},"PeriodicalIF":3.1,"publicationDate":"2024-09-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142181195","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"New partial key exposure attacks on RSA with additive exponent blinding","authors":"Ziming Jiang, Yongbin Zhou, Yuejun Liu","doi":"10.1186/s42400-024-00214-y","DOIUrl":"https://doi.org/10.1186/s42400-024-00214-y","url":null,"abstract":"<p>Partial key exposure attacks present a significant threat to RSA-type cryptosystems. These attacks factorize the RSA modulus by utilizing partial knowledge of the decryption exponent, which is typically revealed by side-channel attacks, cold boot attacks, etc. In practice, the RSA implementations typically employ countermeasures to resist physical attacks, such as additive exponent blinding <span>(d' = d + r varphi (N))</span> with unknown random blinding factor <i>r</i>. Although there are a couple of partial key exposure attacks on blinding RSA, these attacks require a considerable amount of leakage and fail to work when <i>e</i> is up to full size. In this paper, we propose new partial key exposure attacks on RSA with additive exponent blinding, focusing on leakage scenarios where the Most Significant Bits (MSBs) or Least Significant Bits (LSBs) of <span>(d')</span> are revealed. For the case where <i>e</i> is small, we first recover partial information of <i>p</i> by solving the quadratic congruence equation, and then find the small roots of the integer equation to recover entire private key. Our method relaxes the attack requirements, for instance, we reduce the amount of MSBs for a successful attack from 75 to 25% when <span>(e approx N^{0.25})</span> and <span>(rapprox N^{0})</span>. Furthermore, we propose new attacks using the unique algebraic relationship in blinding RSA, which extend the attack to the case where <i>e</i> is of full size.</p>","PeriodicalId":36402,"journal":{"name":"Cybersecurity","volume":"9 1","pages":""},"PeriodicalIF":3.1,"publicationDate":"2024-09-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142181194","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Dynamic group fuzzy extractor","authors":"Kaini Chen, Peisong Shen, Kewei Lv, Xue Tian, Chi Chen","doi":"10.1186/s42400-024-00210-2","DOIUrl":"https://doi.org/10.1186/s42400-024-00210-2","url":null,"abstract":"<p>The group fuzzy extractor allows group users to extract and reproduce group cryptographic keys from their individual non-uniform random sources. It can be easily used in group-oriented cryptographic applications. However, current group fuzzy extractors are not dynamic, i.e. they spend a large cost when dealing with user revocation. In this work, we propose the formal definition and construction of dynamic group fuzzy extractor (DGFE) to address this issue. For the revocation, DGFE allows unrevoked group users to reproduce updated group keys from the existing group help data. Meanwhile, it prevents any revoked group user from generating new group keys using the previously authorized individual help data. We propose a DGFE construction based on the revocable group signature. Furthermore, we give formal proofs of reusability, anonymity and traceability of our construction.</p>","PeriodicalId":36402,"journal":{"name":"Cybersecurity","volume":"386 1","pages":""},"PeriodicalIF":3.1,"publicationDate":"2024-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142181196","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"EvilPromptFuzzer: generating inappropriate content based on text-to-image models","authors":"Juntao He, Haoran Dai, Runqi Sui, Xuejing Yuan, Dun Liu, Hao Feng, Xinyue Liu, Wenchuan Yang, Baojiang Cui, Kedan Li","doi":"10.1186/s42400-024-00279-9","DOIUrl":"https://doi.org/10.1186/s42400-024-00279-9","url":null,"abstract":"<p>Text-to-image (TTI) models provide huge innovation ability for many industries, while the content security triggered by them has also attracted wide attention. Considerable research has focused on content security threats of large language models (LLMs), yet comprehensive studies on the content security of TTI models are notably scarce. This paper introduces a systematic tool, named EvilPromptFuzzer, designed to fuzz evil prompts in TTI models. For 15 kinds of fine-grained risks, EvilPromptFuzzer employs the strong knowledge-mining ability of LLMs to construct seed banks, in which the seeds cover various types of characters, interrelations, actions, objects, expressions, body parts, locations, surroundings, etc. Subsequently, these seeds are fed into the LLMs to build scene-diverse prompts, which can weaken the semantic sensitivity related to the fine-grained risks. Hence, the prompts can bypass the content audit mechanism of the TTI model, and ultimately help to generate images with inappropriate content. For the risks of violence, horrible, disgusting, animal cruelty, religious bias, political symbol, and extremism, the efficiency of EvilPromptFuzzer for generating inappropriate images based on DALL.E 3 are greater than 30%, namely, more than 30 generated images are malicious among 100 prompts. Specifically, the efficiency of horrible, disgusting, political symbols, and extremism up to 58%, 64%, 71%, and 50%, respectively. Additionally, we analyzed the vulnerability of existing popular content audit platforms, including Amazon, Google, Azure, and Baidu. Even the most effective Google SafeSearch cloud platform identifies only 33.85% of malicious images across three distinct categories.</p>","PeriodicalId":36402,"journal":{"name":"Cybersecurity","volume":"11 1","pages":""},"PeriodicalIF":3.1,"publicationDate":"2024-08-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142181197","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}