<?xml version="1.0" encoding="utf-8"?>
    <rss version="2.0">
      <channel xmlns:content="http://purl.org/rss/1.0/modules/content/">
        <title>Frontiers in Computer Science | Computer Security section | New and Recent Articles</title>
        <link>https://www.frontiersin.org/journals/computer-science/sections/computer-security</link>
        <description>RSS Feed for Computer Security section in the Frontiers in Computer Science journal | New and Recent Articles</description>
        <language>en-us</language>
        <generator>Frontiers Feed Generator,version:1</generator>
        <pubDate>2026-09-06T07:39:03.994+00:00</pubDate>
        <ttl>60</ttl>
        <item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1847364</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1847364</link>
        <title><![CDATA[Lightweight confidentiality framework for TinyML-enabled IoT edge communication]]></title>
        <pubdate>2026-09-03T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Kurunandan Jain</author><author>Prabhakar Krishnan</author><author>Sethu Subramanian N.</author><author>Prabu P.</author>
        <description><![CDATA[Lightweight security mechanisms are essential for Internet of Things (IoT) edge environments, where devices operate under strict constraints in computation, memory, and energy. The emergence of TinyML-enabled edge intelligence introduces new communication security requirements, particularly for protecting compact inference outputs (typically 1-32 bytes, including class labels, confidence scores, or anomaly flags) transmitted over potentially insecure networks. This paper presents a lightweight confidentiality-focused encryption framework based on an enhanced variant of the Tiny Encryption Algorithm (TEA), tailored for TinyML-driven IoT communication. The proposed Enhanced TEA incorporates a plaintext-dependent dynamic key diversification mechanism using SHA-256, improving empirical diffusion and ciphertext randomness while preserving the computational efficiency of ARX-based cipher structures. Beyond algorithmic design, the study develops a system-level secure TinyML-enabled IoT communication architecture, integrating encryption directly into edge inference workflows. The framework is implemented and evaluated on an edge computing platform to assess performance in terms of execution time, memory usage, CPU utilization, communication latency, and energy behavior. Experimental results demonstrate an avalanche effect of 54.69% and ciphertext entropy of 7.66 bits/byte, while maintaining less than 5% throughput degradation and minimal latency overhead in MQTT-based communication. The proposed approach provides a practical lightweight confidentiality mechanism for TinyML-enabled edge computing environments operating under moderate resource constraints. However, as the design focuses on confidentiality, it should be combined with lightweight authentication mechanisms to ensure comprehensive security in real-world deployments.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1909955</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1909955</link>
        <title><![CDATA[Missed-attack-risk-oriented compact KAN architecture for industrial IoT intrusion detection]]></title>
        <pubdate>2026-09-01T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Awad A. Younis</author><author>Ahmed Elwhishi</author>
        <description><![CDATA[Intrusion detection in Industrial Internet of Things (IIoT) environments is a risk-asymmetric problem: false alarms increase analyst workload, but false negatives may allow malicious activity to persist in safety- and operation-sensitive systems. Although recent deep learning-based intrusion detection systems report high aggregate accuracy, near-ceiling performance can obscure the residual errors that remain under class imbalance and fine-grained label settings. This study investigates missed-attack-risk-oriented IIoT intrusion detection through CKAN-AFG, a compact non-recurrent Kolmogorov–Arnold Network (KAN)-centered architecture that combines KAN-based feature transformation, residual multi-head feature attention, feature gating, adaptive pooling, and a compact KANLinear classifier. The model is evaluated on the CIC IIoT Dataset 2025 (DataSense) as the main benchmark, with TON-IoT used as a secondary benchmark for cross-dataset comparison and continuity with prior IIoT evaluation. The evaluation uses a leakage-controlled repeated-seed protocol with fold-confined RF-RFE, a final 55-common-feature DataSense protocol, operational error decomposition, KAN-isolation and component-level ablation, repeated-seed stability analysis, and CPU-based deployment-oriented profiling. Under the final DataSense protocol, CKAN-AFG achieves a weighted F1-score of 99.8146% and an FNR of 0.2636%, corresponding to an approximately 5.6% relative FNR reduction compared with the CKAN–BiLSTM continuity baseline. Operational error decomposition shows that CKAN-AFG produces the lowest attack-to-benign count, with 33.8 mean true missed attacks, and the lowest total off-diagonal error count among the retained models. KAN-isolation results show that replacing the KAN-specific feature-transformation and classifier components with conventional CNN or LSTM alternatives increases FNR, while removing attention, feature gating, or both also degrades the false-negative-aware profile. CPU profiling shows that CKAN-AFG remains compact, with 247,005 trainable parameters, a 0.956 MB FP32 footprint, and throughput of approximately 1,691 samples/s under CPU-only profiling. These findings suggest that compact KAN-centered feature refinement can provide a practical operating point for missed-attack-risk-oriented IIoT intrusion detection while avoiding overclaims of universal dominance or direct zero-shot transfer.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1834407</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1834407</link>
