This paper proposes a network security situation analysis and forecasting system to address the limits of current technologies in uncertainty measurement, multi-source data fusion, and long-sequence dependency modeling. The system uses a Genetic Algorithm to optimize the smoothing parameter and the feature weight of the Probability Neural Network to complete the situation assessment. It also uses a self-attention mechanism to enhance the gated recurrent unit’s temporal modeling ability to complete situation prediction. Experiments were conducted on the CIC-IoMT-2024 benchmark dataset, which includes multiple attack types, including DDoS, brute-force, and command-injection attacks, with comparisons against various state-of-the-art algorithms. Experiments show that the system achieves 96.78% accuracy, 95.02% detection rate, and 3.81% false alarm rate in the assessment task. In the prediction task, the mean absolute error stays below 0.0241, the root mean square error stays below 0.0603, and the coefficient of variation stays below 0.085. Compared with various state-of-the-art models, such as the support vector machine integrated with principal component analysis, the proposed integrated system achieves significant improvements in core metrics, including assessment accuracy and prediction error. These results show that the system keeps high precision, high stability, and strong generalization ability in both assessment and prediction. It offers an effective integrated solution to the limitations of current network security situation technologies. More importantly, this work bridges the gap between high-precision real-time assessment and reliable proactive forecasting in a unified framework. The demonstrated capability for accurate early warning of evolving cyber threats provides a practical pathway to building more intelligent, autonomous active defense systems, which are crucial for safeguarding critical infrastructure in the era of IoT and 5G.

Building situational awareness systems that can collect and evaluate data from several sources in real time is crucial as cyber threats become more complex. Sensor fusion, probabilistic reasoning, graph theory, and information theory are all brought together in the innovative mathematical model known as Multi-Source Fusion-Based Cybersecurity Situational Awareness (MF-CSSA). This model is designed to give a complete framework for the visualization and awareness of real-time cybersecurity scenarios. Scalability, accuracy, reaction time, false positive rate, and situational awareness score are the five key performance indicators (KPIs) that we used in order to simulate and assess the proposed model’s architecture. Scalability is the level of scalability that the architecture has. A hundred iterations of the simulation were carried out, and the results indicate that MF-CSSA regularly outperforms the baseline techniques. By combining data and using probabilistic reasoning, the model is able to predict hostile activities in a consistent manner, as shown by the fact that it has an average accuracy of 88% when detecting threats. Having the ability to function in real time is very important, as shown by the fact that its average reaction time is 2.1 seconds. By doing so, it stops attacks from happening before they ever happen. By achieving an average score of 0.82 on the situational awareness scale, the model demonstrates that it is capable of recognizing and contextualizing cybersecurity scenarios. Another way of putting it is that it is able to swiftly adjust to new dangers. The model has a low false positive rate of just 8%, which is in addition to considerably decreasing the amount of work that analysts have to put in and alert fatigue. Last but not least, MF-CSSA is able to develop and handle a significant amount of traffic since it can process around 110 events per second. Because of this, it is a good option for huge networks that experience significant levels of information flow. It is clear from these data that the MF-CSSA architecture is a way of real-time cyber threat defense that is not only intelligent but also practical and provides accurate results.

This study investigates the forensic analysis of WhatsApp’s Msgstore.db.crypt14 file, focusing on rooted and non-rooted devices, which pose unique challenges in data extraction and decryption. This research leverages forensic tools such as WhatsApp-Key-Database Extractor, Binwalk, and Mobile Edit to demonstrate a systematic approach for retrieving and analyzing encrypted data, uncovering hidden content, and extracting valuable metadata. The findings highlight the consistency of WhatsApp’s encryption mechanisms across rooted and non-rooted devices, emphasizing the importance of using multiple forensic tools for comprehensive analysis. Key contributions include insights into WhatsApp’s metadata, encryption keys, and the implications of phone number or device changes on data security. This study advances the field of digital forensics by offering practical methodologies for analyzing encrypted mobile messaging data, providing a foundation for future research into improving forensic tools and addressing privacy and ethical considerations.

