Cloud-native 5G Core (5GC) deployments commonly rely on Kubernetes to restart or replace failed workloads. However, Kubernetes observes generic container health and does not account for Network Function (NF) behaviour, locally held protocol state, or the service disruption caused by replacement. This thesis investigates how Self-Healing for Cyber Security (SH4CS) can be adapted for cloud-native 5GC NFs to support decentralized and proportionate self-healing and self-protection.
A proof-of-concept extension was implemented for the Access and Mobility Management Function (AMF) in a Kubernetes-based free5GC testbed with a simulated UERANSIM radio access network and UE workload. The extension retains the pod-local SH4CS event–rule–action model while incorporating NF metrics, deployment state, and normalized log events. It connects this evidence to actions with different scopes, including temporary logging escalation, stricter OAuth 2.0 token-age enforcement, image replacement, and AMF regeneration. Since the evaluated open-source 5GC implementation does not support transparent UE-context transfer or session continuity between AMF instances, regeneration is performed through a graceful drain-and-restart procedure. The degraded AMF is first removed from the selection of new registrations, causing the gNB to direct them to healthy AMFs. Existing activity is then allowed or actively encouraged to leave the degraded instance before it is restarted.
The evaluation showed that NF-aware recovery can respond to degradation before Kubernetes detects process failure. Under the evaluated workload and memory limit, setting the degraded AMF’s Relative Capacity to zero redirected fresh registrations approximately 249 seconds before the Kubernetes baseline reached an OOMKill. The AMF restart strategy reduced cumulative new-UE service loss by 81.07%, reduced TTR95 from 380 to 135 seconds, and lowered the 95th-percentile onboarding latency from 8564 to 1811 ms. Additional scenarios confirmed the intended state transitions of the self-protection and remediation actions. The sidecar architecture introduced modest steady-state CPU overhead but substantial memory overhead, primarily from the lymphocyte.
The results show that SH4CS can provide a local enforcement and recovery layer for cloud-native 5GC NFs when its observations and actions are specialized for the protected function. The controller is decentralized at the decision boundary while remaining dependent on Kubernetes, operator policy, and the surrounding 5GC. Most importantly, the findings show that container restartability does not make a stateful NF disposable: effective recovery must combine orchestration with protocol-aware observations and actions that account for NF state. ... Read more

Reliable identification of cooperative UAVs in contested environments remains challenging because infrastructure connectivity cannot be assumed, while persistent identifiers expose friendly assets to passive tracking. Existing Identification Friend or Foe (IFF) systems rely on centralised certificate infrastructures and stable communication links, motivating a privacy-preserving alternative that operates autonomously at the tactical edge. This thesis presents the IFF Relation (RIFF), a non-interactive zero-knowledge attestation protocol in which a prover demonstrates federation membership, possession of an enrolled hardware secret, and valid mission credentials without revealing any underlying attributes, using a single Groth16 proof. The protocol jointly constrains membership and hardware attestation within one zero-knowledge relation, preventing cross-asset credential composition, replay attacks through nonce binding, and attribute disclosure, while enabling independent re-verification by multiple observers. The relation is defined over collision-resistant hash functions and Merkle paths, making it migratable to post-quantum backends, although the current Groth16/BN128 instantiation is not post-quantum secure. A proof-of-concept implementation evaluated on x86-64 and ARM hardware under controlled network impairment and adversarial scenarios completes authentication in under 2.2 s on x86-64 but requires 25-28 s on ARM, constraining feasible encounter distances to over 350 m at typical closure speeds. The results demonstrate that privacy-preserving control-state attestation is achievable on capable platforms, while relay attacks remain unmitigated, enabling an adversary without credentials to be classified as friendly by relaying a legitimate proof. Closing this vulnerability requires distance-bounding or channel-binding mechanisms beyond the current design. ... Read more

Memory safety vulnerabilities account for a substantial fraction of critical software exploits. Rust addresses this by enforcing spatial safety at compile time, inserting explicit bounds checks (comparison instructions followed by conditional branches to a panic handler) wherever array accesses cannot be statically proven safe. As Rust sees growing adoption in security-critical infrastructure, an implicit assumption has emerged: that a binary known to be compiled from Rust is, by construction, memory safe.