        <title><![CDATA[An integrated evaluation protocol for adversarial robustness, generalization, and explanation stability in URL-based phishing detection]]></title>
        <pubdate>2026-08-31T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Tanvir Ahamed</author><author>Shawon Chakrabarty Kakon</author><author>Fahmid Al Farid</author><author>Jia Uddin</author><author>Hezerul Bin Abdul Karim</author>
        <description><![CDATA[IntroductionThe reliability of phishing Uniform Resource Locator (URL) detectors under adversarial URL rewriting, domain shift, and explanation instability remains insufficiently understood. This study proposes an integrated robustness evaluation protocol for URL-based phishing detection, which integrates structured adversarial perturbation, unseen attack-family generalization, compositional attack effects, explanation stability, and external vulnerability transfer.MethodsThe protocol tests four representative model families: Logistic Regression, XGBoost, CharCNN, and BERT-base, using 235,370 validated URLs from PHIUSIIL, consisting of 100,520 phishing and 134,850 benign URLs, along with 49,121 PhishTank-validated phishing URLs for external validation.ResultsAll models performed well on the clean test sets, ranging from 0.9962 to 0.9984, but their robustness decreased substantially under realistic URL mutations. Subdomain injection degraded the strong performance of Logistic Regression, XGBoost, and CharCNN to around 0.432, indicating collapse to the phishing-prevalence floor. BERT was highly susceptible to homoglyph, padding, and path-based perturbations. Leave-one-family-out evaluation also showed poor transfer to unseen subdomain attacks for both Logistic Regression and XGBoost, with Robustness Degradation Index values of 0.535 and 0.565, respectively. Explanation stability also suffered, with SHAP top-K Jaccard similarity dropping to 0.526-0.535 under subdomain perturbation.DiscussionThese results provide a solid benchmark for evaluating robustness-aware phishing URL detection for achieving deployable reliability under realistic adversarial and non-IID settings.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1836418</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1836418</link>
        <title><![CDATA[The anatomy of a resilient phishing detector: an in-depth analysis of a transformer's interpretability, causality, and robustness]]></title>
        <pubdate>2026-08-31T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Vishwachetan D.</author><author>Geetha Dayalan</author><author>Abhay Bhandarkar</author>
        <description><![CDATA[The increasing sophistication of phishing attacks necessitates the development of detection models that are not only accurate but also interpretable and secure. While Transformer-based models have shown great promise in this domain, their “black box” nature often hinders trust and deployment in critical security environments. This paper presents a comprehensive, multi-faceted analysis of a DistilBERT-based model for phishing URL detection, moving beyond standard performance metrics to investigate its internal mechanisms, causal reasoning, and security posture. We first establish a performance benchmark by training a high-performance DistilBERT classifier that achieves a 95.85% F1-score after robust threshold optimization, significantly outperforming traditional machine learning baselines. To deconstruct the model's reasoning, we introduce a domain-specific probing method to identify and analyze “specialist” attention heads and contextualize these findings with established XAI methods like SHAP and LIME. A subsequent intervention-based ablation study on these heads yields a surprising insight into the model's resilience: performance does not degrade when specialist heads are removed, revealing a high degree of distributed knowledge and functional redundancy. We evaluate theoretical adversarial vulnerability across multiple perturbation budgets (ϵ∈{0.1, 0.2, 0.3, 0.5}), finding that the model exhibits strong resilience against small perturbations (F1 > 0.95 for ϵ ≤ 0.1) while showing graceful degradation under stronger attacks, consistent with security benefits arising from distributed representations. We further evaluate a battery of operationally realistic, non-gradient obfuscations—including character transposition, leet substitution, homoglyph, and delimiter manipulations (e.g., micorsoft.com, paypa1-login.com)—and find that evasion success never exceeds 7.2%, with the subword tokenizer rendering such manipulations more detectable rather than less. Our findings demonstrate that the model's strength lies not in a few critical components but in a distributed, non-brittle reasoning process, making it a promising component within layered phishing defense systems.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1863891</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1863891</link>
        <title><![CDATA[Enhancing cybersecurity with Explainable Artificial Intelligence: technical framework and applications in training labs]]></title>