In modern web applications, token-based authentication has become a crucial mechanism for securing access to protected resources. JSON Web Tokens (JWTs), in particular, are widely adopted due to their stateless and scalable nature. However, this reliance makes tokens a prime target for attackers, with incidents of token theft and misuse via techniques such as Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), and token hijacking on the rise. Existing security solutions like IDS and application firewalls are not designed to effectively detect token-specific attack patterns, leaving a critical security gap in modern authentication systems. To address this problem, we propose a Token-based Authentication Monitoring System capable of detecting, tracking, analyzing, and investigating suspicious token behaviors in real time. Our research focuses on JWT-based access tokens and the refresh token technique in OAuth 2.0 environments. A core contribution of this work is the design of 25 specialized detection rules based on patterns. We validated the proposed system through 70 comprehensive test cases covering both normal and attack scenarios. The system achieved an overall detection accuracy of 81.4%, demonstrating its capability to effectively detect token-related attacks overlooked by conventional defenses. Additionally, we evaluated the system’s performance, measuring detection latency and operational overhead in a real-world integration scenario. The results confirmed that the monitoring system delivers real-time detection with minimal impact on application responsiveness and system resources. This research offers a practical, adaptable framework that enhances the security of any system employing token-based authentication, reducing the risk of unauthorized access while maintaining system performance.

Cyber-physical systems (CPS), such as power plants and critical infrastructure, face growing safety and security risks due to increased interconnectivity and automation. To address these challenges, we propose a framework that combines deep reinforcement learning (DRL) and Bayesian probability to model and assess vulnerabilities and attack paths. Leveraging Deep Q-Learning Networks (DQN) and cumulative probability, our method improves the identification and prioritization of effective attack paths. We also introduce the attack-fault tree (AFT) model to evaluate interactions between safety and security events. Using Uppaal SMC and statistical timed automata, we simulate dynamic scenarios and generate probabilistic estimates of metrics such as attack cost, duration, and impact. By analyzing both current and hypothetical scenarios, our approach supports informed, adaptive defense strategies for resilient CPS.

Although federated learning provides strong privacy guarantees when handling cross-device or cross-data center learning tasks, it still faces numerous challenges and potential security threats when applying it to real-world scenarios. This paper proposes a privacy attack identification and protection strategy based on vertical federation clustering, so as to improve privacy protection and data processing security in vertical federation clustering. By fusing parameters, it reduces multi-dimensional data to one-dimensional vector, thus reducing the amount of random disturbance in the subsequent random response process. Moreover, this paper proposes a method of independently setting the answer set for each parameter, which improves the probability of outputting the true value in the random response mechanism. In addition, it improves data utility and clustering precision while ensuring randomness. The comprehensive performance of the model proposed in this paper is excellent in the experiment. In particular, its privacy protection effect reaches 89.34% and 95.14% under ARP and Botnet attacks, respectively. At the same time, the identification rate and recall rate are generally high, showing good privacy protection ability and model robustness. Therefore, the model proposed in this paper improves the privacy protection degree of clustering algorithm in the face of various privacy attacks including data reconstruction attacks under federated learning architecture.

In a complex network environment, this study introduces the susceptible sick removed model to solve the optimal defense action timing. By combining FlipIt game theory, a complex network attack and defense time game model is designed. The game equilibrium is solved and an algorithm for selecting the optimal defense time strategy is proposed. The data validate that the relationship between the sizes of PA and PD is different, corresponding to different defense effects. In a small world network with PA=5 and PD=3, the k value was 32. At 60 seconds, the proportion of I1 was 0.448, 0.280 higher than S1. In a network with PA=3 and PD=4, the proportion of infected nodes fluctuated between 0.670 and 0.850 as node proportion stabilized. Adjusting the time strategy dynamically significantly increased defense benefits. Compared to PD=4, a PD=6 defense strategy resulted in a 161.36% defense revenue increase. In the current complex network environment, the application of game theory can provide a foundation for methods of optimal defense timing decision-making. In the context of a complex Internet with small-world effects and scale-free characteristics in the real world, the research method has been demonstrated to effectively enhance network defense effectiveness by dynamically adjusting the time strategy.

