Journal of Information Security and Applications最新文献

{"title":"CTFAgent: An LLM-powered Agent for CTF Challenge Solving","authors":"Yuwen Zou ,&nbsp;Jia Liu ,&nbsp;Wenjun Fan","doi":"10.1016/j.jisa.2025.104305","DOIUrl":"10.1016/j.jisa.2025.104305","url":null,"abstract":"<div><div>Capture-the-Flag (CTF) competitions play an important role in the cybersecurity landscape by simulating realistic attack and defense scenarios and offering diverse categories of challenges. This diversity demands flexible reasoning and adaptive problem-solving, which traditional automation tools struggle to provide, as they are typically designed for specific tasks. Large Language Models (LLMs) with their vast knowledge and strong reasoning capabilities, present a promising approach to overcome these limitations. In this work, we propose CTFAgent, an LLM-powered agent featuring a new plan-and-execute paradigm with a stateful task tree for long-horizon reasoning. To handle diverse challenges, CTFAgent integrates challenge-specific prompting and specialized tools for multimodal analysis and concrete operations. The agent comprises two modes: a fully automated mode and a human-in-the-loop (HITL) mode, which incorporates human operational support for tool execution beyond the automation. Evaluated on challenges from PicoCTF with GPT-4o, Gemini-2.5-Pro and DeepSeek-V3, CTFAgent outperforms 88% of human teams in its automated mode. This performance rises significantly in HITL mode, where it surpasses approximately 94% of teams. These results demonstrate that CTFAgent can effectively solve a wide range of complex tasks, highlighting the potential of LLM-powered agents to advance autonomous cybersecurity solutions.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"96 ","pages":"Article 104305"},"PeriodicalIF":3.7,"publicationDate":"2026-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145569604","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"A Dual-Layer image encryption framework using chaotic AES with dynamic S-Boxes and steganographic QR codes","authors":"Md Rishadul Bayesh ,&nbsp;Dabbrata Das ,&nbsp;Md Ahadullah","doi":"10.1016/j.jisa.2025.104322","DOIUrl":"10.1016/j.jisa.2025.104322","url":null,"abstract":"<div><div>This paper presents a robust image encryption and key distribution framework that integrates an enhanced AES-128 algorithm with chaos theory and advanced steganographic techniques for dual-layer security. The encryption engine features a dynamic ShiftRows operation controlled by a logistic map, variable S-boxes generated from a two-dimensional Hénon map for substitution and key expansion, and feedback chaining with post-encryption XOR diffusion to improve confusion, diffusion, and key sensitivity. To address secure key delivery, the scheme introduces dual-key distribution via steganographically modified QR codes. A static key and an AES-encrypted dynamic session key are embedded with a covert hint message using least significant bit (LSB) steganography. This design ensures the dynamic key can only be decrypted after reconstructing the static key from the hidden message, offering multi-factor protection against interception. Experimental results demonstrate the framework outperforms existing chaos-based and hybrid AES methods, achieving near-ideal entropy ( 7.997 bits per pixel), minimal pixel correlation, and strong differential resistance with NPCR (&gt;99.6 %) and UACI ( 33 %–34 %). Encrypted images show uniform histograms and robustness against noise and data loss. The framework offers a scalable, secure solution for sensitive image transmission in applications such as surveillance, medical imaging, and digital forensics, bridging the gap between cryptographic strength and safe key distribution</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"96 ","pages":"Article 104322"},"PeriodicalIF":3.7,"publicationDate":"2026-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145684286","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Vulnerabilities in Machine Learning for cybersecurity: Current trends and future research directions","authors":"Shantanu Pal ,&nbsp;Geeta Yadav ,&nbsp;Zahra Jadidi ,&nbsp;Ahsan Habib ,&nbsp;Md. Palash Uddin ,&nbsp;Chandan Karmakar ,&nbsp;Sandeep Shukla","doi":"10.1016/j.jisa.2025.104269","DOIUrl":"10.1016/j.jisa.2025.104269","url":null,"abstract":"<div><div>Machine learning (ML) has become integral to cybersecurity applications, e.g., phishing detection, intrusion detection systems, malware analysis, and botnet identification. However, the integration of ML also exposes novel attack surfaces that can be exploited through adversarial machine learning (AML). While prior surveys have examined individual threats or defenses, they often focus narrowly on specific stages, e.g., training or testing. In contrast, in this paper, we provide the first comprehensive survey of adversarial attacks and defenses across the entire ML development life cycle within the cybersecurity domain. Using a structured methodology, we categorize vulnerabilities and countermeasures at each stage, data gathering, model training, testing, deployment, and maintenance, highlighting cross-stage interactions and emerging distributed threat models. Our study addresses key gaps in current defenses, including their limited generalizability and lack of standardized evaluation practices, and identifies promising directions, e.g., lifecycle-aware robustness, distributed resilience, and the integration of statistical with generative methods. Consolidating fragmented research into an end-to-end perspective, this study advances the understanding of AML in cybersecurity and outlines a roadmap for building more trustworthy, and resilient ML-driven security systems.