{"title":"Fuzzing JavaScript JIT compilers with a high-quality differential test oracle","authors":"Jizhe Li, Haoran Xu, Yongjun Wang, Zhiyuan Jiang, Huang Chun, Peidai Xie, Yongxin Chen, Tian Xia","doi":"10.1016/j.cose.2025.104660","DOIUrl":"10.1016/j.cose.2025.104660","url":null,"abstract":"<div><div>Modern JavaScript engines use Just-In-Time (JIT) compilers to convert frequently executed code into machine instructions, boosting performance for web applications and cross-platform systems. However, the optimizations in JIT compilers often introduce vulnerabilities while enhancing speed, especially optimization bugs which are difficult to detect. Despite progress in detecting these bugs by using differential testing oracle, existing methods are limited by high false positives and inefficiencies.</div><div>This paper proposes AccuOracle, a test oracle for detecting JIT optimization bugs. We uses an input template-based test oracle that collects differential results from a single execution, enabling efficient fuzzing. To address the high false positive challenge, AccuOracle employs a four-layer progressive filtering architecture: the dynamism elimination and environment isolation layers address root causes, while the pre-check and differential arbitration layers assess JIT-induced divergences. Experiments on engines like V8, SpiderMonkey, and JavaScriptCore show that AccuOracle effectively eliminates false positives while maintaining high operational efficiency. It provides a high-accuracy and high-efficiency solution for JIT defect detection by integrating high-quality input templates and systematic false positive elimination. Notably, AccuOracle has uncovered eight new bugs (two of them have been assigned CVE), five of which Mozilla has confirmed and fixed.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"159 ","pages":"Article 104660"},"PeriodicalIF":5.4,"publicationDate":"2025-09-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145100165","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Luca Borzacchiello , Matteo Cornacchia , Davide Maiorca , Giorgio Giacinto , Emilio Coppa
{"title":"DroidReach++: Exploring the reachability of native code in android applications","authors":"Luca Borzacchiello , Matteo Cornacchia , Davide Maiorca , Giorgio Giacinto , Emilio Coppa","doi":"10.1016/j.cose.2025.104657","DOIUrl":"10.1016/j.cose.2025.104657","url":null,"abstract":"<div><div>Modern Android applications often incorporate numerous native C/C++ libraries to efficiently handle CPU-intensive tasks or interact at a low level with specific hardware, such as performing specialized GPU rendering. Recent research on Android security has revealed that these libraries are frequently adopted by third-party developers and may pose security risks if not regularly updated, as publicly disclosed vulnerabilities in outdated libraries can be exploited by malicious actors. To determine whether these known vulnerabilities represent an immediate and tangible threat, it is essential to assess whether the vulnerable functions can be executed during application runtime – a research problem commonly known as <em>function reachability</em>. In this article, we introduce <span>DroidReach++</span>, a novel static analysis approach for evaluating the reachability of native function calls in Android applications. Our framework overcomes the limitations of existing state-of-the-art methods by combining heuristics with symbolic execution, enabling a more precise reconstruction of Inter-procedural Control-Flow Graphs (ICFGs). When applied to the top 500 applications from the Google Play Store, <span>DroidReach++</span> identifies a significantly higher number of execution paths compared to previous techniques. Finally, two case studies demonstrate how <span>DroidReach++</span> serves as an effective tool for vulnerability assessment.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"159 ","pages":"Article 104657"},"PeriodicalIF":5.4,"publicationDate":"2025-09-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145050620","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"An anomaly detection based approach for continuous authentication with smartwatch inertial sensors","authors":"Arash Gholami, Furkan Alaca, Mohammad Zulkernine","doi":"10.1016/j.cose.2025.104656","DOIUrl":"10.1016/j.cose.2025.104656","url":null,"abstract":"<div><div>Conventional authentication methods protect unattended devices when they are logged out; however, logged-in devices left unattended are vulnerable to unauthorized access. Inactivity timeouts help mitigate this threat; however, long timeouts increase susceptibility to attack, whereas short timeouts hurt usability. In contrast, continuous authentication mitigates this threat by continuously and non-intrusively verifying whether a device is being used by the user who initially logged in. If verified, the user remains logged in; otherwise, the user is logged out.