network security engineers

Abstract: As network scale and uncertainty complicate automated penetration testing, reinforcement learning (RL) environments must support controlled evaluation under defensive and non-stationary conditions. We present DYNAS (Dynamic Network Attack Simulator), which combines parameterized large-scale scenario generation with stateful intrusion detection responses, explicit scan false-positive and false-negative noise, temporary service unavailability, and duration-based action timeouts. We further introduce Pen-DHRL, a recurrent manager--worker policy that selects persistent subgoals using IDS-conditioned global context. We compare Pen-DHRL with GNN, Invariant, and Attention baselines across four scenario variants and multiple training regimes. Under IDS-disabled training followed by IDS-enabled evaluation, Pen-DHRL obtains approximately 64\% and 24\% higher reward per step on Bridge and Dynamic, respectively, and approximately 26\% and 30\% more captured hosts on VarA and VarB than the next-best baseline. With all defensive dynamics active from the beginning of training, Pen-DHRL achieves positive mean episode returns in all four scenarios, whereas the flat baselines produce negative mean returns in all 12 architecture--scenario combinations; staged curriculum training produces positive mean returns across all 16 evaluated combinations.

Abstract: Stateless post-quantum authenticated key exchanges such as post-quantum WireGuard hedge against unexpected cryptanalytic advances by combining a lattice KEM with code-based Classic McEliece. However, recent attacks have led Germany's BSI to advise against McEliece, which leaves these protocols with lattices alone. HQC, the code-based KEM that NIST selected, could restore diversity, but its keys do not fit in a single packet, so a server would have to buffer multi-packet handshakes. This would leave an attack surface for memory exhaustion, which is what WireGuard's stateless handshake was designed to avoid in the first place. McTiny demonstrated that stateless key encapsulation for Classic McEliece is possible by streaming key blocks one-at-a-time. However, HQC's encapsulation does not split as easily into individual packets, as cyclic polynomial multiplication, unlike matrix-vector multiplication, is inherently non-local. We present HqcLethe, a stateless key exchange that streams an HQC encapsulation in packet-sized pieces. It uses the Chinese remainder theorem to split the polynomial multiplication into independent remainders, one per packet, and masks them so that they reveal no more than an ordinary HQC ciphertext, which we prove in Rocq with SSProve; we also verify session secrecy, server authentication and forward secrecy in ProVerif. Client puzzles bound CPU exhaustion, and HqcLethe removes memory exhaustion: on a Raspberry Pi 3B+, each worker runs in a fixed 1.2-1.6 MiB. At category 5 it sends 27x fewer bytes and uses 9.0x less server CPU than McTiny, the earlier stateless code-based design.

Abstract: A fundamental paradox plagues the deployment of Machine Learning in cybersecurity: supervised models generalize poorly to novel, Out-of-Distribution (OoD) attacks, whereas unsupervised models often suffer from poor separability, leading to unmanageable false-alarm rates. This challenge is exemplified by the BETH dataset, a kernel-level benchmark in which the training data consists solely of benign and suspicious insider behaviors, whereas the test set consists almost entirely of novel botnet activation attacks. To bridge this detection gap, we propose a Hybrid Fuzzy Ensemble that synergizes the precision of supervised learning with the adaptability of unsupervised clustering. Our architecture integrates a gradient-optimized Takagi-Sugeno-Kang (TSK) fuzzy classifier to act as an expert on known insider threats, with a parallel Fuzzy C-Means (FCM) module to detect geometric anomalies. A critical finding of our research is that traditional fuzzy membership scores degrade in high-dimensional feature spaces due to the curse of dimensionality. We overcome this by introducing a robust Min Distance metric that exploits the raw geometric isolation of botnet activation attacks. This approach yields a state-of-the-art AUROC of 0.9951 on the BETH test set, outperforming the original Isolation Forest baseline by 17.1%. By combining near-perfect OoD detection with the intrinsic interpretability of fuzzy logic, our framework offers a viable path toward robust, transparent, and autonomous network defense.

Abstract: Consider a standard multi-hop wireless radio network in which nodes relay messages for one another. While the contents of messages may be sensitive and thus encrypted, the very fact that two radios communicated can leak sensitive information about both the physical location of the origin and the physical location of the destination. We investigate the trade-off between protecting the privacy of a user's current location and the privacy of their location of interest, and how the user should choose dummy destinations to obfuscate their queries.

