Malicious insiders who possess system access and security expertise are notoriously difficult to detect and can inflict severe financial damage. While recent advances in deep learning have demonstrated impressive accuracy in detecting insider threats, these models often assume the presence of well-defined or previously known anomalies. In practical organizational environments, however, threats may manifest as novel, subtle, or context-dependent behaviors that are not captured by existing patterns. Detecting such anomalies necessitates the extraction and analysis of rich behavioral features from large-scale insider activity data—an approach that, while effective, often leads to increased model complexity and computational burden. This, in turn, impedes real-time responsiveness and operational viability, potentially resulting in delayed threat mitigation and financial losses. Therefore, there is a pressing need for lightweight yet robust insider threat detection frameworks that can ensure timely and efficient deployment without compromising detection performance. To address this challenge, this paper proposes the Insider-Specific Feature Learning Autoencoder (ISFL-AE), a model designed to achieve high detection accuracy and fast processing speed. Unlike traditional reconstruction-based anomaly detection models—which use a single set of model parameters to reconstruct normal behavior for all insiders regardless of their role, authority level, or other attributes—ISFL-AE tailors its feature learning to insider-specific characteristics. ISFL-AE operates with the same number of parameters as a conventional autoencoder (AE), maintaining comparable processing speed while significantly improving detection performance. We evaluated ISFL-AE using the CERT r4.2 and r6.2 datasets. The results show that, while processing data at the same speed as a standard AE, ISFL-AE delivered markedly higher detection accuracy. Furthermore, it outperformed other machine learning models in detection accuracy and processing speed. Furthermore, our empirical results demonstrate that integrating insider-specific feature learning into autoencoder-based deep learning architectures significantly enhances anomaly detection performance, all while preserving real-time processing efficiency.

The rapid advancement of the industrial Internet of things (IIoTs) has facilitated the development of diverse platforms and management technologies. However, the lack of standardized protocols and interoperability between platforms developed by various organizations hinders seamless integration. These limitations represent the primary challenge in access control between different IIoT platforms, resulting in limited service utilization across heterogeneous platforms. This study addresses the challenges of effectively sharing user attributes and representations for access control between heterogeneous IIoT platforms using blockchain and a metadata registry (MDR). Utilizing blockchain ensures tamper-proof and transparent attribute sharing, whereas the MDR facilitates the accurate mapping of user attributes for cross-platform resource access control. We demonstrated the feasibility of the proposed framework by successfully implementing access control between two representative standard platforms, namely oneM2M and FIWARE. Our results indicate that enhancing service utilization through access control between heterogeneous IIoT platforms can improve security and efficiency across various industries.

The rise in video content has amplified the risk of information leakage, prompting the development of various anonymization techniques. These techniques include traditional methods such as pixelation, blurring, and masking, as well as more advanced approaches like video encryption, which involves encrypting parameters during video encoding, and techniques that subtly alter facial features to prevent identification. However, assessing the effectiveness of these anonymization techniques remains challenging. Common metrics such as the structural similarity index (SSIM) and peak signal-to-noise ratio (PSNR), often used for object anonymization in videos, primarily assess image quality and lack accuracy for security evaluation. Furthermore, subjective human evaluations fail to provide the consistent, quantitative data necessary for cross-study comparisons. Given that a single identifiable frame in a video can compromise overall security, this study introduces a quantitative method for evaluating the de-identification rate in regions of interest (ROI) within videos. The proposed approach calculates an object de-identification rate (ODR) by combining SSIM and edge detection ratio (EDR) using a harmonic mean and a power mean. Our proposed method enhances the precision and reliability for security of anonymized video.

A malicious insider’s threats who has access to the organization’s systems and is familiar with security policies are difficult to detect and can cause significant financial damage. A reconstruction-based anomaly detection method leveraging deep learning is one method for detecting insider threats. The method is employed to solve a data imbalance problem caused by the scarcity of abnormal data in real environments. The method trains a deep learning model to reconstruct normal data received from all users. After training, the model reconstructs normal data more accurately than abnormal data, and the reconstruction-based anomaly detection method can detect anomalies based on the reconstruction difference between normal and abnormal data. However, existing reconstruction-based anomaly detection methods train on all users’ normal data using the same network parameters. Consequently, if a behavior is normal for one user but abnormal for another, the reconstruction model learns this behavior as normal because the reconstruction model trains only on normal behaviors. Since normal behaviors differ for each user depending on their position, role, and other factors within the organization, it is necessary to develop methods for detecting abnormal behaviors specific to each user. To address this problem, we propose a transfer learning-based insider threat detection method. The proposed method consists of 1) a pre-trained encoder that outputs latent representations of normal data for all users and 2) user-specific decoders assigned to each user, which are trained on the corresponding user’s normal data to reconstruct their normal data. We evaluate the proposed method’s detection rate (DR) and area under the curve (AUC) on the CERT dataset and compare it with a deep learning model trained on normal data from all users. The experimental results show that the proposed method achieves higher DR and AUC than the deep learning model. These results indicate that the proposed method enhances insider threat detection performance by enabling the detection of user-specific abnormal behaviors.