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"96 ","pages":"Article 104269"},"PeriodicalIF":3.7,"publicationDate":"2026-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145520860","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Realization of multi-image encryption algorithm based on DNA and chaotic system on FPGA","authors":"Nermeen H. Abdelzaher ,&nbsp;Mohammed H. Yacoub ,&nbsp;Lobna A. Said","doi":"10.1016/j.jisa.2025.104267","DOIUrl":"10.1016/j.jisa.2025.104267","url":null,"abstract":"<div><div>This paper introduces an efficient FPGA-based image encryption architecture for securing the transmission of grayscale images over high-data-rate networks. The design supports single and multi-image encryption by fusing multiple grayscale input images into a single encrypted three-channel representation. The fractional-order Nose-Hoover hyperchaotic system and the logistic map are employed to generate pseudo-random sequences for the permutation, scrambling, and DNA processing stages. The initial conditions for the chaotic systems result from XORing a SHA-256 hash of the fused image with a user-defined key. Each channel undergoes a sequence of operations: permutation, pixel-level scrambling, DNA encoding, DNA-based XOR operation, and decoding. The proposed algorithm is implemented on an Xilinx Kintex UltraScale KCU105 FPGA and operates at a maximum frequency of 51.3 MHz. The system’s security performance is evaluated through several widely employed statistical metrics. The cipher image achieve an average entropy of 7.9995 in encrypting four 512 × 512 images using the multi-image encryption scheme. The design is robust against differential attacks, achieving high NPCR and UACI averages of 99.6% and 33.47%, respectively. Additionally, it demonstrates robustness against various analysis methods, including cropping attacks and noise attacks. The algorithm passes the NIST statistical test and demonstrates robustness against known plaintext attacks, supporting its suitability for secure and high-throughput image communication applications.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"96 ","pages":"Article 104267"},"PeriodicalIF":3.7,"publicationDate":"2026-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145428832","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"LeakyDroid: A lightweight method for detecting zero-day leaky Android applications using One-Class Graph Neural Networks","authors":"Neha Sharma,&nbsp;Mayank Swarnkar,&nbsp;Shaan Kumar","doi":"10.1016/j.jisa.2025.104296","DOIUrl":"10.1016/j.jisa.2025.104296","url":null,"abstract":"<div><div>In the current era of mobile technology, ensuring user data security and privacy is very important, particularly with the rise of malicious Android applications that aim to leak end-user data. Moreover, the popularity of the Android OS is resulting in growing numbers of such malicious Android applications. Hackers make the apps malicious by downloading the source code of Android applications and modifying it. Static analysis techniques have traditionally been used to detect such leaky Android applications. However, these methods cannot simulate runtime behaviours, leading to false positives or negatives. Moreover, obfuscated code is also harder to analyse using this technique. On the other hand, dynamic analysis-based methods are used to overcome these issues because they capture the application’s actual behaviour during runtime. However, dynamic analysis methods have high computational complexity. To fill this gap, we propose <em>LeakyDroid</em>, a static but lightweight method for detecting zero-day leaky Android applications using one-class graph neural networks. <em>LeakyDroid</em> distinguishes between the zero-day malicious and genuine versions of Android applications based on function calls inside various class files of the installable APK files. <em>LeakyDroid</em> generates a control flow graph from function calls from several versions of normal APK files of the same application. The graph is trained using OCGNN, which effectively captures relationships and invocation patterns of normal APK files. While testing an unknown version of the same application’s APK, if a considerable deviation is seen from normal behaviour, the application is detected as malicious. We evaluated the performance of <em>LeakyDroid</em> on three applications, namely WhatsApp, Netflix, and Instagram, each with approximately 25 benign and a few malicious and leaky versions. <em>LeakyDroid</em> successfully detected all the malicious versions of APK with no false positives.