The Internet of Vehicles (IoV) has emerged as a key enabler of Intelligent Transportation Systems (ITS), IoV faces significant challenges in scalability and security. The growing volume of real-time vehicular data strains network resources, and traditional centralized architectures introduce single points of failure that compromise reliability and data integrity. This paper investigates the integration of IOTA-a Directed Acyclic Graph (DAG) based distributed ledger designed for feeless and scalable transactions-into the IoV system. In the proposed architecture, vehicles operate as lightweight nodes and roadside units function as full nodes, yielding a resource-efficient architecture for secure, tamper-resistant data interaction across vehicular networks. We formally model the latency of transaction propagation and consensus confirmation phases to gain insight into its performance characteristics under high concurrency. We conducted extensive simulations under diverse traffic conditions on a private IOTAenabled vehicular network. Experimental results demonstrate that the IOTA-based IoV system achieves low latency on the order of a few milliseconds and high throughput of hundreds of transactions per second even as vehicle density increases. The system exhibits strong scalability and operational stability, indicating considerable potential for deployment in real-world ITS environments.

Recently, in-vehicle infotainment (IVI) systems, also called car audio video navigation (AVN) systems hold a wealth of digital data valuable for forensic investigations, encompassing navigation history, call logs, and Bluetooth connections. They serve as central hubs for entertainment, communication, and navigation, storing crucial evidence for accidents, thefts, and cybercrimes. Therefore, forensic investigations of IVI systems are becoming increasingly important. In this paper, we conduct a forensic analysis of an Android Jellybean-based AVN system installed in Kia K5 2017. We first efficiently collect system logs as well as navigation logs using the log menu of an engineering mode provided by the car manufacturer company. Therefore, our data collection method does not require a chip-off technique or rooting of the AVN system. Next, we analyze the collected logs systematically and the differences between the two types of log data. Our forensic investigation method can provide insights into occupant activities and reconstruct events leading to incidents and car crimes.

A large amount of data now being transferred through networks has made deep packet inspection (DPI) an essential part of security activities. Several DPI systems are developed based on Bloom filters to defend against malicious worm attacks through the Internet. These approaches have achieved significant performance. However, they do not permit deletion of items from the set of target patterns. This study proposes two multiple pattern matching schemes for DPI to exploit high parallelism capacity of graphics processing units (GPUs). Firstly, a GPU‐based Cuckoo filter scheme is proposed by adopting a new approximate set membership, called Cuckoo filter, for parallel multiple pattern matching. The Cuckoo filter has many advantages over the Bloom filter such as higher insert performance, higher lookup throughput, less memory consumption, less false positive rate, and delete operation support. Secondly, an implementation of the GPU‐based Cuckoo filter, called GPUshared‐based Cuckoo filter is proposed. This scheme can efficiently distribute input string and pre‐processing data in the hierarchical memory of GPUs to optimise the performance of the GPU‐based Cuckoo filter scheme. Experiments show that the proposed schemes offer better performance than the previous approaches based on the Bloom filter.

Unity is the most popular cross-platform development framework to develop games for multiple platforms such as Android, iOS, and Windows Mobile. While Unity developers can easily develop mobile apps for multiple platforms, adversaries can also easily build malicious apps based on the “write once, run anywhere” (WORA) feature. Even though malicious apps were discovered among Android apps written with Unity framework (Unity apps), little research has been done on analysing the malicious apps. We propose static and dynamic reverse engineering techniques for malicious Unity apps. We first inspect the executable file format of a Unity app and present an effective static analysis technique of the Unity app. Then, we also propose a systematic technique to analyse dynamically the Unity app. Using the proposed techniques, the malware analyst can statically and dynamically analyse Java code, native code in C or C ++, and the Mono runtime layer where the C# code is running.

Android application (app) stores contain ahugenumber of apps, which aremanuallyclassified based on the apps’ descriptions into various categories. However, the predefined categories or apps descriptions are usuallynotvery accurate to reflect the real functionalities of apps, thereby leading tomisclassifythe apps, which may cause serioussecurity issuesandunreliabilityproblem in the app store. Therefore, the automatic app classification is animportantdemand to construct asecure,reliable,integrated, andeasy to navigateapp store. In this paper, we propose an effective method calledAndroClasstoautomaticallyclassify apps based on theirrealfunctionalities by usingrichandcomprehensivefeatures representing theactualfunctionalities of the apps. AndroClass performsthreesteps offeature extraction,feature refinement, andclassification. In the feature extraction step, we extract 14 various features for each app by utilizing aunified tool suite. In the feature refinement step, we applyRandom Forestalgorithm to refine the features. In the classification step, we combine refined features into asingleone and AndroClass is equipped with K‐Nearest Neighbor, Naive Bayes, Support Vector Machine, and Deep Neural Network to classify apps. On the contrary to the existing methods, all the utilized features in AndroClass arestableandclearlyrepresent the actual functionalities of the app, AndroClass doesnotpose any issues to theuser privacy, and our method can be applied to classifyunreleasedornewly releasedapps. The results ofextensiveexperiments with tworeal-worlddatasets and a dataset constructed byhuman expertsdemonstrate the effectiveness of AndroClass where the classification accuracy of AndroClass with the latter dataset is 83.5%.

This paper proposes a novel birthmark, a dynamic API authority vector (DAAV), for detecting software theft. DAAV satisfies four essential requirements for good birthmarks--credibility, resiliency, scalability, and packing-free--while existing birthmarks fail to satisfy all of them together. In particular, existing static birthmarks are unable to handle the packed programs and existing dynamic birthmarks do not satisfy credibility and resiliency. Our experimental results demonstrate that DAAV provides satisfying credibility and resiliency compared with existing dynamic birthmarks and also can cover packed programs.

Packing (or executable compression) is considered as one of the most effective anti-reverse engineering methods in the Microsoft Windows environment. Even though many reversing attacks are widely conducted in the Linux-based embedded system there is no widely used secure binary code packing tools for Linux. This paper presents two secure packing methods that use AES encryption and the UPX packer to protect the intellectual property (IP) of software from reverse engineering attacks on Linux-based embedded system. We call these methods: secure UPX and AES-encryption packing. Since the original UPX system is designed not for software protection but for code compression, we present two anti-debugging methods in the unpacking module of the secure UPX to detect or abort reverse engineering attacks. Furthermore, since embedded systems are highly resource constrained, minimizing unpacking overhead is important. Therefore, we analyze the performance of the two packing methods from the perspective of: (i) code size, (ii) execution time, and (iii) power consumption. Our analysis results show that the Secure UPX performs better than AES-encryption packing in terms of the code size, execution time, and power consumption.

Validation methods for hard real-time jobs are usually performed based on the maximum execution time. The actual execution time of jobs are assumed to be known only when the jobs arrive or not known until they finish. A predictable algorithm must guarantee that it can generate a schedule for any set of jobs such that the finish time for the actual execution time is no later than the finish time for the maximum execution time. It is known that any job-level fixed priority algorithm (such as earliest deadline first) is predictable. However, job-level dynamic priority algorithms (such as least laxity first) may or may not. In this paper, we investigate the predictability of a job-level dynamic priority algorithm EDZL (earliest deadline zero laxity). We show that EDZL is predictable on the domain of integers regardless of the knowledge of the actual execution times. Based on this result, furthermore, we also show that EDZL can successfully schedule any periodic task set if the total utilization is not greater than (m + 1)/2, where m is the number of processors