Recently, multimedia has developed and become very important for transferring images securely through public networks. This paper uses the COOT optimization algorithm with compressive sensing (CS) for image encryption. A good method was proposed for encryption using compressive sensing with COOT optimization and chaos to encrypt images and obtain optimal encryption with the least correlation between pixels. This method will strengthen the encryption against various types of attacks. The natural image was sparsed using discreet wavelet transform (DWT) and the FAN transform. The image is divided into several blocks, and CS is applied to each block. The best measurement matrix was obtained using a COOT-optimized algorithm. All blocks are masked to get the compressed image, and the pixels are quantified. Next, the COOT optimization is used to Shuffle the image pixels to achieve the minimum correlation between the pixels. Then, a logistic map will be used to uniform the image pixel values by diffusion to get the final encrypted image. Chen’s chaotic and logistic map initial values are obtained from the input image after its division into four parts by taking a value from each part. The evaluation results obtained for this algorithm showed that it performs highly compared to other conventional methods. The average PSNR for the reconstructed images was 35.244, the average NPCR and UACI were 90.53 and 29.54, respectively, and the average correlation was (D = 0.0018, V = 0.0031, H = 0.0039). The results proved that the method is strong enough and very efficient to withstand attacks.

Facing the challenge of information storage security brought by the rapid development of distribution network technology, this paper analyzes the essential requirements and current security problems of distribution network information storage and designs. It implements a set of security management schemes based on the RBAC model. User authentication and authorization processes are emphasized to ensure only authorized users can access critical information resources. The application in the actual distribution network environment shows that the scheme can improve the security performance of the system, reduce unauthorized access attempts by up to 40%, and improve data processing efficiency by about 30%. The scheme also reduces the complexity of system maintenance, and the number of security events that administrators need to deal with is reduced by about 50% compared to traditional security mechanisms. These data fully prove that the security management mechanism based on RBAC is efficacious in improving the distribution network’s information storage security and operational efficiency. This article proposes and studies an optimization scheme for information security management mechanisms based on RBAC in distribution network information storage technology. This scheme effectively improves the security and reliability of the distribution network information storage system through refined permission management and access control. This study provides innovative strategies, empirical data for distribution network information storage security management, and valuable references for future research on power grid information security.

Specific Emitter Identification (SEI) is advantageous for its ability to passively identify emitters by exploiting distinct, unique, and organic features unintentionally imparted upon every signal during formation and transmission. These features are attributed to the slight variations and imperfections in the Radio Frequency (RF) front end; thus, SEI is being proposed as a physical layer security technique. Most SEI work assumes the targeted emitter is a passive source with immutable and difficult-to-mimic signal features. However, Software-Defined Radio (SDR) proliferation and Deep Learning (DL) advancements require a reassessment of these assumptions because DL can learn SEI features directly from an emitter’s signals, and SDR enables signal manipulation. This paper investigates a strong adversary that uses SDR and DL to mimic an authorized emitter’s signal features to circumvent SEI-based identity verification. The investigation considers three SEI mimicry approaches, two different SDR platforms, the application of matched filtering before SEI feature extraction, and selecting the most informative portions of the signals’ time-frequency representation using entropy. The results show that “off-the-shelf” DL achieves effective SEI mimicry. Additionally, SDR constraints impact SEI mimicry effectiveness and suggest an adversary’s minimum requirements. Our results show matched filtering results in the identity of all authorized emitters being correctly verified at a rate of 90% or higher, the rejection of all other authorized emitters–whose IDs are not being verified–at a rate of 97% or higher, and rejection of forty-five out of forty-eight SEI mimicry attacks. Based on the results presented herein, future SEI research must consider adversaries capable of mimicking another emitter’s SEI features or manipulating their own.