Journal of Information Security and Applications最新文献

筛选
英文 中文
Neurosymbolic AI for network intrusion detection systems: A survey 用于网络入侵检测系统的神经符号人工智能:综述
IF 3.7 2区 计算机科学
Journal of Information Security and Applications Pub Date : 2025-08-26 DOI: 10.1016/j.jisa.2025.104205
Alice Bizzarri , Chung-En (Johnny) Yu , Brian Jalaian , Fabrizio Riguzzi , Nathaniel D. Bastian
{"title":"Neurosymbolic AI for network intrusion detection systems: A survey","authors":"Alice Bizzarri ,&nbsp;Chung-En (Johnny) Yu ,&nbsp;Brian Jalaian ,&nbsp;Fabrizio Riguzzi ,&nbsp;Nathaniel D. Bastian","doi":"10.1016/j.jisa.2025.104205","DOIUrl":"10.1016/j.jisa.2025.104205","url":null,"abstract":"<div><div>Current data-driven AI approaches in Network Intrusion Detection System (NIDS) face challenges related to high resource consumption, high computational demands, and limited interpretability. Moreover, they often struggle to detect unknown and rapidly evolving cyber threats. This survey explores the integration of Neurosymbolic AI (NeSy AI) into NIDS, combining the data-driven capabilities of Deep Learning (DL) with the structured reasoning of symbolic AI to address emerging cybersecurity threats. The integration of NeSy AI into NIDS demonstrates significant improvements in both the detection and interpretation of complex network threats by exploiting the advanced pattern recognition typical of neural processing and the interpretive capabilities of symbolic reasoning. In this survey, we categorise the analysed NeSy AI approaches applied to NIDS into logic-based and graph-based representations. Logic-based approaches emphasise symbolic reasoning and rule-based inference. On the other hand, graph-based representations capture the relational and structural aspects of network traffic. We examine various NeSy systems applied to NIDS, highlighting their potential and main challenges. Furthermore, we discuss the most relevant issues in the field of NIDS and the contribution NeSy can offer. We present a comparison between the main XAI techniques applied to NIDS in the literature and the increased explainability offered by NeSy systems.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"94 ","pages":"Article 104205"},"PeriodicalIF":3.7,"publicationDate":"2025-08-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144896370","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Compression-enhanced Three-Pass Protocol for secure and bandwidth-efficient image transmission 压缩增强的三通道协议,用于安全和带宽高效的图像传输
IF 3.7 2区 计算机科学
Journal of Information Security and Applications Pub Date : 2025-08-25 DOI: 10.1016/j.jisa.2025.104204
Mohamed G. Abdelfattah , Ahmed Elnakib , Salem F. Hegazy
{"title":"Compression-enhanced Three-Pass Protocol for secure and bandwidth-efficient image transmission","authors":"Mohamed G. Abdelfattah ,&nbsp;Ahmed Elnakib ,&nbsp;Salem F. Hegazy","doi":"10.1016/j.jisa.2025.104204","DOIUrl":"10.1016/j.jisa.2025.104204","url":null,"abstract":"<div><div>Key-based cryptography faces persistent challenges in secure key distribution and newly rising vulnerabilities. Three-Pass Protocols (3PPs) tackle these issues through commutative encryption but typically triple bandwidth requirements. This paper addresses these bandwidth limitations by integrating an entropy-regularized Vector Quantized Variational Autoencoder (VQ-VAE) into a Fresnel-transform-based 3PP. Our VQ-VAE, trained on the Flickr8k dataset, achieves high-quality compression (average PSNR <span><math><mo>≈</mo></math></span> 31 dB, average MS-SSIM <span><math><mo>≈</mo></math></span> 0.96) at an average low bitrate (<span><math><mo>&lt;</mo></math></span> 0.35 bpp), reducing 3PP bandwidth requirements by over 97%. Comparative analysis at about 0.3 bpp demonstrates its competitive performance with recent state-of-the-art image compression techniques, and ablation studies validate the contribution of each key component to its overall efficacy. Compressed latent representations are then encrypted via commutative Fresnel transforms, enabling secure, keyless decryption. Security analysis reveals minimal correlation coefficient (<span><math><mrow><mi>C</mi><mi>C</mi><mo>&lt;</mo><mn>0</mn><mo>.</mo><mn>04</mn></mrow></math></span>) between original and encrypted latents, while decrypted latents fully recover the originals (CC <span><math><mrow><mo>=</mo><mn>1</mn><mo>.