Federated learning has advanced intrusion detection systems (IDS) by enabling collaborative model training without requiring direct data sharing. This approach allows multiple institutions to contribute to and benefit from a shared model, enhancing detection capabilities. Despite these advances, the security of model updates remains a significant concern, as malicious actors may reverse-engineer the underlying data from these updates. Additionally, existing federated learning techniques struggle with non-IID (non-Independent and Identically Distributed) data distributions and are vulnerable to inference attacks on model updates. For example, methods like SignSGD , while providing some privacy benefits through gradient sign manipulation, suffer from accuracy degradation, especially when dealing with non-IID data. Similarly, FedAvg , while effective in handling non-IID data, is prone to privacy breaches as it transmits full model updates, potentially revealing sensitive information. To address these challenges, we propose SAFE-IDS , a novel framework combining gradient sign-based aggregation with the zSignFedAvg optimizer. Unlike SignSGD , it incorporates a unified learning rate and weighted loss function to mitigate accuracy loss in non-IID settings. Additionally, while FedAvg shares full model updates, SAFE-IDS only shares gradient signs, enhancing privacy. The integration of zSignFedAvg balances privacy and convergence speed, accelerating convergence and improving robustness, particularly for class imbalance. Notably, SAFE-IDS is the first federated network intrusion detection system that effectively maintains privacy while adeptly managing non-IID data. Our empirical evaluation demonstrates that SAFE-IDS achieves an impressive accuracy of up to 99.74% across various IDS datasets and a varying number of clients, proving its effectiveness in both securing client data and maintaining high model performance.

Abstract Password-based authenticated key exchange (PAKE) allows two parties to compute a common secret key. PAKE offers the advantage of allowing two parties to pre-share only a password. However, when it is executed in a client–server environment, server corruption can expose the clients’ passwords. To be resilient against server compromises, verifier-based authenticated key exchange (VPAKE) is proposed, as an augmented version of PAKE. Thus far, there are two known major VPAKE constructions formally proven secure. However, both involve strong assumptions, such as random oracles. In this paper, we propose a simple and efficient VPAKE using tamper-proof hardware without random oracles to support resilient infrastructures. In particular, we transform Katz–Vaikuntanathan one-round PAKE into two-round VPAKE so as to instill resilience to server compromises. We provide a formal definition of VPAKE using tamper-proof hardware and security proof without random oracles. Finally, we provide a performance analysis and comparisons to previous VPAKE and PAKE protocols. Our transformation supports an efficient VPAKE protocol with six group element communications when the underlying Katz–Vaikuntanathan PAKE is instantiated by Cramer–Shoup ciphertext following the proposal by Benhamouda et al.

Personal Identification Numbers (PINs) and pattern drawing have been used as common authentication methods especially on smartphones. Such methods, however, are very vulnerable to the shoulder surfing attack. Thus, keystroke dynamics that authenticate legitimate users based on their typing manner have been studied for years. However, many of the studies have focused on PC keyboard keystrokes. More studies on mobile and smartphones keystroke dynamics are warranted; as smartphones make progress in both hardware and software, features from smartphones have been diversified. In this paper, using various features including keystroke data such as time interval and motion data such as accelerometers and rotation values, we evaluate features with motion data and without motion data. We also compare 5 formulas for motion data, respectively. We also demonstrate that opposite gender match between a legitimate user and impostors has influence on authenticating by our experiment results.

The objective of this study is to develop a tidal flat reflectance model according to tidal conditions. Tidal flat reflectance greatly varies with tidal conditions twice a day that causes changes in water contents along with exposure time, remnant water, etc. It is difficult to retrieve sediment grain size from optical reflectance alone without correcting the tidal condition effects. The Geostationary Ocean Color Imager (GOCI) is the first ocean color sensor mounted on the geostationary satellite, and provides images 8 times a day. A preliminary tidal flat reflectance model was obtained from 72 cloud free GOCI images in March, 2011. Two reflectance models were found to be minimally required for mud and mixed flats, while the differences between mixed and sand flats were insignificant. The models accommodate tidal conditions of flood or ebb tide. The results lead to a conclusion that the remnant surface water on the recently exposed tidal flats plays a significant role in influencing the optical reflectance. The surface reflectance increases gradually during the ebb tide, while the slope of decrease is steep during the flood tide.

Protocols for authenticated key exchange (AKE) allow parties within an insecure network to establish a common session key which can then be used to secure their future communication. It is fair to say that group AKE is currently less well understood than the case of two-party AKE; in particular, attacks by malicious insiders --- a concern specific to the group setting --- have so far been considered only in a relatively "ad-hoc" fashion. The main contribution of this work is to address this deficiency by providing a formal, comprehensive model and definition of security for group AKE which automatically encompasses insider attacks. We do so by defining an appropriate ideal functionality for group AKE within the universal composability (UC) framework. As a side benefit, any protocol secure with respect to our definition is secure even when run concurrently with other protocols, and the key generated by any such protocol may be used securely in any subsequent application.In addition to proposing this definition, we show that the resulting notion of security is strictly stronger than the one proposed by Bresson, et al. (termed "AKE-security"), and that our definition implies all previously-suggested notions of security against insider attacks. We also show a simple technique for converting any AKE-secure protocol into one secure with respect to our definition.