This thesis challenges that assumption. A malicious developer can compile a legitimate Rust program and then surgically modify the compiled binary (replacing a conditional branch with an unconditional one, substituting a signed comparison for an unsigned one, or decoupling the comparison register from the memory access) while leaving the binary syntactically valid and functionally normal under ordinary inputs. No existing tool systematically detects this class of attack on stripped, optimised binaries.

This work presents VALIDATE, a binary analysis system that detects and classifies adversarial tampering with compiler-inserted bounds checks without access to source code, debug information, or symbol tables. VALIDATE combines dynamic instrumentation via DynamoRIO with targeted static disassembly via radare2 and Capstone, evaluating seven independent structural invariants per check and producing a named verdict that identifies the specific class of tampering detected. ... Read more

The persistence of phishing is driven by the industrialization of the cybercriminal ecosystem.
Current reactive defenses, such as URL blacklisting, are increasingly insufficient due to the extreme speed of modern campaigns and the widespread use of cloaking techniques.
To address these challenges, this thesis proposes a proactive methodology for phishing kit attribution, shifting the analytical focus from ephemeral webpages to the underlying software infrastructure.

We design a system in which we approach kit attribution as an incremental supervised binary classification problem using separate Random Forest models for each phishing kit family.
Our approach prioritizes the "attacker's view" by modeling phishing kits as hierarchical directory trees and extracting stable filesystem artifacts like the presence of files in particular locations.
Through systematic optimization using the \textit{uAdmin} phishing kit family, we demonstrate that this structural fingerprinting provides near-perfect discriminative power for the data-rich \textit{uAdmin} family.

Stress tests reveal that the system is resilient against some levels of obfuscation and that the model's ranking capability remains intact, even at higher levels of perturbation.
Furthermore, learning curve analysis confirms the system's few-shot capability.

When there are not many discovered samples from a phishing kit family, our results show that appending artificially generated samples of phishing kits to the original samples could contribute to a model's performance.

The practical utility of this methodology was validated through an incremental attribution workflow that has generated 23 models for different phishing kit families, which cover over 2000 phishing kits from our database.
A critical real-world application involving a forensic data dump from a German server seizure allowed us to test this incremental attribution workflow on real operational data.

We practically demonstrate two ways to map live phishing pages to known phishing kits, an approach that is based on the most important paths in phishing kit families and an approach that is based on the network activity of a phishing website.

The primary limitations of this thesis are that the client-side artifacts are not taken into consideration, and that live phishing pages do not always correlate well to paths in a phishing kit.

By registering phishing kits and models for phishing kit families alongside with actionable metadata, this thesis provides a scalable phishing kit intelligence system that could help LEAs toward the structural detection and dismantling of industrialized phishing. ... Read more

The Border Gateway Protocol (BGP) remains critical to Internet connectivity, but monitoring unsolicited traffic targeting BGP infrastructure is difficult because contact with TCP port 179 alone does not indicate actual BGP behavior. This thesis investigates whether a protocol-aware BGP honeypot can improve understanding of unsolicited TCP/179 traffic. A medium-interaction BGP honeypot based on BIRD was deployed on unused IPv4 address space, and packet captures were analyzed to extract BGP session information and behavior. The honeypot received 7693 BGP OPEN requests from 1594 unique source IP addresses over 58 days. The honeypot was then compared with a larger reactive network telescope over an aligned monitoring period. The results show that the honeypot provided richer protocol-level information, while the reactive telescope provided broader visibility because of its larger monitored address space. After normalization, the honeypot showed higher BGP source density and BGP visibility, and it also observed some source IPs and real ASNs that were not present in the telescope data. However, most observed interactions remained shallow, usually ending shortly after the OPEN exchange, and no clear BGP-specific attacks were identified. Overall, this thesis shows that a BGP honeypot can serve as a useful complementary monitoring tool by adding protocol-level context to unsolicited BGP traffic observations. ... Read more

Industrial Control Systems (ICS) operate physical processes in environments such as energy, water, manufacturing, and transportation. Many ICS devices communicate through protocols that were designed for trusted operational networks rather than hostile public ones, and often lack authentication, encryption, or other modern security mechanisms. Exposing such services on the public Internet can therefore reveal operational information or create attack surface for systems with physical impact. ICS honeypots help researchers and defenders collect data about scans and attacks against these services by emulating industrial devices. Their value, however, depends on realism: if an attacker or automated tool can recognize the decoy, the interaction may stop and the collected data becomes less useful.

