Journal of Science and Technology on Information security

A Scalable Telegram-Based Botnet Framework for Stealthy Remote Command and Control

Pham Van Toi — 2025-09-30

In this study, we analyze how Telegram Bots can be abused as a Command and Control (C2) infrastructure in cyberattacks. We propose a Telegram-based C2 model that enables attackers to control compromised systems without relying on a centralized server, thereby enhancing anonymity and evasion capabilities. Furthermore, we introduce detection and defense strategies based on network behavior monitoring and encrypted message analysis.

Generating evasive payloads for assessing Web Application Firewalls with Reinforcement Learning and Pre-trained Language Models

Tran Gia Bao — 2025-09-30

Web Application Firewalls (WAFs) serve as a critical defense mechanism against various web-based attacks such as SQL Injection (SQLi), Cross-Site Scripting (XSS), Server-Side Request Forgery (SSRF), Remote Code Execution (RCE), and NoSQL Injection. However, modern adversaries often craft evasive and obfuscated payloads capable of bypassing traditional WAF rules. To effectively assess and challenge the robustness of WAFs, we propose DEG-WAF, a Deep Evasion Generation framework that leverages Large Language Models (LLM) in conjunction with Reinforcement Learning (RL) to generate evasive payloads against WAFs. The system consists of four core components: a payload generation agent based on a pre-trained LLM (OPT-125M), a reward model that approximates WAF behavior, a grammar-based sampling agent that ensures syntactic validity, and an RL agent trained with either Proximal Policy Optimization (PPO) or Advantage Actor-Critic (A2C) to fine-tune generation strategies. Experimental evaluations on real-world WAFs, including ModSecurity and SafeLine, demonstrate that the A2C-based model significantly outperforms baseline LLMs—achieving a bypass success rate of 80.16% on SQLi and 74.70% on NoSQLi for ModSecurity, and 97.8% on RCE for SafeLine. These results underscore the potential of our LLM-RL framework to serve as a robust foundation for evaluating and enhancing the resilience of WAF systems under adversarial conditions.

FedPC Cloud CPU Forecasting using Federated Learning and Periodicity-based Clustering

Nguyen Quoc Khanh — 2025-09-30

Accurate CPU workload forecasting is vital for efficient resource management and system availability in cloud computing, yet faces challenges in data privacy, security, and the "cold start"problem for new Virtual Machines (VMs). Traditional methods risk privacy and struggle with limited data. We propose FedPC, a novel framework leveraging privacy-preserving Federated Learning (FL) with Periodicity-based Clustering. FedPC enables collaborative training without exposing local data, crucially supporting effective forecasting for new VMs with minimal historical information. It clusters VMs by workload periodicity, training tailored LSTMs within each cluster to handle heterogeneity securely. Evaluated on Azure Public Dataset V1, FedPC surpasses FedAvg in privacy and matches state-of-the-art methods in accuracy. This demonstrates FedPC’s efficacy in securely, adaptively managing resources, thereby enhancing system availability, especially in dynamic cloud environments with frequent VM creation and scarce initial data.

Malware Analysis: A Perspective from Dynamic Symbolic Execution of Binary Code

Mizuhito Ogawa — 2025-09-30

Malware analysis typically involves three steps:
obfuscation, infection, and malicious action. Many antivirus methods fail because obfuscation hides control structures. This paper provides an overview of dynamic symbolic execution (DSE) applied to binary code, especially x86. DSE is considered the most powerful technique for deobfuscation and can automatically recover control structures such as control‑flow graphs. Several DSE tools target x86 (e.g., angr, Mayhem, S2E, KLEE‑MC, and BE‑PUM); we examine their design choices and trade‑offs. Finally, we evaluate the effectiveness of control‑flow graph similarity for tasks such as packer identification and original entry point (OEP) detection.

A secure image steganography based on Hamming codes and image block complexity estimation using a zig-zag order

Nguyen Duc Tuan — 2025-09-30

Data hiding in digital images has received considerable attention in recent years. Research efforts have primarily focused on increasing embedding capacity while preserving the visual quality of stego-images. In this paper, we propose a data hiding scheme based on Hamming codes. To enhance visual quality, the scheme estimates block complexity from pairs of adjacent pixels arranged in zig-zag order and uses this measure to identify high-texture regions for embedding message bits. To further minimize distortion, secret bits are embedded using the proposed Hamming code-based method. Moreover, embedding capacity is increased by utilizing multiple pixel bit-planes. A Canonical Gray Code (CGC) is employed in the bit-plane decomposition process to improve the accuracy of texture characterization in data hiding. Experimental results demonstrate that the proposed scheme achieves higher embedding capacity, improved visual quality, and stronger resistance to detection attacks.