International Workshop on Advances on Security and Privacy Technologies and Solutions

1. workshop LDPKiT: Superimposing Remote Queries for Privacy-Preserving Distillation

   Kexin Li, Aastha Mehta and David Lie

   To protect privacy in regulated domains such as healthcare and finance, model owners may allow only remote API access while keeping both the training data and model parameters private. However, model users performing inference on such remotely hosted models may be required to transmit potentially sensitive inputs, raising privacy concerns. In this work, we present LDPKiT, a framework for non-adversarial, privacy-preserving model distillation that leverages a user's private in-distribution data while bounding privacy leakage. LDPKiT introduces a novel superimposition technique that generates approximately in-distribution samples, enabling effective knowledge transfer under local differential privacy (LDP). Experiments on Fashion-MNIST, SVHN, and PathMNIST demonstrate that LDPKiT consistently improves utility while maintaining privacy, with benefits that become more pronounced at stronger noise levels. For example, on SVHN, LDPKiT achieves nearly the same inference accuracy at ε=1.25 as at ε=2.0, yielding stronger privacy guarantees with less than a 2% accuracy reduction. We further conduct sensitivity analyses to examine the effect of dataset size on performance and provide a systematic analysis of latent space representations, offering intuitive and empirical insights into the accuracy gains of LDPKiT.

2. workshop Improving the Utility, Privacy, and Human Acceptance of Differentially Private Rewritten Texts

   Stephen Meisenbacher, Endrit Jashari, Alexandra Klymenko and Florian Matthes

   Although differentially private text rewriting has gained traction as a theoretically viable, yet straightforward way of enacting local Differential Privacy (DP) in the privatization of sensitive texts, it has struggled with usability and practicality. In particular, the ability to produce coherent, yet privacy-preserving rewritten outputs, while also maintaining positive privacy-utility trade-offs, remains elusive. Leveraging the post-processing property of DP, we propose a simple method for LLM-based post-processing of DP rewritten texts, grounded in the use of structured text features to guide a realignment of DP texts. Our evaluations show significant improvements in text quality and coherence, while also demonstrating strong privacy preservation and positive trade-offs. A survey with 252 human participants showcases the higher human acceptance of post-processed texts, as opposed to nearly non-existent acceptance of pure DP outputs. Our work highlights the strong need for increased usability in DP-based text privatization, for which we show that post-processing is a potential solution.

3. workshop Privacy by Design in AI-Assisted Cybersecurity Policy Generation: Benchmarking Private RAG Against Frontier AI Models

   Davide Carboni and Marcello Verona

   The NIS2 Directive and GDPR impose on regulated EU organisations a growing policy compliance gap: the obligation to produce context-specific cybersecurity policy artefacts has outpaced internal capacity to create them. Large language models offer scalable assistance, but effective policy generation requires routing sensitive organisational data through an inference pipeline. Under GDPR Arts. 28, 32, and 44–49, this creates a structural tension: the data required to generate a useful policy is precisely the data that cannot be processed without adequate legal safeguards. We present a controlled empirical benchmark comparing six AI configurations spanning the design space from unaugmented frontier chat to privacy-by-design private RAG. Sixty policy artefacts were generated across two regulated contexts — a fictitious Italian public hospital and a fictitious NATO detachment, constructed as representative synthetic profiles with no connection to real entities — and five policy types, then evaluated by an LLM-as-judge pipeline using a seven-criterion rubric derived from the Anthropic agent evaluation framework and extended with three cybersecurity compliance dimensions. The best frontier configuration (gpt-5.5+web search) achieves a mean score of 4.60/5; the private RAG configuration (KimiK2.5 on EU-resident infrastructure under a DPA) scores 4.15/5 — a 9% gap. The OpenAI Assistants RAG configuration falls below the no-RAG baseline (3.70 vs. 3.83), suggesting that cloud-hosted RAG does not automatically improve output quality. A backbone ablation isolates normative citation discipline as the decisive differentiator. Under the EC Cloud Sovereignty Framework, the private RAG architecture classifies at SEAL-2; frontier configurations qualify at SEAL-0. The 9% quality gap is identified as the operational cost of regulatory-grade data sovereignty.

