With the proliferation of Internet of Things (IoT) technologies, interconnectivity has enlarged the attack surface and intensified security risks. Conventional intrusion detection methods struggle with complex, stealthy intrusions under tight compute and memory budgets, motivating lightweight IDS solutions for accurate and efficient on-device detection. This paper proposes LCT-IDS, a lightweight cascaded Transformer-based IDS tailored to IoT scenarios characterized by high-dimensional, highly heterogeneous traffic and severe class imbalance. LCT-IDS employs a cascaded feature-fusion architecture that integrates local spatial cues extracted by convolutional neural networks (CNNs) with global semantic representations modeled by a compact Transformer; a residual fusion pathway enhances sensitivity to stealthy, low-frequency attacks. Additionally, a cost-sensitive training strategy mitigates performance degradation caused by class imbalance, and a structured modeling strategy improves generalization on high-dimensional inputs. Experiments on UNSW-NB15, NSL-KDD, and CIC-IoT2023 demonstrate high accuracy and efficiency: On UNSW-NB15, the model maintains high precision, recall, F1-score, and AUC, and achieves 99.40% accuracy for binary and 87.72% for multi-class classification. On NSL-KDD and CIC-IoT2023, it achieves highly competitive performance across all evaluated metrics. Compared with a Standard Transformer, LCT-IDS reduces model size by 60.2% and improves inference speed, providing a high-precision, low-overhead IDS that demonstrates strong theoretical potential for resource-constrained IoT deployments.

As network and information systems become widely adopted across industries, cybersecurity concerns have grown more prominent. Among these concerns, insider threats are considered particularly covert and destructive. Insider threats refer to malicious insiders exploiting privileged access to networks, systems, and data to intentionally compromise organizational security. Detecting these threats is challenging due to the complexity and variability of user behavior data, combined with the subtle and covert nature of insider actions. Traditional detection methods often fail to capture both long-term dependencies and short-term fluctuations in time-series data, which are crucial for identifying anomalous behaviors. To address these issues, this paper introduces the Test-Time Training (TTT) model for the first time in the field of insider threat detection, and proposes a detection method based on the TTT-ECA-ResNet model. First, the dataset is preprocessed. TTT is applied to extract long-term dependencies in features, effectively capturing dynamic sequence changes. The Residual Network, incorporating the Efficient Channel Attention mechanism, is used to extract local feature patterns, capturing relationships between different positions in time-series data. Finally, a Linear layer is employed for more precise detection of insider threats. The proposed approaches were evaluated using the CMU CERT Insider Threat Dataset, achieving an AUC of 98.75% and an F1-score of 96.81%. The experimental results demonstrate the effectiveness of the proposed methods, outperforming other state-of-the-art approaches.

Addressing the challenge of untraceable malicious activities due to excessive anonymity in ring signature, we propose a new SM2-based ring signature scheme with revocability and anonymity (SMRSRA). Our scheme innovates by integrating a third-party-generated signer identity tag, a pivotal element in generating both signature values and a revocation tag within the SMRSRA. A key feature of our scheme is its revocation mechanism, which permits the third party to utilize the revocation tag, activating the anonymity revocation algorithm to reveal the signer’s identity. Furthermore, our scheme allows members to verify the third party’s actions for any malicious intent using the revocable anonymity tag. Experimental findings demonstrate that the time efficiency for signature generation and revocation in this scheme scales linearly with the number of ring members, ensuring its efficiency in scenarios involving numerous participants.

User behavior threat detection is important for the protection of network system security. Traditional supervised modeling methods and unbalanced sample data lead to a high false positive rate in user behavior detection. In addition, network user behaviors are complex, changeable, and difficult to predict, and existing detection methods are facing ever greater challenges. Effectively detecting user behavior remains a challenge. In this paper, we propose a user behavior threat detection method based on an Adaptive Sliding Window Generative Adversarial Network(ASW-GAN). This method designs an adaptive sliding window mechanism to process behavior data and uses the GAN model to detect threat behavior, finally uses the maximum interclass variance algorithm Otsu to optimize test detection result. Compared with other typical methods, the proposed method achieves a higher accuracy rate and a markedly lower false positive rate, and can effectively evaluate user threat behaviors.

