2026· ITM Web of Conferences· Vol 87, pp. 01023· 0 citations· 7 references
TL;DR
This work proposes CyberText Shield, a specialized mobile-centric framework for real-time smishing detection that combines lightweight graph-based learning with a user-centric educational interface and achieves detection accuracy of 91% with a critical processing latency of less than 100ms per message.
Abstract
The rapid proliferation of mobile communication has established smishing as a primary vector for cyber-social attacks, leveraging user trust to facilitate unauthorized data exfiltration and malware delivery. Conventional defensive mechanisms, including static keyword filters and sender blacklists, increasingly struggle with high false-positive rates and fail to neutralize sophisticated adversarial permutations. To address these limitations, we propose CyberText Shield, a specialized mobile-centric framework for real-time smishing detection. At its technical core, the system transitions from traditional sequential text analysis to high-order relational modeling via Hypergraph Neural Networks (HGNN). By representing message tokens, sender metadata, and contextual features as nodes connected through an incidence-based hypergraph structure, the model captures non-linear dependencies that standard deep learning architectures frequently overlook. We implement an edge-optimized HGNN inference engine tailored for resource-constrained hardware, achieving a detection accuracy of 91% with a critical processing latency of less than 100ms per message.This integration of lightweight graph-based learning with a user-centric educational interface provides a robust, interpretable, and scalable defense against the evolving landscape of mobile phishing threats. Experimental results validate the system's effectiveness in balancing computational efficiency with superior predictive performance in real-world deployment scenarios.
Artificial-intelligence workloads increasingly process proprietary and personally identifiable data, yetconventional security controls protect data only at rest and in transit, leaving computation itself exposed. This paperpresents CC-Shield, a five-layer confidential-computing architecture that combines hardware trusted executionenvironments (Intel SGX, AMD SEV-SNP), differentially private federated aggregation, remote attestation, encryptedmodel lifecycle management, and LSTM-based anomaly detection into a single, formally analysed defence-in-depthstack. We derive a closed-form leakage bound that jointly composes TEE side-channel capacity and differential-privacynoise, prove three attack-resistance theorems covering membership inference, model inversion, and active-adversaryintegrity, and connect security overhead to system throughput via a queuing-theoretic performance model. On ResNet50/ImageNet, BERT-base/SST-2, and a clinical MLP on MIMIC-III, CC-Shield with differential privacy ( )reduces membership-inference attack success to 51.8% (statistically indistinguishable from the 50% random-chancebaseline at a 95% confidence half-width of approximately 1.0 percentage point over 10,000 attack queries), versus 71.3%for an unprotected baseline, while introducing only 11.9%-13.9% inference latency overhead – more than three ordersof magnitude lower than a homomorphic-encryption baseline. A seven-dimension qualitative comparison against fiveprior frameworks shows CC-Shield is the only approach satisfying data-in-use protection, computation integrity,training- and inference-time protection, quantum resistance, sub-15% latency overhead, and a formal security proofsimultaneously.
G. Saxena· International Journal of Mat...· 0 citations
SSH remains a critical yet heavily targeted protocol for remote system administration, with password-based authentication exposing servers to large-scale brute-force, dictionary, and credential-spray attacks. Existing rule-based defences such as Fail2Ban fail to detect slow, distributed, or threshold-aware adversaries, while conventional account-recovery mechanisms: email links, OTPs, and out-of-band verification introduce additional vulnerabilities including phishing, session hijacking, and weak authentication binding. This work presents SSHafe, a real-time SSH brute-force detection and mitigation system that combines time-series feature engineering with a lightweight LightGBM classifier to identify attack patterns directly from system authentication logs. A multi-scale sliding-window approach extracts behavioural features such as attempt rates, inter-arrival times, failure ratios, and username diversity, enabling the model to achieve a detection accuracy of 99.96% on benchmark data and strong performance on unlabeled real-world traffic. Upon detecting an attack, SSHafe automatically blocks the targeted user account and delivers an SSH banner guiding legitimate users to a novel passkey-based password-rotation workflow. The proposed novel password reset standard performs authentication and password update in a single cryptographically bound flow, eliminating the need for sessions, cookies, OTPs, or email-based verification, and mitigating phishing, session hijacking, CSRF, and replay attacks. Experiments on an Azure VM and live adversarial traffic demonstrate that SSHafe can identify and suppress brute-force activity within ten seconds, preventing account compromise even with weak credentials.
Aditya Mitra, Amar Kumar Mandal, Amaan Rais Shah et al.· 0 citations
Evasion attacks pose a significant threat to Network Intrusion Detection Systems (NIDS) by manipulating packets to bypass their defensive strategies. This paper presents a novel black-box evasion attack framework, BlackSlit, tailored against NIDS for encrypted traffic. Unlike traditional “buffer-and-perturb” pipelines that incur significant latency, BlackSlit enables live evasion by generating universal perturbations for incoming encrypted traffic without prior knowledge. To ensure practical applicability, BlackSlit generates packet-level perturbation sequences and imposes manipulability constraints on encrypted packet features, ensuring that the perturbations are executable at the packet level. BlackSlit comprises two core components, the Generator and the Simulator, which operate in a complementary manner. The Generator iteratively produces packet-level universal perturbations, while the Simulator mimics the behavior of black-box target NIDS to guide the update process of the Generator. Both components employ a hierarchical time-series Transformer (TST)-based architecture to account for temporal correlations intrinsic to encrypted traffic, aligning with the focus of state-of-the-art (SOTA) NIDS. This architecture ensures that temporal dependencies are effectively modeled during both perturbation generation and target system simulation, thereby enhancing the overall efficacy of evasion attacks. Evaluations are conducted on 3 real-world datasets, benchmarked against 6 leading evasion attack baselines and 9 NIDS. Results demonstrate that BlackSlit consistently outperforms state-of-the-art methods across all benchmarks. Moreover, experiments against defended NIDS confirm that BlackSlit maintains robustness.
