<?xml version="1.0" encoding="utf-8"?>
    <rss version="2.0">
      <channel xmlns:content="http://purl.org/rss/1.0/modules/content/">
        <title>Frontiers in Computer Science | Computer Security section | New and Recent Articles</title>
        <link>https://www.frontiersin.org/journals/computer-science/sections/computer-security</link>
        <description>RSS Feed for Computer Security section in the Frontiers in Computer Science journal | New and Recent Articles</description>
        <language>en-us</language>
        <generator>Frontiers Feed Generator,version:1</generator>
        <pubDate>2026-11-09T13:13:30.988+00:00</pubDate>
        <ttl>60</ttl>
        <item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.2010006</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.2010006</link>
        <title><![CDATA[Digital forensics in cybercrime investigation: a comparative legal and institutional analysis of the United States and India]]></title>
        <pubdate>2026-11-09T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Rasheed Tahir</author><author>Sangar Dawood Mohammed</author><author>Kawar Mohammed Mousa</author>
        <description><![CDATA[Digital forensics has become indispensable to cybercrime investigations, yet the reliability and admissibility of digital evidence depend on legal rules, institutional capacity, and procedural safeguards as well as technical competence. This study conducts a qualitative comparative doctrinal and institutional analysis of digital forensics in the United States and India. It examines legislation, judicial decisions, evidentiary rules, official institutional materials, and relevant scholarly literature through five analytical dimensions: legal authority, procedural safeguards, institutional capacity, cross-border cooperation, and fundamental rights. The analysis identifies a specific divergence in the procedural role of electronic-evidence certification. In the United States, Federal Rules of Evidence 901 and 902(13)–(14) provide a plural authentication framework in which certification operates as an optional self-authentication pathway for qualifying electronic evidence, while Rule 702 separately governs expert testimony. In India, Section 63 of the Bharatiya Sakshya Adhiniyam 2023 integrates certification more directly into the statutory admissibility pathway for qualifying computer output. Both jurisdictions face challenges involving cloud-based evidence, encryption, institutional disparities, cross-border access, privacy, and due process. The study argues that effective digital forensic governance requires coordination among legal authorization, technical integrity, institutional competence, judicial oversight, and international cooperation. It recommends modernized evidentiary rules, standardized forensic procedures, professional training, stronger institutional capacity, and rights-protective mechanisms for obtaining and using electronic evidence.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1918269</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1918269</link>
        <title><![CDATA[Secure symmetric encryption using coloring of multipartite graphs]]></title>
        <pubdate>2026-11-04T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>D Gomathi</author><author>Sivakumar Nagarajan</author>
        <description><![CDATA[IntroductionLightweight cryptographic schemes are needed for resource-constrained environments such as Internet of Things systems, wireless sensor networks, and embedded platforms. This paper presents a symmetric encryption framework based on the coloring of complete n-partite graphs, in which the keystream is derived from partition sizes and multi-character color labels assigned to graph partitions.MethodsA cyclic-padding convention extends all color labels to a common length m = max(ℓ1, ℓ2, …, ℓn) before summation, making the keystream period exactly m by construction. Plaintext characters are encoded using ASCII values and encrypted by symbol-wise modular addition over ℤ127, giving a repeated-key additive cipher with time complexity O(L+n·m) and space complexity O(L+n·m), where L is the message length. A formal threat model distinguishes four adversary categories (ciphertext-only, known-plaintext, chosen-plaintext, and active network adversaries) and sets security thresholds in terms of m.ResultsEncryption and decryption time scale linearly with message length. Empirical ciphertext entropy approaches 6.88 bits per symbol at n = 8 partitions. The scheme provides meaningful confidentiality against ciphertext-only adversaries when L ≤ m.DiscussionThe scheme is vulnerable to known-plaintext attacks, a fundamental limitation shared by all repeated-key additive ciphers. It is therefore positioned as a graph-structured, session-bound, repeated-key additive cipher framework, not a replacement for standardized cryptographic primitives. Its low computational cost supports use in lightweight and resource-constrained settings.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1947684</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1947684</link>
        <title><![CDATA[A post-quantum lightweight mutual authentication and encryption scheme for secure UAV communications]]></title>
        <pubdate>2026-11-04T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Alharith A. Abdullah</author><author>Shahad A. Hussien</author>
