Research

MambaTIG is a detection framework for encrypted network traffic that combines self-supervised masked graph learning with selective state-space modeling. It is pretrained only on benign traffic, uses a node-importance-driven masking strategy for robustness under distribution shifts, and replaces attention with a Mamba module to reduce inference overhead. Across four public datasets it reports competitive mean F1, a 56.29% average relative F1 gain under distribution-shift settings, a 37.63% adversarial-setting F1 gain, and a 66.7% reduction in average inference time.

This paper studies how to balance security and connectivity in two-layer multilayer networks. Using the SIR epidemic model, it shows there is an optimal number of interlayer edges that maximizes the probability of staying connected while limiting malware spread from one layer to the other. It also proposes a weighted scoring method, which accounts for personal preferences, to determine that optimal number.

The source is a Computers & Security publication dated 6 July 2026 by Xin Liu, Feiyan Liu and Guanglu Sun, titled "DSFDU: Detection of unicode modifier letter obfuscated commands in Living-Off-the-Land attacks." The provided text contains only the publication metadata, with no abstract, method details, or findings described.

A survey in the Journal of Information Security and Applications, Volume 102, published November 2026, reviews explainable AI (XAI) techniques used in cybersecurity. The authors are Samin Dehbashi Sani, Rukayat Olapojoye, Tara Salman, and Marcio Andrey Teixeira. The source text supplied contains only bibliographic details, so the findings, methods, and challenges it covers cannot be summarized from it.

FlowCrypt is a flow-based image encryption framework for cloud photo privacy that aims for near-lossless recovery without an auxiliary reference image. It uses a secret-key-guided random split and a Flow-based Encryption/Decryption module built on conditional affine coupling blocks. The authors report recovery quality of 115 dB across four datasets, uniformly distributed cipher images, and a model of only 1 M parameters.

This research paper proposes a resilient control method for event-triggered cyber-physical systems facing strategic denial-of-service attacks, where attackers target packets based on their observable importance. The method combines a multi-objective Q-Learning strategy that adjusts the trigger threshold of the event-triggered mechanisms with a data encryption-decryption scheme using a Logistic map and differential encoding to distort state-dependent statistical features. The authors report that comparative experiments verify the method's effectiveness and superiority.

MHcast is a metadata-hiding multicast system for end-to-end encrypted messaging, built on two distributed comparison functions with a public mapping. It adds a mailbox access control scheme that stops malicious clients from disrupting multicast with malformed or junk messages, and an identification scheme that lets honest clients help an honest server identify a malicious server. In experiments, its throughput was 2 to 10 times higher than repeatedly using the unicast protocol at a group size of 16, and it supports groups of any size from 0 to N.

SEO-DBSCAN is a secure outsourcing framework for the DBSCAN clustering algorithm, designed to protect sensitive input data when computation runs in the cloud. It combines a constant-round secure comparison protocol built on lightweight arithmetic secret sharing with a crypto-friendly DBSCAN variant. On synthetic datasets it reports up to $8.65\times$8.65× computational savings and $83.7\times$83.7× communication reduction against ppDBSCAN (AsiaCCS'21).

Ariadne is a goal-oriented framework that reconstructs the prerequisite request sequences behind a terminal attack request, which intrusion detection and SIEM systems usually miss because they alert only on the final payload. It frames reconstruction as a guided state-space search using a state-distance metric based on bipartite graph matching, plus data-driven API dependencies and state-aware parameter sourcing. On 15 real-world vulnerabilities, it reconstructed all attack chains up to 8 steps within 20 minutes, while baselines failed on every attack needing more than two steps.

ContractDB is a framework that integrates external verifiable databases (VDBs) with blockchain DApps to offload data storage and verifiable query processing from the chain. The authors propose a VDB design using authenticated dictionaries and authenticated set operations, plus a disputable update mechanism that uses public verification to lower update costs. In evaluations, ContractDB verified results of a 6-condition conjunction query on a 2^20-line table within 2.4 million gas, while storing the same data in contracts required over 36 billion gas.