Abstract: The threat of quantum computers breaking classical cryptographic is accelerating the adoption of quantum- resistant cryptographic algorithms. Several government agencies have set a tight time-line for upgradation of all system to support post quantum cryptographs. We study post-quantum migration of IPSec protocols and their impact on network performance. The large key lengths in Post-Quantum Cryptography (PQC) cannot fit in a single IP packet leading to IP fragmentation. This can cause failure of security associations and degrade performance of IKEv2 under poor network conditions. To tackle this problem, we study a new key- sharing mechanism for IKEv2 and evaluate its performance. Unlike current hybrid key-sharing approaches, which send the classical and quantum keys sequentially over UDP or TCP (as in RFC 9370), the new approach concatenates them into a single composite key and transport them over TCP to ensure a reliable handshake. We implement and benchmark the new composite key-sharing handshake mechanism against existing hybrid algorithms that use either UDP or TCP. Extensive experiments under various network conditions demonstrate that the new approach significantly improves handshake time and energy consumption by avoiding the severe retransmission penalties of the Hybrid handshake mechanism. At 1% packet loss, the handshake time of composite key sharing mechanism is better by atleast 20% than hybrid mechanisms, and the improve- ment get better with higher packet loss reaching 30% at 10% packet loss. Energy consumption follows the same pattern achieving reduction of 29% at 10% packet loss

Abstract: Eulerian digraphs retain the directional structure of general digraphs while exhibiting a symmetry of cuts reminiscent of undirected graphs. We show that this symmetry extends beyond individual cuts to two fundamental techniques in parameterized algorithms for undirected cut problems: treewidth reduction and recursive understanding and randomized contractions. Both of these techniques have proved useful for dealing with undirected graph cut problems as each of them reduces the problem at hand on general undirected instances to ones that have bounded treewidth or that are highly connected, respectively. In this work we prove an edge-cut analogue of the treewidth-reduction theorem of Marx, O'Sullivan, and Razgon [ACM TALG 2013], and an Eulerian analogue of the reduction of CMSO model checking to unbreakable instances due to Lokshtanov, Ramanujan, Saurabh, and Zehavi [ICALP 2018]. Both these results allow us to reduce several problems on general Eulerian digraphs to Eulerian digraphs whose underlying undirected graph has bounded treewidth, or to Eulerian instances that are highly connected, thus bringing to Eulerian digraphs two fundamental tools from the undirected parameterized cut toolkit for which no counterparts are known on arbitrary digraphs. Beyond their structural significance, these results have substantial algorithmic consequences: they yield FPT algorithms for several directed cut problems that are W[1]-hard in general. We show that Directed Multicut and Directed Edge Odd Cycle Transversal are FPT on Eulerian digraphs when parameterized by the solution size and the number of terminal pairs, and just the solution size, respectively. This is in sharp contrast to general digraphs, where the first problem is W[1]-hard even for 4 terminal pairs, and the second is W[1]-hard in general. We also obtain FPT algorithms for Directed Edge Multiway Cut-Uncut and Directed Steiner Cut.

Abstract: Conway's $99$-graph is a strongly regular graph with parameters $(v,k,λ,μ) = (99,14,1,2)$ and whose existence has long been an open problem. We use both a sum-of-squares program and the fact that a strongly regular graph with $λ= 1, μ= 2$ has no diamond or $K_{2,3}$ subgraph to derive a loose upper bound for the number of triangles that such a graph could contain. This bound is less than the number of triangles that the graph's spectrum asserts, implying that it does not exist.

Abstract: We introduce Confidential Error-correcting Codes (CECs), a new cryptographic primitive that enables reliable decoding from perturbed codewords while preserving message confidentiality. We formalize this primitive through three security properties: confidentiality, robustness, and soundness. To realize this goal, we develop a general framework for constructing CECs based on a Randomness-Security Separation (RSS) structure, which first encodes a nonce to introduce randomness and then masks the encoded payload with a pseudorandom function. Based on our RSS framework, we instantiate CECs, called Conc-CEC, using concatenated Reed-Muller and Reed-Solomon codes. The resulting Conc-CEC admits provable guarantees for all three properties. Notably, compared to PRCs (CRYPTO'24), another recent cryptographic primitive with error-correcting capability, CECs achieve significantly stronger concrete security guarantees under practical parameter settings. As a primary application of CECs, we further present CECMark, a watermarking scheme for AI-generated images. Our experiments on real-world generative image models show that CECMark consistently outperforms state-of-the-art watermarking methods, including Gaussian Shading (CVPR'24), PRCMark (ICLR'25), and T2SMark (NeurIPS'25). In particular, CECMark achieves higher robustness across all 56 evaluated perturbations and ensures a false positive rate below $10^{-5}$ without introducing side effects. Taken together, our work lays a novel cryptographic foundation for trustworthy watermarking schemes that, for the first time, unify provable security guarantees with strong practical reliability.