This thesis studies how open-source ICS honeypots can be fingerprinted through source-backed active probes. It combines local reproduction, protocol and source analysis, and a scanner that applies accepted signatures to Censys-derived Internet exposure data. A fingerprint is accepted only when it is remotely observable, tied to a concrete honeypot or implementation lineage, and supported by a false-positive argument. Applied to a worldwide Censys snapshot of about 143,000 hosts across 28 ICS protocols, the scanner labels about a quarter of the active hosts as honeypot-like, 7,090 of them confirmed by a protocol signature, and it confirms honeypots that neither Censys’s own tags nor previously published signatures detect. The resulting methodology and signature catalogue aim to make honeypot weaknesses measurable, support more accurate Internet measurements, and help operators improve honeypot stealth and effectiveness.
... Read more

Securing modern satellites is increasingly challenging as commercial off-the-shelf components and mixed-criticality workloads make spacecraft software stacks more complex and interconnected. Hypervisors are now used to isolate critical subsystems, yet their privileged position makes them attractive targets and their security has received limited automated scrutiny in space contexts.

This work introduces \textsc{Metal-fuzz}, a coverage-guided, hardware-in-the-loop, bare-metal fuzzing framework that targets paravirtualized hypervisor interfaces under realistic execution conditions. Metal-fuzz bridges common kernel fuzzing backends with embedded targets by forwarding executor operations to a remote system under test, enabling hypercall fuzzing while preserving hardware-specific behavior. We define a threat model centered on guest-to-hypervisor escape and identify key challenges in fuzzing embedded hypervisors, including stateful interfaces, hardware dependence, and coverage collection.

A prototype on a Zynq-7000 (Cortex-A9) platform demonstrates feasibility by fuzzing the XtratuM hypervisor and integrating JTAG-based control and trace-driven coverage. The framework provides a practical foundation for systematic security evaluation of space hypervisors and guides future extensions toward broader device coverage and automated analysis.
... Read more

Internet-wide vulnerability scanners traditionally infer a host's patch level from its advertised version banner. This assumption is fragile: operating system distributions and vendors routinely backport security fixes to older branches without changing the version string, causing banner-based tools to systematically over- or under-report exposure. Because direct exploitation is neither ethical nor legally permissible at scale, there is a need for non-intrusive methods that can distinguish patched from unpatched systems more reliably.

This thesis proposes an adaptive patch-level inference system that replaces banner reading with behavior-based Common Vulnerabilities and Exposures (CVE) probing. The system represents the target's possible patch level as a version space - initially unconstrained - and narrows it after each scan using interval arithmetic over CVE-affected ranges. We propose two adaptive scan policies for selecting which CVE to probe next: Binary Search, which maximizes information gain by targeting 50/50 version space splits, and Adaptive Minimax, which minimizes the worst-case remaining space.

We evaluate the system through controlled lab experiments, exhaustive simulation, and a real-world measurement campaign spanning multiple services and countries. The lab experiments confirm that behavior-based probing can distinguish hosts that are patched from hosts that merely advertise an outdated banner. Simulation results show that Adaptive Minimax is the dominant policy across nearly all simulated outcomes; its advantage stems from correctly handling configuration-dependent CVEs, which Binary Search systematically mis-scores as near-perfect splitters. The real-world scan reveals that a substantial fraction of hosts carry version banners inconsistent with their observed vulnerability behavior, confirming that banner-based inference systematically misleads in practice. Long-disclosed, high-severity vulnerabilities remain active in production deployments, pointing to the practical value of behavior-based patch-level assessment. ... Read more

Modern devices reveal their behavior through the network traffic they generate, yet widespread encryption has made payload inspection impractical and shifted the question from which application produced a flow to when the behavior of the device changes. This thesis studies how far behavioral transitions on a single networked device, such as switching applications or moving between foreground and background activity, can be detected from passive, encrypted traffic alone, using unsupervised concept drift detection that operates online and without labels.

The thesis contributes an end-to-end pipeline that turns raw packet captures into windowed feature streams, four labeled recordings collected on dedicated Android and iOS test devices, and an empirical comparison of seven streaming change detectors under realistic observability constraints. It proposes Online NN-DVI, a streaming density-based detector, together with a retro-confirmation segmenter that converts raw detector alarms into labeled behavioral segments online.

