The Internet of Things (IoT) comprises interconnected physical devices, ranging from smartphones to household appliances, that communicate wirelessly over the internet. As IoT networks grow in complexity, new cybersecurity risks continue to emerge, with cybercriminals exploiting unprotected vulnerabilities. While various security solutions have been developed, traditional network intrusion detection systems (NIDS) often struggle to detect novel cyberattacks, limiting their adaptability to evolving cyberattacks. This paper addresses these limitations by proposing a decision framework that integrates three models to classify IoT traffic as benign, a known attack and type, or a novel attack. The framework consists of: 1) a binary neural network that distinguishes benign traffic from any attack, 2) a multi-class neural network that classifies traffic as benign or one of known attack types, and 3) a k -Nearest Neighbors (KNN) model that assesses packet similarity to known attack patterns. By combining these models through ensemble voting and leveraging distance metrics, the proposed framework effectively identifies known and novel attacks. Using two benchmark datasets, the framework demonstrated considerable detection rates for novel attacks, which conventional supervised baseline models failed to achieve, while retaining strong performance in known attack detection and categorization. These findings offer valuable insights for both academia and industry, contributing to the development of more adaptive IoT security solutions.

Federated Learning (FL) has amassed notable attention for its ability to preserve user privacy while emphasizing the retainment of model training efficiency. Due to this potential, FL has been integrated in many domains, such as healthcare, finance, law, and industrial engineering, where data cannot be easily exchanged due to sensitive information and strict privacy laws. However, current research has indicated that FL protocols are easily compromised by active data reconstruction attacks employed by actively dishonest servers. The malicious modification of global model parameters allows an actively dishonest server to obtain a direct copy of users’ private data via gradient inversion. This class of attacks is highly underexplored and continues to be a major challenge due to the intense threat model. In this article, we propose OASIS as a scalable and modality-agnostic defense based on data augmentation that counteracts active data reconstruction attacks while preserving model performance. To generalize our defense, we uncover the intuition behind gradient inversion that enables these attacks and theoretically establish the conditions by which the defense can be considered robust regardless of attack design. From this, we formulate our defense with data augmentation that illustrates its ability to undermine the attack principle. We evaluate OASIS on five real-world datasets–two image-based (ImageNet and CIFAR100) and three text-based (Wikitext, Stack Overflow, and Shakespeare)–which span diverse uses cases such as vision tasks and language modeling. Comprehensive evaluations on these datasets exhibit the efficacy of OASIS and highlight its feasibility as a solution.

Despite a plethora of anomaly detection models developed over the years, their ability to generalize to unseen anomalies remains an issue, particularly in critical systems. This paper aims to address this challenge by introducing Swift Hydra, a new framework for training an anomaly detection method based on generative AI and reinforcement learning (RL). Through featuring an RL policy that operates on the latent variables of a generative model, the framework synthesizes novel and diverse anomaly samples that are capable of bypassing a detection model. These generated synthetic samples are, in turn, used to augment the detection model, further improving its ability to handle challenging anomalies. Swift Hydra also incorporates Mamba models structured as a Mixture of Experts (MoE) to enable scalable adaptation of the number of Mamba experts based on data complexity, effectively capturing diverse feature distributions without increasing the model’s inference time. Empirical evaluations on ADBench benchmark demonstrate that Swift Hydra outperforms other state-of-the-art anomaly detection models while maintaining a relatively short inference time. From these results, our research highlights a new and auspicious paradigm of integrating RL and generative AI for advancing anomaly detection.

Binary program diffing, or simply binary diffing, is a type of program analysis technique that quantifies the similarity between two binary programs to derive their differences. In particular, binary diffing is an essential technique for uncovering vulnerabilities and potential attack vectors in industrial control systems, where patch deployment is complicated by closed and restricted environments. Studies on binary diffing can be broadly categorized into dynamic analysis-based, static analysis-based, and neural network-based approaches. Each category of existing studies has its shortcomings, including limited coverage, low accuracy, and issues with on-demand learning. In this paper, we propose the binary diffing with sampling-and-aggregate, a hierarchical binary diffing model that generates inductive code representations based on graph sampling-and-aggregate. Our model sequentially produces instruction-level embedding, block-level embedding, and function-level embedding from the inter-procedural control flow graph of a given program, and then performs hierarchical code diffing based on these embeddings. We formally define the detailed models and present the algorithm of hierarchical binary diffing. Additionally, we conduct a thorough analysis of this algorithm, deriving several advantages. We implemented a prototype and evaluated it on a large-scale dataset in a cross-version, cross-optimization, and obfuscation settings. Our prototype showed F1-scores up to 0.96 and 0.968 in cross-version setting for function and basic block diffing, respectively. Also, our method demonstrated its robustness over several binary obfuscations. In conclusion, our proposal, which generates basic block- and function-level embedding by considering the control flow, has solid advantages on binary diffing and shows the robustness on the binary tampering. • We formulate sequential generation of instruction- to function-level embeddings for a binary program. • We use hierarchical embeddings to compute function-to-block similarity and perform code diffing. • We implement the DiffSAGE prototype and evaluate it on a large binary dataset, showing it outforms state-of-the-art.