4. workshop A Benchmark for Multi-Dimensional Evaluation of Location Privacy Protection Mechanisms

   Toon Dehaene, Michiel Willocx, Bert Lagaisse and Vincent Naessens

   A multitude of Location Privacy Protection Mechanisms (LPPMs) are presented in recent years. They aim to balance two competing objectives, namely preserving utility for downstream analytics while limiting sensitive information that can be inferred from traces. A fair comparison of existing work is currently hard as different studies rely on heterogeneous datasets, attacker models, privacy notions, and utility tasks for assessing their effectiveness. This paper presents a benchmarking framework for evaluating and comparing LPPMs with respect to utility and privacy. Our framework is equipped with a repository of representative concrete components, including LPPMs used in real deployments, attacks from prior work and realistic crowd-sensing utility tasks. Multi-dimensional evaluation across diverse real-world mobility datasets reveals a nuanced privacy-utility picture that remains hidden under single-metric analyses. Our results demonstrate the added value of multi-view benchmarking and showcase the framework as an extensible foundation for future research on location privacy. 

The Sixth International Workshop on Security Testing and Monitoring

1. Welcome
2. workshop Automating Security-by-Design in Microservices via Model-Driven DevSecOps

   Ciro Gallucci, Felice Moretta, Massimiliano Rak and Umberto Villano

   Microservices architectures are rapidly becoming the standard for distributed application development but introduce new security challenges. Traditional Secure Development Lifecycle methods often fail to address adequately the pace and complexity of these environments. This work presents an automated, model-driven methodology for the secure design of microservices-based applications, leveraging the MetaSEnD metamodel and a DevSecOps approach. Starting from declarative specifications (e.g., Docker compose files), the system generates a Multi-purpose Application Composition Model (MACM) representing the structure and interactions of the application. Automated graph-based pattern matching identifies architectural vulnerabilities and produces a threat model, enabling the creation of customized DevSecOps pipelines with security tools integrated into the CI/CD cycle. The methodology was validated on a real use case, demonstrating the possibility to automate risk identification and the integration of security testing, reducing significantly time-to-release without sacrificing robustness.

3. workshop Enhancing Patient Data Security in Healthcare through Cybersecurity Tools: A NERO-Based Use Case

   Kitty Kioskli, Eleni Seralidou, Huu-Nghia Nguyen, Angeliki Zarifi, Alex Bensenousi and Athanasios Vidakis

   Healthcare organisations are increasingly targeted by sophisticated cyberattacks due to their growing reliance on interconnected digital systems and the high value of sensitive patient data. This paper presents a comprehensive cybersecurity framework for protecting healthcare information systems through the NERO ecosystem, a centralised marketplace integrating technical security tools and human-centric awareness solutions. Using a real-world healthcare validation scenario based on AINIGMA's AWS-hosted Arkon.Health Data Harmonisation Pipeline, the study demonstrates how advanced cybersecurity mechanisms can secure Electronic Health Records (EHRs), Laboratory Information Management Systems (LIMS), and Electronic Case Report Forms (eC-RFs) against evolving cyber threats. The proposed approach combines automated static and dynamic security analysis, cloud configuration assessment, runtime intrusion detection, and phishing-awareness training.

4. workshop Evaluating a Combined ISTG/BSI Penetration Testing Methodology

   Valentino Schwarz, Roland Schmitz and Joachim Charzinski

   This paper evaluates a combined methodological approach for structured IoT security assessment, integrating the OWASP IoT Security Testing Guide (ISTG), which defines what to test across hardware, firmware, network services, and communication interfaces, with the five-phase penetration testing model of the German Federal Office for Information Security (BSI), which defines how to proceed. The combination is evaluated through a real-device case study of a commercially available low-cost smart home camera. The assessment produced a verified end-to-end attack chain from physical access to full system compromise and recovery of private video data, demonstrating that the combined methodology can drive a non-trivial real-device assessment to completion. More importantly, the case study exposed integration gaps the combination does not resolve.