Across the four recordings and an external cross-corpus check on the public Mirage dataset, density-based detectors are the most effective paradigm, and Online NN-DVI matches the offline NN-DVI baseline within a few F1 points at roughly an eighth of its runtime, generalizing from a single tuning recording to held-out Android, iOS, and Mirage data without per-dataset retuning. Detectability is gated by the type of transition: app-to-app foreground switches are caught in roughly two thirds of cases, foreground enter and exit transitions in about one in three, and administratively defined idle boundaries not at all. An 18-feature behavior subset matches a 54-feature candidate set, and 5-second window aggregation outperforms 1-second aggregation on both accuracy and runtime, while the segmenter reaches a frame-level F1 of 0.739. Taken together, the results indicate that what limits detection on this stream is the signal carried by the features, not the algorithm operating on them. ... Read more

Credential database breaches cause substantial harm, yet the mean time to identify and contain a breach extends to 241 days on average, a window during which stolen credentials are exploited without the affected organisation's knowledge. Honeywords, decoy passwords stored alongside legitimate credentials, were proposed in 2013 as a low-cost mechanism to accelerate breach detection by raising an alarm when an attacker authenticates using a stolen credential, and have since attracted over 140 papers spanning twelve years of research. Despite this sustained effort, no empirical evidence of real-world honeyword deployment has been documented in the research literature. Unlike many security mechanisms whose adoption is simply unobserved, honeyword deployment leaves a structurally detectable signature in any leaked credential database, making the absence of evidence here empirically meaningful rather than merely anecdotal. This thesis presents the first empirical investigation into real-world honeyword deployment, structured around two questions: whether the technology has reached sufficient readiness for production deployment, and whether structural evidence of adoption is observable in leaked credential data. Deployment readiness is assessed through four independent signals: academic literature, patent filings, source code repositories, and a practitioner awareness sweep, including an actively instrumented pip-installable Django package, which collectively place honeyword technology at TRL 6. Deployment evidence is assessed through structural analysis of 487 server-side credential databases collected from dark web forums, spanning 11 industry sectors. Every breached service stores exactly one password digest per user account, with no post exhibiting a secrets-to-emails ratio at or above 2.0, the minimum any meaningful honeyword deployment would produce. This holds across all sectors and across 85 breaches attributable to the post-Amnesia period, after the primary architectural barriers had been addressed. The central finding is that the absence of honeyword adoption is not explained by low technology readiness, but by apparent practitioner unawareness, a coordination barrier that makes unilateral adoption economically unattractive, and additional operational and economic barriers that persist independently of architectural progress. ... Read more

With the current rise in autonomous driving, an area of research focusing on collaborative perception and its security is emerging. Collaborative perception, in which vehicles exchange information about their environment to produce a more accurate map of their surroundings, typically focuses on either lidar or camera sensors. We wanted to investigate whether a vehicle spoofing attack, which has been shown to work for lidar-based collaborative perception frameworks, would also work in a camera-based one, and what the defence against such an attack would be.

We investigated a vehicle spoofing attack on a camera-based collaborative perception framework. In the experiments one or more attackers modify their camera images to insert a fictitious vehicle, and then use these modified images to communicate with the targeted vehicle. When the targeted vehicle then generates its map of the surroundings, this attack can cause it to detect an imaginary spoofed vehicle.

The results of the experiment showed that a vehicle spoofing attack does work for camera-based collaborative perception. The effectiveness of the attack however depends on the number of additional collaborating vehicles and how all vehicles are positioned in relation to each other. Thus, a defence against this attack is comparing received information with that from other sources, including the targeted vehicle’s own sensors.

As autonomous vehicles gain popularity and become more widely available, the chance of vehicles using collaborative perception increases. Because of the relative ease of performing an attack on collaborative perception, it is important to further study both the attacks and defences in order to ensure the safety of all road users. ... Read more

This thesis investigates a large Windows backdoor suspected to be tied to APT-41, a sample that had been publicly available for years yet remained essentially uninvestigated, using obfuscation to resist analysis at several security companies. The binary is stripped and obfuscated with a custom variant of control flow flattening that combines distributed dispatchers, nested local state machines, conditional state writes, and several further patterns that, together, break the assumptions existing deobfuscation tools rely on. To make reverse engineering feasible within the timeframe of the thesis, I built a Ghidra API-based deobfuscation tool tailored to this particular implementation. Alongside this, I developed concepts such as clusters and pre-dispatcher blocks to aid in categorising different block types and recovering the state transitions that the obfuscation is designed to hide. These concepts are intended to carry over to other malware samples that are obfuscated with control flow flattening.

