SafeGuard is presented, a lightweight three-tier client-server architecture for real-time endpoint monitoring, threat reporting, and administrative response that demonstrates that an open-source technology stack can provide real-time endpoint visibility and coordinated administrative response without commercial licensing costs.
Abstract
Endpoint devices remain a primary target for cyberattacks, yet commercial Endpoint Detection and Response (EDR) platforms are often too costly and operationally complex for small and resource-constrained organizations. This paper presents SafeGuard, a lightweight three-tier client-server architecture for real-time endpoint monitoring, threat reporting, and administrative response. The system comprises a Flutter-based endpoint agent extended with Kotlin for Android system access, a Node.js central server that authenticates devices and coordinates secure communication, and an administrative dashboard for live monitoring and remote actions such as device locking, application removal, and warning notification dispatch. Threat detection is implemented through signature-based comparison against a maintained threat database, prioritizing low computational overhead, explainability, and ease of deployment over generalized anomaly detection. Communication security is achieved using WebSocket over TLS (WSS), JSON Web Token (JWT) authentication, and HMAC-based message integrity verification. The system was evaluated through unit, integration, system, load, and preliminary security testing. Under a simulated deployment of 50 concurrent endpoints, average command-dispatch latency was approximately 1.5 seconds and remained below 2 seconds under load. Invalid authentication tokens were rejected, while manual SQL injection and replay attempts were unsuccessful in the evaluated scenarios. The results demonstrate that an open-source technology stack can provide real-time endpoint visibility and coordinated administrative response without commercial licensing costs. The contribution is architectural and empirical rather than algorithmic, with current limitations including reliance on static threat signatures, Android-focused implementation, and controlled-environment evaluation.
Cloud infrastructure security represents a critical challenge in addressing cybersecurity threats, particularly for internet-facing services such as Remote Desktop Protocol (RDP) and SQL Server. This research investigates cloud infrastructure security based on Windows Server 2019 through the development of a proactive and responsive attack detection and analysis framework using the Wazuh platform as Security Information and Event Management (SIEM) integrated with the MITRE ATT&CK framework. The research method employs an experimental approach with continuous monitoring for 30 days of two Windows Server 2019 units running RDP and SQL Server services. Attack simulations were conducted using eight different scenarios including RDP brute force, SQL Server authentication brute force, port scanning, privilege escalation, lateral movement, data exfiltration, persistence mechanisms, and defense evasion. Monitoring results revealed 110,492 total security events, dominated by 109,057 authentication failures (98.7%) and only 171 successful authentications, with the remainder consisting of other activities such as port scanning and process execution. The Wazuh-based detection system with MITRE ATT&CK integration successfully mapped 15 attack techniques, 10 of which were actively observed during the 30-day monitoring period, with a detection rate of 93.2%, false positive rate of 6.8%, and average response time of 2.4 seconds. Compliance analysis showed 87% compliance with PCI DSS, 91% with NIST 800-53, 85% with HIPAA, and 89% with GDPR. The research concludes that the integration of Wazuh SIEM with the MITRE ATT&CK framework is effective in detecting and analyzing cyber attacks on Windows Server 2019, with practical contributions in the form of implementation guidelines for rule-based detection and correlation rules for multi-stage attack detection.
Ikhwan Alfath Nurul Fathony, Affix Mareta, O. Wardhani et al.· Jurnal Sains, Nalar, dan Apl...· 0 citations
MQTT is widely adopted in IoT deployments but offers no built-in encryption or strong authentication. Existing solutions such as the IETF ACE-MQTT-TLS profile require dedicated authorization servers and dynamic token flows, raising deployment complexity for resource-constrained environments. This paper presents a practical secure MQTT architecture that combines Transport Layer Security (TLS) 1.3 with statically provisioned JSON Web Token (JWT) authorization, targeting ESP32-S3 and ESP32-C6 microcontrollers with hardware cryptographic acceleration. A Python-based broker management graphical user interface (GUI) automates Mosquitto configuration and JWT issuance, removing manual setup errors. Measured on real hardware, TLS 1.3 connection time is 315-380 ms and steady-state throughput decreases by only 9%, with an additional heap memory requirement of approximately 42 KB. The results confirm that multi-layered IoT security—encompassing mutual authentication, AES-GCM encrypted transport, and fine-grained access control—is feasible on commodity microcontrollers without specialized infrastructure.
