Decentralized trust systems harbor a paradoxical vulnerability: the emergent rise of a ‘Trust Aristocracy’ that erodes their foundational purpose. While existing models can detect tactical threats, they lack mechanisms to manage this emergent, strategic vulnerability. This paper introduces CrossTrust-IoT, an adaptive framework that presents a paradigm shift from passive observation to active control of decentralization. Our core contribution is the design of the first trust management system to operationalize the Gini coefficient as an evolutionary control variable, thereby transforming a descriptive socio-economic metric into an active defense against influence concentration. We propose a novel dual-loop architecture: a tactical Reinforcement Learning TrustRank (RLTR) for node-level threat detection and a strategic Self-Evolving Trust Architecture (SETA) that monitors the global trust distribution. The SETA’s evolutionary algorithm uses the Gini coefficient directly in its fitness function to penalize influence concentration, actively steering the system’s parameters towards a state of balanced security and decentralization. This mechanism is complemented by privacy-preserving federated learning to train the RLTR model. We validate our framework on the CICIoT2023 dataset and in dynamic agent-based simulations, demonstrating that CrossTrust-IoT achieves a high F1-score of 0.91 for threat detection while preventing trust aristocracy, a failure mode to which even our framework succumbs when the Gini penalty is disabled. This work pioneers a new approach to engineering resilient trust ecosystems by treating decentralization not as a static property, but as a dynamic objective to be actively managed.

There are many custom Android firmware (custom ROMs) which are shared on the Internet. Several recent studies aim their efforts at analyzing pre-installed applications in these firmware. However, they analyzed separate pre-installed applications. In this study we propose a system, uitXROM, to detect sensitive data leakage in custom Android firmware by analyzing relationships of pre-installed applications. The experimental results show that the system can detect all sensitive data leakage in our custom Android firmware. Secondly, it detects several pre-installed applications which leak sensitive data from 290 custom ROMs downloaded from the Internet.

Malware is a program used to disrupt computer operation or to gather the sensitive information or to gain access to private computer system. Malware detection methods can only work well on some specific types of malware. For example, API/function based methods can detect malware quickly, but are unable to identify advanced transformable malwares or unknown malwares. To deal with these malwares, researchers proposed data mining methods which can recognize various types of malware. However, these method not only requires more overhead for training and detecting process but also is still ineffective to identify metamorphic malwares. A semantic set, a set of changed values of registers and variables allocated in memory when a program is executed, supports detecting most of malware variants even when they use complicated transformation techniques such as metamorphic malwares. Nevertheless, this approach requires that malware files must be disassembled. Based on analyzed results of these methods, we concluded that these methods can be combined together to create a powerful malware detection system because each method's advantages can cover the others' disadvantages. Namely, each of method is able to perform effectively in the specific range of malwares, so this combined system can detect all types of malware while separately each method could not. In this paper, we proposed an SSSM system (semantic set and string matching detection) which combined three methods: API/function signature based method, data mining method and semantic set method. SSSM system has been experimented on different datasets and achieved the accuracy up to 99.07% and detection rate nearly 100%•