2nd International Workshop on Secure, Trustworthy, and Robust AI

1. workshop A Multi-Stakeholder Framework for Traceable and Auditable High-Risk AI Systems under the EU AI Act

   Ignacio Miguel Rodríguez, Jordi Castellà Roca and Alexandre Viejo

   Generative AI has rapidly reshaped products and services across multiple sectors, introducing significant risks including embedded bias, unlawful processing of personal data, and potential erosion of fundamental rights. In response, the European Union has established a complex regulatory ecosystem comprising the AIA, the DA, the DGA, and the GDPR, whose combined operationalization presents considerable challenges for stakeholders such as providers, deployers, auditors, and end-users. This paper proposes a multi-stakeholder framework that provides the structure, tooling, and secure information registration mechanisms to facilitate regulatory adherence and auditability for high-risk AI systems under the EU AI Act. The framework coordinates multiple actors through structured roles and responsibilities, automatically recording all relevant actions and decisions in a tamper-evident and verifiable manner, so that all necessary evidence is readily available in case a compliance assessment or audit is required. This is supported through smart-contract-based mechanisms for model registration, licensing, expert oversight, and decision-level traceability. Each AI prediction generates a Decision Output Object enriched with explainability metrics and optional expert validation, reinforcing transparency and human-in-the-loop supervision. Sensitive components are protected via a digital-envelope encryption scheme enabling fine-grained, role-based access control, while long-term integrity is ensured by anchoring critical artifacts on the blockchain and distributing metadata through IPFS.

2. workshop A Security-Oriented Lifecycle Model for Large Language Model Systems

   Eleftherios Batzolis, George Drosatos, Vassilis Katsouros and Konstantinos Rantos

   Large language models are being integrated into critical infrastructure and enterprise workflows at unprecedented scale, yet the lifecycle frameworks governing their development and operations were designed for operational efficiency rather than security analysis. As a result, security-relevant activities such as data provenance verification, artifact signing, agentic permission control, and decommissioning are often left implicit or assumed to receive due care. Governance frameworks, in turn, organise requirements around risk levels or management processes without clearly linking them to the lifecycle stages where they apply. This paper addresses both deficiencies. We propose a lifecycle model for LLM systems that supports security analysis by structuring it around security-relevant boundaries rather than workflow optimisation. The model comprises 32 stages across four core pipeline layers (Data, Model, Distribution, Application), supported by a 12-stage LLMOps pillar and a 9-category governance pillar. Thirteen stages are introduced here as separate units because they expose distinct security concerns that existing frameworks do not clearly distinguish. A governance mapping synthesizing the NIST AI RMF, the EU AI Act, and ISO/IEC 42001 reveals a structural property of the current regulatory landscape: governance evidence concentrates at deployment-facing stages, where systems are visible to regulators, while the most consequential decisions, data selection, alignment strategy, and capability boundaries, are made at development-facing stages, where regulatory visibility is lowest. 

International Workshop on Advances on Security and Privacy Technologies and Solutions

1. workshop Cryptokinetics

   Hadrien Barral, David Naccache and Aleksa Veličković

   Cryptographic operations are momentary. Typically, the verification of a digital signature validates the signer's intervention at a specific moment in the past whereas a successful Σ-protocol round validates a prover's present existence. While cryptography handles very well the notions of 'before' and 'after' (typically in the blockchain), it remains blind to physical time. In many practical situations it is important to assess the probability that the legitimate user is still present as time elapses. The situation is even more complex when the system needs to provide an assessment based on both cryptographic and non-cryptographic (e.g. biometric) inputs. This paper draws an analogy between Continuous User Authentication (CUA) and pharmacokinetics, a branch of pharmacology that studies how drugs interact with the body over time using differential equations. We introduce mathematical models blending data from heterogeneous security inputs (that we call 'sensors') to estimate the overall level of trust at any time. The models take into account the presence of the legitimate user, attackers and the absence of incoming information.

2. workshop Defence framework for the holistic protection of AI applications

   Salvador Cuñat, Evangelos Floros, Evangelos Loutsetis, Alessandro Finocchi, Giuseppe Marseglia, Aikaterini Psychogyiou, Stamatios Kostopoulos, Vassilis Prevelakis, Evangelos K. Markakis, Rafael Vaño and Ignacio Lacalle

   The work reflects on the importance of security layers in the context of AI applications and operations. The paper explores the cybersecurity challenges in designing a defence framework for protecting AI systems against malicious actions and adversarial AI attacks, understanding the figures and mechanisms that govern the process. The authors link those reflections to the direct transfer into a research project, cPAID, that faces such challenges head on as a leading Horizon Europe project. By integrating cutting-edge AI-assisted technologies in Intrusion Detection Systems, using novel unsupervised and XAI methods in conjunction with traditional SIEMs and AI-assisted penetration testing for AI, cPAID provides an adaptive security framework that thoroughly assesses the robustness and resiliency of Machine and Deep Learning algorithms against attacks.

Programme to be announced.