        <pubdate>2026-08-20T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Ahmad Almufarreh</author><author>Ashfaq Ahmad</author><author>Muhammad Arshad</author><author>Choo Wou Onn</author><author>Yegon Michael Kiplangat</author>
        <description><![CDATA[Cyberattacks are growing in complexity, and machine-learning-based intrusion detection systems (IDS) are increasingly adopted to support scalable threat monitoring. However, high-performing models can be operationally difficult to deploy when their decisions are not interpretable or auditable. This paper studies explainability as a decision-support component in an IDS workflow rather than as a purely visual add-on. Using the UNSW-NB15 benchmark, we compare three widely used classifiers—Random Forest (RF), Decision Tree (DT), and Support Vector Machine (SVM)—and then analyse the strongest performer (RF) with post-hoc explainability tools: Local Interpretable Model-Agnostic Explanations (LIME) and Shapley Additive Explanations (SHAP). RF achieved 95.3% accuracy (precision 94.8%, recall 96.1%, F1-score 95.4%), exceeding DT and SVM on the same split. LIME and SHAP consistently highlighted traffic-volume and duration-related features (e.g., destination bytes, source bytes, and flow duration) as influential drivers of intrusion predictions, providing actionable hypotheses for analyst triage and policy refinement. We further discuss how explanation outputs can be operationalized in cybersecurity training labs through auditable “rationale artifacts,” while clarifying that any observed reduction in false positives should be interpreted as the outcome of explanation-guided interventions (e.g., threshold tuning and triage rule adjustments) rather than a direct causal effect of generating explanations. Finally, we outline necessary research extensions—controlled baselines, robustness testing, and explanation stability/faithfulness analysis—to ensure reliable deployment of LIME/SHAP in safety-critical IDS settings.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1844445</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1844445</link>
        <title><![CDATA[Toward practical migration to post-quantum SSH: system-level design and evaluation]]></title>
        <pubdate>2026-08-20T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Shahid Allah Bakhsh</author><author>Inam ul Haq</author><author>Tarek Helmy</author><author>Fakhri Alam Khan</author><author>Shahid Latif</author><author>Jawad Ahmad</author><author>Muhammad Shahbaz Khan</author>
        <description><![CDATA[The migration of remote-access and industrial communication systems from classical public-key cryptography to post-quantum cryptography (PQC) requires careful evaluation at both the protocol and system levels. This paper presents PQC-E2E-CA, a system-level evaluation framework for reviewing post-quantum and hybrid cryptographic configurations in Secure Shell (SSH). The framework integrates OQS-enabled OpenSSH and OpenSSL with Linux netem network emulation, automated experiment execution, SCP integrity verification, and statistical post-processing. The evaluation separates key exchange behavior from host key authentication. Specifically, it measures ML-KEM and hybrid ML-KEM as SSH key exchange mechanisms, and ML-DSA as a host-key signature mechanism. Experiments are conducted under controlled RTT and packet-loss conditions using a gateway virtualised client-server testbed. The results show that ML-KEM and hybrid ML-KEM can be integrated into SSH without prohibitive application-level session setup overhead in the evaluated environment. Among the evaluated configurations, ML-KEM-768 demonstrates comparatively lower SSH session establishment latency at 50 ms RTT with 0% packet loss. ML-DSA-44 achieves the lowest host-key authentication latency under the same conditions and maintains relatively stable performance at 150 ms RTT with 5% packet loss. SCP throughput results for 100 MB and 200 MB transfers indicate that sustained transfer performance is mainly influenced by RTT and transport-layer dynamics using a single dominant key exchange configuration. These findings support migration toward standardized post-quantum mechanisms in SSH-based gateway and remote-access environments, provided that algorithm choice and system configuration are validated under representative workloads and network conditions.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1897752</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1897752</link>
        <title><![CDATA[CT-EWS: graph-centric early warning for multi-protocol cyber campaigns using long-memory forecasting and explainable attribution]]></title>
        <pubdate>2026-08-19T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Rakesh Kumar Sehgal</author><author>Rakesh Matam</author>