        <description><![CDATA[The unmanned aerial vehicle (UAV) field is rapidly evolving, increasing the need for effective security mechanisms to protect data in transit in resource-constrained environments. Although many solutions have been proposed to achieve the required security objectives, these traditional solutions either suffer from high computational complexity or are vulnerable to quantum computing threats, an open challenge. However, this research presents a lightweight security scheme that uses the Kyber 512 algorithm for a quantum-resistant key-exchange algorithm, followed by a Wi-Fi Protected Access 2 (WPA2)-inspired mechanism for mutual authentication. Furthermore, an Ascon Authenticated Encryption with Associated Data (ASCON-AEAD)-based lightweight algorithm is utilized for data encryption and verification. Additionally, the scheme is implemented in a simulation-based UAV environment to demonstrate its performance in protecting the confidentiality and integrity of MAVLink messages transferred between aircraft and the ground control station (CGS), as well as the communicated party's authenticity. Finally, the randomness of both authentication and encryption keys was evaluated using the National Institute of Standards and Technology (NIST) tests across 50 independent sessions, with a significance level of 0.01. All tests showed average p-values higher than the accepted significance level, with pass rates ranging from 96 to 100%, indicating good statistical randomness for the generated keys and supporting their security quality within the proposed protocol. In contrast, it also demonstrated a successful transfer of encrypted Micro Air Vehicle Link (MAVLink) messages. It ensured their validity only after verification of the identities of both communicating parties (i.e., mutual authentication). Furthermore, the achieved processing time averaged approximately 1.45 ms, ranging from 0.91 to 1.89 ms, which was within acceptable limits for such an environment, making this proposed solution efficient and effective.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1897185</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1897185</link>
        <title><![CDATA[Adversarial example detection for image captioning models via SPC-verify]]></title>
        <pubdate>2026-11-04T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Dehai Zhang</author><author>Jiaqi Mao</author><author>Jiajun Zhu</author>
        <description><![CDATA[Image captioning models are vulnerable to adversarial examples that can induce descriptions inconsistent with visual evidence, commonsense knowledge, or physical rules. Existing detection methods mainly rely on confidence anomalies, feature-space deviations, or reconstruction errors, making them less suitable for cross-modal generative tasks. To address this limitation, we propose SPC-Verify, a Semantic-Phenomenon Consistency Verification framework for adversarial example detection in image captioning. The framework combines Visual-Semantic Consistency Verification (VSCV), which assesses whether token-level visual evidence supports the corresponding generated concepts, with Phenomenon Plausibility Verification (PPV), which evaluates the consistency of complete captions with commonsense knowledge and physical constraints. To improve the reliability of local visual evidence, we introduce SCAR-SAT, a post-hoc heatmap refinement method for Show-Attend-and-Tell-based models that integrates semantic consistency, lightweight counterfactual support, spatial continuity, and temporal stability. We further propose Zero-Shot Cross-Model Threshold Transfer (ZS-CMTT), which learns shared decision thresholds from the joint score distributions of SAT and BLIP and transfers them to unseen captioning models without requiring target-model samples. Experiments on MSCOCO and Flickr30K across SAT and BLIP, under multiple attack settings, demonstrate the effectiveness of the proposed framework. Ablation studies show that the Grounded Category Vocabulary improves token-level verification, while PPV provides complementary sentence-level plausibility assessment. Further evaluations indicate that SCAR-SAT improves token-level visual grounding and that ZS-CMTT facilitates threshold transfer across captioning models. Overall, SPC-Verify provides an interpretable and transferable approach to adversarial example detection by jointly evaluating local visual-semantic consistency and global caption plausibility.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.2029696</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.2029696</link>
        <title><![CDATA[Editorial: Data privacy and cybersecurity challenges in digital business transformation]]></title>
        <pubdate>2026-11-02T00:00:00Z</pubdate>
        <category>Editorial</category>
        <author>Saqib Saeed</author><author>Noor Zaman Jhanjhi</author><author>Muhammad Adnan Khan</author><author>Dileep Kumar Yadav</author>
        <description></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1823339</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1823339</link>
        <title><![CDATA[Automated creation of source code variants of a cryptographic hash function implementation using generative pre-trained transformer models]]></title>
        <pubdate>2026-10-30T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Elijah Pelofske</author><author>Vincent Urias</author><author>Lorie M. Liebrock</author>
