Research

Researchers propose an attack path discovery method for industrial control systems that combines knowledge-enhanced attack graphs with causal-aware reinforcement learning. The graphs use the MITRE ATT&CK for ICS matrix to generate attack templates, and causal graphs guide weight assignment and policy updates. Experiments on a fluid catalytic cracking simulation platform and two public datasets show the method increases discovered attack paths by 6.65%, 15.50%, and 11.80% over other methods.

The paper presents P3H-I, a privacy-preserving scheme for hierarchical heavy hitters detection that protects subordinate relationships across hierarchy levels using matrix-based encoding and secure three-party computation. It also presents P3H-II, a privacy-efficiency trade-off variant that uses prefix tree traversal, pruning, and pre-computation to reduce communication and computational overhead. The authors report robust privacy with low costs, outperforming existing methods.

This paper addresses joint beamforming for covert integrated sensing and communication (ISAC) under dual uncertainties at a passive eavesdropper: imperfect channel state information and unknown noise power. It maximizes radar mutual information while meeting covertness and quality of service requirements. Simulations report that the robust optimization and PPO-RB methods enlarge the feasible covert region while preserving radar sensing, communication quality and covert security in static and dynamic settings.

Tramy is a dynamic searchable symmetric encryption scheme that lets multiple clients run conjunctive queries over encrypted data and tracks malicious servers, addressing a gap in Dory, which supports only single-keyword queries in a single-client setting. It hides the search pattern through a new primitive called Matrix-based Multi-Point Retrieval and uses a Malice-Defend Bloom Filter that supports conjunctive queries and verifies the integrity of server responses. Benchmarks reportedly show resistance to adaptive adversaries and up to 20x performance improvements over the state of the art.

HypSCA is a dual-space representation learning method for deep learning-based side-channel attacks. It embeds power or electromagnetic traces in hyperbolic space to model their hierarchical structure, while using Euclidean space for local discriminative learning. The authors report attack performance up to 30.8% better than state-of-the-art methods.

VeriFPHM is a verifiable fuzzy private hash matching scheme for detecting harmful media in end-to-end encrypted communication without exposing the server-side hash set or revealing unmatched media. It uses multivariate polynomial commitments, adaptive Merkle trees, and Cuckoo hash buckets for verification and efficient dynamic updates, plus a two-step fuzzy matching protocol built on LPN-based VOLE. The authors report up to 100x faster certification than the scheme by Scheffler et al. and better update performance than state-of-the-art schemes.

ATLAS release v2026.09 contains 1 matrix, 16 tactics, 120 techniques, 88 sub-techniques, 40 mitigations, and 73 case studies. It adds new techniques such as Triggers in Multimodal Inputs, AI Agent Response Biasing, and Crafted AI Assistant Links, plus one new mitigation, AI Honeypots. It also updates existing techniques, mitigations, and case studies, including Generative AI Guardrails.

Keita Emura and Kazumasa Omote published a security analysis of blockchain-based public key encryption with keyword search for sharing medical data in cloud environments. The source text, which lists only the publication date, journal volume and authors, does not describe the method or findings.

This paper surveys machine learning methods for selecting file traps, decoy files used to detect crypto ransomware. The source text is only bibliographic metadata (journal, volume, issue, page range and date), with no abstract, method or findings included.