Workshop on Education, Training and Awareness in Cybersecurity

Session chair: Lisa Moravek (Brno University of Technology)

1. Workshop Opening

   Jan Hajny (Brno University of Technology)

2. keynote Invited talk: TBA

   Raimundas Matulevicius (University of Tartu)

   TBA

3. workshop Data-driven Cybersecurity Job Market Analysis

   Paulina de Los Angeles Espejo Bacadare and Imre Lendák

   Cybersecurity professionals are in great demand in the job market both in the European Union (EU) and in the World. Unfortunately, there is a widely recognized skills gap between the available training options, existing workforce and the roles available in the field. The goal of this research is to better understand Europe’s cybersecurity job market by exploring relationships and possible discrepancies between market demand and standardised competency definitions, mainly the European Cybersecurity Skills Framework (ECSF) published by the ENISA in 2022. Our analysis started with extensive data collection, during which approximately 250,000 cybersecurity job postings were collected from LinkedIn. Our approach analyses semantic similarity between job-market skills and ECSF job position descriptions, relying on Sentence-BERT embeddings to capture conceptual relationships beyond lexical matching. This enabled a systematic mapping between real-world skill demand and framework-defined competencies, allowing the degree of alignment to be quantitatively and qualitatively assessed. In addition, the study includes a skills demand analysis, based on the frequency distribution of cybersecurity job-market skills. Our results indicate that the alignment between job-market skills needs and ECSF descriptions is limited. Confident alignment is observed at the technical side of demanded skills, where core cybersecurity concepts are well-defined and standardized; however, most of the transversal non-technical skills are not covered in the ECSF, and these are in high demand on the job market. The presented data acquisition and analysis approach is reproducible and scalable, and allows researchers and professionals to study the cybersecurity labour market in the EU and provides insights which may help in the alignment of higher education curricula, policy frameworks, and industry demands.

4. workshop Systematic Design of Competency-based HPC and AI Education for Transport Systems

   Carmel Somers and Horacio González-Vélez

   High Performance Computing (HPC) and Artificial Intelligence (AI) are increasingly used in transport systems through digitalisation, automation, and data-intensive decision-making. However, postgraduate education in these domains remains predominantly anchored in traditional Computer Science (CS) curricula, resulting in misalignment between educational provision and the applied competencies required across transport-sector roles. This paper presents a structured evidence-based desk research methodology developed within the AnonProj project. AnonProj is an EU co-funded initiative focused on the transport and mobility sector under the Digital Europe Programme. The project addresses workforce capacity gaps arising from the increasing integration of HPC and AI across transport systems, with the larger objective of supporting Europe’s strategic goals under the Digital Decade Path by 2030. Our methodology systematically integrates Large Language Model (LLM) assisted evidence extraction, cross-model prompt validation, an Excel-based coding framework, and multi-stage human validation. Rather than forecasting future demand for HPC and AI skills, the approach anchors curriculum design in documented role change in a heterogeneous European transport ecosystem. The paper situates the AnonProj methodology within existing literature on skills ecosystems, just transition, and competency-based education; evaluates its methodological robustness; and discusses implications for non-CS HPC and AI education and future research.

9th International Workshop on Emerging Network Security

1. keynote TBA

   TBA

   TBA

2. workshop Comparing Global vs. Local Large Language Models in Task of Understanding Disinformation: A Real Case Study of the Eastern Border Migration Crisis

   Gracjan Kątek, Rafał Kozik, Marta Gackowska-Kątek, Marek Pawlicki and Michał Choraś

   Weakly supervised and few-shot Large Language Models (LLMs) show great promise in handling complex text analysis without the need for extensive retraining or finetuning. In this paper, we assess practical capabilities of LLMs in disinformation analysis during the eastern border migration crisis. In particular, we evaluated and compared four specific models: Llama 3.1, Qra, Bielik, and PLLuM. Each model was tasked with labeling news articles based on credibility, disinformation types, and the-matic categories. By using Cohen’s Kappa coefficient, we measured how much these models actually agree with each other. Our results show a major sensitivity gap. Particularly, while global models like Llama often view reports as neutral, the Polish-centric models flagged significantly more content as propaganda. In this paper, we investigate the origins of this phenomenon and provide details of the conducted experiments.