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"96 ","pages":"Article 104296"},"PeriodicalIF":3.7,"publicationDate":"2026-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145468937","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"A multilayered deep learning framework for cyber attack detection and mitigation in a heterogeneous IIoT ecosystem","authors":"Arshad Iqbal,&nbsp;Sohail Asghar,&nbsp;Manzoor Ilahi Tamimy","doi":"10.1016/j.jisa.2025.104301","DOIUrl":"10.1016/j.jisa.2025.104301","url":null,"abstract":"<div><div>Intrusion Detection Systems (IDSs) for the Internet of Things (IoT) and Industrial IoT (IIoT) face significant challenges, including high false-positive rates (especially for minority-class attacks) and excessive computational requirements, which hinder their deployment on edge devices. Consequently, alert overload is common because operators receive a large volume of alerts that provide little insight into the problems they address. To address this crucial gap, this study presents DeepGuard, a new four-layer framework that significantly improves the security posture of IoT and industrial IoT environments.</div><div>DeepGuard combines binary and multiclass classifications, intelligent alarming, and cyber deception into a single, effective defence mechanism. The system incorporates a random forest classifier for feature selection, which extracts the most relevant data features and processes them for use with an optimised multilayer perceptron (MLP). This method achieved an unprecedented accuracy of 99.9% with a low false-positive rate (FPR) of 0.2%, surpassing the state-of-the-art research studies.</div><div>We further demonstrated the practical feasibility of DeepGuard by implementing it on computationally constrained, edge devices. With a computational complexity of <span><math><mrow><mi>O</mi><mrow><mo>(</mo><mi>n</mi><mi>l</mi><mi>o</mi><mi>g</mi><mi>n</mi><mo>)</mo></mrow></mrow></math></span> and a memory footprint of less than 100 KB, DeepGuard breaks the long-standing trade-off between detection accuracy and operational performance that has inhibited the adoption of IDS at an industrial scale. In addition to a detection-only approach, DeepGuard includes an embedded honeypot layer that proactively profiles emerging and unknown attacks, thereby enabling automated mitigation responses. Thorough evaluations of the WUSTL-IIoT-2021 and X-IIoTID-2022 datasets demonstrated a new state-of-the-art performance and the feasibility of DeepGuard for protecting critical infrastructure.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"96 ","pages":"Article 104301"},"PeriodicalIF":3.7,"publicationDate":"2026-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145520859","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Cybersecurity Digital Twins: Concept, blueprint, and challenges for multi-ownership digital service chains","authors":"M. Repetto","doi":"10.1016/j.jisa.2025.104299","DOIUrl":"10.1016/j.jisa.2025.104299","url":null,"abstract":"<div><div>The growing level of interconnectedness of digital services and infrastructures creates tight and recursive security inter-dependencies between their providers. However, cybersecurity operations remain highly fragmented, since common tasks like disclosing vulnerabilities, reporting alerts, and suggesting remediation are largely restricted within the boundaries of the administrative domain of each provider, while cooperation is usually limited to paperwork and human interactions. This practice has already demonstrated to be inadequate and risky, because it cannot effectively address multi-step attacks and kill chains that propagate across multiple domains.</div><div>In this position paper, we elaborate on the concept, blueprint, and usage of a Cyber-security Digital Twin that models and captures the security posture of such interconnected systems. Differently from existing models, our work explicitly addresses the challenges brought by multi-ownership, by focusing on the overall architecture to build cooperative, agile, adaptive and autonomous processes for threat hunting, detection of lateral movements, and eradication of attacks among multiple domains. For this reason, our framework takes into account the necessary federation mechanisms that address trust and confidentiality concerns.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"96 ","pages":"Article 104299"},"PeriodicalIF":3.7,"publicationDate":"2026-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145520858","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Collusion-resistant multi-user searchable symmetric encryption with conjunctive query and suppressed pattern leakage","authors":"Yanpeng Ba ,&nbsp;Yuan Ping ,&nbsp;Zengpeng Li ,&nbsp;Zheng Yuan","doi":"10.1016/j.jisa.2025.104289","DOIUrl":"10.1016/j.jisa.2025.104289","url":null,"abstract":"<div><div>Existing multi-user searchable symmetric encryption (MUSSE) schemes often depend on the honesty of users or the assumption that multiple servers will not collude, which compromises security to some extent. While a few collusion-resistant MUSSE schemes are designed for single-server settings, they are limited to single-keyword searches and suffer from significant pattern leakage, making them vulnerable to leakage-abuse attacks (LAAs). We introduce CQ-MUSSE, the first collusion-resistant MUSSE scheme in a single-server setting that supports conjunctive queries to address these limitations. Indeed, CQ-MUSSE enables users to search for multiple keywords simultaneously with a single query. The scheme leverages bloom filters to construct forward indexes and incorporates random dummy keywords into queries to obfuscate search patterns effectively reducing pattern leakage. This design enhances security at the expense of a minor reduction in search result accuracy. The scheme can precisely return documents matching the conjunctive query when pattern leakage is ignored. Experimental evaluations confirm that CQ-MUSSE provides greater search flexibility and improved security with only a moderate increase in computational overhead.