        <description><![CDATA[The growing exposure of IoT devices and industrial control systems (ICS) to the public Internet has significantly increased the attack surface. Most of the current systems still detect these threats only in retrospect. Honeypots are widely used to collect attack data, but they tend to surface only isolated alerts rather than the coordinated campaigns behind them. In this paper, we present CT-EWS, a cyber threat early warning system that treats adversarial activity as a dynamic multi-protocol campaign graph. Honeypot telemetry from heterogeneous protocols is aggregated centrally and fed into SOC-oriented workflows. Each interaction becomes a node, with edges drawn from temporal proximity, behavioral similarity, infrastructure overlap, and cross-protocol relationships. Community extraction over this graph reconstructs coordinated multi-stage campaigns and consolidates fragmented alerts into coherent campaigns. For campaign forecasting, we apply FARIMA-based long-memory modeling on the Largest Connected Component (LCC) of the campaign graph, gaining a lead time of 18–22 min over ARIMA baselines. SHAP-based attribution explains which behavioral signals contribute to each anomaly, with 91.4% rank-weighted feature relevance and an explanation fidelity of R2 = 0.88. The detected subgraphs are mapped to MITRE ATT&CK for ICS, covering 100% of tactics and 84% of techniques. On real Internet-facing honeypot traffic, CT-EWS achieves a Normalized Mutual Information (NMI) of 0.87 and an F1 score of 0.89 for campaign reconstruction, and stays stable under graph perturbations of up to 10%–20%. Together, relational graph modeling, long-memory forecasting, explainability, and ATT&CK-aligned context turn passive honeypot infrastructure into a proactive early warning capability.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1840175</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1840175</link>
        <title><![CDATA[Integrating explainable AI with generative models for IoT intrusion detection systems: a systematic review]]></title>
        <pubdate>2026-08-14T00:00:00Z</pubdate>
        <category>Systematic Review</category>
        <author>Jameela A. Hassan</author><author>Manal Abdullah</author><author>Dania Aljeaid</author>
        <description><![CDATA[IntroductionThe rapid expansion of the Internet of Things (IoT) has increased cybersecurity exposure and highlighted limitations of intrusion detection systems (IDS), including class imbalance and inadequate representation of minority attack types. Generative models address data limitations, while explainable artificial intelligence (XAI) improves transparency; however, their joint use remains underexplored.MethodsWe conducted a PRISMA-guided systematic review of studies published from 2014 to 2025 and retrieved from IEEE Xplore, ACM Digital Library, SpringerLink, and ScienceDirect. Eligible studies were categorized as (i) generative augmentation pipelines, (ii) XAI-enhanced IDS models, or (iii) hybrid generative-explainable frameworks.ResultsTwenty-one studies were included. GANs and conditional GANs dominated generative IDS research. Approximately 39% of GAN-based and 52% of cGAN-based studies incorporated post-hoc XAI methods such as SHAP and LIME. None of the reviewed InfoGAN-based IoT IDS studies integrated formal XAI mechanisms.DiscussionExisting research remains fragmented, with gaps in interpretability, cross-dataset robustness, explanation stability, real-time scalability, and deployment readiness. Future work should develop transparent, robust, and efficient generative-XAI IDS frameworks for IoT security.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1892143</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1892143</link>
        <title><![CDATA[Adaptive multi-domain threat detection in critical infrastructure via context-gated risk aggregation and ANOVA validation]]></title>
        <pubdate>2026-08-12T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Geetanjali Rathee</author><author>Razi Iqbal</author><author>Hafiz Husnain Raza Sherazi</author><author>Fizza Azhar</author><author>Mubashir Ali</author>
        <description><![CDATA[Critical infrastructure forms the backbone of modern society by providing an efficient and interconnected communication network. In addition to the emergence of various secure solutions, numerous other critical issues require resolution alongside the assurance of network security. Although complex security structures enhance security, they also introduce delays in storage, computation, and other areas, which may invite intruders to harm the system's performance. This article proposes a unified mechanism integrating a secure policy framework comprising a multi-risk security model, an ANOVA-based statistical validation mechanism, and a context-aware security policy to ensure resilient and secure critical infrastructure. The proposed mechanism captures heterogeneous risks across the physical, cyber, and operational domains using separate encoders that help in modeling characteristics of each domain. Furthermore, a context-gated attention mechanism is utilized to measure weights for temporal, behavioral, and environmental signals, which ensures threat protection without retraining. An ANOVA-based statistical validation is used for quantifying improvements in overall performance across multiple metrics, including F1, accuracy, and resiliency score. The proposed mechanism ensures optimal and accurate decision-making in a multi-domain environment by reducing vulnerabilities in critical infrastructure.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1874392</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1874392</link>
        <title><![CDATA[Browser-based phishing detection system using modern web technologies]]></title>
        <pubdate>2026-08-04T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Muhammad Arshad</author><author>Beena Sherin Kuriakose</author><author>Choo Wou Onn</author><author>Farhan Ahmad Siddiqui</author><author>Mohammad Shahid Kamal</author>
