IET Information Security最新文献

{"title":"VR-Sniffer: WebVR Browsing History Sniffing Attack by Exploiting Controller Input Leakage","authors":"Jiyeon Lee,&nbsp;Byunggill Joe,&nbsp;Kilho Lee","doi":"10.1049/ise2/9755308","DOIUrl":"https://doi.org/10.1049/ise2/9755308","url":null,"abstract":"<p>With an increasing interest in Metaverse, virtual reality (VR) comes to the web and widely spreads to various apps. This is enabled by the WebVR framework, which allows running VR apps on top of major web browsers, providing better compatibility and accessibility. However, WebVR is exposed to privacy threats due to the open nature of the web. In particular, a malicious website can easily obtain any input from a user’s VR controller and distinguish the user’s browsing history through the controller usage patterns. This paper presents such a threat and demonstrates an effective privacy attack on major web browsers. We propose VR-Sniffer, a deep learning-based browsing history identification platform. For the privacy attack, it collects inputs from the user’s VR controller, transforms the data into a suitable format for our deep learning network, feeds the processed data into the network, and then infers the WebVR site the user is visiting. Our extensive evaluation with 18 participants shows that VR-Sniffer effectively identifies the visiting WebVR site with an accuracy of up to 95.8%. This result implies that the proposed attack may result in severe privacy threats to major WebVR applications.</p>","PeriodicalId":50380,"journal":{"name":"IET Information Security","volume":"2026 1","pages":""},"PeriodicalIF":2.0,"publicationDate":"2026-10-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1049/ise2/9755308","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149258906","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"A Lightweight Polynomial–Based Provable Data Possession Scheme With Blockchain for Integrity and Ownership Verification","authors":"Jaeshin Ryu,&nbsp;Suntae Kim,&nbsp;Jungwon Seo","doi":"10.1049/ise2/6917069","DOIUrl":"https://doi.org/10.1049/ise2/6917069","url":null,"abstract":"<p>Data outsourcing improves the scalability of large-scale storage systems but introduces risks related to data tampering and unverifiable ownership claims. Existing provable data possession (PDP) schemes often incur substantial cryptographic overhead and primarily focus on data integrity. This paper proposes a lightweight PDP scheme that uses a user-specific polynomial to construct integrity tags without bilinear pairing operations. The scheme is integrated with a blockchain smart contract to provide dual verification: The file owner verifies outsourced data integrity, while the smart contract validates ownership proofs, challenge freshness, file versions, and record validity on behalf of the external server. Experimental results identify <i>π</i>_<i>d</i> = 3 and <i>Q</i> = 60 as practical parameter settings. The implemented protocol completes recurring setup, ownership registration, and ownership verification in 465.95, 27.47, and 54.33 ms, respectively. Under a common primitive operation model, the proposed scheme achieves the lowest tag generation cost and a lower integrity audit cost than five of the six compared schemes. The results demonstrate efficient and scalable integrity and ownership verification for outsourced storage systems.</p>","PeriodicalId":50380,"journal":{"name":"IET Information Security","volume":"2026 1","pages":""},"PeriodicalIF":2.0,"publicationDate":"2026-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1049/ise2/6917069","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149146805","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"A Signal-Matching Approach to RLWE-Based PSI: Achieving Optimal Online Efficiency in 3 Rounds","authors":"Yue Qin,&nbsp;Bei Liang,&nbsp;Hongyuan Cai,&nbsp;Jintai Ding,&nbsp;Chengrui Dang","doi":"10.1049/ise2/6614097","DOIUrl":"https://doi.org/10.1049/ise2/6614097","url":null,"abstract":"<p>In this study, we propose a novel post-quantum private set intersection (PSI) protocol based on the ring learning with errors (RLWE) assumption. Different from existing PSI protocols based on post-quantum oblivious pseudorandom functions (EUROCRYPT’25) and fully homomorphic encryption (FHE) (CCS’21), our construction follows the Diffie–Hellman (DH)-based PSI paradigm and uses post-quantum key exchange to achieve PSI functionality. Our key technique is a signal matching (SigMa) mechanism, which determines whether two items match by checking the consistency of the reconciliation signals derived from their corresponding shared keys. The resulting PSI protocol completes in three rounds. In the first two rounds, the parties exchange RLWE-based public keys associated with their items; in the third round, the sender transmits the corresponding signals. The receiver then applies SigMa to compare the received signals with its locally computed signals and thereby identify the intersection. We implement our protocol and compare it with Cong et al. (CCS’21) and Heimberger et al. (EUROCRYPT’25). Our protocol achieves the lowest online communication across all evaluated symmetric and asymmetric set-size configurations, at the cost of additional offline communication. It also achieves the lowest online and total times among the evaluated protocols for all symmetric settings with |<i>X</i>| = |<i>Y</i>| ∈ {2¹², 2¹⁶, 2²⁰} and all asymmetric settings with |<i>X</i>| ∈ {2¹², 2¹⁶, 2²⁰} and |<i>Y</i>| ∈ {5535, 11041}. We believe that our work not only supplements existing post-quantum PSI frameworks but also opens the opportunity for broader applications of post-quantum PSI.