</mo><mn>0</mn></mrow></math></span>). The final reconstructed images maintain high fidelity (CC <span><math><mrow><mo>&gt;</mo><mn>0</mn><mo>.</mo><mn>98</mn></mrow></math></span>). Furthermore, encrypted latents exhibit negligible adjacent-pixel correlation (<span><math><mo>&lt;</mo></math></span> 0.05), highlighting strong immunity to statistical attacks. Histogram analysis shows a high Kullback–Leibler (KL) divergence (<span><math><mo>&gt;</mo></math></span> 3.29) and a low histogram intersection (0.597) between ciphers and original latents, underscoring robust resistance to frequency-based methods. Sensitivity analysis reveals that a minute deviation in the diffraction distance (<span><math><mrow><mn>1</mn><msup><mrow><mn>0</mn></mrow><mrow><mo>−</mo><mn>5</mn></mrow></msup></mrow></math></span> m) severely degrades decryption quality (CC <span><math><mo>&lt;</mo></math></span> 0.05), demonstrating resistance against brute-force attacks. A lightweight verification step thwarts replay attacks, a known 3PP weakness. This framework enables secure and bandwidth-efficient image transmission, making it suitable for resource-constrained and security-critical applications such as telemedicine and remote-sensing downlinks.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"94 ","pages":"Article 104204"},"PeriodicalIF":3.7,"publicationDate":"2025-08-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144893800","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Searchable face recognition authentication based on homomorphic encryption 基于同态加密的可搜索人脸识别认证
IF 3.7 2区 计算机科学
Journal of Information Security and Applications Pub Date : 2025-08-25 DOI: 10.1016/j.jisa.2025.104208
Baiqi Wu , Shuli Zheng , Peiming Dai , Jiazheng Chen , Yuanzhi Yao
{"title":"Searchable face recognition authentication based on homomorphic encryption","authors":"Baiqi Wu ,&nbsp;Shuli Zheng ,&nbsp;Peiming Dai ,&nbsp;Jiazheng Chen ,&nbsp;Yuanzhi Yao","doi":"10.1016/j.jisa.2025.104208","DOIUrl":"10.1016/j.jisa.2025.104208","url":null,"abstract":"<div><div>Recent advances in deep learning-based facial recognition have sparked significant concerns over data security and privacy. To minimize storage and computational overhead, facial data is frequently outsourced to cloud servers for matching. Unlike passwords, facial features uniquely identify individuals, creating irreversible risks if compromised. Searchable Encryption (SE) schemes have emerged to protect outsourced data in the cloud, enabling queries directly over encrypted data. However, existing approaches primarily support deterministic exact match searches, neglecting the natural variability of facial features due to temporal and environmental factors, leading to decreased accuracy. Furthermore, reliance on symmetric encryption potentially compromises data confidentiality and integrity. To address these limitations, we propose <strong>SFRA</strong>, an efficient and verifiable <strong>S</strong>earchable <strong>F</strong>acial <strong>R</strong>ecognition <strong>A</strong>uthentication scheme. <strong>SFRA</strong> leverages locality-sensitive hashing combined with twin bloom filters to generate a tree-structured index storing encrypted facial feature vectors extracted by a deep learning model. During retrieval, the similarity between query trapdoors and stored index is measured using a predefined threshold for successful matching. We also define a comprehensive security framework and rigorously prove <strong>SFRA</strong>’s security under three leakage patterns. Empirical experiments in real-world datasets demonstrate that <strong>SFRA</strong> achieves superior accuracy and computational efficiency. Overall, <strong>SFRA</strong> significantly enhances security and efficiency in encrypted facial recognition systems for cloud deployments.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"94 ","pages":"Article 104208"},"PeriodicalIF":3.7,"publicationDate":"2025-08-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144893802","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Reversible natural language watermarking with augmented word prediction and compression 具有增强词预测和压缩的可逆自然语言水印
IF 3.7 2区 计算机科学
Journal of Information Security and Applications Pub Date : 2025-08-25 DOI: 10.1016/j.jisa.2025.104211
Lingyun Xiang , Yangfan Liu , Yuling Liu