Abstract: Federated learning (FL) lets distributed intrusion-detection systems (IDS) train on private traffic, but exposes the global model to poisoning and backdoor attacks under non-IID client data. A popular defense family scores or filters clients using a small trusted "root" dataset and the similarity of client behaviour to a trusted reference. I re-examine these trust-based defenses under a protocol designed to remove common evaluation artifacts: train-only feature standardization, a server root set disjoint from client data, multi-seed (n=6) runs with paired significance tests, formal (varepsilon, delta) accounting for DP-SGD, and a defense-aware adaptive attacker. Across three NIDS datasets (CSE-CIC-IDS2018, NF-ToN-IoT, NF-UNSW-NB15-v2) I find: (1) a representation-similarity aggregator (RepGuard) significantly improves classification utility and seed-stability over FLTrust under heavy non-IID poisoning, and - under severe heterogeneity or many adversaries - also lowers backdoor ASR substantially (e.g., 0.48 vs FLTrust 0.86 at Dirichlet alpha=0.1); (2) at strong trigger magnitudes no defense reduces backdoor attack success rate (ASR approx 0.95); (3) a controlled trigger-magnitude sweep shows defenses help only for small triggers (ASR 0.10 for RepGuard at magnitude 0.5, vs. 0.40 undefended) and collapse to ASR approx 1.0 by magnitude 2; (4) a triggered-canary check that assumes knowledge of the attacker's trigger - the assumption behind much prior "success" - lowers ASR from 0.49 to 0.12, i.e., trigger knowledge, not representation scoring, suppresses the backdoor; (5) correctly-accounted DP-SGD (varepsilon in [0.3, 16]) costs little utility but does not mitigate the backdoor. I release the protocol so future FL-IDS defenses can be evaluated without the leakage and oracle assumptions that inflate reported robustness.

Abstract: Physical layer (PHY) information hiding refers to the concealment of secrets within PHY waveforms without compromising the integrity of the primary communication link, thereby enabling critical applications such as covert communication, PHY steganography, and watermarking. The widespread deployment of Wi-Fi has motivated substantial research interest in hiding secrets within Wi-Fi waveforms. However, existing Wi-Fi information hiding approaches suffer from two limitations: restricted steganographic capacity and insufficient robustness against environmental variations, both of which severely constrain practical deployment. This work proposes to embed secrets within the Wi-Fi legacy short training field (L-STF). The designed method preserves the autocorrelation properties of Wi-Fi L-STF, ensuring that packet detection and coarse frequency offset compensation functionalities remain uncompromised. The secret embedding and extraction processes employ a pair of neural networks designed to learn optimal embedding rules and maximize steganographic capacity. We developed a prototype system and conducted comprehensive experiments across both indoor and outdoor environments. Experimental results show that our method can reliably embed 46 secret bits within Wi-Fi packets across diverse channel conditions, achieving significantly enhanced steganographic capacity and environmental robustness. The hardware prototype study validates the feasibility of the proposed Wi-Fi information hiding scheme.

Abstract: Post-quantum TLS at an IoT gateway must protect many device connections without large increases in handshake delay, CPU cost, or network traffic. HQC provides code-based diversity beyond ML-KEM, but its computation and ciphertext sizes can increase these costs. We optimize HQC for x86 processors with AVX2, AVX-512, and the Galois Field New Instructions (GFNI), and integrate the resulting implementations into TLS 1.3. We extend branch-free Toom-Cook/Karatsuba multiplication to AVX-512, accelerate Reed-Solomon decoding with GFNI, improve Reed-Muller decoding, accelerate SHA3-512 and fixed-weight sampling, and port Frobenius additive FFT (FAFFT) multiplication to AVX-512 + GFNI for HQC-5. On an Intel Core i5-1135G7 processor, our AVX2 implementation reduces decapsulation by 11.1-21.5% over the fastest prior AVX2 results. Our AVX-512 implementation reduces key generation by 24.9-29.5%, encapsulation by 10.4-11.1%, and decapsulation by 20.6-26.1% relative to Cabral et al. across the three HQC parameter sets. We evaluate the effects of these implementations on TLS 1.3 handshake latency and server and client CPU costs, as well as the effects of round-trip time (RTT) and bandwidth. In local loopback TLS measurements, our AVX-512 HQC-5 implementation reduces handshake latency from 3.22 ms to 2.92 ms compared with Cabral et al. On a constrained path with 1 Mbit/s bandwidth and an added RTT of 50 ms, the HQC-5 handshake takes 243 ms, compared with 87 ms for ML-KEM-1024. This indicates that HQC public-key and ciphertext sizes, rather than implementation speed, determine the remaining handshake cost on constrained links.

Abstract: Protocol verifiers check whether a protocol meets a security goal under stated trust assumptions, such as that a key is never leaked, a value is fresh, or a channel is authentic. They do not say which of those assumptions the goal needs. Rowe, Guttman and Liskov asked for the weakest assumptions under which a protocol achieves a goal and left the question open. We answer it for assumptions about keys, values and channels. Call a run that violates the goal an attack, and the assumptions that would rule it out its stopping set. The least a protocol must trust to meet a goal is exactly the set of minimal ways to stop all of its minimal attacks. Several such sets may exist. The answer becomes unique once either/or assumptions are allowed, and it is a single set exactly when every minimal attack is stopped by a single assumption. A Galois connection between assumptions and goals explains why: a goal may end in "or", but its hypothesis may not. The same structure gives the trust needed by a conjunction of goals and an exact condition under which composed protocols need no extra trust. To compute the answer, a loop asks a verifier whether a candidate suffices, records what stops each attack it reports, and recomputes the candidates. Deciding whether some trust of at most k assumptions suffices is NP-hard. With a bounded analyser of our own and with CPSA, the loop finds the weakest trust for 18 goals over ten protocols and their variants, and on each it agrees with evaluating every trust using the same verifier. The answers include an assumption that our model of the adopted fix of Kerberos PKINIT states but the client's authentication of the server does not need, and channel assumptions under which Needham-Schroeder meets its goal in a bounded model.

