Journal of Information Security and Applications最新文献

{"title":"Quantum-safe and provable secure vehicle to infrastructure authenticated key-agreement for VANETs","authors":"Nahida Majeed Wani ,&nbsp;Girraj Kumar Verma ,&nbsp;Neeraj Kumar","doi":"10.1016/j.jisa.2025.104274","DOIUrl":"10.1016/j.jisa.2025.104274","url":null,"abstract":"<div><div>The rapid progression of Vehicular Ad-Hoc Networks (VANETs) has greatly eased the dissemination of safety-critical data among vehicles. However, the susceptibility of wireless links in VANETs to malicious attacks presents a significant obstacle. To mitigate the obstacle, various authenticated key agreement (AKA) schemes have been devised to establish secure communication between vehicles and infrastructure. However, the advent of quantum computing threatens the security of traditional number theory-based AKA schemes. As a countermeasure, lattice-based schemes have emerged, offering quantum resistance. However, many such lattice-based schemes incur high computational and communication overhead. To overcome these limitations, this paper proposes an efficient and provably secure lattice-based AKA scheme for VANETs. Devised AKA protocol leverages quantum-safe lattice-based cryptography to ensure communication security between vehicles and infrastructure. A comprehensive security analysis within the Real-or-Random model framework validates the proposed scheme’s robustness. Furthermore, performance analysis shows that the proposed scheme reduces computational cost by approximately 92% and communication cost by 29% compared to the existing recent approach, making it well-suited for VANET deployment.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"95 ","pages":"Article 104274"},"PeriodicalIF":3.7,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145424925","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Blockchain-based secure and fair data trading mechanism for healthcare","authors":"Kuan Fan ,&nbsp;Jie Bai ,&nbsp;Shiyue Zhou ,&nbsp;Wenbo Shi ,&nbsp;Ning Lu","doi":"10.1016/j.jisa.2025.104252","DOIUrl":"10.1016/j.jisa.2025.104252","url":null,"abstract":"<div><div>The trading of data from multi-source has been demonstrated to significantly enhance the capability of knowledge discovery in the field of healthcare research. However, such trading faces challenges including inefficient data authenticity verification, limited data usability, and unfair reward distribution. To address these issues, we propose a blockchain-based secure and fair data trading mechanism for healthcare. By integrating RSA accumulators and digital signatures, we efficiently verify data authenticity. Additionally, we employ zero-knowledge proofs, which enable verifiable confirmation of whether the acquired data meets the buyer’s requirements for categories and value ranges. This enhances usability while preserving privacy.To achieve fair reward allocation, a contribution assessment model is designed, which comprehensively considers both the quantity and value of data contributed by providers. Rewards are then distributed proportionally based on each provider’s assessed contribution. Security analysis demonstrates that the mechanism can effectively resist various potential security threats. Theoretical analysis and simulation evaluation validate the practicality and fairness of the proposed scheme.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"95 ","pages":"Article 104252"},"PeriodicalIF":3.7,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145365867","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Defeating evasive malware with Peekaboo: Extracting authentic malware behavior with dynamic binary instrumentation","authors":"Matthew Gaber,&nbsp;Mohiuddin Ahmed,&nbsp;Helge Janicke","doi":"10.1016/j.jisa.2025.104290","DOIUrl":"10.1016/j.jisa.2025.104290","url":null,"abstract":"<div><div>The accuracy of Artificial Intelligence (AI) in malware detection is dependent on the features it is trained with, where the quality and authenticity of these features is dependent on the dataset and the analysis tool. Evasive malware, that alters its behavior in analysis environments, is challenging to extract authentic features from where widely used static and dynamic analysis tools have several limitations. However, Dynamic Binary Instrumentation (DBI) allows deep and precise control of the malware sample, thereby facilitating the extraction of authentic behavior from evasive malware. Considering the limitations of malware analysis for use with AI, this research had two primary objectives: investigation of the evasive techniques used by modern malware and the creation of Peekaboo, a DBI tool to extract authentic data from live Windows malware samples. Peekaboo instruments and defeats evasive techniques that target analysis tools and virtual environments. A dataset of 20,500 samples was assembled and each sample was run for up to 15 min to observe not only the anti-analysis techniques used but also its complete behavior. Peekaboo outperforms other tools on several fronts, it is the only tool to measure start and completion rates, capture the executed Assembly (ASM) instructions, record all network traffic and implements the largest coverage against evasive techniques.