{"title":"Reversible natural language watermarking with augmented word prediction and compression","authors":"Lingyun Xiang ,&nbsp;Yangfan Liu ,&nbsp;Yuling Liu","doi":"10.1016/j.jisa.2025.104211","DOIUrl":"10.1016/j.jisa.2025.104211","url":null,"abstract":"<div><div>Reversible natural language watermarking presents a significant challenge due to the dual requirements of perfect content recovery and maintaining high-quality, natural outputs. Existing methods often struggle with limited embedding capacity or noticeable degradation in text fluency and semantics. To overcome these limitations, this paper proposes a novel reversible watermarking method that improves embedding capacity while preserving text naturalness by leveraging augmented word prediction and compression techniques. Specifically, the proposed method utilizes the masked language model BERT to predict high-quality candidate substitutable words at selected embedding positions. Based on prediction results, original words across the entire text are mapped into an unbalanced binary sequence, which is then compressed via arithmetic coding to create additional space to accommodate the watermark information. The compressed sequence and the watermark bits are jointly embedded by replacing the original words with their predicted substitutable ones. During watermark extraction, the words at the embedding positions in the watermarked text are decoded to recover the embedded watermark and the original binary sequence, enabling lossless restoration of the original text. Moreover, to further improve compression efficiency, which in turn increases embedding capacity, a lexical substitution-based data augmentation strategy is proposed to expand the corpus for fine-tuning the BERT model. This enhancement improves prediction consistency, increasing the likelihood that more original words are accurately predicted as the most probable candidates. As a result, more original words are mapped to the same value, intensifying the imbalance in the binary sequence and thus favoring better compression rates and more available embedding space. Experimental results demonstrate that, compared to existing similar reversible natural language watermarking methods, the proposed method achieves higher watermark embedding capacity, and renders better security and higher imperceptibility under the same embedding rate.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"94 ","pages":"Article 104211"},"PeriodicalIF":3.7,"publicationDate":"2025-08-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144893772","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Learning to detect PII: Tabular vs. Document classification models for network traffic analysis 学习检测PII:用于网络流量分析的表格与文档分类模型
IF 3.7 2区 计算机科学
Journal of Information Security and Applications Pub Date : 2025-08-25 DOI: 10.1016/j.jisa.2025.104196
Rishika Kohli , Shaifu Gupta , Manoj Singh Gaur , Soma S. Dhavala
{"title":"Learning to detect PII: Tabular vs. Document classification models for network traffic analysis","authors":"Rishika Kohli ,&nbsp;Shaifu Gupta ,&nbsp;Manoj Singh Gaur ,&nbsp;Soma S. Dhavala","doi":"10.1016/j.jisa.2025.104196","DOIUrl":"10.1016/j.jisa.2025.104196","url":null,"abstract":"<div><div>Detecting Personally Identifiable Information (PII) exfiltration from mobile network traffic is critical for preserving user privacy. Traditional approaches rely on machine learning classifiers trained on manually engineered features extracted from network packets. Deep learning offers the potential to remove the reliance on such an external feature selection process; however, its effectiveness depends significantly on how underlying packets are encoded. In this work, we investigate deep learning paradigms for PII detection with a focus on the impact of feature encoding strategies. We explore tabular modeling approaches, including both an existing architecture (FT-Transformer) and proposed modular frameworks that integrates a pretrained language model (all-MiniLM-L6-v2) for semantic feature embeddings, followed by a classifier. We also evaluate document classification modeling by applying pretrained language models such as TinyBERT directly to the raw packet content. We further demonstrate the feasibility of on-device inference by deploying trained models using ONNX and TensorFlow Lite. Finally, we recommend modeling strategies based on <em>data size</em>, <em>performance</em>, <em>resource utilization</em>, and <em>generalizability</em>, enabling model selection according to the primary requirement of the deployment scenario.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"94 ","pages":"Article 104196"},"PeriodicalIF":3.7,"publicationDate":"2025-08-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144893773","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Revealing the compactness of real samples via image reconstruction for deepfake detection 通过图像重建揭示真实样本的紧密性,用于深度伪造检测
