Next-generation networks, including IoT, edge, vehicular, and 6G systems, require cryptographic schemes that not only resist attacks but also withstand channel degradation without disrupting secure data flows. This paper presents a novel adaptive encryption architecture for quantum-resilient networks that integrates real-time attack detection in quantum channels with per frame key management. A lightweight controller has been designed, which tracks the quantum bit error rate (QBER) via a sliding-window hysteresis and buffer thresholds, deciding per frame whether to derive symmetric keys from Quantum Key Distribution (QKD) or from a post-quantum cryptographic fallback, while maintaining a unified AES–GCM AEAD dataplane. Moreover, a deterministic HMAC-based key derivation function (HKDF) schedule binding eliminates key reuse across modes, retransmissions, and re-encapsulations. Experimental evaluation on image payloads shows: (i) timely QBER-spike detection with 9.5-frame latency and zero misses; (ii) full decryptability and tamper detection across both key sources; (iii) symmetric throughput of ≈ 1.1GB/s with negligible adaptation overhead; and (iv) near-ideal ciphertext metrics including entropy 8.02bits/pixel, NPCR ≈ 99.6%, and UACI ≈ 30.7%. The framework achieves secure, continuous encryption by preventing unsafe QKD use and maintaining authenticated operation under quantum-channel degradation.

Anomaly Detection (AD) is an important area of research because it helps identify outliers in data, enabling early detection of errors, fraud, and potential security breaches. Machine Learning (ML) can be utilized for distinct AD systems, and Generative Adversarial Networks (GANs) have emerged as a promising technique due to their ability to generate new data that closely resembles a given dataset, allowing for the creation of realistic images, videos, audio, text, and other types of synthetic data. This paper explores state-of-the-art approaches in AD using GANs. The paper starts by providing a comprehensive overview of ML techniques for AD, including supervised, unsupervised, and semi-supervised approaches. This survey also explores various AD approaches based on GANs and provides an application-based classification of GANs-based AD approaches in the Internet-of-Things (IoT), Industrial IoT, Digital Healthcare, Energy Management Systems, and Cellular Network domains. Moreover, the paper discusses several datasets used in evaluating the performance of GANs-based AD techniques such as BOT-IoT, TON-IoT, CIC-IoT, CIC-IDS, and NSL-KDD. These datasets serve as valuable resources for researchers and practitioners to develop and test AD systems, particularly in the context of IoT and network security. Furthermore, the paper discusses the challenges and limitations of GANs-based AD techniques and proposes future research directions to address these challenges.

The security of image data in the Internet of Things (IoT) and edge networks is crucial due to the increasing deployment of intelligent systems for real-time decision-making. Traditional encryption algorithms such as AES and RSA are computationally expensive for resource-constrained IoT devices and ineffective for large-volume image data, leading to inefficiencies in privacy-preserving distributed learning applications. To address these concerns, this paper proposes a novel Feature-Aware Chaotic Image Encryption scheme that integrates Feature-Aware Pixel Segmentation (FAPS) with Chaotic Chain Permutation and Confusion mechanisms to enhance security while maintaining efficiency. The proposed scheme consists of three stages: (1) FAPS, which extracts and reorganizes pixels based on high and low edge intensity features for correlation disruption; (2) Chaotic Chain Permutation, which employs a logistic chaotic map with SHA256-based dynamically updated keys for block-wise permutation; and (3) Chaotic chain Confusion, which utilises dynamically generated chaotic seed matrices for bitwise XOR operations. Extensive security and performance evaluations demonstrate that the proposed scheme significantly reduces pixel correlation— almost zero, achieves high entropy values close to 8, and resists differential cryptographic attacks. The optimum design of the proposed scheme makes it suitable for real-time deployment in resource-constrained environments.

The increasing connectivity of Internet of Things (IoT) devices and networks has significantly raised security concerns. Intrusion detection systems (IDSs) serve as a firstline defense mechanism to detect and identify various cyber threats. However, traditional IDSs frameworks come with their own challenges, such as high computational costs, limited generalization to evolving variants of cyberattacks, increasing complexity, and vulnerability to adversarial attacks. This paper proposes a meta-learning-based IDS framework using Model-Agnostic Meta-Learning (MAML) to particularly combat adversarial attacks in IoT networks. The designed architecture optimizes model initialization by performing inner-loop updates using adversarially perturbed data. It aggregates gradients from these adversarially adapted models in the outer loop to achieve a resilient initialization that generalizes well against adversarial attacks. The proposed approach is rigorously evaluated by training and testing the model on three major adversarial attacks: Fast Gradient Sign Method (FGSM), Projected Gradient Descent (PGD), and DeepFool. The experimental outcomes indicate the promising performance of the proposed architecture with an average attack detection accuracy of 95.97%. The compact model size of 0.06MB makes it suitable for deployment on resource-constrained IoT devices and networks. Furthermore, the lower inferencing time ensures the timely detection of intrusion, which is significant for real-time IDSs.