The rapid increase in Internet of Things (IoT) devices and data across various domains (e.g., healthcare, smart cities, smart factories, and smart homes) has led to growing complexity in managing security policies to protect them. Moreover, the increased complexity makes it even more challenging to define security policies in the attribute-based access control (ABAC) model, which requires considering user requirements and environmental conditions. Thus, the ABAC model is likely to include unexpected uncertainties when administrators define security policies. In this study, uncertainty refers to unforeseen future outcomes that may arise from factors the administrator has not considered. Furthermore, the increasing number of IoT devices makes it nearly impossible for administrators to predict all uncertainties and adjust security policies accordingly. Several studies have been proposed to address these challenges, but they rely on human intervention. Therefore, this study proposes a self-adaptive framework that combines a self-adaptive system with deep neural networks (DNNs) to respond to uncertainties intelligently and autonomously. The framework effectively identifies uncertainties in the access control process through variational autoencoder (VAE) and long short-term memory (LSTM) without human intervention and autonomously responds using a self-adaptive system.

The Internet of Things (IoT) connects a wide range of entities and can be applied to various types of environments. In addition, IoT environments can be dynamically changed at runtime; thus, IoT systems can be deployed in various environments. To support stable operation, IoT systems must adapt to dynamic environmental changes. The self-adaptive software aims to adjust various artifacts or attributes of software to adapt the detected context by itself, and various studies have applied self-adaptive methods in IoT-related research. In this study, we proposed a self-adaptive software framework with master–slave architecture-based finite-state machine modeling. In addition, model checking is applied, which is a formal method to verify IoT systems at runtime, and a cache-based mechanism is applied to reduce the computational time required for verification. To demonstrate the efficiency of the proposed framework, an empirical evaluation was performed with several model-checking tools (RINGA, NuSMV, nuXmv, and CadenceSMV), and the results showed the efficiency of the proposed framework with the cache-based mechanism. In addition, an example application was investigated with smart greenhouse scenarios, and the application was implemented on Android and Arduino. The application was operated in physical environments, and the results showed the practical usability of the proposed framework with verification at runtime.

Currently, software systems are operated in a dynamic and uncertain environment, making it difficult to predict the operating environment. Particularly, the Internet of Things (IoT) interconnects several entities, users, and information resources with services. Therefore, IoT systems can dynamically create various environments at runtime. Consequently, to support the dynamic IoT environment, an efficient verification method is required for IoT systems. Model checking is one of the formal methods for verification of concurrent systems, which is applied in several software fields. However, model checking has a chronic problem (i.e., state explosion) that obstructs the verification at runtime. To overcome this limitation, one possible approach is to abstract the system design as expression forms and then perform verification by solving the expressions. To apply this approach, the abstraction and verification processes need to be performed at a reasonable time. In this article, we focused on developing an efficient model checking method during the IoT system runtime verification. A cache mechanism is proposed that reduces the computational time for abstraction and verification, which was validated through experiments. Additionally, the comparison of other model checking tools (such as RINGA, CadenceSMV, NuSMV, and nuXmv) reveals that the proposed approach is more efficient at runtime.

Duties are segregated within a team by using the role-based access control (RBAC) in the Azure Internet of Things (IoT) framework, and only an appropriate level of access is granted to users to perform specific tasks, depending on a given situation. However, the same authentication and authorization mechanism is used for “sort of user,” which increases the operation overload on the cloud server. Moreover, due to its RBAC nature, the IoT framework is inefficient in handling a dynamic situation where multiple users request similar kinds of resources, by creating several repeated roles. This results in inconsistent and inflexible implementation and the loss of the capability to efficiently address policy management, semantics, redundancy issues in roles, dynamic user handling, work delegation issues, scalability, role explosion, individual rights, and security issues in large organizations. In this article, we designed and presented a novel access control model for a significantly large medical scenario with efficient priority-based authentication mechanisms to address the abovementioned problems associated with the Azure IoT cloud. The proposed model encapsulates the enforcement of priority-based resource access rights across multiple users in a large organization, reduces inefficiency and ineffectuality, and supports individuals with the consistent implementation of policies. We evaluated the benefits of the proposed model by comparing it with existing models and the Azure model, using the healthcare use-case situation. The comparison results show that by incorporating the priority attribute facility in the existing RBAC model, the proposed model classifies the policy mechanism based on priority attributes and proves that the proposed model is capable of handling problems that generally occur when dealing with huge dynamic scenarios in large organizations.