IF 3.7 2区 计算机科学
Journal of Information Security and Applications Pub Date : 2025-08-25 DOI: 10.1016/j.jisa.2025.104201
Dongyu Han , Gaoming Yang , Ting Guo , Xiujun Wang , Ji Zhang
{"title":"Revealing the compactness of real samples via image reconstruction for deepfake detection","authors":"Dongyu Han ,&nbsp;Gaoming Yang ,&nbsp;Ting Guo ,&nbsp;Xiujun Wang ,&nbsp;Ji Zhang","doi":"10.1016/j.jisa.2025.104201","DOIUrl":"10.1016/j.jisa.2025.104201","url":null,"abstract":"<div><div>The escalating threats posed by deepfakes to society and cybersecurity have triggered public anxiety, and growing efforts have been devoted to this pivotal research on deepfake detection. The generalization capability of existing models encounters a serious challenge. A prevailing explanation is that models tend to overfit artifacts in fake samples, thereby neglecting the exploration of available real ones. Prior studies have indicated that real images exhibit intra-class clustering and inter-class uniformity in the latent feature space, termed as compactness. Since deepfakes disrupt this property, exploring the common compactness of real samples may boost the generalization of models. In light of this, this paper proposes a targeted <strong>C</strong>ompact <strong>R</strong>econstruction <strong>L</strong>earning (<strong>CRL</strong>) strategy. It applies an enhanced Multi-View Reconstruction Loss (for self-compactness) to reconstruct only real images and a new Real-Sample Compactness Loss (for other-compactness) to bolster ties across real samples. Besides, a novel <strong>Joint</strong>-<strong>G</strong>uided <strong>R</strong>easoning (<strong>JointGR</strong>) module is introduced, which richly fuses features from the encoder-decoder and reconstructed differences. It fully capitalizes on multi-source features from CRL while improving the representational ability of our model. Under the latest benchmark, extensive experiments show our model keeps the competitive performance on most challenging datasets, even achieving state-of-the-art results on some. The code will be open-sourced at <span><span>https://github.com/Dongyu-Han/CRL</span><svg><path></path></svg></span>.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"94 ","pages":"Article 104201"},"PeriodicalIF":3.7,"publicationDate":"2025-08-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144893801","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Robust clustering federated learning with trusted anchor clients 具有可信锚客户机的健壮集群联合学习
IF 3.7 2区 计算机科学
Journal of Information Security and Applications Pub Date : 2025-08-23 DOI: 10.1016/j.jisa.2025.104210
Maozhen Zhang , Yi Li , Fei Wei , Bo Wang , Yushu Zhang
{"title":"Robust clustering federated learning with trusted anchor clients","authors":"Maozhen Zhang ,&nbsp;Yi Li ,&nbsp;Fei Wei ,&nbsp;Bo Wang ,&nbsp;Yushu Zhang","doi":"10.1016/j.jisa.2025.104210","DOIUrl":"10.1016/j.jisa.2025.104210","url":null,"abstract":"<div><div>Federated Learning (FL) is a distributed machine learning framework that has attracted widespread attention. However, its decentralized architecture makes it vulnerable to attack with malicious data or model injection. While existing methods are can defend against a limited number of malicious clients, the challenge of defending against model poisoning attacks from a large number of malicious clients remains an unresolved issue. To address these challenges. We propose the Robust Clustering Federated Learning with Trusted Anchor Clients, which aims to provide clean global models for specified trusted client’s enterprise (trusted client as anchor client), even in the presence of a substantial number of malicious clients. Specifically, it performs classification by extracting clustering factors from the differences between anchor clients and other clients. It then identifies trustworthy clusters as aggregation clusters to identify the most likely benign clients. Extensive experiments on two datasets demonstrate that our method maintains robust defense efficacy, even in scenarios involving numerous malicious clients (more than 50%) or highly non-independent, non-identically distributed data.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"94 ","pages":"Article 104210"},"PeriodicalIF":3.7,"publicationDate":"2025-08-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144890496","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Detecting cyberattacks based on deep neural network approaches in industrial control systems 基于深度神经网络方法的工业控制系统网络攻击检测
