Journal of Information Security and Applications最新文献

{"title":"Moving target defense for DDos mitigation with shuffling of critical edge(s) connections","authors":"Amir Javadpour ,&nbsp;Forough Ja’ Fari ,&nbsp;Tarik Taleb ,&nbsp;Chafika Benzaïd","doi":"10.1016/j.jisa.2025.104347","DOIUrl":"10.1016/j.jisa.2025.104347","url":null,"abstract":"<div><div>Moving Target Defense (MTD) has as a widely adopted approach to mitigate vulnerability exploitation. It is a widely adopted approach to mitigate the exploitation of vulnerabilities. Its dynamic and proactive nature makes it well-suited for SDNs requiring comprehensive and continuous monitoring. A core objective of MTD is to minimize the number of hosts shuffled while maintaining robust security and low scrambling frequency. This paper introduces a novel approach, the Number of Edge Connections (NoEC) strategy, aimed at mitigating Distributed Denial of Service (DDoS) attacks in a resource-efficient manner. This is achieved by strategically reconfiguring a select group of highly connected hosts known as “Edges” to protect critical assets. This approach enhances analytical clarity and supports informed selection of defense strategies tailored to specific edge deployment scenarios. We designed a system utilizing NoEC and conducted simulations using Mininet. The results show that NoEC reduces the complexity by 55.12 % compared to previous MTD methods while increasing the security level by 15.72 %. Among the techniques, topology randomization and edge node shuffling show the highest disruption effect, validating the approach’s practical viability and robustness in defending edge infrastructures.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"97 ","pages":"Article 104347"},"PeriodicalIF":3.7,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145841428","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"A traceable threshold Asmuth–Bloom secret sharing scheme","authors":"Maria Leslie,&nbsp;Ratna Dutta","doi":"10.1016/j.jisa.2025.104350","DOIUrl":"10.1016/j.jisa.2025.104350","url":null,"abstract":"<div><div>In a (<em>t, n</em>)-threshold secret sharing scheme, accountability is crucial when a subset of <em>f</em> &lt; <em>t</em> servers collude to leak secret shares. <em>Traceable Threshold Secret Sharing</em> (<span>TTSS</span>) ensures that leaked shares can be traced back to the compromised servers while preventing false accusations through non-imputability. In Crypto’24, Boneh et al. proposed new definitions and more practical constructions for <span>TTSS</span> based on Shamir’s and Blakley’s secret sharing schemes, removing the practical limitation of existing <span>TTSS</span>.</div><div>Our work presents a <span>TTSS</span> scheme built upon an additive variant of the Asmuth-Bloom scheme, relying only on oracle access to the reconstruction box <span><math><mi>R</mi></math></span>. In our model, a subset of <em>f</em> &lt; <em>t</em> colluding servers can construct a reconstruction box <span><math><mi>R</mi></math></span> that recovers the secret with the assistance of an additional <span><math><mrow><mi>t</mi><mo>−</mo><mi>f</mi></mrow></math></span> random shares. We note that integrating tracing in the standard (<em>t, n</em>)-Asmuth-Bloom Secret Sharing (<span>ABSS</span>) scheme exhibits a tracing leakage issue. We fix this limitation by introducing additive variants of <span>ABSS</span>, <span>ABSS-</span>I and <span>ABSS-</span>II that retain the security of the original scheme <span>ABSS</span> while splitting the secret <em>s</em> into <em>t</em> additive components and generating all shares from the additive components of <em>s</em>. Based on <span>ABSS-</span>I, we construct a <span>TTSS</span> scheme, <span>TTSS-</span>I, that introduces traceability into the framework and is proven to be universally traceable in the random oracle model, assuming <span><math><mi>R</mi></math></span> is a universally good reconstruction box. We integrate a tracing mechanism in <span>ABSS-</span>II and propose a second scheme, <span>TTSS-</span>II, which extends <span>TTSS-</span>I by additionally concealing partial information about the additive component of the secret <em>s</em> to introduce non-imputability to prevent the tracer from falsely accusing any honest party by fabricating evidence of its corruption. The security of <span>TTSS-</span>II is also in the random oracle model and relies on the hardness of the discrete logarithm problem.