Journal of Science and Technology on Information security

A Formal Analysis of The Modified 5G EAP-TLS Protocol

2026-06-16T14:41:46+07:00

The 5G EAP-TLS protocol is one of the three protocols standardised by 3GPP for use in 5G networks. Although this protocol inherently ensures security, authentication, and data integrity, recent studies have shown that it still faces several vulnerabilities, including Man-in-The-Middle attacks, user impersonation, and replay attacks. This paper presents a detailed description of the steps in the modified EAP-TLS protocol, which addresses these issues by directly binding the digital certificate to the subscriber’s SUCI identity to prevent user impersonation, binding the session key to both the certificate and the identity to ensure resistance against Man-in-The-Middle attacks, and introducing a nonce value to prevent the reuse of old packets in replay attacks. The paper employs the Proverif tool as a formal verification approach to evaluate the security of the modified 5G EAP-TLS protocol. The verification outcomes indicate that the proposed protocol satisfies the specified security properties, including the confidentiality of the session key (KSESSION), the subscriber identity (SUPI), the pre-master key (RPREKEY), as well as other relevant security requirements.

Towards Semantic-Preserving Obfuscation for Analysis-Resistant EVM Bytecode

2026-08-20T08:15:26+07:00

With the transparency of the Ethereum platform, deployed smart contracts remain permanently public, exposing their virtual machine code to risks such as reverse engineering, control-flow analysis and malicious behavior identification. Although several obfuscation approaches for the EVM have been proposed, existing solutions often suffer from limited resistance against advanced analysis techniques, insufficient structural transformation capability or excessive execution overhead. In this work, we propose a novel obfuscation framework for EVM bytecode that enhances security by combining semantic-aware transformations with control-flow perturbation techniques. The proposed framework significantly increases structural complexity, hinders Control Flow Graph (CFG) recovery and alters discriminative virtual machine code characteristics while preserving the semantic correctness of smart contracts. Experimental results demonstrate that the proposed framework achieves a 100% obfuscation success rate with an average cyclomatic complexity of 90.80. Across all 15 evaluated transformation combinations, the framework introduces an overall mean virtual machine code size increase of 15.99% and a mean gas overhead of 7.04%. Notably, the complete multi-layer pipeline (T1+T2+T3+T4) exhibits overheads of 29.73% for virtual machine code size and 12.58% for gas, which remain acceptable considering the achieved robust resistance against reverse engineering and automated static analysis.

Secure Sudoku Mapping for Dual-Image Reversible Data Hiding

2026-08-20T08:46:08+07:00

Reversible data hiding in encrypted images (RDHEI) often creates embedding room by preserving or preprocessing image redundancy, thereby coupling the hiding layer to a specialized encryption model. This paper presents a dual-image method that works directly on AES-CTR ciphertext. Its design rests on four elements: a keyed Sudoku coordinate code for carrying two base-8 digits per accepted pair; exact reconstruction of each ciphertext pair from inter-block displacement; AES-GCM framing for payload confidentiality and integrity; and an adaptive movement threshold that selects the lowest-distortion mappings able to accommodate the complete frame. The data hider requires neither plaintext nor the image-encryption key, and no location map is transmitted. On sixteen 512×512 grayscale images, the method achieves a mean maximum net rate of 1.4187 bits per transmitted pixel. At ER_t=1.0, the two marked outputs reach mean PSNR values of 47.65 dB, and all 160 image-rate trials yield zero payload error and pixel-exact recovery. An independent implementation of the embedding and recovery layer of Venkatesh et al. is also examined; published and reproduced results are reported separately where the original specification leaves ambiguity. The experiments show that the proposed architecture provides predictable payload, low carrier-domain distortion, authenticated framing, and exact recovery while retaining standard image encryption.

FL-SVM: A Federated Learning-Based Support Vector Machine Model for IoT Malware Detection

2026-07-28T07:59:57+07:00

The rapid development of IoT devices has significantly contributed to digital transformation across organizations, enterprises, and institutions. The risk of malware infection on IoT devices has become increasingly prevalent and dangerous, with new attack methods and infection techniques. IoT devices, with their numerous, diverse types, configurations and resource usage characteristics, have raised new requirements for more efficient, accurate IoT malware detection methods and solutions that ensure privacy during model training in real-world applications. In this paper, we propose a more efficient IoT malware detection model based on an improved Federated Learning method. Specifically, our key contributions include a dynamic aggregation mechanism designed for clients with heterogeneous feature spaces, allowing resource-constrained IoT devices to adaptively adjust their feature dimensionality according to hardware capacity. The proposed malware detection model has been tested with an IoT dataset on the MIPS architecture platform. Experimental results show that the proposed malware detection model achieves good accuracy while strongly leveraging the advantages of Federated Learning in ensuring data privacy and minimizing computational resource usage during model training.