Abstract: For a graph $H$, its $k$-colour vertex Ramsey class is the set of all graphs $G$ such that any colouring of the vertices of $G$ in $k$ colours results in a monochromatic (induced) copy of $H$. We prove that for any $k$, Ramsey classes of any non-isomorphic graphs are distinct.

Abstract: One-way network devices, known as data diodes, are used to defend against sophisticated cyberattacks. Partly due to their high cost, data diodes are mostly deployed in nuclear power plants and within the government for handling classified information. Although commercially available data diodes are expensive, a data diode's hardware can assembled from commodity fiber-optic network equipment. However, specialized software is needed to send data through a data diode reliably: the receiving program cannot request retransmission of dropped packets, so packet loss must be minimized and mitigated. First, we developed a minimal program to measure packet loss. We found that most packet loss was caused by the receiving program processing incoming packets too slowly, and that packet loss often occurs in clusters. Also, we discovered ways to minimize packet loss on Linux and macOS without using superuser privileges. Next, we tested three existing open source programs for one-way data transfers: netcat, UDPcast, and lidi. Although these programs were unreliable in their default configurations, we identified reliable configurations for UDPcast and lidi. Finally, we incorporated our findings into pydiode, our cross-platform program for reliable one-way data transfers.

Abstract: Tor is a widely used anonymity network that provides network privacy by routing client communications through a sequence of relays to their destinations. An adversary observing a single Tor relay cannot readily link clients to their destinations, as doing so requires identifying the other relays along the client circuit. Identifying these relays from traffic observed at the monitored relay alone is challenging: each relay carries traffic for many circuits simultaneously, and client circuits typically last only about 10 min, limiting observations of a given circuit. In contrast, Tor onion services use introduction circuits that remain fixed for 18 to 24 h. We develop an intersection attack that exploits this design, allowing an adaptive adversary observing one Tor relay at a time to identify the network location of an onion service. We evaluate the attack on the live Tor network against a self-operated onion service carrying genuine third-party traffic. Across nine end-to-end experiments, the attack reconstructs the complete Tor circuit in every run, with an estimated median time of 2.2 h. To mitigate this attack, we propose a mechanism that periodically rebuilds internal introduction circuits to limit evidence accumulation without changing publicly advertised information.

Abstract: Under tight feature and compute budgets, classical threat detection pipelines often degrade on near-decision-boundary events. Small quantum processors are now available, but existing work inadequately shows whether quantum components improve end-to-end threat detection under the above resource constrained conditions. This paper tries to address this gap with a hybrid architecture that uses a compact multilayer perceptron layer to compress the information in data and then routes the processed features to a few qubit quantum heads implemented in quantum support vector machine (QSVM) and variational quantum circuit (VQC) models. On a simulation platform, we benchmark these hybrid models against classical models with comparable parameter budgets on two representative cybersecurity tasks, network intrusion detection on NSL-KDD dataset and spam filtering on Ling-Spam dataset. To validate their precision on real quantum hardware, we deploy the best 4-qubit QSVM model on an IBM Quantum device with noise-aware execution, evaluated on a smaller sub-dataset. In the results, shallow quantum heads consistently match, and on difficult near-boundary cases modestly reduce missed attacks and false alarms compared to classical models using the same features. Hardware validation results track the simulation behavior closely enough that the remaining gap is dominated by device noise rather than model design. Furthermore, we conduct adversarial attacks to test the robustness of one QSVM model. Taken together, the study shows that even on small, noisy devices, carefully engineered quantum components may function as competitive, budget-aware components in practical cyber threat detection applications.

Abstract: As Internet of Things (IoT) networks increasingly depend on machine learning for anomaly, malware, intrusion detection, and network monitoring, such systems have become attractive targets for evasion attacks. Evasion attacks pose a major security risk because an adversary intentionally modifies input data to mislead a trained model into producing incorrect predictions while evading detection. This study evaluates the impact of black-box evasion attacks on a cost-utility-based adversarial training defense strategy in an Online AutoML context for IoT networks. Specifically, evasion attacks were applied to online learners, including Hoeffding Tree (HT), Leveraging Bagging (LB), Streaming Random Patches (SRP), Hoeffding Adaptive Tree (HAT), and Adaptive Random Forest (ARF). By developing naive and adversarially trained (AT) versions of these online learners, we generated clean and adversarial accuracies for each model. The results show that the AT versions of LB and SRP performed best, achieving the highest adversarial accuracy (0.985) and high clean accuracy (0.993) at the highest cost budget of 1.00, with a maximum accuracy reduction of only 0.8%. Finally, drift detection was conducted using the Early Drift Detection Method (EDDM).

