Large Language Models (LLMs) have demonstrated advanced capabilities in code generation and manipulation, inspiring growing concerns about their potential to enhance malware obfuscation. Nevertheless, the cybersecurity literature still lacks wide experimental evidence comparing LLM-driven knowledge-based malware evasion to traditional metamorphic engines. This paper addresses this critical research void through three key contributions: (1) a structured methodology leveraging commercial LLMs (GPT, Claude, DeepSeek, Gemini) against traditional metamorphic engines (MetaMe) using YARA rule detection; (2) experimental evidence demonstrating that LLMs produce variants with significantly higher structural diversity and improved evasion against signature-based detection compared to traditional metamorphic engines, generating variants with substantially greater structural diversity and high evasion rates against signature-based detection; and (3) analysis of LLM-transformed real-world malware (Alina-POS) mutations that systematically evade YARA detection signatures while preserving malicious functionality. Our key insight reveals that LLMs leverage semantic understanding rather than syntactic transformations to achieve effective structural variation in code generation. These findings suggest an emerging trend towards knowledge-based evasion techniques, creating a computational asymmetry where generating sophisticated malware variants requires significantly less expertise and effort than detecting them. This emerging imbalance highlights potential challenges for current malware detection approaches and defensive strategies. • Large Language Models can generate malware variants with higher structural diversity than traditional metamorphic engines. • Empirical analysis shows LLM-based variants achieve improved evasion against signature-based detection. • Evaluation across syscall patterns and structural metrics characterizes transformation behavior and its impact on detection signatures.

Protection of data-in-use is a key priority, for which Trusted Execution Environment (TEE) technology has unarguably emerged as a — possibly the most — promising solution. Multiple server-side TEE offerings have been released over the years, exhibiting substantial differences with respect to several aspects. The first comer was Intel SGX, which featured Process-based TEE protection, an efficient yet difficult to use approach. Some SGX limitations were (partially) overcome by runtimes, notably: Gramine , Scone , and Occlum . A major paradigm shift was later brought by AMD SEV, with VM-based TEE protection, which enabled ”lift-and-shift” deployment of legacy applications. This new paradigm has been implemented by Intel only recently, in TDX. While the threat model of the aforementioned TEE solutions has been widely discussed, a thorough performance comparison is still lacking in the literature. This paper provides a comparative evaluation of TDX , SEV , Gramine-SGX , and Occlum-SGX . We study computational overhead and resource usage, under different operational scenarios and using a diverse suite of legacy applications. By doing so, we provide a reliable performance assessment under realistic conditions. We explicitly emphasize that — at the time of writing — TDX was recently released to the public. Thus, the evaluation of TDX is a unique feature of this study.

Generative Adversarial Networks (GANs) are emerging as a transformative technology in cybersecurity, presenting both opportunities and challenges in enhancing defensive and offensive strategies. This paper explores the impact that Generative Artificial Intelligence (AI) has on cybersecurity, focusing on its application in the field of network and web security. Current research reveals robust defensive approaches; however, there remains a significant gap in the application of Generative AI to develop advanced attack scenarios capable of bypassing existing defense mechanisms. Our work attempts to fill this gap and spreads awareness regarding a potential exposure of Neural Network (NN)-based Intrusion Detection Systems (IDSs) against AI-enhanced attacks. Unlike conventional approaches that focus on Input Perturbation, Data Poisoning, or Spoofing, we propose a novel offensive strategy called Attack Obfuscation. This strategy leverages Conditional GANs (CGANs) to conceal genuine attacks by injecting synthetic traffic designed to deceive NN-based IDS. The experimental investigation validates the proposed approach against three distinct datasets and different typologies of attacks, managing to successfully deceive the IDS.

The evolution from traditional power grids to modern smart grids marks a significant advancement in energy management and efficiency. This transition—driven by the implementation of bidirectional energy and information flows—results in a dramatic increase in infrastructure vulnerability since new entry points are introduced on the attack surface. In particular, prosumers represent a brand new—and, thus, largely unexplored—attack vector, for which a thorough re-evaluation of the existing security measures is very much needed. This article proposes a novel approach to security monitoring, which exploits business process knowledge to effectively identify and mitigate prosumer-specific advanced persistent threats in smart grids. To validate the approach, an experimental campaign is done in a real setup, specifically the power grid of the Berchidda municipality, in Italy. Impact evaluation covers technical as well as business aspects since the analysis includes potential economic consequences of the attacks.