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"95 ","pages":"Article 104290"},"PeriodicalIF":3.7,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145424931","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"VeriKNN: A verifiable and efficient secure k-NN query scheme via homomorphic encryption in dual-cloud environments","authors":"Wankang Bao,&nbsp;Zhongxiang Zheng","doi":"10.1016/j.jisa.2025.104265","DOIUrl":"10.1016/j.jisa.2025.104265","url":null,"abstract":"<div><div>With the widespread adoption of cloud computing, data privacy protection has become a critical issue, especially for encrypted retrieval tasks in cloud environments. This paper proposes <strong>VeriKNN</strong>, a secure, efficient, and verifiable <span><math><mi>k</mi></math></span>-nearest neighbor (kNN) query scheme based on homomorphic encryption. The scheme introduces a verification mechanism that specifically ensures communication integrity between servers under an honest-but-curious threat model. VeriKNN first constructs a Voronoi diagram and partitions it into encrypted grids for coarse filtering. Then, it builds a multi-layer index of neighboring cells to enable fine-grained search. To address the challenges of computational efficiency and security, we propose a novel set of secure protocols specifically designed for dual-cloud collaboration, significantly improving retrieval performance. Extensive experiments demonstrate that VeriKNN outperforms the state-of-the-art SVK scheme by up to 3000 times in speed across various dataset sizes and <span><math><mi>k</mi></math></span>-values, and is applicable not only to two-dimensional data but also to high-dimensional data. Compared to the HFkNN scheme, VeriKNN achieves a slight reduction in accuracy but offers a 500-fold increase in speed, with the performance gap widening as dataset size increases, highlighting its superior scalability and efficiency.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"95 ","pages":"Article 104265"},"PeriodicalIF":3.7,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145334806","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Entropy collapse in mobile sensors: The hidden risks of sensor-based security","authors":"Carlton Shepherd,&nbsp;Elliot A.J. Hurley","doi":"10.1016/j.jisa.2025.104272","DOIUrl":"10.1016/j.jisa.2025.104272","url":null,"abstract":"<div><div>Mobile sensor data has been proposed for security-critical applications such as device pairing, proximity detection, and continuous authentication. However, the foundational premise that these signals provide sufficient entropy remains under-explored. In this work, we systematically analyse the entropy of mobile sensor data using four datasets from multiple application contexts (UCI-HAR, SHL, Relay, and PerilZIS). Using direct computation and estimation, we report entropy values – max, Shannon, collision, and min-entropy – for an exhaustive range of sensor combinations. We demonstrate that the entropy of mobile sensors remains far below what is considered secure by modern standards for security applications, even when many sensors are combined. In particular, we observe an alarming divergence between average-case Shannon entropy and worst-case min-entropy. Single-sensor min-entropy varies between 3.408–4.483 bits despite Shannon entropy being several multiples higher. We also show that redundancies between sensor modalities contribute to a <span><math><mo>≈</mo></math></span>75% reduction between Shannon and min-entropy. Indeed, min-entropy plateaus between 8.1–23.9 bits when combining up to 22 modalities, while Shannon entropy can exceed 80 bits. Adding sensors typically increases Shannon entropy but moves min-entropy by only <span><math><mo>≈</mo></math></span>1–2 bits per added modality, evidencing entropy collapse under redundancy. Our results reveal that adversaries may feasibly predict sensor signals through an exhaustive exploration of the measurement space. Our work also calls into question the widely held assumption that adding more sensors inherently yields higher security. Ultimately, we strongly urge caution when relying on mobile sensor data for security applications.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"95 ","pages":"Article 104272"},"PeriodicalIF":3.7,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145365341","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Res2Next with attention mechanisms for malware classification based on feature visualization","authors":"Liangwei Yao ,&nbsp;Hongliang Zhu ,&nbsp;Yang Xin","doi":"10.1016/j.jisa.2025.104271","DOIUrl":"10.1016/j.jisa.2025.104271","url":null,"abstract":"<div><div>Malware poses a significant threat to cybersecurity due to its diverse types, complex behaviors, and strong destructiveness. Accurately classifying malware is crucial for taking effective defense measures. However, traditional malware classification methods based on static and dynamic features face challenges such as poor adaptability, manual intervention, and low classification accuracy. Although improvements have been made with