The Internet of Things (IoT) connects several objects within environments that dynamically change, and so requirements may be added and changed at runtime. Therefore, requirements may be satisfied at dynamic change. Self-adaptive software can alter their behavior to satisfy requirements in dynamic environments. In this perspective, the concept of self-adaptive software is suitable for IoT environments. In this study, a self-adaptive framework is proposed for decision making in IoT environments at runtime. The framework includes finite-state machine model designs and game theoretic decision-making methods to extract efficient strategies. The framework is implemented as a prototype, and experiments are performed to evaluate runtime performance. The results demonstrate that the proposed framework can be applied to IoT environments at runtime.

This study takes an intuitive step to develop the user‐convenient smart vehicle parking system (SVPS), a smart system able to manage the massive crowd of vehicles during parking searching and do the better jobs of parking reservation and management, with the shorter‐path processing tactics. For that, this study inclusively employed the mapping strategy, where the system parking points are prevalent, to assist the users to get the parking information fast and conveniently. This study is comprised of the several parking points systematically spread over the several locations and traceable over the available graphical map, and the overall information is easily accessible using smart devices. For parking information, a smart web application which is another important module of this study is designed, with which the SVPS system’s registered users are able to access all the services provided for smart vehicle parking searching and reservation in efficient and reliable ways. An integrated network approach, RFID (radio frequency identification) and wireless sensors network (WSN), called RF‐WSN, is employed to retrieve the real‐time information from the installed and configured sensor devices in RFID‐WSN network.

Twitter is a microblogging website, which has different characteristics from any other social networking service (SNS) in that it has one-directional relationships between users with short posts of less than 140 characters. These characteristics make Twitter not only a social network but also a news media. In addition, Twitter posts have been used and analyzed in various fields such as marketing, prediction of presidential elections, and requirement analysis. With an increase in Twitter usage, we need a more effective method to analyze Twitter content. In this paper, we propose a method for content analysis based on the influence of Twitter content. For measuring Twitter influence, we use the number of followers of the content author, retweet count, and currency of time. We perform experiments to compare the proposed method, frequency, numerical statistics, user influence, and sentiment score. The results show that the proposed method is slightly better than the other methods. In addition, we discuss Twitter characteristics and a method for an effective analysis of Twitter content.

Address resolution protocol (ARP) is widely used to maintain mapping between data link (e.g. MAC) and network (e.g. IP) layer addresses. Although most hosts rely on automated and dynamic management of ARP cache entries, current implementation is well-known to be vulnerable to spoofing or denial of service (DoS) attacks. There are many tools that exploit vulnerabilities of ARP protocols, and past proposals to address the weaknesses of the ‘original’ ARP design have been unsatisfactory. Suggestions that ARP protocol definition be modified would cause serious and unacceptable compatibility problems. Other proposals require customised hardware be installed to monitor malicious ARP traffic, and many organisations cannot afford such cost. This study demonstrates that one can effectively eliminate most threats caused by the ARP vulnerabilities by installing anti-ARP spoofing agent (ASA), which intercepts unauthenticated exchange of ARP packets and blocks potentially insecure communications. The proposed approach requires neither modification of kernel ARP software nor installation of traffic monitors. Agent uses user datagram protocol (UDP) packets to enable networking among hosts in a transparent and secure manner. The authors implemented agent software on Windows XP and conducted an experiment. The results showed that ARP hacking tools could not penetrate hosts protected by ASA.

ABSTRACT Successful Security Risk Analysis (SRA) enables us to develop a secure information management system and provides valuable analysis data for future risk estimation. One of the qualitative techniques for SRA is the scenario method. This provides a framework for our explorations that raises our awareness and appreciation of uncertainty. However, the existing scenario methods are too abstract to be applicable to some situations and have not been formalized in information systems (ISs) because they do not explicitly define artifacts or have any standard notation. Therefore, this paper proposes the improved scenario‐based SRA approach, which can create SRA reports using threat scenario templates and manage security risk directly in ISs. Furthermore, in order to show how to apply the proposed method in a specific environment, especially in a Broadband convergence Network (BcN) environment, a case study is presented. Copyright © 2011 John Wiley & Sons, Ltd.