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"97 ","pages":"Article 104350"},"PeriodicalIF":3.7,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145841431","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Implications of applying emulation data to machine learning-based intrusion detection systems","authors":"Maximilian Wolf ,&nbsp;Kevin Bergner ,&nbsp;Pascal Förtsch,&nbsp;Dieter Landes","doi":"10.1016/j.jisa.2025.104362","DOIUrl":"10.1016/j.jisa.2025.104362","url":null,"abstract":"<div><div>Intrusion detection systems (IDS) require high-quality benchmark data sets for evaluating their performance in distinguishing suspicious activities from normal behavior patterns. While real-world network environments often consist of physical hardware components, it is, however, difficult to generate an IDS benchmark data set in a real-world network environment for reasons such as scalability, costs, anonymity in real-world data, infrastructure, and availability of hardware components. A solution to this problem is the usage of emulated network environments to create IDS benchmark data sets. Nevertheless, it is unclear whether emulated data represents physical network characteristics based on the recorded data patterns. Several IDS benchmark data sets were generated in the past, but none addressed the described infrastructure gap so far. To address this issue, we recreated a small physical enterprise network by using an emulated network environment. Inside both networks, we executed identical script-based user behavior, which includes six normal behavior categories and one attack behavior category. To check whether the emulated data are a suitable proxy for training machine learning-based IDS, recorded host and network data sources of both simulation environments are analyzed via diverse approaches. We use Wasserstein distances to compare the properties of the data distributions. Subsequently, we apply established classification metrics to evaluate the performances of a collection of machine learning-based classifiers on the data. For both host and network data, differences between emulated and actual hardware-based data could be identified. In general, the machine learning-based performances show that emulated IDS data is a good proxy for hardware-generated data produced on actual devices during our experiments.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"97 ","pages":"Article 104362"},"PeriodicalIF":3.7,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145977328","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Software supply chain: A taxonomy of attacks, mitigations and risk assessment strategies","authors":"Betul Gokkaya,&nbsp;Leonardo Aniello,&nbsp;Basel Halak","doi":"10.1016/j.jisa.2025.104324","DOIUrl":"10.1016/j.jisa.2025.104324","url":null,"abstract":"<div><div>The software product is a source of cyber-attacks that target organizations by using their software supply chain (SSC) as a distribution vector. As the reliance of software projects on open-source or proprietary modules is increasing drastically, SSC is becoming more and more critical and, therefore, has attracted the interest of cyber attackers. While existing studies primarily focus on software supply chain attacks’ prevention and detection methods, there is a need for a broad overview of attacks and comprehensive risk assessment for software supply chain security. This study conducts a systematic literature review to fill this gap. By analyzing 96 papers published between 2015-2023, we identified 19 distinct SSC attacks, including 6 novel attacks highlighted in recent studies. Additionally, we developed 25 specific security controls and established a precisely mapped taxonomy that transparently links each control to one or more specific attacks. By establishing this relationship, we demonstrate how SSC security controls are strategically designed to counteract specific attack vectors. Furthermore, we emphasize the role of risk assessment as a foundational step in understanding and prioritizing these vulnerabilities. This study introduces a risk assessment methodology tailored to software supply chain environments, focusing on identifying vulnerabilities in software components, dependencies, and suppliers. The proposed methodology enables organizations to systematically prioritize threats and implement appropriate mitigation strategies.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"97 ","pages":"Article 104324"},"PeriodicalIF":3.7,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145738765","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"RL-IDS: A robust and lightweight intrusion detection system for in-vehicle network","authors":"Jianjun Yuan,&nbsp;Hong Sun,&nbsp;Rong Cao,&nbsp;Guojun Huang","doi":"10.1016/j.jisa.2025.104361","DOIUrl":"10.1016/j.jisa.2025.104361","url":null,"abstract":"<div><div>As a standard protocol for in-vehicle networks, the Controller Area Network (CAN) effectively facilitates communication among electronic control units. However, due to the lack of necessary security mechanisms in CAN, hackers can exploit the CAN bus to launch various attacks on vehicles. To enhance vehicle security, an intrusion detection system (IDS) can be deployed to detect attacks in the CAN bus. This paper proposes a robust and lightweight intrusion detection system (RL-IDS) for detecting attacks in CAN traffic. RL-IDS is built upon an unsupervised learning model to address the limitation of supervised methods, which cannot detect previously unknown attacks. Furthermore, to address the issue that unsupervised models are difficult to use in-vehicle networks due to their high complexity, we utilize the teacher-student network architecture to perform lightweight optimization of RL-IDS. Experimental results on real in-vehicle network intrusion detection datasets (car hacking dataset and survival analysis dataset) demonstrate that compared with state-of-the-art methods, RL-IDS achieves competitive attack detection performance while ensuring a higher degree of lightweight.