The adoption of Digital Twin technology has witnessed significant growth in various domains, enabling continuous monitoring and testing in diverse applications. In the context of safeguarding critical infrastructures, particularly smart grids, Digital Twin has emerged as a viable solution to meet the requirements outlined in the NIS2 directive issued by the European Commission. Additionally, the increasing trend in Europe towards establishing shared dataspaces, and fostering collaborative environments through data sharing, necessitates a heightened focus on cybersecurity risks.

An important objective being pursued by the European Commission is the establishment of a unified data market where stakeholders can safely and confidently share and exchange data in standardized formats. This trend is supported by numerous initiatives, promoting the creation of European Common data spaces, and it is already in full swing in several sectors, such as energy and health. Among the many initiatives for building common data spaces, FIWARE appears to be one of the most promising. FIWARE promotes the use of Digital Twin technology to build distributed infrastructures for facilitating real-time data sharing in collaborative environments. By fostering an open and collaborative approach to software development and providing several building blocks of IT architectures for a number of domains (specifically: Smart AgriFood, Smart Cities, Smart Energy, Smart Industry, and Smart Water), FIWARE facilitates the creation of Digital Twins of real-world Industry 4.0 setups in a shared data space, which is typically hosted in the cloud. This paper addresses the security issues in a typical functional FIWARE architecture and provides a detailed description of a reference solution which ensures data confidentiality and integrity throughout the data life cycle, i.e. from the generation to the consumption phase. The proposed solution strongly relies on Commercial Off The Shelf Trusted Execution Environment technologies (namely: Intel SGX and Arm TrustZone) to provide effective protection of data-in-use. Protection of data-at-rest and data-in-transit is achieved by means of advanced cryptographic techniques and secure communication protocols, respectively.

The use of pervasive IoT devices in Smart Cities, have increased the Volume of data produced in many and many field. Interesting and very useful applications grow up in number in E-health domain, where smart devices are used in order to manage huge amount of data, in highly distributed environments, in order to provide smart services able to collect data to fill medical records of patients. The problem here is to gather data, to produce records and to analyze medical records depending on their contents. Since data gathering involve very different devices (not only wearable medical sensors, but also environmental smart devices, like weather, pollution and other sensors) it is very difficult to classify data depending their contents, in order to enable better management of patients. Data from smart devices couple with medical records written in natural language: we describe here an architecture that is able to determine best features for classification, depending on existent medical records. The architecture is based on pre-filtering phase based on Natural Language Processing, that is able to enhance Machine learning classification based on Random Forests. We carried on experiments on about 5000 medical records from real (anonymized) case studies from various health-care organizations in Italy. We show accuracy of the presented approach in terms of Accuracy-Rejection curves.

Protecting data-in-use from privileged attackers is challenging. New CPU extensions (notably: Intel SGX) and cryptographic techniques (specifically: Homomorphic Encryption) can guarantee privacy even in untrusted third-party systems. HE allows sensitive processing on ciphered data. However, it is affected by i) a dramatic ciphertext expansion making HE unusable when bandwidth is narrow, ii) unverifiable conditional variables requiring off-premises support. Intel SGX allows sensitive processing in a secure enclave. Unfortunately, it is i) strictly bonded to the hosting server making SGX unusable when the live migration of cloud VMs/Containers is desirable, ii) limited in terms of usable memory, which is in contrast with resource-consuming data processing. In this article, we propose the VIrtual Secure Enclave (VISE), an approach that effectively combines the two aforementioned techniques, to overcome their limitations and ultimately make them usable in a typical cloud setup. VISE moves the execution of sensitive HE primitives (e.g., encryption) to the cloud in a remotely attested SGX enclave, and then performs sensitive processing on HE data-outside the enclave-leveraging all the memory resources available. We demonstrate that VISE meets the challenging security and performance requirements of a substantial application in the Industrial Control Systems domain. Our experiments prove the practicability of the proposed solution.

Modern cars include a huge number of sensors and actuators, which continuously exchange data and control commands. The most used protocol for communication of different components in automotive system is the Controller Area Network (CAN). According to CAN, components communicate by broadcasting messages on a bus. In addition, the standard definition of the protocol does not provide information for authentication, so exposing it to attacks. This paper proposes a method based on deep learning aiming at discovering attacks towards the CAN-bus. In particular, Neural Networks and MultiLayer Perceptrons are the class of networks employed in our approach. We also validate our approach by analysing a real-world dataset with the injection of messages from different types of attacks: denial of service, fuzzy pattern attacks, and attacks against specific components. The obtained results are encouraging and demonstrate the effectiveness of the approach.