</div><div>We design and evaluate a comprehensive data processing pipeline for smartwatch-based continuous authentication using inertial sensor data. We use a Siamese convolutional neural network to learn and extract discriminative features, and one-class classifiers to determine if a user is the account owner. We compare our learned features with handpicked features proposed in prior work; we show that our learned features achieve better equal-error rates (EER) compared to the handpicked features, particularly for shorter-duration time-series windows. We find that learned features are a promising approach to more quickly and accurately detect unauthorized use of devices. This work thus contributes to making smartwatch-based continuous authentication more secure and usable.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"159 ","pages":"Article 104656"},"PeriodicalIF":5.4,"publicationDate":"2025-09-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145109847","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"dK-DGDP: A differential privacy approach on directed social network graphs","authors":"Fengrui Hao , Shiyi Zhao , Tianlong Gu , Yan Ma","doi":"10.1016/j.cose.2025.104647","DOIUrl":"10.1016/j.cose.2025.104647","url":null,"abstract":"<div><div>With the spread of social network services, the publication of social network graphs provides useful insights into various fundamental social phenomena such as information dissemination and personalized recommendations. Social network graphs usually contain a lot of sensitive information. However, most of the existing social network graph publishing methods are designed for undirected graphs, and there are few approaches exist for publishing directed graphs securely. In this paper, we initiate the exploration of a solution for publishing directed social network graphs, and develop a novel <em>dK</em>-series based differential privacy directed graph publishing approach, named <em>dK</em>-DGDP. In our solution, the noise is added to the 2K entries extracted from the original directed graph by the <em>dK</em>-series differential privacy mechanism, and then an adaptive strategy is designed to handle the situation in which entries with added noise cannot generate the graph directly. Moreover, a subgroup division strategy is proposed to reduce the amount of noise during perturbation and address the issue of excessive noise. Experimental results show that <em>dK</em>-DGDP can achieve effective privacy protection of directed graph data while almost maintaining its utility.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"159 ","pages":"Article 104647"},"PeriodicalIF":5.4,"publicationDate":"2025-09-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145050618","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Dongni Zhang , Xiuzhang Yang , Side Liu , Yilin Zhou , Jianming Fu , Guojun Peng
{"title":"A survey on Android dynamic evasive malware: Taxonomy, countermeasures and open challenges","authors":"Dongni Zhang , Xiuzhang Yang , Side Liu , Yilin Zhou , Jianming Fu , Guojun Peng","doi":"10.1016/j.cose.2025.104646","DOIUrl":"10.1016/j.cose.2025.104646","url":null,"abstract":"<div><div>Android dynamic evasive malware has gained increasing attention and has become a critical threat in recent years. The inherent stealth and context-aware behavior of such malware allow it to bypass dynamic analysis systems and remain undetected during execution. In this paper, we present a comprehensive review of the evolution of dynamic evasion techniques in Android malware and systematically analyze their core strategies and implementation trends. We propose a novel, context-dependent taxonomy that unifies evasion behaviors under two major categories: those leveraging analysis environment artifacts and those relying on trigger conditions. Based on this taxonomy, we further conduct a systematic and comparative review of existing countermeasure techniques, highlighting their strengths and limitations. Moreover, we identify key open challenges that hinder current detection efforts, such as native code blind spots, AI-powered evasions, and analysis-monitoring contradictions, and offer forward-looking insights into potential research directions for mitigating dynamic evasive threats in Android malware.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"159 ","pages":"Article 104646"},"PeriodicalIF":5.4,"publicationDate":"2025-09-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145061088","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Alessandra Maciel Paz Milani , Arty Starr , Samantha Hill , Callum Curtis , Norman Anderson , David Moreno-Lumbreras , Margaret-Anne Storey