With the widespread use of the Internet of Things (IoT), securing the storage and transmission of multimedia content across IoT devices is a critical concern. Chaos-based Pseudo-Random Number Generators (PRNGs) play an essential role in enhancing the security of image encryption algorithms. This paper introduces a novel 1-dimensional cosine-modulated-polynomial chaotic map to be used as a PRNG in image encryption algorithms. The proposed map utilizes a cosine function to modulate the outcome of a polynomial expression, resulting in complex chaotic behaviour. The designed map acts as a self-modulating system and offers a larger chaotic range, reduced structural complexity, and enhanced chaotic properties, such as aperiodicity, unpredictability, ergodicity, and sensitivity to control parameters and initial conditions, in comparison to the traditional 1-dimensional chaotic maps. An extensive evaluation is performed to gauge the chaotic behaviour of the proposed map, including bifurcation diagrams, chaotic trajectory analysis, fixed point and stability analysis, Lyapunov Exponent, Kolmogorov Entropy and NIST SP800-22 tests demonstrating its effectiveness to be used as a secure PRNG in image encryption algorithms.

Digital transformation is a method where new technologies replace the old to meet essential organisational requirements and enhance the end-user experience. Technological transformation often improvises the manner in which a facility or resources are delivered to the recipient. Data is one of the key assets of every organisation which influences significantly reaching the long-term objective. Thus, the entities, as well as technologies involved in the data management process, have a significant role to play to secure different data types. However, the traditional data governance process often follows a centralised approach and thus resulting in various cyber attacks, whereas the distributed approaches are mostly research prototypes and often comprise various security challenges. Security incidents such as data theft fabricate the integrity of confidential data and thus the consequences are often disastrous. To address the challenges, we introduce TRUSTEE, a data-driven platform which aims to provide a secure and privacy-by-design framework to empower companies, organisations, and individuals to access different data domains, use and re-use the data and metadata to extract knowledge with trust and confidentiality. In this paper, we assess the effectiveness of the platform by reviewing the potential challenges and threats associated with the incorporated technologies. Our research emphasises the efficacy of distributed technologies to indicate their significance in data integrity and security.

In the era of Industrial IoT (IIoT) and Industry 4.0, ensuring secure data transmission has become a critical concern. Among other data types, images are widely transmitted and utilized across various IIoT applications, ranging from sensor-generated visual data and real-time remote monitoring to quality control in production lines. The encryption of these images is essential for maintaining operational integrity, data confidentiality, and seamless integration with analytics platforms. This paper addresses these critical concerns by proposing a robust image encryption algorithm tailored for IIoT and Cyber-Physical Systems (CPS). The algorithm combines Rule-30 cellular automata with chaotic scrambling and substitution. The Rule 30 cellular automata serves as an efficient mechanism for generating pseudo-random sequences that enable fast encryption and decryption cycles suitable for realtime sensor data in industrial settings. Most importantly, it induces non-linearity in the encryption algorithm. Furthermore, to increase the chaotic range and keyspace of the algorithm, which is vital for security in distributed industrial networks, a hybrid chaotic map, i.e., logistic-sine map is utilized. Extensive security analysis has been carried out to validate the efficacy of the proposed algorithm. Results indicate that our algorithm achieves close-to-ideal values, with an entropy of 7.99 and a correlation of 0.002. This enhances the algorithm's resilience against potential cyber-attacks in the industrial domain.

Advances in quantum computing make Shor’s algorithm for factorising numbers ever more tractable. This threatens the security of any cryptographic system which often relies on the difficulty of factorisation. It also threatens methods based on discrete logarithms, such as with the Diffie-Hellman key exchange method. For a cryptographic system to remain secure against a quantum adversary, we need to build methods based on a hard mathematical problem, which are not susceptible to Shor’s algorithm and create Post Quantum Cryptography (PQC). While high-powered computing devices may be able to run these new methods, we need to investigate how well these methods run on limited powered devices. This paper outlines an evaluation framework for PQC within constrained devices, and contributes to the area by providing benchmarks of the front-running algorithms on a popular single-board low-power device. It also introduces a set of five notions which can be considered to determine the robustness of particular algorithms.

Machine learning and Artificial Intelligence (AI) already support human decision-making and complement professional roles, and are expected in the future to be sufficiently trusted to make autonomous decisions. To trust AI systems with such tasks, a high degree of confidence in their behaviour is needed. However, such systems can make drastically different decisions if the input data is modified, in a way that would be imperceptible to humans. The field of Adversarial Machine Learning studies how this feature could be exploited by an attacker and the countermeasures to defend against them. This work examines the Fast Gradient Signed Method (FGSM) attack, a novel Single Value attack and the Label Flip attack on a trending architecture, namely a 1-Dimensional Convolutional Neural Network model used for time series classification. The results show that the architecture was susceptible to these attacks and that, in their face, the classifier accuracy was significantly impacted.