Applied across the binary, the tool rebuilds all but one of the approximately 300 obfuscated functions, turning each from a tangle of dispatcher logic back into a readable sequence of original blocks. This made it possible to thoroughly reverse engineer the sample, including its configuration format, C2 protocol, module loading, and syscall evasion, and from there to compare it against known APT-41 tooling. The analysis uncovered broad and specific overlap with the backdoor CurveBack across code, configuration, and protocol, alongside a smaller but distinctive overlap with CrossWalk. On this basis I place a previously unanalysed implant in the APT-41 lineage with reasonable confidence, and reflect on what this adds to the public picture of the group's tooling. Finally, I discuss the practical value of investing in automation when confronted with obfuscation of this kind. ... Read more

Modern spacecraft increasingly rely on commercial off-the-shelf (COTS) hardware, reducing development cost but expanding the attack surface. The bootloader is the most exposed component: it executes before any other software and, if compromised, enables persistent unauthorised code execution for the entire mission lifetime. Despite this risk, Secure Boot has not seen broad adoption in space, primarily due to stringent reliability requirements, limited resources, and the high cost of qualifying new technology for space.

This thesis investigates how Secure Boot can be incorporated into space mission bootloaders without compromising these constraints. A lifecycle-based threat model, grounded in the ENISA Space Threat Landscape taxonomy, identifies two primary attacker scenarios: a physical adversary with pre-launch hardware access, and a remote adversary exploiting firmware update channels after deployment. These scenarios motivate a formal Secure Boot specification, designated SAVOIR-GS-002S, written in the language and requirement structure of the ESA SAVOIR framework so that it can be adopted by standards bodies without a translation step. The specification introduces seven additive security requirements covering a hardware Root of Trust, digital signature verification, non-bypassability, protection against both classical and quantum computational attacks, rollback protection via a monotonic counter, and structured failure reporting.

A hardware trade-off analysis shows that only two primitives are strictly necessary to realise the specification: sector-level hardware-enforced write protection for the Boot Software and public key storage, and protected non-volatile storage for the monotonic rollback counter. Both are present on commodity ARM Cortex-M microcontrollers without requiring any specialised hardware. A proof-of-concept implementation in C on the STM32F439ZI confirms that all seven requirements are achievable on representative COTS hardware. The implementation includes A/B image partitioning, monotonic rollback protection in option-byte-protected flash, PUS-compatible boot reporting, and an algorithm-agnostic cryptographic verification interface, with an automated end-to-end test suite verifying all nominal and failure paths over UART and SWD.

Performance benchmarks for ECDSA-P256, RSA-3072/4096, ML-DSA-44/65, and LMS demonstrate that the security overhead is modest. A hybrid ECDSA-P256 plus LMS deployment on a 128~kB image completes in approximately 363~ms with hardware SHA-2 acceleration, well within a one-second boot budget, and LMS requires only 3~kB of working memory and a 60-byte public key. The results show that incorporating Secure Boot into space-grade bootloaders is not a fundamental hardware or performance barrier, but primarily a gap in standards and tooling. The SAVOIR-GS-002S specification and accompanying implementation provide a concrete, standards-compatible starting point for closing that gap. ... Read more

System call interposition is a key technique for enforcing security policies, enabling compatibility layers, and debugging. However, existing approaches struggle to simultaneously achieve strong security, high performance, and usability, often relying on intrusive modifications, including OS or standard library changes, that are difficult to maintain, reduce compatibility, and increase the trusted computing base (TCB). In this thesis, we first identify and categorize security pitfalls that arise when combining PKU-based isolation with in-process system call interposition. Then, we present ISO-K23, a system call interposer that combines exhaustive system call mediation with strong security guarantees through PKU-based memory isolation. ISO-K23 protects the interposer’s trusted state by combining PKU with unsafe-instruction rewriting, executable-memory restrictions, and mediation of security-sensitive system calls. It mitigates both previously known and newly identified attacks on system call interposers and PKU sandboxes without introducing any kernel or library modifications. Our security evaluation identifies limitations in previous work and shows that ISO-K23 blocks the evaluated proof-of-concept attacks. We evaluate ISO-K23’s performance using benchmarks on six widely used real-world applications and show that ISO-K23 adds minimal overhead on top of K23 across most evaluated workloads. ... Read more

Secure group communication must balance cryptographic security with the efficiency required for large-scale deployments. Current secure group communication protocols exist on two extremes of a server/trust spectrum. On the one hand, the IETF's MLS (Messaging Layer Security) protocol views servers as untrusted relays providing end-to-end security at a price of O(log n) update costs. On the other hand, Telegram's MTProto views servers as trusted entities which manage all client keys resulting in O(1) sender side complexity and loss of many security guarentees. However, the design space between these extreme server trust positions remains undefined.