Abstract: Zero Forcing (ZF) and Power Dominating Set (PDS) mark vertices in a graph based on a common forcing process starting from a problem-specific set of initially marked vertices. ZF initially marks the selected vertices while PDS additionally marks their neighbors. In the forcing process, a marked vertex with only one unmarked neighbor may force that neighbor which then becomes marked, too. A solution marks the entire graph by exhaustive application of this rule. One variant generalizes the forcing threshold; vertices may force when they have a fixed number of $k$ unmarked neighbors. Another variant limits propagation to a fixed number of rounds. We classify the parameterized complexity of the problem variants obtained by combining these choices of initialization, round limit and forcing threshold. We show that with appropriate choices, these variants range in parameterized complexity from fixed-parameter tractable to complete for every even layer $W[2\ell]$ of the $W$-hierarchy, and up to $W[P]$-complete. Our results demonstrate that small changes in any one of these three dimensions can lead to a sharp change in problem complexity.

Abstract: In this paper, we consider the complexity of enumerating inclusion minimal defensive alliances. We present a polynomial-delay algorithm on graphs with maximum degree 5. We complement this result by proving that there is no output-polynomial algorithm on bipartite graphs with maximum degree 6 and degeneracy 2, unless P = NP. Furthermore, there is an FPT-delay algorithm when parameterized by neighborhood diversity. This result is the first exploit of a recently published enumeration algorithm for ILPs. By way of contrast, we prove that, for the parameter pathwidth, there is no FPT-delay algorithm for enumerating all inclusion minimal defensive alliances (unless FPT = W[1]). To the best of our knowledge, this is the first non-enumerability result using parameterized complexity for variations of Another/Next-problems.

Abstract: Dark pools are designed to provide pre-trade privacy, liveness, and post-trade confidentiality - concealing order flow before execution and limiting information leakage after. Decentralized dark pools, such as Renegade, aim to replicate these properties without custodial risk, using secure multi-party computation (MPC) and zero-knowledge proofs for private order matching and verifiable settlement. We show that Renegade's cryptographic guarantees do not deliver these dark pool properties in practice. MPC-with-abort ensures correctness but not fairness: a party may learn the match result and abort without penalty, breaking pre-trade privacy. We demonstrate that the protocol's discovery layer further leaks trading intent before MPC even begins, and that sustained probing via selective abort can probabilistically reconstruct counterparty order history, threatening post-trade confidentiality. We also show that the absence of input-consistency checks prior to MPC execution enables a griefing attack using invalid state commitments requiring no real token holdings that continuously locks honest users' wallets and wastes compute, breaking liveness under sustained conditions. We further analyze over 700,000 Renegade transactions on Base and probe the P2P layer, finding that the network is effectively centralized: 88% of traffic routes through a handful of relayers, with only four nodes sustaining the P2P layer. Since relayers hold their users' wallet state in plaintext, this concentration means the system operates as a centralized orderbook in practice - reproducing off-chain the information asymmetry that dark pools are designed to eliminate. Together, our results show that cryptographic privacy does not imply dark pool security: pre-trade privacy, liveness, and post-trade confidentiality each require additional protocol-level guarantees beyond MPC correctness.

Abstract: In the vertex cover interdiction problem, we are given an undirected graph $G=(V,E)$, two integers $t$ and $k$ and a vertex subset $B\subseteq V$, and we are asked to find a set $X \subseteq B$ with $|X|\leq t$ such that $X$ hits (i.e., intersects) all the vertex covers of $G$ of size at most $k$. Recently, Grüne and Wulf proved that the problem is $Σ_2^p$-complete. However, their reduction relied on the fact that the vertex cover problem is NP-complete. This, in turn, means that we do not know the complexity status of the vertex cover interdiction problem when the input graph is restricted to a bipartite graph since the vertex cover problem can be solved in polynomial time for bipartite graphs. One of our main results shows that the vertex cover interdiction problem is NP-complete for bipartite graphs. In contrast, when $k$ is restricted to the minimum vertex cover size, i.e., we are only required to hit all the minimum vertex covers, we show that the vertex cover interdiction problem can be solved in polynomial time for bipartite graphs. This motivates us to study the parameterized complexity of the vertex cover interdiction problem for bipartite graphs when the difference of $k$ and the minimum vertex cover size is taken as a parameter. With this parameter, we show that the problem is $\mathrm{W}[1]$-hard, but can be solved in polynomial time when the parameter is constant (i.e., in XP time). We also show that the problem is fixed-parameter tractable when parameterized by $k$.