The spread of COVID-19 has highlighted the need for a robust contact tracing infrastructure that enables infected individuals to have their contacts traced, and followed up with a test. The key entities involved within a contact tracing infrastructure may include the Citizen, a Testing Centre (TC), a Health Authority (HA), and a Government Authority (GA). Typically, these different domains need to communicate with each other about an individual. A common approach is when a citizen discloses his personally identifiable information to both the HA a TC, if the test result comes positive, the information is used by the TC to alert the HA. Along with this, there can be other trusted entities that have other key elements of data related to the citizen. However, the existing approaches comprise severe flaws in terms of privacy and security. Additionally, the aforementioned approaches are not transparent and often being questioned for the efficacy of the implementations. In order to overcome the challenges, this paper outlines the PAN-DOMAIN infrastructure that allows for citizen identifiers to be matched amongst the TA, the HA and the GA. PAN-DOMAIN ensures that the citizen can keep control of the mapping between the trusted entities using a trusted converter, and has access to an audit log.

Threat information sharing is considered as one of the proactive defensive approaches for enhancing the over-all security of trusted partners. Trusted partner organizations can provide access to past and current cybersecurity threats for reducing the risk of a potential cyberattack—the requirements for threat information sharing range from simplistic sharing of documents to threat intelligence sharing. Therefore, the storage and sharing of highly sensitive threat information raises considerable concerns regarding constructing a secure, trusted threat information exchange infrastructure. Establishing a trusted ecosystem for threat sharing will promote the validity, security, anonymity, scalability, latency efficiency, and traceability of the stored information that protects it from unauthorized disclosure. This paper proposes a system that ensures the security principles mentioned above by utilizing a distributed ledger technology that provides secure decentralized operations through smart contracts and provides a privacy-preserving ecosystem for threat information storage and sharing regarding the MITRE ATT&CK framework.

Data analysis and machine learning methods often involve the processing of cleartext data, and where this could breach the rights to privacy. Increasingly, we must use encryption to protect all states of the data: in-transit, at-rest, and in-memory. While tunnelling and symmetric key encryption are often used to protect data in-transit and at-rest, our major challenge is to protect data within memory, while still retaining its value. Ho-momorphic encryption, thus, could have a major role in protecting the rights to privacy, while providing ways to learn from captured data. Our work presents a novel use case and evaluation of the usage of homomorphic encryption and machine learning for privacy respecting state surveillance.

Phishing is considered to be one of the most prevalent cyber-attacks because of its immense flexibility and alarmingly high success rate. Even with adequate training and high situational awareness, it can still be hard for users to continually be aware of the URL of the website they are visiting. Traditional detection methods rely on blacklists and content analysis, both of which require time-consuming human verification. Thus, there have been attempts focusing on the predictive filtering of such URLs. This study aims to develop a machine-learning model to detect fraudulent URLs and be used within the Splunk platform. Inspired from similar approaches in the literature, we trained the SVM and Random Forests algorithms using malicious and benign datasets found in the literature and one dataset that we created. We evaluated the algorithms' performance with precision and recall reaching up to 85% precision and 87% recall in the case of Random Forests while SVM achieved up to 90% precision and 88% recall using only descriptive features.

Insider threats continue to present a major challenge for the information security community. Despite constant research taking place in this area; a substantial gap still exists between the requirements of this community and the solutions that are currently available. This paper uses the CERT dataset r4.2 along with a series of machine learning classifiers to predict the occurrence of a particular malicious insider threat scenario - the uploading sensitive information to wiki leaks before leaving the organization. These algorithms are aggregated into a meta-classifier which has a stronger predictive performance than its constituent models. It also defines a methodology for performing pre-processing on organizational log data into daily user summaries for classification, and is used to train multiple classifiers. Boosting is also applied to optimise classifier accuracy. Overall the models are evaluated through analysis of their associated confusion matrix and Receiver Operating Characteristic (ROC) curve, and the best performing classifiers are aggregated into an ensemble classifier. This meta-classifier has an accuracy of 96.2% with an area under the ROC curve of 0.988.

Domain squatting is a common adversarial practice where attackers register domain names that are purposefully similar to popular domains. In this work, we study a specific type of domain squatting called "combosquatting," in which attackers register domains that combine a popular trademark with one or more phrases (e.g., betterfacebook[.]com, youtube-live[.]com). We perform the first large-scale, empirical study of combosquatting by analyzing more than 468 billion DNS records - collected from passive and active DNS data sources over almost six years. We find that almost 60% of abusive combosquatting domains live for more than 1,000 days, and even worse, we observe increased activity associated with combosquatting year over year. Moreover, we show that combosquatting is used to perform a spectrum of different types of abuse including phishing, social engineering, affiliate abuse, trademark abuse, and even advanced persistent threats. Our results suggest that combosquatting is a real problem that requires increased scrutiny by the security community.