Abstract Critical infrastructure mainly performs its role through an industrial control system (ICS). Organizations conduct cyber exercises between red and blue teams, focusing on offense and defense. Practical exercises require explicit attack scenarios and corresponding defense strategies. However, systematic guides for deriving cyberattack scenarios or defense strategies still need to be improved. This paper proposes a guide for establishing realistic attack scenarios and defense strategies for cybersecurity exercises in ICS environments. Attack scenario generation is divided into four steps: generating attack references, deriving attack sequences, mapping threat information, and mapping vulnerable implementation patterns. Deriving a defensive strategy consists of two steps parallel to developing an attack scenario: deriving containment and eradication. The methodology we propose guides exercise planning based on a knowledge base, thereby assisting exercise planners in generating various scenarios and deriving clear defense strategies. We showed that a clear exercise plan could be established through a case study.

As a primitive function of location-based services (LBSs), the location sharing aims to provide a user's current location information to other designated users. In recent years, LBSs have become one of the most popular services provided by mobile online social networks (mOSNs). As LBSs actively exploit the users' identity and current location information, appropriate approaches have to be utilized to protect the location privacy of the users. Several recent reports have discussed the significance of friendship privacy protection with the goal of hiding the friendship relation of users from unintended entities. However, to the best of our knowledge, there hasn't been an approach for protecting the location sharing with complete privacy of location and friendship connections. To address this issue, we propose a new cryptographic primitive, functional pseudonym, for location sharing in mOSNs that ensures both of them. Unlike many of the existing solutions, our approach does not require a fully trusted server and does not assume pre-established secrets among friends, and therefore is highly practical. Also, the proposed approach significantly reduces computational overhead of users by delegating part of the computations for location sharing to a server, therefore it is highly sustainable. Our primitive can be widely used in many mOSNs to enable LBSs with improved privacy and sustainability. Consequently, it will contribute to proliferate LBSs by eliminating users privacy concerns.

Summary In this paper, a key backup technique for the recovery of files encrypted by ransomware is proposed. Ransomware interferes with the victim's system through abnormal behavior such as locking of the victim's system or encryption of the system or files. Ransomware writers demand money from the victims as a condition for the recovery of the encrypted files and systems that have been seized; systems infected by ransomware cannot be repaired without a decryption key, making the employment of detection and recovery methods urgent. This paper proposes a prevention technique for backing up encryption keys in a secure repository which enables the recovery of ransomware‐infected systems and ransomware‐encrypted files. The proposed technique can be used to repair systems infected by ransomware, thereby ensuring safety against such malicious codes.

Recently an online electric vehicle (OLEV) concept has been introduced, where vehicles are propelled by the wirelessly transmitted electrical power from the infrastructure installed under the road while moving. The absence of secure-and-fair billing is one of the main hurdles to widely adopt this promising technology. This paper introduces a new secure and privacy-aware fair billing framework for OLEV on the move through the charging plates installed under the road. We first propose two extreme lightweight mutual authentication mechanisms, a direct authentication and a hash chain-based authentication between vehicles and the charging plates that can be used for different vehicular speeds on the road. Second, we propose a secure and privacy-aware wireless power transfer on move for the vehicles with bidirectional auditability guarantee by leveraging game theoretic approach. Each charging plate transfers a fixed amount of energy to the vehicle and bills the vehicle in a privacy-aware way accordingly. Our protocol guarantees secure, privacy-aware, and fair billing mechanism for the OLEVs while receiving electric power from the infrastructure installed under the road. Moreover, our proposed framework can play a vital role in eliminating the security and privacy challenges in the deployment of power transfer technology to the OLEVs.

Smart Grid addresses the problem of existing power grid's increasing complexity, growing demand and requirement for greater reliability, through two-way communication and automated residential load control among others. These features also makes the Smart Grid a target for a number of cyber attacks. In the paper, we study the problem of rate alteration attack (RAA) through fabrication of price messages which induces changes in load profiles of individual users and eventually causes major alteration in the load profile of the entire network. Combining with cascading failure, it ends up with a highly damaging attack. We prove that the problem is NP-Complete and provide its inapproximability. We devise two approaches for the problem, former deals with maximizing failure of lines with the given resource and then extending the effect with cascading failure while the later takes cascading potential into account while choosing the lines to fail. To get more insight into the impact of RAA, we also extend our algorithms to maximize number of node failures. Empirical results on both IEEE Bus data and real network help us evaluate our approaches under various settings of grid parameters.

ABSTRACT Rogue access points (APs) have been used in several attacks such as packet sniffing and man‐in‐the‐middle attacks. It is becoming a serious security threat to users in public and enterprise networks. Moreover, it is easy to install malicious APs using mobile devices and networks, and existing solutions do not effectively detect these rogue APs. In this paper, we propose a method to detect rogue APs over mobile networks using round‐trip time measurements, without relying on information from authorized lists of APs or users. Through experiments, we proved that our proposed method could detect rogue APs successfully. Copyright © 2013 John Wiley & Sons, Ltd.