Abstract: Post-Quantum Cryptography (PQC) is being deployed while embedded systems increasingly adopt lightweight virtualization for workload isolation and security. Both trends change performance characteristics, yet their interaction is not well understood. To address this, we present a measurement study of PQC primitives on embedded-class ARM hardware under three execution environments with a shared software stack: native execution, a Docker container, and a Unikraft unikernel running under QEMU. We benchmark five signature and five key encapsulation mechanism families, and, for comparison, two classical algorithms each. We evaluate them using different parameter sets for a total of around 70 configurations, measuring execution time, memory, and energy per operation. To better gauge the impact on applications, we evaluated TLS 1.3 cipher combinations. We find that container overhead is negligible for primitive computation, whereas unikernel overhead depends on the algorithm. For most PQC families the overhead is negligible. A moderate overhead (1.28-1.53) arises in BIKE, HQC, and MAYO, and, above all, in Falcon signing (17.8-19.2). Per-operation energy closely tracks execution time in all environments. For TLS handshakes, container and unikernel clients need more time and energy per handshake, while all three environments converge once expensive post-quantum algorithms dominate the handshake. In these cases algorithm choice affects per-handshake energy by up to three orders of magnitude, far outweighing the environment. Overall, virtualization cost is inversely related to cryptographic cost: environment choice matters most for computationally cheap, standardized algorithms, while for expensive schemes, algorithm choice alone dominates performance.

Abstract: Automotive Ethernet carries heterogeneous multi-protocol traffic in modern in-vehicle networks, where labeled attack data are rarely available and the strongest prior unsupervised detector still relies on handcrafted traffic features. This article presents X-SPUR, an explainable, surprisal-based, protocol-aware unsupervised reasoning framework that instead represents raw packet fields as token sequences, learns benign traffic patterns through causal language modeling, and detects anomalies from per-token cross-entropy surprisal. To incorporate temporal context, we introduce a bimodal fusion architecture that combines payload-token embeddings with inter-packet timing through additive fusion and a Hadamard interaction. To handle the heterogeneous score distributions of different protocol families, we further propose a dual top-$k$% per-protocol $Z$-score calibration that jointly captures moderately distributed and sparse anomaly signatures. On the TOW-IDS dataset, X-SPUR achieves an AUC of 0.9987. This is marginally higher than the 0.9969 reported for AERO. X-SPUR also eliminates handcrafted feature engineering. We train a separate CarDS model using the same architecture and training hyperparameters. This model retains strong performance on the second automotive Ethernet dataset. Beyond detection, per-token surprisal provides fine-grained explainability by attributing anomaly scores to specific protocol fields, supporting interpretable security analysis in heterogeneous in-vehicle networks.

Abstract: Connected and autonomous vehicles (CAVs) face severe Sybil attacks, where attackers exploit privacy-preserving pseudonym-switching mechanisms to anomaly alternate identities while forging Basic Safety Messages (BSMs). Although existing schemes can flag suspicious behaviors, these temporally fragmented Sybil identities render traditional single-point and sequence-based deep learning methods ineffective. Linking these fragmented identities back to the source attacker is essential for root-cause elimination, particularly under extreme label scarcity. Therefore, the Sybil-TraceGuard is proposed as a dynamic semi-supervised spatio-temporal GNN framework for Sybil Guardian, prioritizing "who is responsible" over "whether an attack is happening". It comprises four tightly coupled modules: Incremental Stream Attack Detection (ISAD) for efficient Sybil attack pre-screening; the Dynamic Topology-aware Constructor (DTC) for constructing spatio-temporal dynamic graphs; the Spatial GAT-Encoder with Multi-head Attention (SGEM) to capture multi-identity logical conflicts in spatial interactions; and the Multi-scale Spatio-Temporal Audit (MSTA) to audit short-term and long-term temporal inconsistencies. These modules are optimized within a semi-supervised Mean-Teacher framework via feature-edge shuffling perturbations, regularizing the latent feature space using minimal labels. Experiments across four Sybil attack scenarios demonstrate that Sybil-TraceGuard effectively links fragmented pseudonyms to source attackers. It outperforms state-of-the-art baselines across unlabeled ratios of 0.70-0.95, maintaining high stability and sensitivity despite extreme class imbalance and varying hyperparameter settings.

Abstract: Identifying isolated points is important in image processing applications such as medical imaging, astronomy and quality control management. Other domains, such as cybersecurity, also present challenges that can be framed as image processing problems. One example of particular interest is the identification of anomalous single nodes in spatially organised networks where groups of nodes in different regions share similar feature values. This task can involve both binary and more complex grayscale images. However, existing methods face limitations: template matching is infeasible for grayscale images, while 2nd order derivative based methods are highly sensitive to noise and require user-specified thresholds. To overcome these issues, a novel method is proposed for detecting meaningful single-pixel deviations in images. This approach modifies and extends a neuron model, originally designed for anomaly detection, to operate on spatially diameter limited receptive fields that incorporate excitatory and inhibitory regions. The result is a method that is free from user-specified thresholds and parameters, and can be applied to both binary and grayscale images, providing an effective, robust and efficient solution.

Abstract: PURPOSE - Workloads in containers, such as Docker containers and Kubernetes pods, are vulnerable to many of the same attacks as workloads in non-container environments, including phishing, application exploits and network intrusions. This systematic review and design-and-creation study explores techniques for securing containerised-based operating systems against Man-in-the-Middle (MitM) attacks. The proposed framework uses a conceptual model for representing communication and cryptographic primitives, together with the AnBxJ Java security library and container firewalls operating at layer 7 of the OSI model. The study addresses the question: How can containerised-based operating systems be effectively secured from Man-in-the-Middle attacks? It aims to support practitioners in protecting Docker and Kubernetes deployments by systematising security practices and applying a zero trust architecture. METHODOLOGY - The research uses a Systematic Review (SR) based on the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA), bringing together evidence from studies addressing the same research topic. FINDINGS - Success factors were identified, and a security mechanism was successfully implemented in a containerised-based operating system scenario. VALUE - The findings may help practitioners protect Kubernetes and Docker installations by systematising container security practices and providing a zero trust architecture for containerised-based operating systems.