</p>","PeriodicalId":50380,"journal":{"name":"IET Information Security","volume":"2026 1","pages":""},"PeriodicalIF":2.0,"publicationDate":"2026-09-28","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1049/ise2/6614097","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149146666","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"WENNKP: Investigating Weak IVs and Statistical Bias in Stream Ciphers via Weighted Ensemble Neural Network","authors":"Jingtao Li,&nbsp;Bo Gao,&nbsp;Jianxiong Wan,&nbsp;Leixiao Li,&nbsp;Qing Xu","doi":"10.1049/ise2/4052232","DOIUrl":"https://doi.org/10.1049/ise2/4052232","url":null,"abstract":"<p>At EUROCRYPT 2024, recovering key bits via superpoly (over 20 trillion terms for 851-round Trivium) hit a bottleneck due to its complexity. While existing machine learning (ML)-based cryptanalysis has shown promise on block ciphers, applying it to stream ciphers is difficult due to rapid diffusion. In this work, we propose a novel ML-based analytic framework: weighted ensemble neural network for key prediction (WENNKP), aimed at investigating potential weak initialization vectors (IVs) and their induced statistical biases. Unlike standard ciphertext-only attacks, we model the problem as a chosen-IV analysis. Our preliminary observations suggest that for a specific, empirically selected IV candidate, the keystream of 1152-round Trivium and Kreyvium appears to exhibit a distinguishable statistical dependence on the secret key. WENNKP integrates multiple neural networks to act as a distinguisher, indicating this potential nonrandomness with a prediction accuracy exceeding 50% (random guess). Experimental results show that WENNKP detects signs of these biases in over 70 out of 100 validation datasets. This work provides empirical evidence supporting the hypothesis of weak IVs in modern stream ciphers and explores the capability of ML as a sensitive tool for detecting deep statistical leaks.</p>","PeriodicalId":50380,"journal":{"name":"IET Information Security","volume":"2026 1","pages":""},"PeriodicalIF":2.0,"publicationDate":"2026-09-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1049/ise2/4052232","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149048116","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Optimizing AI-Enabled Financial Shared Services: An Integrated Accounting-Based Evaluation and Resource-Allocation Framework","authors":"BaiHui Wang,&nbsp;GuiJuan Zhao,&nbsp;Changguo Liu","doi":"10.1049/ise2/7371432","DOIUrl":"https://doi.org/10.1049/ise2/7371432","url":null,"abstract":"<p>Artificial-intelligence-enabled financial shared services require enterprises to select appropriate functional modules under limited financial, technological, and organizational resources. However, existing studies generally evaluate financial sharing from a single perspective and provide limited support for converting accounting diagnosis into an implementable optimization portfolio. This study develops an integrated accounting-based framework for evaluating and optimizing intelligent financial shared services. First, a gray-whitening weight function clustering model is used to determine the maturity levels of accounting services, risk control, and value creation under uncertain expert evaluations. Second, activity-based costing identifies the cost drivers associated with each candidate function, while neural-network prediction estimates the corresponding implementation costs. Third, entropy weights are adjusted using the Decision-Making Trial and Evaluation Laboratory (DEMATEL) method to account for interactions among functional objectives, and Kano coefficients are used to represent asymmetric user-satisfaction effects. Finally, a 0–1 goal-programming model selects the optimal functional portfolio under cost, time, and technological-maturity constraints. The empirical analysis is based on 150 questionnaires collected from financial managers, shared-service professionals, and artificial-intelligence system experts in three large Chinese group enterprises. The overall functional maturity was classified as gray level 3, indicating a medium level of realization and intelligence. The optimized portfolio produced a maximum user-satisfaction value of 50.67 while satisfying all specified constraints. The proposed framework extends activity-based costing from retrospective cost allocation to the ex ante selection of intelligent financial functions and provides an auditable link between cost drivers, functional interactions, resource constraints, and implementation decisions.