        <description><![CDATA[Phishing remains one of the most persistent cybersecurity threats, exploiting human trust to steal sensitive information through deceptive websites. Traditional detection methods, reliant on blacklists and reactive reporting, offer limited protection against rapidly evolving zero-day attacks. To address these challenges, this study proposes and evaluates a hybrid browser-resident phishing detection framework that combines three complementary detection mechanisms: a locally executed Random Forest model using URL lexical features, lightweight real-time DOM structure analysis, and VirusTotal’s multi-engine reputation service. Communication between the client and server is optimised using gRPC over the QUIC protocol, ensuring secure, high-performance data exchange with built-in retry mechanisms for resilience. The framework adopts a fail-safe decision strategy in which URLs identified as malicious by VirusTotal are immediately blocked, while benign or unknown results are further evaluated using a weighted fusion of machine learning and DOM-based scores. The model was trained on several high-impact URL features to ensure both speed and accuracy. Privacy remains a core principle, with sensitive data processed locally and minimal external data transmission. Experimental evaluation demonstrates that the proposed framework achieves a detection accuracy of 96.7%, with 97.1% precision, 96.0% recall, an F1-score of 96.6%, and an AUC of 0.993 using the optimised Random Forest classifier. The complete detection pipeline maintains an average end-to-end latency of less than one second, while the hybrid decision-fusion strategy successfully detects 91.7% of zero-day phishing URLs in the live evaluation dataset. These results demonstrate that the proposed architecture provides an accurate, low-latency, privacy-aware, and practically deployable solution for real-time browser-based phishing detection.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1939656</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1939656</link>
        <title><![CDATA[Correction: FBR-PAEKS: revocable public-key authenticated keyword search with forward privacy for dynamic cloud environments]]></title>
        <pubdate>2026-07-28T00:00:00Z</pubdate>
        <category>Correction</category>
        <author>Mishal Ismaeel</author><author>Ali Raza</author>
        <description></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1847376</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1847376</link>
        <title><![CDATA[Next-generation intrusion detection in cyber-physical systems using an ensemble of quantum-inspired and deep neural models]]></title>
        <pubdate>2026-07-27T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Maloth Sagar</author><author>Vanmathi C</author>
        <description><![CDATA[Cyber-physical systems (CPSs) could cause actuation and safety risks. Intrusion detection is essential for preserving the system's integrity due to growing security issues. Nowadays, deep learning (DL) schemes have been deployed to enhance the detection of cyber-attacks, yet these models are prone to overfitting, which reduces detection performance. Hence, this research proposes a novel deep learning-based Intrusion Detection System (IDS) for CPS to address these limitations. The proposed methodology consists of four key stages, including preprocessing, feature extraction, feature selection, and intrusion detection. Data preprocessing is performed via cleansing, followed by the extraction of statistical [mean, median, and standard deviation (SD)], entropy-based, improved correlation, improved mutual information (MI), flow-based, and Improved Information Gain (IIG) features, which are derived to obtain the important features. The Archimedes Algorithm with Team Work Principle (AA_TWP), integrating the Archimedes Optimization Algorithm (AOA) and the Teamwork Optimization Algorithm (TOA), with modifications to the exploration phase, is employed to efficiently select the most relevant features. The selected features, along with preprocessed data, are fed into an ensemble of Deep Belief Networks (DBNs), Quantum Deep Neural Networks (QDNNs), and optimized Bidirectional Long Short-Term Memory (Bi-LSTM), with Bi-LSTM weights further tuned by AA_TWP. The ensemble outputs are averaged to produce the final intrusion decision. Experimental results demonstrate 91.52% accuracy and 91.76% Matthews Correlation coefficient (MCC), highlighting the effectiveness of the proposed approach, which outperforms existing techniques.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1867907</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1867907</link>
        <title><![CDATA[Fine-grained continuous user authentication via mouse grip pressure biometrics]]></title>
        <pubdate>2026-07-17T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Xiang Zou</author><author>Jingbo Wang</author><author>Yanqiu Liu</author><author>Jiali Wu</author><author>Guangjun Liu</author>