        <description><![CDATA[Generative pre-trained transformers (GPTs) are a type of large language machine learning model that are unusually adept at producing novel, and coherent, natural language. However, GPT model outputs in general are stochastic and not always correct. For programming languages, the exact specification of the computer code, syntactically and algorithmically, is strictly required in order to ensure the security of computing systems and applications. Therefore, using GPT models to generate computer code poses an important security risk—while at the same time allowing for potential innovation in how computer code is generated. This study examines GPT model outputs of novel and correct, and notably very insecure, versions of implementations of the cryptographic hash function SHA-1. The GPT models Llama-2-70b-chat-hf, Mistral-7B-Instruct-v0.1, and zephyr-7b-alpha are used. The GPT models are prompted to re-write each function using a modified version of the localGPT framework to provide word embedding context of the full source code and header files to the model, resulting in over 150, 000 function re-write GPT output text blocks, approximately 50, 000 of which were able to be parsed as C code and subsequently compiled. The generated code is analyzed for being compilable, correctness of the algorithm, memory leaks, compiler optimization stability, and character distance to the reference implementation. Remarkably, several generated function variants have a high implementation security risk of being correct for some test vectors, but incorrect for other test vectors. Additionally, many function implementations were not correct to the reference algorithm of SHA-1, but produced hashes that have some of the basic characteristics of hash functions. Many of the function re-writes contained serious flaws such as memory leaks, integer overflows, out of bounds accesses, use of uninitialized values, and compiler optimization instability. Compiler optimization settings and SHA-256 hash checksums of the compiled binaries are used to cluster implementations that are equivalent but may not have identical syntax—using this clustering, over 100, 000 distinct and correct (up to input-output validation checking) versions of the SHA-1 codebase were generated, by permuting between versions of the four component functions, where each component C function of the reference implementation is different from the original code.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1914634</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1914634</link>
        <title><![CDATA[Mosca’s inequality revisited: a systematic review of quantum risk-timing models after the 2025–2026 reductions in quantum resource estimates]]></title>
        <pubdate>2026-10-27T00:00:00Z</pubdate>
        <category>Systematic Review</category>
        <author>Simon Baradziej</author>
        <description><![CDATA[IntroductionEstimates of the quantum resources required to break public-key cryptography fell sharply across 2025 and 2026, by enough to disturb the assumptions underlying the timing models organizations use to plan cryptographic migration. This review synthesizes published estimates for breaking RSA-2048, an integer-factoring target, and 256-bit elliptic-curve cryptography, a discrete-logarithm target, and examines what the revised figures do and do not imply for Mosca’s inequality, the standard risk-timing framework.MethodsFollowing a protocol adapted from PRISMA 2020 conventions for a technical corpus, and after a search conducted in two rounds, 84 sources were included from preprint servers, standards repositories, and peer-reviewed venues, with 13 core studies charted in a structured extraction matrix of twelve fields that records the assumption set behind every physical-qubit figure.ResultsThe headline physical-qubit estimate for factoring RSA-2048 fell from about one billion in 2012 to 20 million in 2019, to roughly 900,000 in 2025, and to figures between about 11,000 and 471,000 in 2026 depending on the operating point selected. Estimates for 256-bit elliptic-curve keys followed a comparable path. The reductions are attributable to arithmetic and circuit innovations, magic-state techniques, higher-rate quantum error-correcting codes, and changed architectural and hardware assumptions, and these contributions are decomposed separately here instead of being reported as a single trend. A synthesis restricted to peer-reviewed sources alone yields the same direction of travel but a materially weaker magnitude, and this is reported explicitly.DiscussionA reduction in required qubits compresses a resource threshold, not a calendar. Because the relationship between a resource requirement and the date a machine meeting it is built depends on fabrication yield, achieved error rates, connectivity, decoder throughput, control systems, and sustained-runtime engineering, this review presents the consequences for Mosca’s inequality as conditional implications and supports them with scenario analysis across plausible confidentiality lifetimes, migration times, and threat horizons in place of a point forecast. The evidence reduces one barrier to feasibility and widens the uncertainty around the threat horizon; on a risk-management basis, not an evidentiary one, that combination favors prioritized migration of long-lived confidential data.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1994804</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1994804</link>
        <title><![CDATA[Attributable federated DDoS mitigation for 6G cloud network slices]]></title>
        <pubdate>2026-10-22T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Anukriti Naithani</author><author>Seema Rawat</author><author>Pradeep Kumar</author>