ABSTRACT Despite much research on defense against phishing attacks, incidents continue to occur where sensitive (e.g., personal or financial) information is stolen using social engineering and technical spoofing techniques. Most approaches use the notions of blacklists versus whitelists (WWLs), and it is difficult to quantify the degree of a website's vulnerability against phishing attacks. In this paper, we present a quantitative approach for evaluating the phishing possibility of a given website using the refined security risk elements for domain and web page. Design and implementation of the website risk assessment system for antiphishing are also included. It can detect suspicious websites containing phishing attack and abnormal behavior and generates a warning if website is judged untrustworthy. Copyright © 2012 John Wiley & Sons, Ltd.

Software Product-Line Engineering (SPLE) is composed of two areas, namely domain engineering and application engineering. Domain engineering is associated with product-line architecture, which is a core asset of the product-line. One of the key issues of the software product-line, especially in domain engineering, is handling the variability among product families. That is, variation management for the software product-line architecture determines the success of software development. Therefore, this paper proposes processes and artifacts to build the software product-line architecture and to manage uniform variability over the life cycle of software product-lines. Furthermore, a case study, namely, the Electronic Medical Record (EMR) system, is presented.

Software development based on the software product-line can develop software products more easily and fast by reusing the developed core assets. One of key issues of software product-line is to handle variability between product families. That is, the variation management for software product-line decides the success of software development. There are considerable researches relating to model the variability in software product-line. However, the existing researches do not explicitly define artifacts and any relevant relationships between them used in each process. Therefore, in this paper, processes and artifacts of each process to manage uniformly variability over the life cycle of software product-line are proposed. Furthermore, in order to show how to apply those into a specific domain, especially electronic medical record (EMR) system, case study is presented

Mobile agent paradigm is recognized as a new environment for distributed computing and provides many merits such as mobility, security, self-decision, and so on. However, its security problems should be resolved to increase its application to a variety of real domains. Especially, we must guarantee integrity of transferred mobile agents. Although many mobile agent systems were developed, the integrity issue remains a critical one. In this paper, we propose an integrity checking mechanism to do the aforementioned issue. The proposed mechanism is independent of specific security frameworks and can be added and used easily for various mobile agent platforms.

Security is critical in a home gateway environment. Robust secure mechanisms must be put in place for protecting information transferred through a central location. In considering characteristics for the home gateway environment, this paper proposes a bundle authentication mechanism. We designed the exchange mechanism for transferring a shared secret key. This transports a service bundle safely in the bootstrapping step, by recognizing and initializing various components. In this paper, we propose a bundle authentication mechanism based on a MAC that uses a shared secret key created in the bootstrapping step. In addition, we verify the safety of the key exchange mechanism and bundle authentication mechanism using BAN Logic. From the verified result, we achieved goals of authentication. That is, the operator can trust the bundle provided by the service provider. The user who uses the service gateway can also express trust and use the bundle provided by the operator.

Recent developments in information systems (ISs) have resulted in a critical need for integration and retention of heterogeneous ISs in various domains, using their commonalities. Stovepipe systems have been developed because of inconsistencies in planning architecture among stakeholders. Several countries are currently adopting enterprise architecture (EA) systems, such as Zachman AF (ZF), C4ISR AF, SBA, and FEAF, in order to solve various IS problems in the field of information technology, but enterprise architecture framework (EAF) legacy systems can be inadequate to solve problems arising from stovepipe systems. An EAF is required to satisfy aspects of both EA and system architecture (SA) inside a common information technology (IT) domain. This paper proposes a new enterprise architecture framework that will resolve the problems inherent in previous frameworks and their features.

The services in the OSGi framework environment are deployed dynamically according to the service gateway and the life-cycle of a service bundle. Services also have interactions with other services. In this paper, we propose a bundle authentication mechanism considering characteristics for the home gateway environment. We design the key exchange mechanism for exchanging a key and propose the service bundle authentication mechanism based on MAC that use a shared secret created in the bootstrapping step. Service bundle authentication mechanism we propose is more efficient than PKI-based bundle authentication mechanism or RSH protocol in the service platform, which has restricted resources such as storage space and operations.

Sensors in ubiquitous computing provide a new opportunity to extend existing RFID capabilities to situation-awareness. This paper proposes several alternatives of the situation-aware radio frequency identification (SA-RFID) system architecture and analyzes the pros and cons of each alternative.