visualization-based image classification methods, they remain susceptible to interference information in deep feature extraction. To this end, this paper proposes an innovative malware classification framework that utilizes the feature visualization method to convert malware into RGB images, effectively preserving its rich features and avoiding reverse engineering. Afterward, a lightweight adaptive channel attention (ACA) mechanism is proposed, and ensemble models based on Res2NeXt that integrate various attention mechanisms are designed for deep feature extraction and classification. In addition, through t-SNE visualization, confusion matrix, and Grad-CAM heatmap display, the proposed Res2NeXt with ACA model as a typical example shows superior performance in feature space distribution, classification accuracy, and focusing on crucial features. In summary, a series of experiments conducted on public datasets, MMCC and MaleVis, demonstrate that the attention mechanisms in the ensemble models can effectively guide the model to focus on crucial features, filter out interference information, and enhance classification effectiveness. Specifically, the ACA attention mechanisms significantly improve classification accuracy with minimal impact on the model’s efficiency. The proposed framework achieves classification accuracy of up to 99.26% and 98.04%, respectively, surpassing the current state-of-the-art methods.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"95 ","pages":"Article 104271"},"PeriodicalIF":3.7,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145365862","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"SecTwin: A secure and efficient authentication mechanism for vehicular digital twins","authors":"Muhammad Tanveer ,&nbsp;Kainat Toor ,&nbsp;Abdullah G. Alharbi ,&nbsp;Syed Rizwan Hassan","doi":"10.1016/j.jisa.2025.104292","DOIUrl":"10.1016/j.jisa.2025.104292","url":null,"abstract":"<div><div>As vehicular digital twin (VDT) networks continue to evolve, ensuring secure and efficient communication between physical vehicles and their digital counterparts is crucial. Traditional authentication protocols rely on computationally intensive cryptographic techniques, leading to increased latency and resource consumption in real-time vehicular environments. To address these challenges, this paper proposes SecTwin, a lightweight authentication mechanism designed specifically for VDT networks. SecTwin leverages TinyJAMBU authenticated encryption and hash-based authentication to establish a secure and resource-efficient communication framework between autonomous vehicles and their DTs. By integrating lightweight cryptographic techniques and secure key management, SecTwin enhances the security and efficiency of VDT networks, paving the way for reliable and safe autonomous vehicle communication. The informal demonstrates that SecTwin is resilient against key security threats, including replay attacks, impersonation, and man-in-the-middle attacks. Moreover, formal security analysis using the random oracle model and Scyther shows SecTwin is secure. Additionally, performance evaluations reveal that SecTwin reduces communication cost by 51.22%, to 52.38% and execution time by 63.29% to 82.63%, making it highly suitable for latency-sensitive vehicular applications.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"95 ","pages":"Article 104292"},"PeriodicalIF":3.7,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145474740","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Blockchain-based dynamic MUD profiles for tamper-proof IoT access control","authors":"Chouhan Kumar Rath ,&nbsp;Amit Kr. Mandal ,&nbsp;Anirban Sarkar","doi":"10.1016/j.jisa.2025.104273","DOIUrl":"10.1016/j.jisa.2025.104273","url":null,"abstract":"<div><div>The Internet of Things (IoT) has revolutionized various industries by enabling data exchange between different devices across various domains such as smart cities, healthcare, industrial automation etc. However, managing access control with growing number of IoT devices brings major security challenges. Traditional access control mechanisms such as Role-Based Access Control(RBAC) and Attribute-Based Access Control(ABAC) become very complex and computationally expansive for the large scale iot networks. Besides these, Manufacturer Usage Description (MUD) based mechanism empowers networks to restrict IoT devices to communicate only with authorized endpoints, ensuring that each device sends and receives only the intended traffic while preventing unauthorized access or data transmission. However, the static MUD profiles provided by manufacturers are not adaptable to dynamic IoT environments, where devices frequently join, leave, or change behavior. Additionally, manually creating and updating MUD profiles may not be possible and prone to errors for dynamic and large scale IoT network. To address these limitations, this paper proposes an automated framework for generating and enforcing MUD profiles based on network behavior. The framework leverages the MUD specification by analyzing network traffic and extracting the most relevant features using mutual information (MI) scores. These