Hua Ding, Lixing Chen, Bo Zhang et al.· IEEE Transactions on Network...· 0 citations
Cyber-Physical-Social Systems (CPSS) face escalating side-channel threats that undermine secure data transmission and authentication. As China’s national cryptographic hash standard, SM3 is widely deployed in CPSS-integrated social network ecosystems for identity authentication, API signing, and cross-platform data integrity verification—yet its key-dependent input vulnerabilities against side-channel attacks remain inadequately addressed. This study tackles two critical limitations of traditional side-channel attacks for HMAC-SM3 key recovery: non-profiling methods fail due to absent plaintext correlations, while profiling-based approaches suffer from error accumulation and near-zero success rates in single-trace scenarios. We propose a self-calibrating side-channel attack (SC-SCA) that enables high-accuracy HMAC-SM3 key recovery using only a single power trace during the attack phase. The method constructs a Bayesian network to integrate power trace statistics with prior knowledge of input dependencies, then performs joint probabilistic inference
via
belief propagation. Experimental results demonstrate 100% key recovery success under simulated noiseless conditions, 91.45% success on a real smart card system, and 73% effectiveness at a 10 dB signal-to-noise ratio. Crucially, this work exposes a previously overlooked attack surface in CPSS-based social networks: a single compromised HMAC-SM3 key can enable forged device control commands, large-scale privacy breaches, and cascading identity theft across linked social platforms. Our findings provide both a practical security benchmark for CPSS edge devices and theoretical foundations for designing side-channel-resistant cryptographic implementations.
Zhen Wu, Zhiguang Qin, Kai Wang· Frontiers of Physics· 0 citations
The increasing sophistication of intelligent cyber warfare, in which adversaries exploit artificial intelligence to automate reconnaissance, generate polymorphic malware, and conduct machine-speed attacks, has rendered conventional perimeter security and static Zero Trust implementations inadequate for autonomous and self-managing networks. This study addresses the absence of an integrated, adaptive architecture by designing and analytically evaluating an AI-driven adaptive Zero Trust framework that unifies behavioural analytics, federated intrusion detection, explainable trust scoring, and autonomous policy enforcement within a NIST-aligned model. Adopting a quantitative, experimental, and simulation-based design, the framework was evaluated using public benchmark datasets including CICIDS2017, UNSW NB15, and BoT IoT, with standardised preprocessing, balanced resampling, and stratified cross-validation. Eight classifiers were trained, among which gradient boosting achieved an accuracy and F1 score of approximately 0.9999 on the CICIDS2017 benchmark after leakage-prone identifier features were removed, while ensemble and convolutional models performed strongly. The dynamic trust engine, exercised on an illustrative cohort of ten simulated agents, enforced conservative session-level access decisions, and a simulated three-node federated learning configuration produced an aggregated F1 score of 0.9185, quantifying the privacy-performance trade-off under heterogeneous partitions. These findings support a coherent, identity-centric defence delivering continuous, explainable verification. The study contributes a conceptual architectural blueprint validated through simulation rather than an operationally deployed system, and sampled datasets and simulated agents constrain operational generalization, motivating future validation on live autonomous network testbeds.
Utin Nyimeobong Archibong, Suleiman S. Abba, Busola Motunrayo Olawale et al.· Asian Journal of Research in...· 0 citations
: Static key rotation policies are structurally mismatched to machine-paced adversaries that can exfiltrate session keys within a single cryptoperiod. This paper presents Threat-Reactive Encryption (TRE), a four-layer framework that couples a real-time ML threat scorer to a PKCS#11-compatible key management pipeline, closing the gap between threat detection and cryptographic response. A 47-feature telemetry vector from network flows, TLS handshake metadata, syscall traces, and hardware performance counters (HPCs) is scored every 500ms by an XGBoost+Isolation Forest ensemble inside a hardware-attested Trusted Execution Environment (TEE). Rotation fires atomically when the unified threat score exceeds a Bayesian adaptive threshold, installing new key material via TLS1.3 post-handshake authentication without session interruption. On a 168-hour, 10Gbps testbed with 500 concurrent TLS1.3 sessions and 12 injected CALDERA attack cam-paigns, TRE achieves macro-AUPRC=0.952, median rotation latency=57ms (P99=163ms), and steady-state FPR ≤ 2 . 0% with zero session resets. Post-compromise key exposure is reduced 625 × vs. the 24-hour static policy and 26 × vs. the 1-hour static policy. Adversarial analysis shows full evasion requires the attacker to operate at ≈ 7% of unconstrained attack throughput. The approach is PKCS#11-compatible and provides a direct extension path to post-quantum algorithm substitution via CRYSTALS-Kyber (NIST FIPS203).
Mohammed El-hajj· Proceedings of the 23rd Inte...· 0 citations