In the recent years, we are assisting to an undiminished, and unlikely to stop number of cyber threats, that have increased the organizations/companies interest about security concerns. Further, the rising costs of an efficient IT security staff and environment is posing a significant challenge. These have created a new fast growing trend named Managed Security Services (MSS). Often customers turn to MSS providers to alleviate the pressures they face daily related to information security. One of the most critical aspect, related to the outsourcing of security issues, is privacy. Security monitoring and in general security services require access to as much data as possible, in order to provide an effective and reliable service. It is the well known conflict between privacy and security, a particularly evident problem in security monitoring solutions. This paper analyzes a scenario of MSS in order to provide a privacy preserving solution that allows the security monitoring without violating the privacy requirements. The basic idea relies on the usage of the Homomorphic Encryption technology. Encrypting data using homomorphic schemes, cloud computing and MSS providers can perform different computations on encrypted data without ever having access to their decryption. This solution keeps data confidential and secured, not only during exchange and storage, but also during processing. We provide an ad-hoc Intrusion Detection System architecture for privacy preserving security monitoring, considering as counter threats Code Injection attacks on homomorphically encrypted fields.

The cloud computing has recently emerged as compelling paradigm for managing and delivery services over the internet. However, users as well as critical infrastructure operators, have legitimate concerns about the confidentiality, integrity and availability, in short the dependability, of applications and their data hosted on a third-party cloud. The dependability is become a commercial imperative for cloud providers, especially to support cloud computing for critical infrastructures. In this paper the SecureCloud project, its approach and goals are presented. SecureCloud aims to remove technical impediments to dependable cloud computing, encouraging and enabling a greater uptake of cost-effective, environment-friendly, and innovative cloud solutions, in particular, for critical infrastructure applications.

During the last decade, we witnessed a constantly increasing digitalization in the health-care domain that, while from the one hand, has increased the average life expectancy representing one of the crowning achievements of the last years, from the other hand, has introduced extra challenges due to the simultaneous increasing of the proliferation of cyber-crime and the creation of malicious applications which try to access health sensitive data. This created the need for increased security implementations, leading to improved user acceptance of such applications and thus to large-scale adoption of these technologies and to full exploitation of their advantages. We here propose the use of a SIEM-based framework specifically tailored for a healthcare portal developed within the context of the Italian National Project eHealthNet, which allows real time monitoring of portal accesses with the aim of detecting potential threats and anomalies that could cause major security issues.

Freedom of movement in the European Union (EU) requires the possibility to exchange healthcare - related information across borders. Such an interchange must face legal, technical and security issues. In this work, we provide a technical analysis of the state - of - the - art software for cross - border eHealth data exchange in the EU, namely OpenNCP, from the security point of view. Moreover, we present a number of solutions that will be developed during the 36 - months, EU - funded KONFIDO project to improve the security of healthcare - related data exchange and to add support for smart IoT sensors.

The cloud computing paradigm is gaining more and more momentum, to the extent that it is no more confined to its initial application domains, i.e. use by enterprises and businesses that are simply willing to lower costs or to increase computing capacity in a flexible manner. In particular, increasing interest is recently being paid to the dramatic potentials that the use of cloud computing technology by critical infrastructure (CI) operators might bring about, in terms of benefits for the society at large. Since accidental or deliberate damage to a CI may result in devastating consequences, this mandates for dependable and trustworthy security mechanisms in cloud platforms. In this paper, we present a distributed application for real-Time monitoring of a Power Grid. The application, which is called PoGriMon, is deployed on top of the SecureCloud platform, a security-enhanced IaaS solution that exploits the Intel Software Guard eXtension (SGX) technology. PoGriMon has been designed based on the requirements of the SCADA network of the Israeli Electric Corporation (IEC), and it is currently being validated in a realistic setup also provided by IEC.