</p>","PeriodicalId":50380,"journal":{"name":"IET Information Security","volume":"2026 1","pages":""},"PeriodicalIF":2.0,"publicationDate":"2026-09-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1049/ise2/7371432","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148994118","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Attention-Driven Real-Time Fusion for Robust Intrusion Detection in Control Networks","authors":"Ateeq Ur Rehman,&nbsp;Sunawar Khan,&nbsp;Muhammad Adnan Khan,&nbsp;Ayman Altameem,&nbsp;Salil Bharany,&nbsp;Belayneh Matebie Taye,&nbsp;Ahmad Almogren","doi":"10.1049/ise2/2349648","DOIUrl":"https://doi.org/10.1049/ise2/2349648","url":null,"abstract":"<p>The increasing prevalence of cyber threats targeting industrial control systems (ICSs) has made robust and reliable intrusion detection systems (IDSs) essential for securing critical infrastructure. This study proposes an explainable, attention-driven feature fusion framework for real-time intrusion detection in Distributed Network Protocol 3 (DNP3) networks. To improve model performance, the proposed research hypothesizes three hybrid deep learning models: CNN + XGBoost (XGB), CNN + bidirectional long short-term memory (BiLSTM), and CNN + BiGRU, each incorporating a custom attention layer to emphasize significant features for enhanced classification accuracy. The proposed framework preprocesses 81 numerical features using StandardScaler and reshapes the resulting data to fit the CNN architecture. Experiments are conducted on a balanced 11-class, DNP3 dataset comprising 5126 training samples and 2200 test samples. Among the evaluated models, CNN + XGBoost model outperformed others, achieving an accuracy of 96.50% and macro precision, recall, and F1-scores of 0.965. It outperforms CNN + BiGRU, which achieves 96.23% accuracy and a macro F1-score of 0.962, and CNN + BiLSTM, which achieves 91.59% accuracy and a macro F1-score of 0.915. To enhance model transparency and facilitate security analysis, multiple explainability techniques are employed, including gradient-weighted class activation mapping (Grad-CAM) for per-filter feature visualization, SHapley Additive exPlanations (SHAP) based on 50 representative samples, and local interpretable model-agnostic explanation (LIME) for individual prediction-level explanations. Model performance is further evaluated using confusion matrices and receiver operating characteristic (ROC) and precision–recall (PR) curves. In addition, the low inference latency demonstrated by the proposed models highlights their potential suitability for real-time ICS environments. This scalable and interpretable approach offers significant improvements to ICS security and holds potential for application to other network protocols.</p>","PeriodicalId":50380,"journal":{"name":"IET Information Security","volume":"2026 1","pages":""},"PeriodicalIF":2.0,"publicationDate":"2026-09-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1049/ise2/2349648","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148993991","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"GAN-Enhanced Ransomware Detection in SDN-Based IIoT Networks","authors":"Mohammad Najafimehr,&nbsp;Reza Mohammadi","doi":"10.1049/ise2/3387260","DOIUrl":"https://doi.org/10.1049/ise2/3387260","url":null,"abstract":"<p>The escalating threat of ransomware in Industrial Internet of Things (IIoT) networks necessitates advanced detection methods to protect critical infrastructure. This article proposes a robust ransomware detection and mitigation framework that integrates generative adversarial network (GAN)-based data augmentation with machine learning (ML) classifiers within a software-defined networking (SDN) environment. To address severe class imbalance in IIoT traffic, synthetic ransomware samples are generated to augment the EdgeIIoTset dataset. This enhanced dataset trains multiple ML classifiers—including decision tree (DT), light gradient boosting machine (LightGBM), eXtreme gradient boosting (XGBoost), and random forest (RF)—leveraging dynamic feature selection to identify critical network attributes. Experimental evaluations demonstrate that GAN-enhanced training enables the XGBoost classifier to achieve 99.92% accuracy, 100% precision, 99.26% recall, and a 99.63% F1-score, alongside a low false positive rate of 3.73 × 10⁻⁶. This represents a 4.5% improvement in recall compared to nonaugmented baseline models. Furthermore, an adaptive mitigation threshold of 97% malicious packets effectively blocks attack flows in real time, reducing attack throughput to zero. These figures of merit confirm the efficacy and scalability of coupling generative data balancing with programmable SDN control for IIoT security.</p>","PeriodicalId":50380,"journal":{"name":"IET Information Security","volume":"2026 1","pages":""},"PeriodicalIF":2.0,"publicationDate":"2026-09-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1049/ise2/3387260","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148942864","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Machine Learning-Based Open-Source Framework for Real-Time Network Intrusion Detection","authors":"Daud Ahmed,&nbsp;Muhammad Iqbal,&nbsp;Muhammad Ali,&nbsp;Muhammad Hanif Durad,&nbsp;Anila Usman,&nbsp;Asghar Ai Shah,&nbsp;Khan Muhammad Adnan","doi":"10.1049/ise2/1954901","DOIUrl":"https://doi.org/10.1049/ise2/1954901","url":null,"abstract":"<p>The rapid increase in internet usage has led to a surge in network threats, making traditional signature-based intrusion detection systems (IDS) less effective. This paper presents a machine learning-based, open-source framework designed for real-time detection of malicious network traffic. The proposed system uses a flowmeter to extract time and size-based features from network traffic, followed by a preprocessing pipeline that enhances detection accuracy. After evaluating various models, the deep belief network (DBN) was selected for its superior performance, achieving a weighted F1 score of 99.83 and a prediction time of 2.57 s. To improve scalability and efficiency, the framework integrates with the Wazuh security information and event management (SIEM) system, enabling real-time alerts and flexible deployment across networks. Simulations conducted using graphical network simulator-3 (GNS3) confirm the framework’s effectiveness in real-time intrusion detection.