features, which correlate strongly with device behavior, are then used in association rule mining (ARM) to generate refined access control rules. The rules are verified and integrated into the MUD profiles, ensuring automated policy enforcement. Furthermore, the MUD profiles are stored in a tamper-resistant manner using IPFS (InterPlanetary File System), preventing them from unauthorized modifications. The framework also utilizes smart contracts on a blockchain to verify and enforce security policies. The approach improves security by allowing only intended device interactions while denying abnormal traffic, and enhances performance through efficient rule generation and enforcement. The results demonstrate that the use of ARM with MI scores improves rule quality, reduces complexity, and facilitates faster, more reliable network operations in dynamic IoT environments.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"95 ","pages":"Article 104273"},"PeriodicalIF":3.7,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145365864","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Intrusion detection systems in IoT: A detailed review of threat categories, detection strategies, and future technologies","authors":"Burak Aydin ,&nbsp;Hakan Aydin ,&nbsp;Sedat Gormus","doi":"10.1016/j.jisa.2025.104291","DOIUrl":"10.1016/j.jisa.2025.104291","url":null,"abstract":"<div><div>The rapid growth of the Internet of Things (IoT) has transformed numerous sectors by enabling enhanced connectivity and automation among devices in industrial settings. However, this expansion has brought forward notable security concerns, as Internet enabled and connected devices has become increasingly vulnerable to a variety of cyberattacks. This has elevated the importance of Internet of Things security, necessitating robust defense mechanisms. In this paper, we thoroughly examine Intrusion Detection Systems (IDS) within the context of IoT networks, focusing on the different types of attacks and the corresponding detection methods designed to counteract them. Specifically, we classify IoT-specific threats into categories such as network based, device-level, data-centric, and insider attacks, providing insights into their mechanisms, impacts, and real-world occurrences. To address these threats, various IDS approaches are discussed, including signature based IDS, anomaly based IDS, specification based IDS, and hybrid IDS techniques. We further explore the application of Machine Learning in enhancing IDS capabilities for Internet of Things security. Each method’s strengths and limitations are evaluated in terms of accuracy, adaptability, computational efficiency, and scalability. By exploring emerging trends, ongoing challenges, and potential future directions in IDS research for IoT, this study underscores the urgent need for adaptive, scalable, and effective IDS frameworks to protect IoT ecosystems against evolving cyber threats. In addition, this survey provides a critical assessment of the current research landscape, highlighting the fundamental challenges that remain unresolved and outlining future research directions derived both from the existing literature and our own domain-specific analysis.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"95 ","pages":"Article 104291"},"PeriodicalIF":3.7,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145424927","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"WeiDetect: Weibull distribution-based defense against poisoning attacks in federated learning for network intrusion detection systems","authors":"Sameera K.M. ,&nbsp;Vinod P. ,&nbsp;Anderson Rocha ,&nbsp;Rafidha Rehiman K.A. ,&nbsp;Mauro Conti","doi":"10.1016/j.jisa.2025.104275","DOIUrl":"10.1016/j.jisa.2025.104275","url":null,"abstract":"<div><div>The rapid growth of Internet of Things (IoT) devices has expanded the cyber-attack surface, making traditional Network Intrusion Detection Systems (NIDS) less effective against modern, dynamic threats. The rise of privacy concerns and legal restrictions also limits the use of centralized security systems, highlighting the need for decentralized alternatives. Federated Learning (FL)-based NIDS addresses this by training models without sharing private user data. However, these systems are still vulnerable to poisoning attacks and can suffer from performance issues due to varied client data. In this paper, we introduce WeiDetect, a novel two-phase defense mechanism for FL-based NIDS. Operating on the server side, WeiDetect tackles both adversarial attacks and client data heterogeneity. It works by evaluating local models with a validation dataset, fitting their performance scores to a Weibull distribution for identifying and excluding malicious or low-quality models before aggregation. Our experimental results show that WeiDetect outperforms existing defenses, improving target class recall by up to 70% and enhancing the global model’s F1 score by 1%–14%.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"95 ","pages":"Article 104275"},"PeriodicalIF":3.7,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145424930","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}