IF 3.7 2区 计算机科学
Journal of Information Security and Applications Pub Date : 2025-08-22 DOI: 10.1016/j.jisa.2025.104206
Selen Ayas , Mustafa Sinasi Ayas , Bora Cavdar , Ali Kivanc Sahin
{"title":"Detecting cyberattacks based on deep neural network approaches in industrial control systems","authors":"Selen Ayas ,&nbsp;Mustafa Sinasi Ayas ,&nbsp;Bora Cavdar ,&nbsp;Ali Kivanc Sahin","doi":"10.1016/j.jisa.2025.104206","DOIUrl":"10.1016/j.jisa.2025.104206","url":null,"abstract":"<div><div>Historical cases demonstrate the growing cybersecurity threats associated with water distribution and treatment systems, which are essential components of infrastructure. Detecting anomalies in time series data from industrial control systems has become an important issue due to its significance. This paper proposes an anomaly detection approach that utilizes statistical measurements and the relationship between observed and predicted values of deep neural network (DNN) models. To achieve this goal, we compared several convolutional and recurrent DNN architectures, including convolutional neural network (CNN), long short-term memory (LSTM), recurrent neural network (RNN), and gated recurrent unit (GRU) models. Our aim was to automatically learn the relationships between sensors from time series data, improve detection performance, and quickly extract long-term and short-term dependencies to help detect possible anomalies. The performances of the DNN models on two real water system datasets, Secure Water Treatment (SWaT) and Water Distribution (WADI) datasets, were analyzed. The results indicate that the GRU model is more efficient than the other models in reducing the absolute error between the predicted and observed values, when evaluated in terms of prediction performance for both datasets. Additionally, the RNN model demonstrated successful anomaly detection with high F1-score values of 0.9848 and 0.7651 for SWaT and WADI datasets. The study provides valuable information on how to secure water networks against online attacks through extensive testing and comparative evaluation.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"94 ","pages":"Article 104206"},"PeriodicalIF":3.7,"publicationDate":"2025-08-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144886306","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
RNN for intrusion detection in digital substations based on the IEC 61850 基于iec61850的数字变电站入侵检测RNN
IF 3.7 2区 计算机科学
Journal of Information Security and Applications Pub Date : 2025-08-22 DOI: 10.1016/j.jisa.2025.104197
Johnatan Alves de Oliveira , Anderson Fernandes Pereira dos Santos , Ronaldo Moreira Salles
{"title":"RNN for intrusion detection in digital substations based on the IEC 61850","authors":"Johnatan Alves de Oliveira ,&nbsp;Anderson Fernandes Pereira dos Santos ,&nbsp;Ronaldo Moreira Salles","doi":"10.1016/j.jisa.2025.104197","DOIUrl":"10.1016/j.jisa.2025.104197","url":null,"abstract":"<div><div>Network communication has become a reality within electrical power systems. The IEC 61850 standard establishes the protocols and requirements for digital communications in substations. However, despite enhanced connectivity and integration benefits, network communication has also introduced cyber threats to these environments. Intrusion detection systems based on machine learning have emerged as a potential solution to address these threats in the context of IEC 61850-based communication. Literature indicates that algorithms using decision trees have shown enhanced effectiveness in detecting attacks on GOOSE protocol communication, alongside some exploration of deep learning techniques. Thus, this work examines the use of deep learning, specifically recurrent neural networks (RNNs), for intrusion detection in GOOSE protocol communication. To achieve this, a realistic electrical power system simulation was conducted