</p>","PeriodicalId":50380,"journal":{"name":"IET Information Security","volume":"2026 1","pages":""},"PeriodicalIF":2.0,"publicationDate":"2026-09-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1049/ise2/1954901","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148942647","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Two-Party Adaptor Signature: New Definition and Efficient Constructions From ECDSA","authors":"Binbin Tu,&nbsp;Xueli Wang,&nbsp;Yu Chen","doi":"10.1049/ise2/4013546","DOIUrl":"https://doi.org/10.1049/ise2/4013546","url":null,"abstract":"<p>Adaptor signature (AS) has gained increasing popularity lately due to its widespread adoption in different Blockchain applications such as atomic swaps and payment channels. Two-party AS enhances the security of the signing key by splitting it into two parts. Erwig et al. (PKC 2021) first define a two-party AS with aggregatable public keys and instantiate them via a generic transformation from ID-based signature schemes. However, their definition could not cover two-party signature with interactive key generation, such as two-party ECDSA. In this paper, we first propose a generic definition of two-party ASs that inherently supports interactive key generation. Then, we present efficient constructions of two-party AS based on ECDSA, which inherit the performance advantages of two-party ECDSA. Compared to the state-of-the-art work (Malavolta et al., NDSS 2019), experimental results demonstrate that our protocol achieves about 5.6× speedup in the presigning algorithm. In terms of application, we showcase a secure atomic swap protocol that leverages our two-party ASs to enhance signing key protection and strengthen overall protocol security.</p>","PeriodicalId":50380,"journal":{"name":"IET Information Security","volume":"2026 1","pages":""},"PeriodicalIF":2.0,"publicationDate":"2026-08-31","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1049/ise2/4013546","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148943682","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Token-Guided Flow Tracing for Auditable Zero-Knowledge Smart Contract Transfers","authors":"Junhee Lee,&nbsp;Jihye Kim,&nbsp;Hyunok Oh,&nbsp;Heejin Park","doi":"10.1049/ise2/1765419","DOIUrl":"https://doi.org/10.1049/ise2/1765419","url":null,"abstract":"<p>Private transfers on public smart contract blockchains hide transaction values and private transfer links, but accountable privacy requires controlled auditability. Existing auditable zero-knowledge transfer systems make per-transaction audit information available to an authorized auditor, but their audit model may allow the auditor to inspect transactions beyond the flow connected to the authorized audit target. In such a model, granting audit capability for one investigation can expose unrelated transactions or allow tracing to continue farther than intended. In this paper, we propose token-guided flow tracing for auditable zero-knowledge smart contract transfers, enabling audit authorization to be scoped to a transaction flow and epoch range. The construction separates audit authorization from audit capability by introducing a tracing-token manager and an auditor. The auditor can open audit information only when it holds the auditor secret key, an epoch secret key for an authorized epoch, and a tracing token associated with the target transaction flow. Direction-specific tracing tokens confine tracing to the authorized direction, while epoch public keys and a binary key-derivation tree support compact authorization of audit intervals. We analyze security through ledger indistinguishability, transaction nonmalleability, balance, audit correctness, and restricted audit authorization. Restricted audit authorization is established in an honest authorization model that assumes the tracing-token manager and the auditor do not collude beyond explicit audit authorizations; under these assumptions, the auditor cannot open or trace transactions outside the authorized flow, direction, and epoch scope. Our implementation adds 16,349 transfer-circuit constraints, about 178,000 gas to each accepted transfer, and 448 bytes to the serialized transfer transaction, showing that scoped auditability can be added with moderate on-chain overhead.</p>","PeriodicalId":50380,"journal":{"name":"IET Information Security","volume":"2026 1","pages":""},"PeriodicalIF":2.0,"publicationDate":"2026-08-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1049/ise2/1765419","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148783931","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}