        <description><![CDATA[6G enabled cloud networks segregate traffic into service slices (eMBB, URLLC, mMTC) with very different latency, reliability, and density needs. For the ever evolving network environments like such, DDoS defense must not only detect attacks but respond to them per slice, without breaking each slice's service guarantees. Detection is well studied, but mitigation remains unexplored. The existing federated slice-aware frameworks report only aggregate performance, without showing which stage of the pipeline produced the given outcome. This research proposed a federated, slice aware framework for DDoS defense in 6G Cloud networks. A deep detector segregates each flow and passes its confidence and embedding to per slice mitigation policies. It is Trained by federated aggregation across heterogeneous cloud edge domains so that no raw traffic leaves its source. The interface is confidence gated, which means low-confidence flows are allowed before the slice policy is consulted. This makes every decision attributable to either the gate or the policy. This research introduces a stage attributable evaluation that traces each mitigation outcome to its source, and a SLA metric that separates policy quality from the attack density of the test data. Three dataset configurations are usd in this research : A synthetic 6G CTGAN-generated dataset, CICDDoS2019 dataset and a combined configuration. Across three dataset configurations the framework detects DDoS traffic with 0.96 to 0.9998 accuracy. It mitigates attacks at up to exact malicious block and benign allow rates and raises sustained SLA from as low as 0.13 to 0.81 against oracle ceilings of 0.97. All results come from a single reproducible run, and an honest ablation shows a shared policy matches the per slice design on accuracy. The result is a privacy preserving, slice aware, and interpretable approach to DDoS mitigation for 6G cloud networks.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1869476</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1869476</link>
        <title><![CDATA[The potential of bio-inspired trace alignment for side-channel analysis]]></title>
        <pubdate>2026-10-21T00:00:00Z</pubdate>
        <category>Hypothesis and Theory</category>
        <author>Nikolaos Alachiotis</author><author>Marco Ottavi</author><author>Bruno Endres Forlin</author><author>Konstantinos Paraskevopoulos</author><author>Luca Mariot</author><author>Ana-Lucia Varbanescu</author>
        <description><![CDATA[Public-key cryptography is vulnerable to mathematical attacks by quantum computers, and governments encourage organizations to adopt new post-quantum cryptography (PQC) algorithms to secure critical infrastructure. However, these new algorithms are susceptible to physical attacks, such as side-channel attacks, and current testing infrastructures to assess their resistance to physical attacks typically sacrifice quality for run time to cope with the high computational costs. In this work, we show that unprotected PQC implementations are vulnerable to Side-Channel Analysis (SCA), and discuss the hypothesis that bio-inspired methods and algorithms can enhance the effectiveness of SCA-based security evaluations. Building on preliminary empirical evidence from a previous SCA study of a public-key cryptographic implementation using the Advanced Encryption Standard (AES), we discuss their potential to improve security assessment against SCA attacks as a promising direction for future research. Early results show that a multiple sequence alignment (MSA) algorithm for DNA and protein sequences (MAFFT) can be used to align AES power traces, and the resulting alignment enabled the extraction of cryptographic keys with up to 44% fewer traces, when applying Correlation Power Analysis, than the alignment obtained through an elastic alignment implementation (based on Dynamic Time Warping) in a commercially available SCA tool. These early results provide preliminary support for the feasibility of the proposed hypothesis in AES, and motivate the exploration of MSA-based trace-alignment techniques in security evaluations of post-quantum implementations to assess whether the observations obtained based on AES transfer to PQC as well.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1966725</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1966725</link>
        <title><![CDATA[Cryptographically verifiable authorization for autonomous AI agents: a falsifiable hypothesis and proof of concept]]></title>
        <pubdate>2026-09-24T00:00:00Z</pubdate>
        <category>Hypothesis and Theory</category>
        <author>Mar Llambí-Morillas</author><author>Daniel Fernández-Fernández</author>
        <description><![CDATA[Autonomous AI agents increasingly execute actions, invoke tools, and operate on protected resources with limited human oversight. Existing authentication and authorization mechanisms establish identity and delegate authority but do not inherently provide cryptographic evidence that a concrete request issued by a specific agent satisfies the applicable policy in a specific execution context. This study hypothesizes that agent authorization can be formalized as a cryptographically verifiable relation, denoted RCVA, that jointly binds an agent principal, a concrete authorization request, an execution context, and the satisfaction of an applicable policy, while selectively preserving the confidentiality of private authorization attributes. We introduce a preliminary formal abstraction for Cryptographically Verifiable Agent Authorization (CVA), define a compact set of candidate security properties including authorization soundness, principal binding, request binding, policy binding, and replay resistance, and provide an executable zero-knowledge proof of concept that instantiates selected elements of the model over a Groth16 zk-SNARK construction. We further identify and formalize the structural separation among identity binding, authorization-request binding, and runtime execution binding as a central open problem in the design of secure agentic systems, a distinction to our knowledge, has not been formalized within a cryptographically verifiable authorization relation by current agentic security frameworks, and present a falsifiable research agenda for its resolution.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1844484</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1844484</link>