With the rapid development of information technology, information system security and insider threat detection have become important topics for organizational management. In the current network environment, user behavioral bio-data presents the characteristics of nonlinearity and temporal sequence. Most of the existing research on authentication based on user behavioral biometrics adopts the method of manual feature extraction. They do not adequately capture the nonlinear and time-sequential dependencies of behavioral bio-data, and also do not adequately reflect the personalized usage characteristics of users, leading to bottlenecks in the performance of the authentication algorithm. In order to solve the above problems, this paper proposes a Temporal Convolutional Network method based on an Efficient Channel Attention mechanism (ECA-TCN) to extract user mouse dynamics features and constructs an one-class Support Vector Machine (OCSVM) for each user for authentication. Experimental results show that compared with four existing deep learning algorithms, the method retains more adequate key information and improves the classification performance of the neural network. In the final authentication, the Area Under the Curve (AUC) can reach 96%.

Network security situation assessment (NSSA) is an important and effective active defense technology in the field of network security situation awareness. By analyzing the historical network security situation awareness data, NSSA can evaluate the network security threat and analyze the network attack stage, thus fully grasping the overall network security situation. With the rapid development of 5G, cloud computing, and Internet of things, the network environment is increasingly complex, resulting in diversity and randomness of network threats, which directly determine the accuracy and the universality of NSSA methods. Meanwhile, the indicator data is characterized by large scale and heterogeneity, which seriously affect the efficiency of the NSSA methods. In this paper, we design a new NSSA method based on the autoencoder (AE) and parsimonious memory unit (PMU). In our novel method, we first utilize an AE‐based data dimensionality reduction method to process the original indicator data, thus effectively removing the redundant part of the indicator data. Subsequently, we adopt a PMU deep neural network to achieve accurate and efficient NSSA. The experimental results demonstrate that the accuracy and efficiency of our novel method are both greatly improved.

Internet of Things (IoT) brought great convenience to people’s daily lives. Meanwhile, the IoT devices are facing severe attacks from hackers and malicious attackers. Hackers and malicious attackers use various methods to invade the Internet of Things system, causing the Internet of Things to face a large number of targeted, concealed, and penetrating potential threats, which makes the privacy problem of the Internet of Things suffers serious challenges. But the existing methods and technologies cannot fully identify the attacker’s attack process and protect the privacy of the Internet of Things. Alarm correlation method can construct a complete attack scenario and identify the attacker’s intention by alarming the alarm data which provides an effective protection for user privacy. However, the existing alarm correlation methods still have the disadvantages of low correlation accuracy, poor correlation efficiency, and strong dependence on the knowledge base. To address these issues, we propose an alarm correlation method based on Affinity Propagation (AP) clustering algorithm and causal relationship. Our method considers that the alarm data triggered by the same attack process has high similarity characteristics, adopts the AP algorithm to improve the correlation efficiency, and at the same time constructs a complete attack process based on the causal correlation idea. The new alarm correlation method has a high correlation effect and builds a complete attack process to help managers identify attack intentions and prevent attacks.

With the rapid development of the Internet of Things (IoT) technology, it has been widely used in various fields. IoT device as an information collection unit can be built into an information management system with an information processing and storage unit composed of multiple servers. However, a large amount of sensitive data contained in IoT devices is transmitted in the system under the actual wireless network environment will cause a series of security issues and will become inefficient in the scenario where a large number of devices are concurrently accessed. If each device is individually authenticated, the authentication overhead is huge, and the network burden is excessive. Aiming at these problems, we propose a protocol that is efficient authentication for Internet of Things devices in information management systems. In the proposed scheme, aggregated certificateless signcryption is used to complete mutual authentication and encrypted transmission of data, and a cloud server is introduced to ensure service continuity and stability. This scheme is suitable for scenarios where large‐scale IoT terminal devices are simultaneously connected to the information management system. It not only reduces the authentication overhead but also ensures the user privacy and data integrity. Through the experimental results and security analysis, it is indicated that the proposed scheme is suitable for information management systems.

Summary Cloud storage has been gaining tremendous popularity among individuals and corporations because of its low maintenance cost and on‐demand services for the clients. To improve the availability and the reliability of critical data, storing multiple replicas on multiple servers is a commonly used strategy. Currently, several provable data possession (PDP) protocols for multiple replicas of dynamic data have been proposed to ensure the integrity of outsourced multi‐copy data, but the efficiency of these protocols on verifying multiple replicas one by one is not satisfactory. In this paper, we propose a provable multiple replication data possession protocol with full dynamics, named MR‐DPDP. In MR‐DPDP, we utilize a novel authenticated data structure called Merkle hash tree with rank to support both full dynamic data updates and efficient integrity verification. In addition, our construction with RSA signature can support both variable‐sized file blocks and public verification. Through security proof and performance evaluation, we demonstrate that MR‐DPDP not only is sound but also incurs less communication overhead when updating data blocks as well as verifying a proof of the integrity of multiple replicas. Copyright © 2015 John Wiley & Sons, Ltd.