        <description><![CDATA[Computers have become indispensable tools in modern society and they often serve as repositories for large amounts of private and confidential information in public. User authentication is therefore a fundamental mechanism for protecting device security and user privacy. Traditional authentication methods such as passwords are not tightly bound to user identity and impose a significant memory burden, which has motivated the widespread adoption of biometric-based authentication approaches, such as fingerprint and facial recognition. However, fingerprint- and face-based authentication typically requires additional hardware support and can be vulnerable to interception by ultra-high-definition cameras, raising serious privacy concerns. To solve these problems, this paper proposes a fine-grained and continuous user authentication method based on mouse grip pressure biometrics. By deploying resistive pressure sensors on the surface of a mouse, we capture individualized pressure distribution patterns generated during natural mouse gripping. To further enhance discriminative capability, we refine the sensor contact layout to improve spatial feature resolution. Moreover, we introduce a layered representation for omnidirectional pressure signals to mitigate sensitivity to grip direction variations. Extensive experimental results demonstrate the effectiveness of the proposed system, achieving the FAR below 0.1% and the FRR below 0.4%. These results indicate that mouse grip pressure constitutes a highly discriminative and robust biometric modality for continuous user authentication.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1886719</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1886719</link>
        <title><![CDATA[Real-time saliency-guided deep watermarking on Kria KV260: a Vitis AI accelerated proxy architecture]]></title>
        <pubdate>2026-07-16T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Mehmet İrfan Gedik</author><author>Aysun Coşkun</author>
        <description><![CDATA[The rapid growth of Industrial Internet of Things (IIoT) ecosystems and autonomous surveillance networks has necessitated the shift of digital content security from central servers to the data-generating edge. In industrial security scenarios, operators must continuously monitor live video streams and optionally capture high-resolution, verifiable evidence snapshots. However, high computational costs and hardware-based precision losses prevent the real-time execution of deep learning-based watermarking models on resource-limited embedded devices. This study proposes a hardware-aware and semantically oriented real-time watermarking architecture running on the Xilinx Kria KV260 FPGA platform. The fundamental innovation of the proposed system is the asynchronous “Proxy Frame” software architecture, which allows heavy Convolutional Neural Networks (CNNs) to run in the background, isolated from the live video stream. Thus, highly secure watermarking can be performed at 1080p resolutions without compromising the fluidity of the 30 FPS live preview offered to the operator. Furthermore, a Noise-Assisted Dithering technique, inspired by stochastic resonance, was used to mitigate the “Signal Fading” problem arising from watermark signal loss during 8-bit integer (INT8) quantization on the Deep Learning Processing Unit (DPU). By injecting controlled Gaussian noise into the quantized inference pipeline, the detectability of subthreshold weak watermark signals was increased, reducing the hardware Bit Error Rate (BER) from 18.75% to 13.06%. MobileNetV2 and ResNet50-FCN based saliency models achieved an average PSNR visual quality of 39.86 dB by concealing the payload in perceptually insignificant regions. Under clean hardware conditions, the system achieved a baseline BER of 2.6% (with MobileNetV2). In attack tests, the BER remained below 15% for MobileNetV2 under most standard degradations, with the stated exceptions of severe JPEG compression and deliberate geometric cropping. This end-to-end hardware and software solution demonstrates that theoretical deep learning models can be integrated into industrial smart cameras without experiencing performance bottlenecks, particularly for static infrastructure monitoring.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1871563</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1871563</link>
        <title><![CDATA[FBR-PAEKS: revocable public-key authenticated keyword search with forward privacy for dynamic cloud environments]]></title>
        <pubdate>2026-07-15T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Mishal Ismaeel</author><author>Ali Raza</author>
        <description><![CDATA[This study presents Forward-private and Binary-tree-Revocable PAEKS (FBR-PAEKS), a public-key authenticated encryption with keyword search scheme for secure multi-user cloud environments that integrates forward privacy and cryptographic revocation in a single construction. The proposed scheme supports expressive keyword search policies represented by linear secret-sharing schemes (LSSS), enabling flexible AND, OR, and threshold-based queries over encrypted indexes. FBR-PAEKS integrates a binary-tree-based revocation mechanism using the complete-subtree algorithm KUNode, an epoch-bound one-way state evolution chain for forward privacy, and a deletion-tag filter for logical document deletion. To resist insider keyword-guessing attacks by the cloud server, the construction introduces a sender–receiver shared element derived from the Diffie–Hellman value of their secret keys. Furthermore, the receiver's epoch secret is embedded into the trapdoor exponent to prevent current-state compromise from exposing past search information. We formalized the security of the scheme through ciphertext indistinguishability, resistance to insider keyword guessing, revocation unforgeability, forward privacy under state compromise, and trapdoor integrity. The security reductions are established under the CDH, mDLIN, PRF, one-wayness, and signature unforgeability assumptions in the random oracle model. Theoretical and practical evaluations show that FBR-PAEKS achieves strong security and expressive search functionality with competitive performance compared with existing PAEKS schemes.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1860652</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1860652</link>