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"97 ","pages":"Article 104361"},"PeriodicalIF":3.7,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145884192","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"FRIDA: Free-rider detection using privacy attacks","authors":"Pol G. Recasens ,&nbsp;Ádám Horváth ,&nbsp;Alberto Gutierrez-Torre ,&nbsp;Jordi Torres ,&nbsp;Josep Ll Berral ,&nbsp;Balázs Pejó","doi":"10.1016/j.jisa.2025.104357","DOIUrl":"10.1016/j.jisa.2025.104357","url":null,"abstract":"<div><div>Federated learning is increasingly popular as it enables multiple parties with limited datasets and resources to train a machine learning model collaboratively. However, similar to other collaborative systems, federated learning is vulnerable to free-riders — participants who benefit from the global model without contributing. Free-riders compromise the integrity of the learning process and slow down the convergence of the global model, resulting in increased costs for honest participants. To address this challenge, we propose FRIDA: <strong>f</strong>ree-<strong>ri</strong>der <strong>d</strong>etection using privacy <strong>a</strong>ttacks. Instead of focusing on implicit effects of free-riding, FRIDA utilizes membership and property inference attacks to directly infer evidence of genuine client training. Our extensive evaluation demonstrates that FRIDA is effective across a wide range of scenarios.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"97 ","pages":"Article 104357"},"PeriodicalIF":3.7,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145884709","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Lightweight orthogonal perturbation for privacy-preserving federated learning against poisoning attacks","authors":"Chuanyu Peng ,&nbsp;Hequn Xian","doi":"10.1016/j.jisa.2025.104345","DOIUrl":"10.1016/j.jisa.2025.104345","url":null,"abstract":"<div><div>Federated Learning (FL) is a distributed machine learning approach where multiple users collaboratively train a shared model without sharing raw data, thereby preserving data privacy. However, FL remains vulnerable to inference and poisoning attacks, which can compromise privacy and degrade global model performance. Therefore, many privacy-preserving frameworks have been proposed. Among these, mask-based frameworks provide advantages in efficiency and flexibility, but are particularly susceptible to poisoning attacks by malicious users. To overcome this challenge, we propose LOPAS-FL, an efficient, privacy-preserving, and robust mask-based federated learning scheme. It first introduces a gradient-splitting and orthogonal perturbation mechanism to ensure privacy through computational indistinguishability. Meanwhile, a dual-server architecture conducts multi-dimensional verification across gradient direction, distribution, and homogeneity. Only gradients that pass all validations are aggregated. This approach effectively defends against poisoning attacks and ensures the quality and robustness of the final model. Security analysis and experiments show that LOPAS-FL effectively detects and mitigates poisoning attacks, outperforming existing approaches in efficiency.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"97 ","pages":"Article 104345"},"PeriodicalIF":3.7,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145791476","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"MVNIDS: A multiview-based network intrusion detection system","authors":"Sunit Kumar Nandi,&nbsp;Ritesh Ratti,&nbsp;Sanasam Ranbir Singh,&nbsp;Sukumar Nandi","doi":"10.1016/j.jisa.2025.104321","DOIUrl":"10.1016/j.jisa.2025.104321","url":null,"abstract":"<div><div>Traditional Network Intrusion Detection Systems (NIDS) predominantly rely on signature-based and supervised learning approaches that require large volumes of labeled attack data. However, generating such labeled data is costly, time-consuming, and often impractical, especially in the presence of class imbalance and zero-day attacks. To address these limitations, this paper proposes MVNIDS, a Multiview-based Network Intrusion Detection System employing a self-supervised learning paradigm. The proposed method constructs three complementary views from raw packet capture data, namely, Network View, Flow View, and Image View, each capturing distinct protocol, temporal, and structural characteristics of network traffic. Independent autoencoder models are trained on benign samples for each view, and their reconstruction errors are fused through a majority-voting mechanism to automatically generate “Attack” and “Benign” pseudo-labels. These labels are subsequently used to train a binary classifier for final intrusion detection. Experimental evaluation on the CICIDS2018 dataset, focusing on FTP BruteForce and UDP DoS attacks, demonstrates that MVNIDS outperforms most view-specific and supervised baselines, achieving up to 98.3 % F1-score and 98.5 % accuracy. The multiview representation enhances detection robustness and enables effective identification of zero-day and variant attacks, highlighting MVNIDS as a scalable, computationally efficient, and generalizable framework for modern network security applications.