{"title":"Fuzzy to clear: Elucidating the threat hunter cognitive process and cognitive support needs","authors":"Alessandra Maciel Paz Milani , Arty Starr , Samantha Hill , Callum Curtis , Norman Anderson , David Moreno-Lumbreras , Margaret-Anne Storey","doi":"10.1016/j.cose.2025.104651","DOIUrl":"10.1016/j.cose.2025.104651","url":null,"abstract":"<div><div>With security threats increasing in frequency and severity, it is critical that we consider the important role of threat hunters. These highly-trained security professionals learn to see, identify, and intercept security threats. Many recent works and existing tools in cybersecurity are focused on automating the threat hunting process, often overlooking the critical human element. Our study shifts this paradigm by emphasizing a human-centered approach to understanding the lived experiences of threat hunters. By observing threat hunters during hunting sessions and analyzing the rich insights they provide, we seek to advance the understanding of their cognitive processes and the tool support they need. Through an in-depth observational study of threat hunters, we introduce a model of how they build and refine their mental models during threat hunting sessions. We also present 23 themes that provide a foundation to better understand threat hunter needs and suggest five actionable design propositions to enhance the tools that support them. Through these contributions, our work enriches the theoretical understanding of threat hunting and provides practical insights for designing more effective, human-centered cybersecurity tools.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"159 ","pages":"Article 104651"},"PeriodicalIF":5.4,"publicationDate":"2025-09-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145109848","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"MVX-based mitigation of position-independent code reuse","authors":"Bert Abrath, Bart Coppens, Bjorn De Sutter","doi":"10.1016/j.cose.2025.104655","DOIUrl":"10.1016/j.cose.2025.104655","url":null,"abstract":"<div><div>In literature, position-independent return-oriented programming (PIROP) attacks have been demonstrated that exploit memory vulnerabilities even when coarse-grained address space layout randomization (ASLR) is deployed and in the complete absence of information disclosure. The demonstrated attacks involved the patching of code pointers present on massaged stacks to create useful ROP chains. To the best of our knowledge, no effective countermeasures have been researched and evaluated to this date.</div><div>While multi-variant execution (MVX) has been demonstrated in literature to provide strong protection against many classes of code-reuse attacks, the structured forms of diversification used in MVX in the past, such as disjoint code layouts (DCL), fail to mitigate PIROP attacks, for the same reason that ASLR fails to do so.</div><div>In this paper, we present additional forms of structural diversity that, together with DCL, enable MVX to mitigate patch-based PIROP attacks. We present these extensions to MVX with DCL, and present a qualitative and quantitative security analysis, as well as a performance analysis, revealing that strong mitigation is achieved, at performance costs that vary from negligible to significant but in many scenarios acceptable. The main result is that the number of available, chainable gadgets is reduced to nearly zero, leaving virtually zero opportunities for successful patch-based PIROP attacks.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"159 ","pages":"Article 104655"},"PeriodicalIF":5.4,"publicationDate":"2025-09-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145099648","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
DiegoF BustamanteV, Luis E. Sánchez, David G. Rosado, Antonio Santos-Olmo, Eduardo Fernández-Medina
{"title":"Towards a sustainable cybersecurity framework for Agriculture 4.0 based on a systematic analysis of proposals","authors":"DiegoF BustamanteV, Luis E. Sánchez, David G. Rosado, Antonio Santos-Olmo, Eduardo Fernández-Medina","doi":"10.1016/j.cose.2025.104650","DOIUrl":"10.1016/j.cose.2025.104650","url":null,"abstract":"<div><div>The world is currently experiencing a profound transformation driven by the convergence of disruptive technologies under the concept of Industry 4.0. These technologies have driven sectors such as agriculture to modernise and automate for greater sustainability, leading to what is now referred to as Agriculture 4.0 However, this transformation entails risks and requires new frameworks that address cybersecurity, sustainability, and knowledge reuse. In this paper, we conduct a systematic review of these new systems with the aim of identifying their main shortcomings and proposing a new framework. The review revealed a significant gap in comprehensively addressing cybersecurity, AI, and sustainability. This highlights the need for deeper exploration of how these elements interact to benefit the agricultural sector. To this end, we propose the development of the QUILLAQUA framework, oriented towards secure, intelligent, and sustainable agriculture, with a focus on fostering effective synergies among these crucial components. This framework integrates advanced technologies in cybersecurity, IoT, and AI to optimise the management of water and nutritional resources in hydroponic systems, ensuring sustainability and data security. This approach aims to enhance technological efficiency in agriculture. It also aims to foster greater awareness to tackle present and future challenges in sustainable agriculture. By doing so, it ensures a successful transition towards more digitized and secure agricultural practices.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"159 ","pages":"Article 104650"},"PeriodicalIF":5.4,"publicationDate":"2025-09-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145050619","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Sibo Qiao , Qiang Guo , Min Wang , Haohao Zhu , Joel J.P.C. Rodrigues , Zhihan Lyu