        <title><![CDATA[IIDS: a light-weight interpretable intrusion detection system for network infrastructures]]></title>
        <pubdate>2026-07-14T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Asadullah Momand</author><author>Sana Ullah Jan</author><author>Naeem Ramzan</author>
        <description><![CDATA[Network security remains a critical challenge in today's interconnected world, where effective intrusion detection is essential for safeguarding sensitive infrastructure, including financial, medical, and governmental systems. Existing intrusion detection systems (IDS) often lack interpretability, preventing security personnel from gaining clear insights into detected anomalies and impeding timely, informed decision-making. Moreover, the growing complexity of networks demands an adaptable IDS capable of identifying diverse intrusion types, such as overflow, black hole, or diversion across varied environments, while minimizing false positives and computational overhead. To address these issues, this study proposes an interpretable intrusion detection system (IIDS) that leverages an ensemble learning approach integrating an attention-based convolutional neural network (CNN), long short-term memory (LSTM), and an interpretable random forest (RF) algorithm. The CNN and LSTM components extract spatial and temporal features from network traffic. At the same time, the RF enhances transparency by providing decision trees that elucidate the model's reasoning, enabling security teams to understand and trust the predictions. When evaluated against other methods, the proposed IIDS achieves optimal performance with an accuracy of 99.00% and an F1-score of 99.00%, outperforming other models on benchmark datasets.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1860123</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1860123</link>
        <title><![CDATA[Quantum-ready IoMT architecture for chest X-ray imaging with lightweight CNN and hybrid chaos-DNA encryption]]></title>
        <pubdate>2026-07-09T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Altahir Saad Ahmed</author><author>Ali Raza</author><author>Abed Saif Alghwali</author><author>Suzan Hassan Bakhit</author><author>Muhammad Farman</author>
        <description><![CDATA[This study presents a complete quantum-aware Internet of Medical Things (IoMT) framework for secure medical imaging that integrates lightweight edge diagnostics, quantum key distribution, and hybrid image encryption. At the edge layer, MicroRadNet, an ultra-compact convolutional neural network (CNN) with exactly 3,140 trainable parameters, is deployed on a Raspberry Pi Zero 2 W, achieving 98.24% accuracy on chest X-ray classification with INT8 quantization. This reduces the model size to 3.14 KB and yields inference latency that meets real-time constraints. At the communication layer, a gateway-mediated BB84 protocol executed on Amazon Braket generates session keys via Golay [24, 12, 8] reconciliation (correcting up to t = 3 errors per codeword) and privacy amplification, producing 256-bit keys with quantum bit error rate (QBER) < 0.02. At the image-protection layer, a hybrid cipher combines 5D hyperchaotic permutation (seeded from BB84 key material), fixed-rule DNA encoding, and quantum-keyed diffusion. Security evaluation demonstrates near-ideal entropy, strong NPCR and UACI values, uniform ciphertext histogram distribution, low directional adjacent-pixel correlations, low average absolute correlation, large key space, high plaintext sensitivity, high key sensitivity, and stable chaotic-sequence randomness. These results provide empirical statistical validation of resistance to common statistical, differential, brute-force, and key-sensitivity attacks. End-to-end latency remains below the 1.5 s system constraint, validating practical edge deployment. The framework replaces classical public-key dependency with simulation-validated quantum-aware foundations while maintaining clinical accuracy and real-time performance, establishing a path toward deployable, standards-aligned quantum-aware healthcare security.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1873568</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1873568</link>
        <title><![CDATA[Adversarial attacks detection for network intrusion detection systems using outlier-filtered principal component analysis]]></title>
        <pubdate>2026-07-08T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>N. Dhinakaran</author><author>S. Anto</author>
        <description><![CDATA[Cybersecurity frameworks are increasingly incorporating machine learning-based Intrusion Detection Systems (IDS) into their security measures. Despite the effectiveness of these systems, they remain susceptible to different forms of attacks that take advantage of their operation; specifically, those that are designed to circumvent their protective mechanisms. For example, modifications made to network traffic can produce “adversarial samples,” which are designed to go undetected. To tackle this issue, two systems based on Principal Component Analysis (PCA) have been proposed for spotting adversarial samples: Standard Principal Component Analysis (SPCA) and Outlier Filtered Principal Component Analysis (OFPCA). SPCA identifies the basic structure of normal network traffic through principal components and detects adversarial attacks by looking at reconstruction errors. A sample is projected onto the principal components and then reconstructed in the original space. The difference between the original and reconstructed features is the reconstruction error. Larger errors can indicate manipulation. OFPCA, on the other hand, is trained only on normal samples after removing outlier data points from the training set. When testing SPCA method using the NSL-KDD dataset, it achieved an AUC-ROC score of 0.97 in detecting FGSM adversarial samples. OFPCA had a higher AUC-ROC score of 0.99 in identifying FGSM adversarial samples. OFPCA performed better than SPCA and other techniques, when tested under different adversarial attacks.