D3QN-Based Joint Power and Reflection Optimization for Energy-Efficient Anti-Jamming against Dynamic Jamming Attacks in Backscatter-Enabled 6G IoT Networks

2026-07-13T08:32:46+07:00

This paper develops a Dueling Double Deep Q-Network (D3QN) framework for joint transmit-power and reflection-coefficient control in backscatter-enabled 6G Internet-of-Things networks subject to random, reactive, and time-varying jamming. The problem is formulated as a jammer-aware Markov decision process with a 20-action power–reflection space and a normalized reward that balances spectral efficiency, transmit-power consumption, and low-SINR outage. The proposed method is evaluated against DQN, DDQN, PPO, TD3, SAC, random selection, and fixed control over five independent seeds with 95% confidence intervals. Under random jamming at Pj = 30 dBm, D3QN improves spectral efficiency by 19.83% and reduces outage probability by 6.99% relative to DQN. Under a common dynamic-jamming trace, it provides a 2.12% spectral-efficiency gain while using an average transmit power of 0.427 W, with the maximum-power action selected in only 17.6% of the slots. The 20-action design also improves spectral efficiency by 4.21% over a 9-action grid while using 59.18% fewer outputs than a 49-action grid. Under strong reactive jamming, D3QN improves energy efficiency over DQN by 2.54%, but exhibits lower spectral efficiency and slightly higher outage, revealing a rate - energy - reliability trade -off. Overall, the proposed framework offers a practical balance among communication performance, energy use, and action-space complexity

Evaluating the Guessability of 6-Digit PINs under User Bias and Date-of-Birth Leakage

2026-07-20T10:06:24+07:00

Six-digit PIN security cannot be characterized by the nominal -value space or by unconditional entropy alone. This paper presents a fully specified synthetic evaluation of three populations: uniform (M1), survey-calibrated biased (M2), and user-specific date-of-birth linked (M3). The anonymous convenience survey contained 142 responses; one missing strategy response was excluded, one free-text response was recoded, and date-format probabilities were estimated conditionally from 119 applicable responses. Exact population metrics are separated from finite-sample plug-in estimates, and four attacks are evaluated on held-out users across 20 declared seeds. Correct full-support enumeration gives M1 an expected guess number Frequency-Ranked of 500,000.5, Top-10 success whereas reaches 19.833% ± 0.252% against M2. M3 has unconditional entropy but conditional entropy ; with DOB known, Leakage-Assisted Top-10 success reaches 38.736% ± 0.409%. Thus, population diversity and individual protection are different properties. Blocklist outcomes depend on post-rejection behavior: conditional reselection can reduce global frequency attacks but does not mitigate the modeled DOB-assisted attack, while concentrated workarounds can increase risk. Conclusions are limited to the stated synthetic populations and assumptions; no blocklist size is claimed to be universally optimal.

Multimodal Deepfake Detection for Digital Forensics: A Robust Audio-Visual Inconsistency Approach for Evidence Integrity

2026-04-17T08:27:57+07:00

The rapid proliferation of Generative AI (GenAI) has democratized the creation of hyper-realistic multimedia forgeries, posing severe threats to electronic Know Your Customer (eKYC) systems and digital forensic investigations. While visual synthesis has reached near-perfection, maintaining precise synchronization between lip movements (visemes) and speech signals (phonemes) remains a formidable challenge. To address this, we propose a novel Multimodal Deep Learning framework designed to detect high-fidelity Deepfakes by exploiting audio visual temporal inconsistencies. Beyond traditional feature fusion, our architecture integrates a Contrastive Synchronization Loss with a Transformer based Cross-Modal Attention mechanism. This hybrid objective explicitly enforces intra-class compactness for authentic pairs while amplifying the distance for asynchronous forgeries. Extensive experiments on FaceForensics++, DFDC, and a custom Vietnamese dataset (Vn-eKYC-Aug) demonstrate that our model achieves state-of-the-art performance, maintaining high robustness against video compression and environmental noise, though operational efficacy remains sensitive to extreme low-light conditions and diverse regional dialects. This research provides a resilient forensic layer for digital identity verification, ensuring evidence integrity in the GenAI era.

Integrating the MKV Block Cipher into the ZFS File System

2026-08-20T08:02:12+07:00

In the context of ever-growing digital data in both scale and value, the need to ensure data confidentiality and integrity has become essential for modern storage systems. Among advanced storage solutions, TrueNAS, built on ZFS, stands out for its data integrity verification and encryption capabilities. Based on an analysis of ZFS characteristics, this article evaluates the feasibility of integrating MKV, a Vietnamese post-quantum-resistant block cipher, to enhance data security. Experimental results show that the proposed MKV encryption mechanism achieves a write bandwidth of 390 MB/s, compared with 608 MB/s for AES encryption and 774 MB/s for the non-encrypted configuration, while maintaining low CPU utilization. Although the proposed mechanism introduces performance overhead, the results demonstrate its feasibility for applications requiring enhanced data confidentiality with an acceptable trade-off between security and storage performance.

LDOP-Edge Architecture for Distributed Data Processing and Sharing in E-Government

2026-08-20T07:54:06+07:00

E-government systems use growing volumes of data across agencies and administrative levels. In a fully centralized model, each local request traverses a wide-area network (WAN), which may increase latency, consume bandwidth, and interrupt point-of-service operations during outages. This design paper proposes LDOP-Edge, a governed edge layer integrated with the National Data Platform (NDOP), secure connection points (AGN), local data platforms (LDOP), and authoritative source systems. LDOP distributes machine-enforceable policies for cache eligibility, time-to-live (TTL), permitted degraded-mode operations, access control, retention, synchronization, and evidence logging. Edge Nodes store only approved minimum data and never become authoritative sources. Cached records carry source, version, update time, validity, integrity protection, and verification status. Offline transactions carry event and idempotency identifiers and remain provisional until central validation. The paper contributes a public-sector architecture mapping, a decision matrix for policy-controlled caching, a transaction state machine, a threat-control model, and a reproducible protocol for comparing centralized, simple-cache, and LDOP-Edge configurations. Because the current work is architectural and no measured prototype results are claimed, expected performance and continuity benefits are stated as hypotheses for controlled validation.