Publisher Copyright: Copyright © 2026 by SCITEPRESS – Science and Technology Publications, Lda.

Decentralized trust systems harbor a paradoxical vulnerability: the emergent rise of a ‘Trust Aristocracy’ that erodes their foundational purpose. While existing models can detect tactical threats, they lack mechanisms to manage this emergent, strategic vulnerability. This paper introduces CrossTrust-IoT, an adaptive framework that presents a paradigm shift from passive observation to active control of decentralization. Our core contribution is the design of the first trust management system to operationalize the Gini coefficient as an evolutionary control variable, thereby transforming a descriptive socio-economic metric into an active defense against influence concentration. We propose a novel dual-loop architecture: a tactical Reinforcement Learning TrustRank (RLTR) for node-level threat detection and a strategic Self-Evolving Trust Architecture (SETA) that monitors the global trust distribution. The SETA’s evolutionary algorithm uses the Gini coefficient directly in its fitness function to penalize influence concentration, actively steering the system’s parameters towards a state of balanced security and decentralization. This mechanism is complemented by privacy-preserving federated learning to train the RLTR model. We validate our framework on the CICIoT2023 dataset and in dynamic agent-based simulations, demonstrating that CrossTrust-IoT achieves a high F1-score of 0.91 for threat detection while preventing trust aristocracy, a failure mode to which even our framework succumbs when the Gini penalty is disabled. This work pioneers a new approach to engineering resilient trust ecosystems by treating decentralization not as a static property, but as a dynamic objective to be actively managed.

In this paper, we present a comprehensive approach for efficient vulnerability detection in Ethereum smart contracts using a multimodal deep learning (DL) approach. Our proposed approach combines two levels of features in smart contracts, including source code, bytecode, and utilizes BERT and Bi-LSTM models to extract and analyze the features. The last layer of our multimodal approach is a fully connected layer that predicts the vulnerability in Ethereum smart contracts. We address the limitations of existing deep learning-based vulnerability detection methods for smart contracts, which often rely on a single type of feature or model, resulting in limited accuracy and effectiveness. The experimental results show that our proposed approach achieves superior results compared to existing state-of-the-art methods, demonstrating the effectiveness and potential of multimodal DL approaches in smart contract vulnerability detection.

Although Software-defined networking (SDN) is a promising architecture that simplifies network management and control, it also faces security problems that may affect the whole network. Hence, protecting strategies, such as intrusion detection and prevention system (IDPS), are in need in the SDN context. The potential of machine learning-based solutions can become the motivation of cut-edge deep learning-based intrusion detection system that can leverage the centralized control and view of the controller to secure the underlying infrastructure. However, performing additional IDPS functions in the controller, which needs to process enormous traffic amounts, can overload this component, and slow down the network. This paper introduces an approach of Big Data analysis for intrusion detection system in SDN, named BIDSDN to enhance the classification perfor-mance with a massive amount of network traffic data. Specifically, we leverage Apache Spark to deploy the distributed deep learning – based detector to reduce the processing time on complex algorithms. The experiments conducted on CICIDS2018 dataset with distributed cluster prove the efficacy in tackling the Big Data-related issues in the large-scale network like SDN.

Revolutionizing operation model of traditional network in programmability, scalability, and orchestration, Software-Defined Networking (SDN) has considered as a novel network management approach for a massive network with heterogeneous devices. However, it is also highly susceptible to security attacks like conventional network. Inspired from the success of different machine learning algorithms in other domains, many intrusion detection systems (IDS) are presented to identify attacks aiming to harm the network. In this paper, leveraging the flow-based nature of SDN, we introduce DeepFlowIDS, a deep learning (DL)-based approach for anomaly detection using the flow analysis method in SDN. Furthermore, instead of using a lot of network properties, we only utilize essential characteristics of traffic flows to analyze with deep neural networks in IDS. This is to reduce the computational and time cost of attack traffic detection. Besides, we also study the practical benefits of applying deep transfer learning from computer vision to intrusion detection. This method can inherit the knowledge of an effective DL model from other contexts to resolve another task in cybersecurity. Our DL-based IDSs are built and trained with the NSL-KDD and CICIDS2018 dataset in both fine-tuning and feature extractor strategy of transfer learning. Then, it is integrated with the SDN controller to analyze traffic flows retrieved from OpenFlow statistics to recognize the anomaly action in the network.

There are many custom Android firmware (custom ROMs) which are shared on the Internet. Several recent studies aim their efforts at analyzing pre-installed applications in these firmware. However, they analyzed separate pre-installed applications. In this study we propose a system, uitXROM, to detect sensitive data leakage in custom Android firmware by analyzing relationships of pre-installed applications. The experimental results show that the system can detect all sensitive data leakage in our custom Android firmware. Secondly, it detects several pre-installed applications which leak sensitive data from 290 custom ROMs downloaded from the Internet.

In this paper, we propose a method to identify and group together traces left on low interaction honeypots by machines belonging to the same botnet(s) without having any a priori information at our disposal regarding these botnets. In other terms, we offer a solution to detect new botnets thanks to very cheap and easily deployable solutions. The approach is validated thanks to several months of data collected with the worldwide distributed Leurre.com system. To distinguish the relevant traces from the other ones, we group them according to either the platforms, i.e. targets hit or the countries of origin of the attackers. We show that the choice of one of these two observation viewpoints dramatically influences the results obtained. Each one reveals unique botnets. We explain why. Last but not least, we show that these botnets remain active during very long periods of times, up to 700 days, even if the traces they left are only visible from time to time.