        <title><![CDATA[Enhanced detection of regular graphical passwords in Passpoints through convex hull area analysis]]></title>
        <pubdate>2026-09-22T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Joaquín Alberto Herrera-Macías</author><author>Carlos Miguel Legón-Pérez</author><author>Lisset Suárez-Plasencia</author><author>Omar Rojas</author><author>Guillermo Sosa-Gómez</author>
        <description><![CDATA[IntroductionPasspoints is a graphical authentication system presented as a viable alternative to traditional methods, owing to its security, usability, and low implementation cost. It requires the user to select five ordered points in an image, the configuration fixed by the Passpoints scheme. If the points selected by a user follow a regular pattern, i.e., they repel each other, the password is not secure. The existing literature reports that statistical tests can detect such a pattern at the registration stage of this system; however, their effectiveness is limited.MethodsIn this document, a new, highly effective test is proposed to detect a regular pattern in Passpoints passwords, based on the area of the convex hull formed by the five points. The reference (null) distribution of this area under complete spatial randomness is estimated by simulation and approximated by a Weibull law, whose adequacy is assessed with the Anderson—Darling, Kolmogorov—Smirnov and Chi-square goodness-of-fit tests using a parametric bootstrap, since the parameters are estimated from the same sample. Classification of an individual password is then carried out by a one-sided tail test of that single observation against the reference distribution—a discordancy test, not a goodness-of-fit test—and the Type I and Type II errors are estimated by simulation. The proposed test is compared, in effectiveness and efficiency, against the two strongest baselines in the literature: the mean-distance test and the test based on the perimeter of Delaunay triangles.ResultsOn simulated password databases, the proposed test attains the highest detection rate reported to date for this pattern, reaching 87% at α = 0.05 under the lower of the two simulated regularity levels and exceeding the detection rate of previous tests by more than 50% under matched conditions, while also attaining the lowest execution time among the tests compared.DiscussionThese figures characterise performance on passwords generated by a spatial inhibition process; detection performance on passwords chosen by real users has not yet been measured and is the subject of ongoing work.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1900546</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1900546</link>
        <title><![CDATA[Agent-access receipts for artificial intelligence-mediated content and application programming interface access: a reproducible synthetic security experiment]]></title>
        <pubdate>2026-09-10T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Anton Sokolov</author>
        <description><![CDATA[Artificial intelligence (AI)-mediated web and application programming interface (API) access is often treated as a bot-management problem—identify an automated caller and then allow, block, delay, challenge, or meter the request. That framing is useful but incomplete. A disputed access decision can depend on the caller’s authenticated identity, the represented principal, delegated authority, declared purpose, and resource or API surface. It can also depend on the current policy snapshot, response sensitivity, payment or licensing state, and the survival of validation evidence after the request has completed. This article presents a reproducible synthetic experiment using an agent-access receipt—a compact decision record generated at a publisher or API edge and preserved for later inspection when corresponding validation material remains available. The study implements a deterministic Python laboratory with a synthetic policy and synthetic trust registry, evaluating 15 scenario cases, 15 mutation/control cases, and 3 post-issue receipt-integrity controls. It also emits generated receipts in JavaScript Object Notation (JSON), a JSON Schema, and result tables in comma-separated values (CSV) and JSON formats. In the deposited v0.1.6 package, all 15 scenario cases, all 15 mutation cases, and all 3 integrity controls match expected outcomes, and all 30 generated receipts pass the required-field/schema-shape guard. The artifact is not a production security protocol; it does not claim legal compliance, deployment readiness, or endorsement by any third party. The article contributes a reproducible controlled experiment showing why AI-mediated access-control evidence should preserve bindings among identity, delegation, declared purpose, resource/API inventory, economic authorization, policy freshness, sensitivity, and validation survivability. The deposited artifact provides data and code for rerunning and inspecting the experiment.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1904025</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1904025</link>
        <title><![CDATA[The Mercer Advisors data breach through the essential eight: lessons and analytical limits]]></title>
        <pubdate>2026-09-10T00:00:00Z</pubdate>
        <category>Perspective</category>
        <author>Indra Abeysekera</author>
        <description><![CDATA[Cybersecurity breaches orchestrated by malicious attackers can have painful consequences for victim organizations. Such events show how breaches can occur and what factors lead to them. This study offers a point of reflection from theoretical and security-posture perspectives, focusing on the Mercer Advisors Inc. data breach. While acknowledging the limitations of public records, the study contributes to the literature by examining theoretical and security-posture aspects, such as the lack of multi-factor authentication at all required levels and the possible failure to implement a robust defense-in-depth strategy, both of which can result in adverse consequences for organizations.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1847364</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1847364</link>