H. Minasyan, Hripsime Hakobyan· 2026 6th International Confe...· 0 citations
Authorization violations under valid Web sessions are difficult to identify and handle in real time from traffic because they depend strongly on business semantics and exhibit few distinctive protocol-level features. This paper proposes a non-intrusive traffic analysis framework for authorization risk detection and coordinated response. Request-response transactions are correlated to extract the access subject, business endpoint, object identifier, authentication state, and behavioral sequence. Object-access evidence, identity consistency, behavioral anomalies, authentication context, network environment, and endpoint-operation risk are mapped to interpretable risk components. Weighted fusion and high-risk priority constraints produce graded decisions that drive allow, alert, block, and external policy actions. The risk components are instantiated using deterministic and interpretable rules to evaluate multi-source evidence organization, risk fusion, and the coordinated-response loop at the framework level. In a controlled local testbed containing 2,000 balanced labeled samples, the framework classified 998 of 1,000 authorization-risk events as risky and produced no false positives among 1,000 normal accesses, achieving 99.90% accuracy, 100.00% precision, 99.80% recall, and a 99.90% F1 score. Removing runtime object evidence reduced the F1 score to 81.31%, while removing the high-risk priority constraint reduced it to 73.90%. In a prototype feasibility test with 100 concurrent requests and 1,000 total requests, mean risk-decision computation latency was 0.077 ms and P99 latency was 0.137 ms. The results demonstrate the feasibility of organizing heterogeneous runtime evidence and establishing an executable authorization-risk decision and coordinated-response loop without modifying application code, but do not establish general applicability in production environments.
Si-Chen Lin, Yuchao Luo, Zihan Zhu et al.· 0 citations
Modernizing the security of operational technology systems that control critical infrastructure has become a pressing challenge. Because edge devices have limited capabilities, modernization has relied on application gateways that interface with identity management systems and enforce access policies. These gateways are powerful enough to perform complex authorization decisions and support zero-trust architectures, but they create major deployment and management burdens: they must be collocated with remote, distributed edge devices, kept up to date with security patches, and managed with minimal downtime. We propose Provable Remote Execution of Zero-Trust Authorization (Prezta), an architecture that eliminates these gateways by evaluating policies within a zero-knowledge virtual machine (zkVM) running on the client. The zkVM produces a succinct proof of authorization that edge devices can verify efficiently, extending the zero-trust security envelope to the edge. Policies and identity management schemes can evolve without updating edge devices. To demonstrate the feasibility of Prezta, we implement a prototype built using the RISC Zero zkVM that supports XACML 3.0 policies and JWT identity claims. While zkVMs introduce substantial proof overhead, we mitigate this overhead by compiling policies to Rust code and precompiling regular expressions. Combined with optimized signature verification and JWT parsing, these measures reduce prover time by more than an order of magnitude. Our compiler correctly implements 83\% of the XACML 3.0 conformance suite, with proof generation completing in tens of seconds on a desktop. Verification, by contrast, takes only tens of milliseconds, which is fast enough for resource-constrained edge devices.
Zhongjing Wei, Osaid Muhammad Ameer, N. Borisov et al.· 0 citations
Industrial cyber-physical systems increasingly use cloud analytics, remote maintenance, software-defined gateways, and virtualized edge compute. This convergence expands the attack surface while operational technology (OT) remains constrained by safety, availability, determinism, long asset lifetimes, and narrow maintenance windows. This paper presents an OTspecific method for using confidential computing with attested key release (AKR): cryptographic material is released only to workloads that prove, through remote attestation, that they execute inside an approved trusted execution environment (TEE) and an approved deployment configuration. The core contribution is an Attested Release Contract (ARC), a policy object that binds TEE measurements, signed configuration manifests, site and role context, minimum security versions, operational modes, fallback behavior, and credential lifetime into one release decision. The paper also defines a fail-safe release state machine, a protocol blueprint covering replay, impersonation, rollback, verifier compromise, and service exhaustion, and an OPC UA gateway case study that includes legacy coexistence and analytical latency constraints. The result is a zero-trust pattern that reduces host-secret exposure while keeping hard real-time control outside the attestation critical path. The paper does not claim a new TEE primitive or measured implementation result.
Shilpi Mittal, Ankit Gupta· 2026 6th International Confe...· 0 citations
Computer-based testing (CBT) platforms have transformed education and certification by enabling scalable, efficient, and accessible examinations. However, these systems face significant cybersecurity risks, including unauthorized access, denial-of-service (DoS) attacks, and digital cheating, which threaten fairness and reliability. This study proposes a network-based security information system (NBSIS) designed specifically for CBT environments. The framework integrates layered defense, including pfSense firewalls (FW), Snort intrusion detection, Splunk security information and event management (SIEM), and artificial intelligence (AI)-powered analytics, into a unified architecture. A human-centered dashboard ensures usability for non-technical exam administrators, providing real-time alerts and intuitive controls. Validation through simulated attack scenarios demonstrated strong resilience, with high detection accuracy, reduced false positives, and rapid response times. Comparative analysis against intrusion detection system (IDS)-only and SIEM-only systems confirmed superior performance. The findings highlight NBSIS as a robust, scalable, and adaptive solution that safeguards exam integrity while remaining practical for diverse organizational contexts. This research contributes to computer science by advancing secure architecture, applying AI-driven anomaly detection, and integrating human-computer interaction principles into cybersecurity for education.