{"title":"Advances in network flow watermarking: A survey","authors":"Sibo Qiao , Qiang Guo , Min Wang , Haohao Zhu , Joel J.P.C. Rodrigues , Zhihan Lyu","doi":"10.1016/j.cose.2025.104653","DOIUrl":"10.1016/j.cose.2025.104653","url":null,"abstract":"<div><div>Over the past three decades, with the rapid development of the Internet, network security threats have increasingly intensified. Traffic analysis (TA) has become a core method for addressing these threats, enabling real-time monitoring and analysis of network traffic to identify abnormal behaviors and potential security risks accurately. TA is usually divided into passive and active categories. Passive TA monitors network traffic and analyzes its characteristics and patterns to detect threats, with no intervention in the data flow; the observer remains a bystander. However, as network threats become more complex, passive TA has gradually revealed its limitations in terms of accuracy, real-time performance, and handling of encrypted traffic. To overcome these limitations, network watermarking, as a form of active TA, has become an important tool for tracking and identifying network traffic. In recent years, with the development of watermarking technology, its application scope is no longer limited to the areas described in previous studies. Our primary contribution lies in providing a more comprehensive exploration of the technological evolution of network watermarking. Specifically, we investigate the potential of watermarking in emerging cross-domain application scenarios; articulate the overall architecture of watermarking systems together with novel embedding carriers; discuss the threats currently faced by watermarking technology; and systematically analyze the performance of various watermarking algorithms. Moreover, to overcome practical bottlenecks such as line-rate latency, large-scale concurrency, power consumption, and portability, we propose an FPGA-based watermarking concept, examine the potential synergy between watermarking techniques and field-programmable gate arrays (FPGAs), and outline new research challenges.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"159 ","pages":"Article 104653"},"PeriodicalIF":5.4,"publicationDate":"2025-09-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145050621","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Yahui Yang , Yangyang Geng , Qiang Wei , Man Zhou , Xin Che
{"title":"Physical semantic inference method for industrial control proprietary protocol data fields","authors":"Yahui Yang , Yangyang Geng , Qiang Wei , Man Zhou , Xin Che","doi":"10.1016/j.cose.2025.104654","DOIUrl":"10.1016/j.cose.2025.104654","url":null,"abstract":"<div><div>The precise interpretation of physical semantics within industrial proprietary protocol data fields, which directly govern cyber–physical interactions, plays a pivotal role in securing industrial control systems (ICS). Current protocol reverse engineering methods face three fundamental limitations that hinder ICS security efforts: (1) discerning physical significance in raw hexadecimal streams, (2) unassisted field delineation amid unknown data types, and (3) mapping concurrent physical semantics to protocol fields without contextual references. To overcome these challenges, we propose Physeinfer, a novel physical semantic inference framework that innovatively integrates visual human–machine interface (HMI) monitoring with temporal sequence analysis. Our methodology leverages camera-acquired HMI panel differentials to extract physical semantic sequences, develops adaptive step-size strategies for longitudinal multiple sequence alignment, and employs dynamic time warping (DTW) to establish cyber–physical correlations. Evaluated in six industrial scenarios, Physeinfer was able to accurately recover the physical semantics of industrial control protocol data fields and demonstrated superior performance in field segmentation (11%–27% improvement over Netzob, MSERA, and Fieldhunter) without requiring prior knowledge of the protocol. This breakthrough establishes an essential foundation for context-aware security mechanisms in industrial infrastructure, enabling physics-informed vulnerability discovery and anomaly detection for ICS.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"159 ","pages":"Article 104654"},"PeriodicalIF":5.4,"publicationDate":"2025-09-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145050617","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}