        <title><![CDATA[Lightweight confidentiality framework for TinyML-enabled IoT edge communication]]></title>
        <pubdate>2026-09-03T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Kurunandan Jain</author><author>Prabhakar Krishnan</author><author>Sethu Subramanian N.</author><author>Prabu P.</author>
        <description><![CDATA[Lightweight security mechanisms are essential for Internet of Things (IoT) edge environments, where devices operate under strict constraints in computation, memory, and energy. The emergence of TinyML-enabled edge intelligence introduces new communication security requirements, particularly for protecting compact inference outputs (typically 1-32 bytes, including class labels, confidence scores, or anomaly flags) transmitted over potentially insecure networks. This paper presents a lightweight confidentiality-focused encryption framework based on an enhanced variant of the Tiny Encryption Algorithm (TEA), tailored for TinyML-driven IoT communication. The proposed Enhanced TEA incorporates a plaintext-dependent dynamic key diversification mechanism using SHA-256, improving empirical diffusion and ciphertext randomness while preserving the computational efficiency of ARX-based cipher structures. Beyond algorithmic design, the study develops a system-level secure TinyML-enabled IoT communication architecture, integrating encryption directly into edge inference workflows. The framework is implemented and evaluated on an edge computing platform to assess performance in terms of execution time, memory usage, CPU utilization, communication latency, and energy behavior. Experimental results demonstrate an avalanche effect of 54.69% and ciphertext entropy of 7.66 bits/byte, while maintaining less than 5% throughput degradation and minimal latency overhead in MQTT-based communication. The proposed approach provides a practical lightweight confidentiality mechanism for TinyML-enabled edge computing environments operating under moderate resource constraints. However, as the design focuses on confidentiality, it should be combined with lightweight authentication mechanisms to ensure comprehensive security in real-world deployments.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1909955</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1909955</link>
        <title><![CDATA[Missed-attack-risk-oriented compact KAN architecture for industrial IoT intrusion detection]]></title>
        <pubdate>2026-09-01T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Awad A. Younis</author><author>Ahmed Elwhishi</author>
        <description><![CDATA[Intrusion detection in Industrial Internet of Things (IIoT) environments is a risk-asymmetric problem: false alarms increase analyst workload, but false negatives may allow malicious activity to persist in safety- and operation-sensitive systems. Although recent deep learning-based intrusion detection systems report high aggregate accuracy, near-ceiling performance can obscure the residual errors that remain under class imbalance and fine-grained label settings. This study investigates missed-attack-risk-oriented IIoT intrusion detection through CKAN-AFG, a compact non-recurrent Kolmogorov–Arnold Network (KAN)-centered architecture that combines KAN-based feature transformation, residual multi-head feature attention, feature gating, adaptive pooling, and a compact KANLinear classifier. The model is evaluated on the CIC IIoT Dataset 2025 (DataSense) as the main benchmark, with TON-IoT used as a secondary benchmark for cross-dataset comparison and continuity with prior IIoT evaluation. The evaluation uses a leakage-controlled repeated-seed protocol with fold-confined RF-RFE, a final 55-common-feature DataSense protocol, operational error decomposition, KAN-isolation and component-level ablation, repeated-seed stability analysis, and CPU-based deployment-oriented profiling. Under the final DataSense protocol, CKAN-AFG achieves a weighted F1-score of 99.8146% and an FNR of 0.2636%, corresponding to an approximately 5.6% relative FNR reduction compared with the CKAN–BiLSTM continuity baseline. Operational error decomposition shows that CKAN-AFG produces the lowest attack-to-benign count, with 33.8 mean true missed attacks, and the lowest total off-diagonal error count among the retained models. KAN-isolation results show that replacing the KAN-specific feature-transformation and classifier components with conventional CNN or LSTM alternatives increases FNR, while removing attention, feature gating, or both also degrades the false-negative-aware profile. CPU profiling shows that CKAN-AFG remains compact, with 247,005 trainable parameters, a 0.956 MB FP32 footprint, and throughput of approximately 1,691 samples/s under CPU-only profiling. These findings suggest that compact KAN-centered feature refinement can provide a practical operating point for missed-attack-risk-oriented IIoT intrusion detection while avoiding overclaims of universal dominance or direct zero-shot transfer.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1836418</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1836418</link>
        <title><![CDATA[The anatomy of a resilient phishing detector: an in-depth analysis of a transformer's interpretability, causality, and robustness]]></title>