Abstract: We study a discrete memoryless two-way wiretap channel under strong one-sided secrecy, where User 1's message is confidential and User 2's message is not required to be secret. We develop non-adaptive and key-assisted adaptive inner bounds from a common resolvability estimate for selected index components. For the adaptive construction, we prove a multiround leakage theorem that accounts both for information revealed about a key before its later use and for the possibility that an encoder uses an incorrectly decoded key. The proof includes an ideal-to-implemented coupling, deterministic codebook selection, and a growing-round argument that removes the initialization-rate loss. We eliminate the internal component rates exactly and characterize the adaptive gain at each fixed auxiliary distribution. For an open two-parameter family of binary channels, we also prove a converse for arbitrary non-adaptive stochastic codes and obtain an operational adaptive-versus-non-adaptive separation. For one representative channel, the complete non-adaptive strong one-sided secrecy capacity region is identified exactly.

Abstract: A cryptographically relevant quantum computer will break the elliptic-curve cryptography behind Bitcoin and its Lightning Network, the most widely used payment channel network. Even a post-quantum consensus upgrade of Bitcoin would not cover Lightning's off-chain surfaces, so its gossip, peer transport, invoices, payment onions, and offers need separate protection. An adversary can already record Lightning's encrypted traffic today and decrypt it once such a computer exists. Lightning can therefore move to post-quantum cryptography now, without waiting for Bitcoin, and stop such harvest-now-decrypt-later attacks along with node impersonation, invoice forgery, and payment deanonymization. In this paper, we propose PQLN, a hybrid post-quantum extension of Lightning that protects all of these surfaces with the lattice-based standards ML-DSA and ML-KEM. PQLN distributes post-quantum node identities through Lightning's gossip, hybridizes the transport handshake, adds post-quantum signatures to invoices, commits post-quantum keys in offers, and makes payment onions hybrid. Since post-quantum material is much larger than its elliptic-curve counterpart, we introduce techniques that fit it into Lightning's existing message formats and size limits. We analyze the security of PQLN against a quantum adversary and implement it in rust-lightning, a major Lightning implementation. Our evaluation with real Lightning nodes shows that PQLN nodes interoperate with unmodified nodes. The added cryptographic operations take at most 0.33 milliseconds, and the main cost is communication, since gossip data grows about tenfold with ML-DSA and about fourfold with the smaller Falcon. To our knowledge, PQLN is the first post-quantum design, implementation, and evaluation for Lightning.

Abstract: Distributed Denial-of-Service (DDoS) attacks remain a serious threat to transport networks, with recent attack volumes exceeding 30 Tbps, and the telecommunications industry being the main target. Recent work has yet to study the impact of the hosting software architecture on network monitoring solutions, or to assess recent algorithms for improving attack detection. This paper presents a Network Intrusion Detection System (NIDS) for DDoS detection in transport networks, developed in collaboration with Ericsson. Building on a statistical baseline, we improve detection effectiveness with an Isolation Forest trained on a wider set of flow features, extracted by GoFlowMeter, our open-source Go implementation of CICFlowMeter, and we integrate eBPF/XDP so that the NIDS filters real traffic at the kernel level. We further compare three deployments, monolithic, Kafka-based, and gRPC-based microservices, on a Raspberry Pi 5 testbed replaying the CIC-DDoS2019 dataset as real network traffic. Detection quality is governed mainly by the choice of detector rather than by the transport: the Isolation Forest raises recall and F1 score (0.965 live in the monolithic variant) over the baseline by flagging low-volume attack windows that the baseline misses. The transport is not neutral, however: gRPC reaches almost the same accuracy as the monolithic variant while adding less than 2 milliseconds of transport time per window, whereas the asynchronous Kafka pipeline trails by roughly nine percentage points and adds about 27 milliseconds. These findings clarify the trade-off between detection quality and architectural overhead when deploying a NIDS on resource-constrained hardware.