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"95 ","pages":"Article 104289"},"PeriodicalIF":3.7,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145424929","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"ABA-LEP: Autonomous Bidirectional Authentication and Lightweight Encryption Protocol for drones under ARM architecture","authors":"Qian Zhou ,&nbsp;Jiayang Wu ,&nbsp;Weizhi Meng","doi":"10.1016/j.jisa.2025.104268","DOIUrl":"10.1016/j.jisa.2025.104268","url":null,"abstract":"<div><div>Secure communication protocols for drones are crucial in ensuring safety in potentially threatening network environments. However, existing protocols often suffer from weak autonomy, lack of optimization for ARM architecture, and inefficient utilization of lightweight cryptographic algorithms. To address these issues, this paper designs and analyzes an Autonomous Bidirectional Authentication and Lightweight Encryption Protocol (ABA-LEP) for drones under ARM architecture. The protocol optimizes the fixed-point scalar multiplication in SM2 for ARM architecture to accelerate authentication and key agreement efficiency, and employs simple operations like one-time pad limited XOR for lightweight secure communication encryption. Experiments conducted on the ARM Cortex M-4 based CrazyFlie 2.1 drone demonstrate that, in resource-constrained environments, the ABA-LEP achieves a performance improvement of up to 80.18% in fixed-point scalar multiplication with a 256-bit operand, compared to existing techniques. Additionally, the number of transmitted messages per unit time increases by up to 97.02%. The protocol’s resilience against multiple types of attacks has also been verified using the formal verification tool ProVerif.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"95 ","pages":"Article 104268"},"PeriodicalIF":3.7,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145334788","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"The ransomware blueprint: Attack patterns and strategic variations across gangs","authors":"Francesco Saccone ,&nbsp;Pietro Melillo ,&nbsp;Arnaldo Sgueglia ,&nbsp;Andrea Di Sorbo ,&nbsp;Corrado Aaron Visaggio","doi":"10.1016/j.jisa.2025.104264","DOIUrl":"10.1016/j.jisa.2025.104264","url":null,"abstract":"<div><div>In recent years, ransomware attacks have attracted the attention of researchers and companies, prompting new issues in identifying effective defense techniques. The study provides a comprehensive analysis of ransomware attacks and their employed tactics from 2020 to 2024, leveraging a large dataset of over 16,000 documented ransomware incidents involving 155 distinct gangs. Using this data, we identify the exploited software vulnerabilities (CVEs) and map them to specific adversarial behaviors within the MITRE ATT&amp;CK framework. In addition to this technical mapping, we differentiated between broadly targeting “generalist” gangs and industry-focused ”specialist” gangs, and we examined variations in attack patterns across target sectors and geographic origins. Our methodology reveals the core ”ransomware blueprint”: a unified kill-chain model comprising recurring techniques spanning initial access through encryption. Key findings include the use of high-severity, widely deployed CVEs (particularly public-facing exploits, such as T1190) as entry points, followed by routine privilege escalation, lateral movement, and impact actions (e.g., T1486 for data encryption). The analysis also reveals regional and sectoral differences: (i) Russian-origin groups often emphasize rapid disruption and recovery inhibition, and (ii) other groups focus on stealthier reconnaissance. Generalist gangs (e.g., LockBit, Cl0p, ALPHV) employ advanced techniques across multiple industries, while specialist gangs concentrate on narrower sectors, using simpler methods such as phishing and credential reuse. Moreover, the number of shared techniques is employed to assess the degree of interconnection among the gangs. These findings provide actionable intelligence for defenders, highlighting the need for multi-layered defenses, targeted vulnerability management, and sector-specific hardening strategies to mitigate evolving ransomware threats.</div></div>","PeriodicalId":48638,"journal":{"name":"Journal of Information Security and Applications","volume":"95 ","pages":"Article 104264"},"PeriodicalIF":3.7,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145365865","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}