        <pubdate>2026-08-31T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Vishwachetan D.</author><author>Geetha Dayalan</author><author>Abhay Bhandarkar</author>
        <description><![CDATA[The increasing sophistication of phishing attacks necessitates the development of detection models that are not only accurate but also interpretable and secure. While Transformer-based models have shown great promise in this domain, their “black box” nature often hinders trust and deployment in critical security environments. This paper presents a comprehensive, multi-faceted analysis of a DistilBERT-based model for phishing URL detection, moving beyond standard performance metrics to investigate its internal mechanisms, causal reasoning, and security posture. We first establish a performance benchmark by training a high-performance DistilBERT classifier that achieves a 95.85% F1-score after robust threshold optimization, significantly outperforming traditional machine learning baselines. To deconstruct the model's reasoning, we introduce a domain-specific probing method to identify and analyze “specialist” attention heads and contextualize these findings with established XAI methods like SHAP and LIME. A subsequent intervention-based ablation study on these heads yields a surprising insight into the model's resilience: performance does not degrade when specialist heads are removed, revealing a high degree of distributed knowledge and functional redundancy. We evaluate theoretical adversarial vulnerability across multiple perturbation budgets (ϵ∈{0.1, 0.2, 0.3, 0.5}), finding that the model exhibits strong resilience against small perturbations (F1 > 0.95 for ϵ ≤ 0.1) while showing graceful degradation under stronger attacks, consistent with security benefits arising from distributed representations. We further evaluate a battery of operationally realistic, non-gradient obfuscations—including character transposition, leet substitution, homoglyph, and delimiter manipulations (e.g., micorsoft.com, paypa1-login.com)—and find that evasion success never exceeds 7.2%, with the subword tokenizer rendering such manipulations more detectable rather than less. Our findings demonstrate that the model's strength lies not in a few critical components but in a distributed, non-brittle reasoning process, making it a promising component within layered phishing defense systems.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1834407</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1834407</link>
        <title><![CDATA[An integrated evaluation protocol for adversarial robustness, generalization, and explanation stability in URL-based phishing detection]]></title>
        <pubdate>2026-08-31T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Tanvir Ahamed</author><author>Shawon Chakrabarty Kakon</author><author>Fahmid Al Farid</author><author>Jia Uddin</author><author>Hezerul Bin Abdul Karim</author>
        <description><![CDATA[IntroductionThe reliability of phishing Uniform Resource Locator (URL) detectors under adversarial URL rewriting, domain shift, and explanation instability remains insufficiently understood. This study proposes an integrated robustness evaluation protocol for URL-based phishing detection, which integrates structured adversarial perturbation, unseen attack-family generalization, compositional attack effects, explanation stability, and external vulnerability transfer.MethodsThe protocol tests four representative model families: Logistic Regression, XGBoost, CharCNN, and BERT-base, using 235,370 validated URLs from PHIUSIIL, consisting of 100,520 phishing and 134,850 benign URLs, along with 49,121 PhishTank-validated phishing URLs for external validation.ResultsAll models performed well on the clean test sets, ranging from 0.9962 to 0.9984, but their robustness decreased substantially under realistic URL mutations. Subdomain injection degraded the strong performance of Logistic Regression, XGBoost, and CharCNN to around 0.432, indicating collapse to the phishing-prevalence floor. BERT was highly susceptible to homoglyph, padding, and path-based perturbations. Leave-one-family-out evaluation also showed poor transfer to unseen subdomain attacks for both Logistic Regression and XGBoost, with Robustness Degradation Index values of 0.535 and 0.565, respectively. Explanation stability also suffered, with SHAP top-K Jaccard similarity dropping to 0.526-0.535 under subdomain perturbation.DiscussionThese results provide a solid benchmark for evaluating robustness-aware phishing URL detection for achieving deployable reliability under realistic adversarial and non-IID settings.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1863891</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1863891</link>
        <title><![CDATA[Enhancing cybersecurity with Explainable Artificial Intelligence: technical framework and applications in training labs]]></title>
        <pubdate>2026-08-20T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Ahmad Almufarreh</author><author>Ashfaq Ahmad</author><author>Muhammad Arshad</author><author>Choo Wou Onn</author><author>Yegon Michael Kiplangat</author>