This thesis fills that gap by defining five distinct server trust levels. Zero Trust, Structural Trust, Aggregation Trust, Partial Key Trust, and Full Trust. We construct a Tamarin Prover model for each. Across the models, security lemmas covering group key secrecy, forward secrecy, post-compromise security, state agreement, and message authentication are proved or disproved. The finding is that state agreement is the first property to fail as server authority increases. A malicious server at our Level 3 can silently partition the group without violating message secrecy, and members have no means of detecting this inconsistency. Thus, we also devise a commitment-hardened variant of Level 3. It restores state agreement by detecting the attack at the cost of one transcript hash per commit.

The results are complemented by a simulation quantifying bandwidth and message complexity across group sizes of up to 128 members. The simulation additionally confirms that the Level 2 filtering optimisation reduces update bandwidth by up to 3.6x relative to Level 1 at no security cost, and that Level 3 aggregation reduces catch-up bandwidth by approximately 88% relative to Level 2 with 20 missed epochs. Together, the formal verification and simulation provide a principled structure for visualizing the security efficiency trade off as server authority grows, and offer design guidance for practitioners. ... Read more

Quantum attacks threaten the public-key cryptography that underpins modern distributed systems, including permissioned blockchains. This thesis investigates the practicality of post-quantum cryptography (PQC) in enterprise settings by integrating CRYSTALS-Kyber (Key Encapsulation Mechanism) and CRYSTALS-Dilithium (digital signatures) into a Fabric-based banking application. A protocol is designed for account creation and authenticated transactions where clients register with a Kyber public key, and the server encapsulates a shared secret used to authenticate the transactions. All balance, deposit, withdrawal, and transfer messages are signed with Dilithium and verified. The implementation comprises server, client, and chaincode components, integrated via Fabric Private Chaincode (FPC), and performance is evaluated against an RSA baseline in terms of key, ciphertext, and signature sizes.

The evaluation demonstrates that PQC integration is feasible with modest overheads. The replacement from RSA to Dilithium for transaction authentication and Kyber for key establishment performs better in most situations and maintains system throughput within operational bounds. Predictable trade-offs are observed between larger key and signature artifacts and reduced verification complexity. Message sizes for each cryptographic stage (key generation, encapsulation/decapsulation, signature/verification) are quantified. The system resists chosen-ciphertext and chosen-message attacks under the Module-LWE/SIS assumptions and achieves strong unforgeability for application messages.

This work provides an end-to-end blueprint covering APIs, message formats, chaincode logic, and deployment scripts for migrating Fabric-style ledgers to post-quantum security and ideas to improve upon the work in the future. ... Read more

Globalization and the aftermath of Covid-19 saw an increasing number of people working from home, using their company’s VPN to access various internal resources hosted on enterprise servers. Similarly, VPNs have experienced more widespread use among the general public in recent years as a result of a growing understanding of digital privacy. While previous research has shown that VPNs are vulnerable to fingerprinting, our hypothesis is that attackers can discern even more precise information about VPN traffic. Specifically, because the VPN server and endpoint are hosted physically close in the business use case but not in the internet browsing case, an attacker can exploit the Round Trip Time (RTT) difference to distinguish between the two scenarios.