In the era of the global economy the container shipping represents a fundamental link of the logistic chain of the multimodal transport. The optimization of the cargo handling and, generally, of the port operations becomes a challenge for improving the performance of the whole supply chain. The adoption of Information and Communication Technologies can largely support operations management in a container terminal. On the other hand, the terroristic threats have dramatically increased the need for protecting critical infrastructures like ports, railway stations, airports. In this paper we describe the case study of the SIS-TEMA project which aims at designing a secure integrated framework for management of port operations. An architecture which guarantees both the efficiency of terminal operations and the security of the overall critical infrastructure is presented.

While techniques for offline testing of FPGAs, either manufacturing-oriented or application-oriented, are today relatively mature, in critical applications such as avionics, space, and even numerous commercial products it is often necessary to perform online testing. In this paper, we present a technique for online testing of digital designs implemented on an FPGA. The approach enables application-oriented testing, in that it covers the subset of the FPGA which is actually used for the implemented design, and considers scenarios where the FPGA component is a part of a larger embedded system. The proposed approach is in fact based on a software framework, which acts as an abstraction layer for reconfigurable hardware resources. Essentially, the framework exposes to software applications a Register-Transfer Level view of the underlying hardware, allowing test procedures to be implemented as software programs. Our approach is especially advantageous when memory is a constraint, the case of many embedded systems. As proved by experimental results, in fact, test procedures turn out to be very compact and much more memory-efficient than conventional approaches relying on static sets of FPGA testing configurations to be stored in system memory.

Today's business processes are rarely accomplished inside the companies domains. More often they involve entities geographically distributed which interact in a loosely coupled cooperation. While cooperating, these entities generate transactional data streams, such as sequences of stock-market buy/sell orders, credit-card purchase records, Web server entries, and electronic fund transfer orders. Such streams are often collections of events stored and processed locally, and they thus have typically ad-hoc, heterogeneous formats. On the other hand, elements in such data streams usually share a common semantics and indeed they can be profitably mined in order to obtain combined global events. In this paper, we present an approach to the parsing of heterogeneous data streams based on the definition of format-dependent grammars and automatic production of ad-hoc parsers. The stream-dependent parsers can be obtained dynamically in a totally automatic way, provided that the appropriate grammar, written in a common format, is fed into the system. We also present a fully working implementation, that has been successfully integrated into a telecommunication environment for real-time processing of billing information flows

Information security is a key requirement in emerging networked scenarios, which typically involve a large variety of heterogeneous, often resource-constrained devices. Providing security to this emerging class of distributed applications raises a number of new challenges. This paper discusses such challenges with respect to two key security services, namely public key certification and digital timestamping, and presents a multi-tier architecture which combines a hardware-accelerated back-end and a Web Services based Web tier to for achieving interoperability while boosting performance. The paper describes the organization of the multi-tier architecture, provides a detailed description of individual components, and presents the results of a thorough experimental campaign

Recent advances in wireless technologies have enabled pervasive connectivity to Internet scale systems which include heterogeneous mobile devices, such as mobile phones and personal digital assistants, a trend which is generally referred to as ubiquitous computing. This leads to the need for providing security functions to applications which are partially deployed over wireless devices. Delivering security services to mobile devices raises a number of challenging issues, mostly related to the limited amount of computing power which is typically available on the target plat-forms. Some promising solutions rely on multi-tier architectures, which are based on the emerging Web services technology. In this scenario, understanding the impact of architectural characteristics of specific platforms is a key issue for practitioners who have to develop and deploy efficient security-enabled applications on mobile devices. This paper provides an experimental study of the impact that specific characteristics of individual mobile device platforms have on the final performance of security applications. Focus is on performance and resource utilization, which are key aspects when one develops applications on mobile devices. The case study is a Web services based solution for delivering public key infrastructure (PKI) services to mobile devices. Experiments have been conducted on three different mobile terminals, which span a large range of characteristics in the class of resource-constrained devices. Results show that: i) performance figures are not uniform in spite of similar underlying hardware characteristics, and ii) security and performance are often conflicting requirements

In recent years, elliptic curve cryptography (ECC) has gained widespread exposure and acceptance, and has already been included in many security standards. Engineering of ECC is a complex, interdisciplinary research field encompassing such fields as mathematics, computer science, and electrical engineering. In this paper, we survey ECC implementation issues as a prominent case study for the relatively new discipline of cryptographic engineering. In particular,we show that the requirements of efficiency and security considered at the implementation stage affect not only mere low-level, technological aspects but also, significantly, higher level choices, ranging from finite field arithmetic up to curve mathematics and protocols.