        <description><![CDATA[Cyberattacks are growing in complexity, and machine-learning-based intrusion detection systems (IDS) are increasingly adopted to support scalable threat monitoring. However, high-performing models can be operationally difficult to deploy when their decisions are not interpretable or auditable. This paper studies explainability as a decision-support component in an IDS workflow rather than as a purely visual add-on. Using the UNSW-NB15 benchmark, we compare three widely used classifiers—Random Forest (RF), Decision Tree (DT), and Support Vector Machine (SVM)—and then analyse the strongest performer (RF) with post-hoc explainability tools: Local Interpretable Model-Agnostic Explanations (LIME) and Shapley Additive Explanations (SHAP). RF achieved 95.3% accuracy (precision 94.8%, recall 96.1%, F1-score 95.4%), exceeding DT and SVM on the same split. LIME and SHAP consistently highlighted traffic-volume and duration-related features (e.g., destination bytes, source bytes, and flow duration) as influential drivers of intrusion predictions, providing actionable hypotheses for analyst triage and policy refinement. We further discuss how explanation outputs can be operationalized in cybersecurity training labs through auditable “rationale artifacts,” while clarifying that any observed reduction in false positives should be interpreted as the outcome of explanation-guided interventions (e.g., threshold tuning and triage rule adjustments) rather than a direct causal effect of generating explanations. Finally, we outline necessary research extensions—controlled baselines, robustness testing, and explanation stability/faithfulness analysis—to ensure reliable deployment of LIME/SHAP in safety-critical IDS settings.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1844445</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1844445</link>
        <title><![CDATA[Toward practical migration to post-quantum SSH: system-level design and evaluation]]></title>
        <pubdate>2026-08-20T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Shahid Allah Bakhsh</author><author>Inam ul Haq</author><author>Tarek Helmy</author><author>Fakhri Alam Khan</author><author>Shahid Latif</author><author>Jawad Ahmad</author><author>Muhammad Shahbaz Khan</author>
        <description><![CDATA[The migration of remote-access and industrial communication systems from classical public-key cryptography to post-quantum cryptography (PQC) requires careful evaluation at both the protocol and system levels. This paper presents PQC-E2E-CA, a system-level evaluation framework for reviewing post-quantum and hybrid cryptographic configurations in Secure Shell (SSH). The framework integrates OQS-enabled OpenSSH and OpenSSL with Linux netem network emulation, automated experiment execution, SCP integrity verification, and statistical post-processing. The evaluation separates key exchange behavior from host key authentication. Specifically, it measures ML-KEM and hybrid ML-KEM as SSH key exchange mechanisms, and ML-DSA as a host-key signature mechanism. Experiments are conducted under controlled RTT and packet-loss conditions using a gateway virtualised client-server testbed. The results show that ML-KEM and hybrid ML-KEM can be integrated into SSH without prohibitive application-level session setup overhead in the evaluated environment. Among the evaluated configurations, ML-KEM-768 demonstrates comparatively lower SSH session establishment latency at 50 ms RTT with 0% packet loss. ML-DSA-44 achieves the lowest host-key authentication latency under the same conditions and maintains relatively stable performance at 150 ms RTT with 5% packet loss. SCP throughput results for 100 MB and 200 MB transfers indicate that sustained transfer performance is mainly influenced by RTT and transport-layer dynamics using a single dominant key exchange configuration. These findings support migration toward standardized post-quantum mechanisms in SSH-based gateway and remote-access environments, provided that algorithm choice and system configuration are validated under representative workloads and network conditions.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1897752</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1897752</link>
        <title><![CDATA[CT-EWS: graph-centric early warning for multi-protocol cyber campaigns using long-memory forecasting and explainable attribution]]></title>
        <pubdate>2026-08-19T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Rakesh Kumar Sehgal</author><author>Rakesh Matam</author>
        <description><![CDATA[The growing exposure of IoT devices and industrial control systems (ICS) to the public Internet has significantly increased the attack surface. Most of the current systems still detect these threats only in retrospect. Honeypots are widely used to collect attack data, but they tend to surface only isolated alerts rather than the coordinated campaigns behind them. In this paper, we present CT-EWS, a cyber threat early warning system that treats adversarial activity as a dynamic multi-protocol campaign graph. Honeypot telemetry from heterogeneous protocols is aggregated centrally and fed into SOC-oriented workflows. Each interaction becomes a node, with edges drawn from temporal proximity, behavioral similarity, infrastructure overlap, and cross-protocol relationships. Community extraction over this graph reconstructs coordinated multi-stage campaigns and consolidates fragmented alerts into coherent campaigns. For campaign forecasting, we apply FARIMA-based long-memory modeling on the Largest Connected Component (LCC) of the campaign graph, gaining a lead time of 18–22 min over ARIMA baselines. SHAP-based attribution explains which behavioral signals contribute to each anomaly, with 91.4% rank-weighted feature relevance and an explanation fidelity of R2 = 0.88. The detected subgraphs are mapped to MITRE ATT&CK for ICS, covering 100% of tactics and 84% of techniques. On real Internet-facing honeypot traffic, CT-EWS achieves a Normalized Mutual Information (NMI) of 0.87 and an F1 score of 0.89 for campaign reconstruction, and stays stable under graph perturbations of up to 10%–20%. Together, relational graph modeling, long-memory forecasting, explainability, and ATT&CK-aligned context turn passive honeypot infrastructure into a proactive early warning capability.]]></description>
      </item>
      </channel>
    </rss>