Jun 2026· Digital Technology Security· pp. 91-106· 0 citations
TL;DR
The developed solution enables independent, vendor-neutral comparative analysis of security measures, reduces testing costs, ensures test reproducibility, and enhances the soundness of security measure selection for critical infrastructure.
Abstract
This article discusses the development of a universal, comprehensive testing methodology for intrusion detection and prevention systems, designed to objectively evaluate their effectiveness in the face of increasingly complex network attacks. Existing approaches are often vendor-specific, which hinders independent comparative analysis. The methodology is based on a modular approach and is implemented on a test bench with the system directly integrated into the network traffic path. The study formulates requirements for the methodology, including universality, reproducibility, ease of use, and transparency of results analysis. Functional tests verify real-time attack blocking, logging accuracy, rule processing for various protocols, content filtering, and system behavior in failure mode. The article proposes an evaluation framework consistent with the recommendations of ISO/IEC 27034-1 and NIST SP 800-94. The developed solution enables independent, vendor-neutral comparative analysis of security measures, reduces testing costs, ensures test reproducibility, and enhances the soundness of security measure selection for critical infrastructure.
This review's results show that penetration testing is an important part of improving cybersecurity because it helps identify weaknesses before they become problems and reduces risk.
The rapid expansion of the life cycle for software deployment has required a move from traditional, manual security analysis to automated and integrated assurance frameworks. This study examines the effectiveness of integrating assurance, real-time threat detection, and automated certification gates right into the Continuous Integration and Continuous Deployment pipeline. The analysis is based on a synthetic dataset comprising values from 429 different builds, which is used to study the agreement between automated gating mechanisms and lower vulnerability escape rates. We used a standard tool chain consisting of Jenkins for orchestration, SonarQube for static analysis, and Splunk for log aggregation to emulate a high-velocity enterprise environment. The system seeks to reduce technical debt and potential security risks without impeding deployment velocity by enforcing stringent quality gates that prevent non-compliant artifacts from being promoted. The study highlights the quantitative effects of these controls on success build rates and on the exposure of hidden threats during staging. The results reveal that, despite an initial slowdown in delivery velocity, the incorporation of automated certification gates considerably reduces critical severity incident rates. Implications: The results indicate how to make system changes in response to data for those attempting to put DevSecOps into practice while maintaining the speed and integrity of their systems.
Sauhard Bhatt, Satyanarayana Gadiraju· 2026 6th International Confe...· 0 citations
Focusing on the typical characteristics of power monitoring systems—including dedicated protocols, stable communication relationships, stringent real-time requirements, and security incidents with severe operational consequences—this paper presents a systematic review of protocol analysis-based secure traffic monitoring and anomalous behavior detection. The review begins with the network architecture, representative protocols such as International Electrotechnical Commission (IEC) 104, IEC 61850, and Distributed Network Protocol 3 (DNP3), and their associated security risks, thereby clarifying the foundational role of protocol-level visibility in power monitoring scenarios. It then surveys protocol analysis methods, including deep packet inspection, flow-level feature analysis, machine learning, and hybrid identification approaches, as well as anomaly detection strategies targeting connection behavior, operational status, and physical consistency. On this basis, it further summarizes common issues in publicly available datasets, evaluation metrics, and experimental design. Existing studies indicate that related technologies are moving from single rule matching toward the coordinated use of protocol semantic understanding, behavioral modeling, and multi-layer fusion analysis. Nevertheless, substantial gaps remain in power-specific data resources, cross-scenario generalization, stealthy anomaly recognition, and engineering interpretability. Finally, the paper discusses future research directions in light of the practical requirements of power monitoring systems.
Shan-Shan Bai, Pengyuan Wang, Tian-Le Gao et al.· Journal of Electronics and E...· 0 citations
The increasing complexity of modern network environments has heightened the need for practical and scalable intrusion detection solutions. This study presents the development of a real-time, flow-based Intrusion Detection and Security Management System (IDSMS) that integrates live traffic monitoring, machine learning-based intrusion analysis, centralized data storage, and web-based visualization. The system captures network traffic from a MikroTik-based gateway using a passive flow sniffer deployed on a Kali Linux monitoring node. Packets are aggregated into bidirectional flows and transformed into statistical feature vectors, which are analyzed by a machine learning inference service through an application programming interface. Detection results, including risk level and attack classification, are stored in a centralized database and presented through an interactive dashboard. The intrusion detection engine employs a two-stage ensemble approach: Stage A performs binary classification (benign vs. malicious) using a calibrated stacking ensemble of Random Forest, Gradient Boosting, and XGBoost classifiers with Logistic Regression as meta-classifier, achieving 99.92% accuracy and 0.99987 ROC-AUC. Stage B performs multi-class classification across 14 attack categories using a Random Forest classifier, achieving 99.83% accuracy with per-class F1-scores exceeding 99.6%. Development-stage testing using simulated attack traffic demonstrates the system’s ability to capture, analyze, and visualize network threats in real time, with average inference latency of 12.4 ms per flow and processing throughput of 3,842 flows per minute. The proposed system provides a practical foundation for deployment in shared-access networks, small enterprises, and IoT-enabled environments.
Jimson A. Olaybar, Patrick D. Cerna· 2026 International Conferenc...· 0 citations
This article describes the implementation of a comprehensive approach to assessing information security threats concerning a specific class of devices—embedded systems. The article combines regulatory and technical-analytical approaches to evaluating the threats posed by software backdoors in embedded systems. The assessment of the threat from software backdoors in embedded systems is conducted within the framework of the classifications outlined in the «Information Security Threat Assessment Methodology» approved by the Federal Service for Technical and Export Control of Russia on February 5, 2021. Based on the classifications regulated by the methodology concerning the capabilities, tactics, and typical techniques of an attacker, and taking into account the peculiarities of the development and operation of embedded systems, the threat from software backdoors for this class of devices is assessed. As a result of the technical analysis, potential sources of information for an attacker implementing information-gathering tactics are detailed, and clustering is performed by network type for the tactics employed by the attacker to gain initial access to system components and networks using various techniques. The results of the threat assessment from software backdoors in embedded systems can be used to develop relevant countermeasures against threats, select optimal information protection means during the development and operation of embedded systems, and formulate technical specifications for the enhancement of existing or the creation of advanced information protection means in embedded systems.
A.I. Miroshnichenko, R. A. Dyachenko· Informatization and communic...· 0 citations
: In the contemporary digital landscape, network security represents a critical challenge due to the increasing frequency and sophistication of cyberattacks. Firewall systems play a central role in protecting network infrastructure by filtering traffic and controlling access. pfSense, an open-source firewall solution based on the FreeBSD platform, offers a wide range of features, including VPN, IDS/IPS, and advanced traffic control mechanisms. This paper analyzes the effectiveness of the pfSense system in detecting and preventing various types of network attacks through experimental testing in both virtual and physical environments. The experiments encompass port scanning, brute-force attacks, and DDoS scenarios, utilizing tools such as Nmap, Hydra, and hping3. Research results indicate that pfSense, with properly configured IDS/IPS systems, can effectively detect and block a significant percentage of attacks, making it a reliable solution for network protection, particularly in resource-constrained environments.
Nemanja Jeličić, Marko Šarac· SINTEZA· 0 citations