Abstract: Commercial security gateways repeatedly ship implementation bugs in the code path between the network and the policy decision: hand-written enforcement logic that diverges from the policy author's intent, and ad-hoc request parsers at the network boundary that introduce memory-safety flaws of their own. In both cases the bug is in the deployed enforcement code, not in the policy. Existing approaches either leave the enforcement runtime unverified or connect a formal model to a hand-written engine only by differential testing. Our contribution is a class result: a forward-only, backtrack-free EverParse validator is a verified recognizer for a bounded, finite-state class, and access-control decision functions with fixed-offset fields and bounded disjunction belong to it, so one machine-checked proof transfers to every policy in the class rather than being re-established per policy. Concretely, we encode a bounded policy language's decision function into a fixed-size byte buffer and verify the enforcement code once---covering all byte values---with an SMT solver, proving the validator accepts if and only if the decision function accepts, for every policy, request, and session. Editing rule content over a fixed endpoint set then needs no new proof; adding endpoints reruns the toolchain; extending the language needs new proofs. We establish faithful enforcement of a policy, not that a policy is itself secure. The verified gate is platform-independent, requiring only EverParse/Z3 and a C compiler, whose correctness we assume. We demonstrate a deployment on the seL4 microkernel, which ensures every request passes through the gate and that unverified components cannot corrupt the verified enforcement chain.

Abstract: Graph-based network intrusion detection systems (GIDS) report strong benchmark detection metrics, but those metrics establish little about deployability. We approach the problem from first principles: rather than inheriting the preprocessing, windowing, and thresholding conventions of each published system, we ask what a controlled comparison requires and impose it uniformly. The result is GIDS-Eval, an evaluation framework that decomposes a GIDS into six interchangeable stages and turns those conventions into explicit experimental variables, so reported performance can be attributed to individual stages instead of whole pipelines. We survey nine representative GIDS, reimplement five of them within GIDS-Eval, and evaluate them on four datasets under one matched protocol. We identify nine recurring evaluation gaps and quantify the impact of each: two crafted edges achieve full evasion against three of the eight detector-dataset pairs with anything to hide; the snapshot window alone accounts for a mean 38.3% relative swing in average precision (AP); aligning preprocessing across systems moves AP by up to 61.8 percentage points for a single detector; and none of the 18 detector-dataset pairs we replay can alert as events arrive. We introduce GIDS-Lite, an encoder-free control built in the same framework, which ranks first by AP on two of the four datasets at up to 575$\times$ lower runtime. Architectural complexity is therefore not a consistent driver of detection quality under our matched protocol on current benchmarks, but it does enlarge the runtime, calibration, and attack surfaces operators must defend.

Abstract: Cyberattacks against Operational Technology (OT) systems, which monitor and control industrial processes, pose an increasing threat to essential societal services. For this reason, developing automated intrusion response strategies is highly important. In this paper, we present a formal model of an OT intrusion response use case using the POMDP framework. It includes a realistic model of partial observability that is based on traffic measurements. This approach allows us to develop tractable, learning-based solution methods for automated intrusion response, which are based on PPO. We evaluate the obtained response strategies on an emulated OT system and find that they are effective against several types of MITRE attacks for the studied use case.

Abstract: Off-path network attacks against TCP and DNS (over UDP) client-server connections are generally considered impractical nowadays, due to built-in security features in these protocols, e.g. randomized TCP (initial) sequence numbers and randomized UDP source ports, respectively. In this work, we refute this presumption by demonstrating that an unprivileged malicious application running on the client (but practically off-path), when combined with a remote off-path adversary, can enable powerful network attacks against such connections. We show how such a local--remote collaboration between the malicious application and a remote adversary allows inference of sensitive connection state, including TCP sequence numbers and DNS stub-resolver UDP source ports. Our attacks exploit standard socket API calls such as bind(), protocol mechanisms such as IP options, and operating system features such as cBPF and procfs to infer the TCP initial sequence number (ISN) and the UDP source port in use by the connection of interest. Specifically, we take advantage of certain properties of the ISN generation algorithm as implemented in major operating systems. We demonstrate TCP connection hijacking in Linux, Android, Windows, macOS and iOS, and DNS cache poisoning against Windows, Android and the popular systemd-resolved DNS stub resolver in Linux. We evaluate our techniques across multiple operating systems and realistic deployment settings, including environments behind port-preserving NAT-integrated routers. We disclosed our techniques to Microsoft, Apple, Linux and Google, which led to the release of several patches.

Abstract: SSH is the standard protocol for secure remote administration of servers. At the transport layer, SSH uses the Binary Packet Protocol (BPP) for encrypted and authenticated communication. Above this, the SSH Connection Protocol multiplexes one or more logical channels over a single connection, supporting interactive shells, port forwarding, and related functionality. We show that SSH channel multiplexing creates a previously unrecognized compression side channel: all channels on a connection share the same compression context. When compression is enabled, an attacker can inject partially chosen plaintext into a channel and observe the length of the resulting ciphertext on the network. This enables an adaptive chosen-plaintext attack that recovers secrets from one channel by interacting with another. While related attacks such as CRIME and BREACH have been studied extensively for HTTP over TLS, this is, to our knowledge, the first compression side-channel attack on SSH and the first SSH analysis to consider a combined passive eavesdropper and web attacker threat model. We further demonstrate the attack in three different application scenarios and evaluate its effectiveness under varying levels of protocol noise. We find that, in the lowest-noise scenario, an 8-character secret over a 26-letter alphabet can be recovered using at most 276 guesses. Finally, we analyze the SSH ecosystem for compression support and other implementation characteristics that influence the practical efficacy of the attack.