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1865398</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1865398</link>
        <title><![CDATA[Network-aware communication-efficient fingerprint representation for resource-constrained IoT systems]]></title>
        <pubdate>2026-06-24T00:00:00Z</pubdate>
        <category>Original Research</category>
        <author>Ibrahim Alameri</author><author>H. I. Wahhab</author><author>Tawfik Al-Hadhrami</author><author>Sultan Noman Qasem</author>
        <description><![CDATA[Biometric authentication with Internet of Things (IoT) systems is constrained by low data bandwidth, packet size, and energy capabilities. The transmission of raw biometric data exceeds the maximum transmission unit (MTU) size of traditional IoT standards (e.g., IEEE 802.15.4), resulting in large packet fragmentation and a high frame collision probability. We present a network-aware payload optimization method to minimize the application layer payload. thereby reducing airtime (channel occupation time) and improving spectrum efficiency. By using skeleton bitmaps and minutiae vectors, the size of the data is decreased by 70%–98% compared with raw images. A smaller payload reduces the protocol header overhead and ARQ for lost packets in lossy wireless environments. We introduce a distributed edge computing architecture for offloading data-intensive tasks from the core network to the network edge, thereby reducing backhaul traffic. Performance tests with a network simulator (NS-3) in Wi-Fi 6 (IEEE 802.11ax) and IEEE 802.15.4 scenarios reveal that transmission times are significantly reduced from 420–520 to 150–190 ms and energy consumption from 110–160 to 65–95 mJ by reducing the payload size from 120 to 35 kB or even further down to 2.4 kB. These results indicate that network-aware, communication-efficient biometric data representations enable scalable and energy-efficient IoT authentication. This strategy emphasizes the importance of minimizing transmitted data volume through network performance metrics in limited wireless scenarios. The results provide architectural guidelines for designing secure and low-latency biometric-based authentication systems in smart homes, healthcare monitoring, and industrial IoT applications, emphasizing network-centric optimization for resource-constrained IoT networks.]]></description>
      </item><item>
        <guid isPermaLink="true">https://www.frontiersin.org/articles/10.3389/fcomp.2026.1837023</guid>
        <link>https://www.frontiersin.org/articles/10.3389/fcomp.2026.1837023</link>
        <title><![CDATA[The human firewall effect training and awareness as drivers of phishing mitigation and reporting behavior]]></title>
        <pubdate>2026-06-19T00:00:00Z</pubdate>
        <category>Brief Research Report</category>
        <author>Omar Osman Haji Abdi</author><author>Ali Abdi Jama</author><author>Abdirahman Ibrahim Abdi</author>
        <description><![CDATA[Phishing attacks remain a major cybersecurity threat, particularly in environments where human factors play a critical role in system vulnerability. While organizations widely implement information security training and awareness programs, evidence on their effectiveness in promoting protective behavior remains inconsistent. This study examines the relationships among information security training, security awareness, phishing threat mitigation behavior, and reporting behavior within humanitarian organizations operating in Mogadishu, Somalia. A quantitative cross-sectional design was employed, and this study is presented as a Brief Research Report to provide concise and focused empirical evidence on these relationships. Data were collected from 121 employees using a structured questionnaire, and Partial Least Squares Structural Equation Modeling (PLS-SEM) was applied to analyze the proposed relationships. The results show that information security training significantly enhances security awareness and reporting behavior but does not directly influence phishing threat mitigation behavior. Security awareness emerged as the strongest predictor of both mitigation and reporting behaviors. Furthermore, mediation analysis revealed that security awareness fully mediates the relationship between training and mitigation behavior and partially mediates the relationship between training and reporting behavior. These findings highlight the importance of human-centered cybersecurity strategies, emphasizing continuous awareness-building rather than reliance on traditional training alone. The study contributes to theory by clarifying the role of awareness as a behavioral mechanism and provides practical implications for strengthening organizational resilience in fragile and resource-constrained contexts.]]></description>
      </item>
      </channel>
    </rss>