To compute the RTT of an encrypted VPN connection, we devise a method to identify underlying request-response packet pairs. We target TLS handshakes, using the fact that the order and size of their constituent packets remain unaffected by encryption and consistent among most connections. The latency is computed by subtracting the arrival times of the identified handshake packets. Applying our method on synthetic data, we find that the mean and median RTT of a business-use VPN are lower than those of a private-use VPN, implying an attacker can differentiate between the two scenarios by simply observing encrypted data. ... Read more

This work addresses the challenge of performing expressive, multi-dimensional range queries directly over encrypted data while balancing query efficiency against privacy leakage. Existing searchable encryption and encrypted multi-map (EMM) schemes either reveal access or volume patterns or incur substantial overhead by fully hiding all leakage (e.g. via ORAM) making them unpractical. Building on the static, multi-dimensional EMM framework of Falzon et al., we introduce a family of five EMM variants that provide tunable leakage profiles, spanning from full access- and volume-pattern exposure to near-complete concealment through adaptive padding and dummy-access techniques. The empirical evaluation of our
five EMM variants reveals a clear, quantifiable spectrum of privacy-performance trade-offs. On large-range workloads, the access-hiding schemes offer the best overall balance, with measured average latency slopes of ≈ 0.012 ms/label. For workloads dominated by small result sets, a volume hiding scheme excels, achieving an even lower slope of 0.0032 ms/label by tuning its padding to realistic occupancy bounds. In contrast, fully padded schemes like incur substantially higher overheads, up to two orders of magnitude greater, making them suitable only when maximal leakage resilience is required. These results allow cloud providers with quantitative guidance to deploy encrypted range search that meets both privacy requirements and performance expectations in real-world, multi-attribute database services. ... Read more

Searchable Encryption (SE) has shown a lot of promise towards enabling secure and efficient queries over encrypted data. In order to achieve this efficiency, SE inevitably leaks some information, and a big open question is how dangerous this leakage is. While prior reconstruction attacks have demonstrated effectiveness in one-dimensional settings, extending them to high-dimensional datasets remains challenging. Existing methods either demand excessive query information (e.g. an attacker that has observed all possible responses) or produce low-quality reconstructions in sparse databases.
In this work, we present REMIN, a new leakage-abuse attack against SE schemes in multi-dimensional settings, based on access and search pattern leakage from range queries. Our approach leverages unsupervised representation learning to transform query co-occurrence frequencies into geometric signals, allowing the attacker to infer relative spatial relationships between records. This enables accurate and scalable reconstruction of high-dimensional datasets under minimal leakage. Furthermore, we introduce REMIN-P, a practical variant of the attack that incorporates a poisoning strategy. By injecting a small number of auxiliary anchor points—either known or intentionally leaked—REMIN-P significantly improves reconstruction quality, particularly in sparse or boundary regions.
We evaluate our attacks extensively on both synthetic and real-world structured datasets. Compared to state-of-the-art reconstruction attacks, our reconstruction attack achieves up to 50% reduction in mean squared error (MSE), all while maintaining fast and scalable runtime. When the poisoning strategy is chosen properly, our poisoning attack further reduces MSE by an additional 50% on average. To the best of our knowledge, these are the first attacks that enables accurate multi-dimensional reconstruction under low-leakage conditions for any type of database. ... Read more

Cybersecurity attacks are increasingly sophisticated, while traditional, rule-based intrusion detectionsystems (IDS) remain prone to high false alert rates. This research explores temporal graph learning fornetwork intrusion detection, introducing a framework that combines temporal graph construction withGraph Attention Networks and recurrent modeling (GATv2 + LSTM). We evaluate on the LANL authentication logs and Zeek logs from the University of West Florida (UWF).

On LANL, our models (Try1/Try2) outperform state-of-the-art baselines for temporal link prediction,achieving high precision and robustness: Accuracy ≈ 0.994, F1 ≈ 0.993, AUC ≈ 0.993–0.998, AP ≈ 0.999.On Zeek data, edge prediction is sensitive to how malicious activity is distributed over time: a simple“Day" shuffling that preserves the temporal structure while also spreading the clusters of attack activity,yields large gains (e.g., Accuracy ≈ 0.969, AUC ≈ 0.996, F1 ≈ 0.959, AP ≈ 0.995), whereas random shufflingharms temporal dependencies and performance.

Extending to edge classification (benign vs. malicious) reveals a key limitation: despite high accuracy,AUC and AP remain low due to a tendency to label nearly all edges as benign under class imbalance andtemporal clustering, producing many false negatives. We test mitigation strategies (dropout, alternativeloss formulations with confidence weighting), which provide a small increase in stability but do notfully resolve the issue.

With our results, we find that the proposed temporal graph method is a strong fit for anomaly detectionvia edge prediction: robust across datasets, resilient to imbalance, and practically applicable. In contrast,edge classification currently lacks reliability for production without improved data balancing, graphconstruction, and training. ... Read more