using a Real-Time Digital Simulator (RTDS) combined with a physical Intelligent Electronic Device (IED) in a hardware-in-the-loop (HIL) setup. Four types of cyber-attacks were executed during the simulation: masquerade, replay, message injection, and poisoning attack. Network traffic datasets were also generated and made publicly available, with each frame sample clearly labeled as normal or malicious. Subsequently, the Recurrent Neural Network (RNN), Long Short-Term Memory (LSTM), Bidirectional LSTM (BiLSTM), Gated Recurrent Unit (GRU), and Bidirectional GRU (BiGRU) algorithms were trained and tested to detect the so-called masquerade attack, a more stealthy type of attack in the context of the GOOSE protocol. The results indicated that recurrent neural networks performed better than decision tree-based algorithms in detecting masquerade attacks. Additionally, RNNs also improve detection performance in multi-class problems by classifying network traffic into four types of attacks and normal behavior.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"94 ","pages":"Article 104197"},"PeriodicalIF":3.7,"publicationDate":"2025-08-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144886305","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Securing Modbus in legacy industrial control systems: A decentralized approach using proxies, Post-Quantum Cryptography and Self-Sovereign Identity 保护传统工业控制系统中的Modbus:使用代理、后量子密码学和自我主权身份的分散方法
IF 3.7 2区 计算机科学
Journal of Information Security and Applications Pub Date : 2025-08-21 DOI: 10.1016/j.jisa.2025.104199
Francesco Trungadi , Manuel Fabiano , Davide Aloisio , Giovanni Brunaccini , Francesco Sergi , Giovanni Merlino , Francesco Longo
{"title":"Securing Modbus in legacy industrial control systems: A decentralized approach using proxies, Post-Quantum Cryptography and Self-Sovereign Identity","authors":"Francesco Trungadi ,&nbsp;Manuel Fabiano ,&nbsp;Davide Aloisio ,&nbsp;Giovanni Brunaccini ,&nbsp;Francesco Sergi ,&nbsp;Giovanni Merlino ,&nbsp;Francesco Longo","doi":"10.1016/j.jisa.2025.104199","DOIUrl":"10.1016/j.jisa.2025.104199","url":null,"abstract":"<div><div>Industrial Control Systems (ICSs) are increasingly vulnerable to cyber threats due to their reliance on legacy protocols like Modbus TCP/IP, which lack built-in security mechanisms. Despite these risks, replacing or upgrading ICS components remains costly and impractical for many critical infrastructures, such as manufacturing, power generation, and transportation. This highlights the urgent need for security solutions that enhance protection without requiring disruptive system overhauls.</div><div>Building on our previous work, this paper introduces a decentralized security framework based on dedicated proxies that manage cryptographic operations for legacy devices and facilitate secure communication. The architecture leverages Decentralized Identifiers (DIDs) for node identity management, storing DID Documents containing post-quantum public keys in a Distributed Hash Table (DHT). The DHT, composed of proxy nodes, is specifically modified to function as a Verifiable Data Registry (VDR), ensuring data integrity and availability. To support authorization, Verifiable Credentials (VCs) are issued by an operator-controlled Issuer Node, activated solely during new device installations, or maintenance operations.</div><div>The proposed solution eliminates reliance on a central authority, enhances communication security against quantum threats, and improves resilience through decentralized identity management. Performance evaluations on both physical testbeds and simulated environments analyze handshake latency and system efficiency. Results demonstrate that our approach effectively secures legacy ICSs with an acceptable operational impact, paving the way for more robust and future-proof industrial networks.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"94 ","pages":"Article 104199"},"PeriodicalIF":3.7,"publicationDate":"2025-08-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144880048","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
0
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
确定
请完成安全验证×
相关产品
×
本文献相关产品
联系我们:info@booksci.cn Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。 Copyright © 2023 布克学术 All rights reserved.
京ICP备2023020795号-1
ghs 京公网安备 11010802042870号
Book学术文献互助
Book学术文献互助群
群 号:604180095
Book学术官方微信