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"96 ","pages":"Article 104321"},"PeriodicalIF":3.7,"publicationDate":"2026-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145684285","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Enhancing black-box membership inference attacks in federated learning","authors":"Qiang Shi,&nbsp;Luzhen Ren,&nbsp;Xinfeng He","doi":"10.1016/j.jisa.2025.104302","DOIUrl":"10.1016/j.jisa.2025.104302","url":null,"abstract":"<div><div>With the widespread deployment of machine learning models in privacy-sensitive domains such as healthcare and finance, the risk of training data leakage has attracted increasing attention. As a fundamental approach for evaluating model privacy leakage, Membership Inference Attack (MIA) has been extensively studied in distributed learning scenarios such as Federated Learning (FL). However, under black-box settings, attackers face severe challenges, including the unavailability of real non-member samples and the inaccessibility of target model architectures, which limit the generalization and accuracy of existing methods. To address these limitations, this paper proposes a DCGAN-enhanced black-box MIA framework, whose innovations are reflected in three major aspects: (1) a discriminator-guided pseudo-sample filtering mechanism that ensures the authenticity and diversity of non-member data; (2) a multi-shadow-model softmax high-dimensional concatenation strategy, which fuses the softmax probability outputs from multiple shadow models to construct discriminative high-dimensional attack representations; and (3) a SMOTE-based balancing module designed to mitigate class imbalance and further improve the generalization of the attack model. The proposed framework significantly enhances the discriminative capability and robustness of black-box MIAs without accessing the internal parameters or training procedures of the target model. Extensive experiments demonstrate that our method consistently outperforms state-of-the-art baselines across multiple federated learning protocols (FedAvg, FedMD, and FedProx) and benchmark datasets (CIFAR-10, CIFAR-100, Fashion-MNIST, and SVHN), achieving an accuracy of 0.9897, an AUC of 0.9899, and a TPR@FPR=1% of 0.9967. These results verify the robustness, generalizability, and wide applicability of the proposed framework, providing a systematic and scalable solution for privacy evaluation in federated learning environments.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"96 ","pages":"Article 104302"},"PeriodicalIF":3.7,"publicationDate":"2026-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145520857","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Uncertainty-aware regular-singular discriminant analysis for lossless watermarking","authors":"Guo-Dong Su ,&nbsp;Xu Wang ,&nbsp;Ching-Chun Chang","doi":"10.1016/j.jisa.2025.104295","DOIUrl":"10.1016/j.jisa.2025.104295","url":null,"abstract":"<div><div>It remains a major challenge in how to effectively organize and manage digital images stored in cloud. Regular-singular (RS) based watermarking, as one of important technologies, aims to insert watermark into digital images to solve this issue. By revisiting series of RS based watermarking methods, however, how to achieve a better trade-off between enlarging the embedding capacity and keeping the amount of distortion as soon as possible remains an interesting problem, especially deep learning comes powerful. For this, this paper presents a novel lossless watermarking method using uncertainty-aware discriminant analysis and deep learning technology. First, a numerical ordinary differential equation inspired network architecture for cover synthesis we refer to as <strong>NDCS</strong> is introduced. It produces a more realistic cover objective by minimizing a smaller local truncation error. As for <strong>NDCS</strong>, we are also interested in its performance under different network configurations. On this basis, we introduce an uncertainty-aware discriminant analysis in steganographic algorithm, thereby enabling to yield perceptually indistinguishable watermarked images at various capacities. The experimental results demonstrate that our method is conducive to improving the quality of synthetic objective with the mean hamming distance of 0.2231 and achieving a more satisfactory rate-distortion trade-off with an average embedding capacity of 0.2043 bpp, when comparing to the prior regular-singular methods. In addition, our approach can against RS steganalysis and has the identical performance in encrypted domain.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"96 ","pages":"Article 104295"},"PeriodicalIF":3.7,"publicationDate":"2026-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145468934","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}