The Sixth International Workshop on Security Testing and Monitoring

1. workshop Autonomous AI-Driven Pentesting Agent for Healthcare Systems Security

   Manh-Dung Nguyen, Manuel Méndez Hurtado, Miguel Benito Parejo, Ana Rosa Cavalli and Edgardo Montes de Oca

   DICOM and PACS infrastructures are essential components of modern healthcare systems but remain exposed to protocol-level security and robustness issues. Traditional fuzzing approaches are often not well suited for testing complex and stateful medical communication protocols. In this paper, we present an extension of a smart network protocol fuzzer, for intelligent security assessment of DICOM-based systems. Our approach combines rule-based replay, GAN-based traffic generation, LLM-assisted rule synthesis, and a reinforcement learning-guided fuzzing engine that adapts mutation strategies according to runtime feedback from the target system. We also develop an autonomous pentesting agent that integrates reconnaissance, analysis, fuzzing, and reporting capabilities to support scalable security assessments of healthcare infrastructures.

2. workshop Security Auditing for RISC-V SoCs via Process Mining

   Salvatore Bramante, Matteo Busi, Alessandro Cilardo, Riccardo Focardi, Flaminia Luccio, Nicola Mazzocca and Francesco Vitale

   The rapid adoption of open-hardware RISC-V System-on-Chip (SoC) designs in security-sensitive embedded and edge scenarios is raising the bar on observability and assurance requirements for such platforms. In fact, unforeseen runtime misbehaviors due to incompatible third-party IPs, hardware trojans in peripherals, and compromised drivers can cause misbehaviors that core-level monitors, such as RISC-V Formal Interface (RVFI), cannot see. We introduce the Peripheral Formal Interface (PFI), a passive AXI-aware observation interface that extends the RVFI philosophy from the core to the peripherals. The PFI emits a structured event stream that off-chip auditors can consume without touching the functional path. On top of it, we define an auditing architecture that merges the peripheral-bus stream and the RVFI retirement stream into a single event log, and a process mining pipeline that turns this log into a Contract.

3. workshop A Knowledge-Grounded LLM Agent for Critical Infrastructure Cybersecurity: Toward a Smart Digital Twin

   Quoc-Viet Pham, Fatiha Zaidi and Ana Rosa Cavalli

   Operators of critical infrastructure increasingly rely on heterogeneous catalogs of cybersecurity services (probes, intrusion detection systems, monitoring tools), yet selecting and reasoning about these services remains a manual, expert-driven task. Digital Twins (DTs) have emerged as virtual replicas of physical systems for monitoring and simulation, and platforms have been built to manage the catalogs of cybersecurity services that can be deployed into such twins; however, these platforms typically remain passive. To address this, we propose a smart digital twin augmented with cooperating LLM-based agents that perform knowledge-grounded reasoning, automated deployment, and incident response. As a first step, we present a Boss Agent embedded in an existing DT management platform. This conversational assistant uses Retrieval-Augmented Generation (RAG) to ground responses in the platform's service catalog.

4. workshop AMTD-EC: An Adaptive Moving Target Defense framework for Edge-Cloud Systems

   Daniele Iorio and Alessandra De Benedictis

   Distributed Edge-Cloud systems offer scalable, flexible, and modular infrastructure but introduce significant security challenges due to heterogeneity, decentralized data processing, expanded attack surfaces, and the difficulty of enforcing consistent protections across dynamic and resource-constrained environments. Traditional security mechanisms are not well suited to cope with these systems as they assume stable infrastructures and predictable threat models. On the other hand, Moving Target Defense (MTD) offers a proactive approach by continuously reconfiguring system parameters, reducing the attack surface and increasing uncertainty and complexity for adversaries. In this paper we present AMTD-EC, a novel adaptive MTD framework tailored to distributed infrastructures built upon container-based technologies. The framework leverages specific monitoring rules to enable automated detection of attacks, and includes automated selection and enforcement of adaptive response to ongoing attacks by the activation of suitable MTD mechanisms from a pool.

International Workshop on Security and Privacy in Intelligent Infrastructures

1. Welcome
2. workshop Assessing Charging Station Cybersecurity: A Market-Analysis-Driven Methodology Applied to Germany

   Jakob Löw, Lukas Eder, Alexander Müller and Hans-Joachim Hof

   Modern charging communication standards for electric vehicles include optional security controls such as TLS-based authentication and encryption. However, with tens of thousands of fast charging points deployed in any given country, individually testing each one for security control support is infeasible. This paper proposes a scalable, extrapolation-based methodology for assessing charging station cybersecurity at a national level. A market analysis identifies operator-manufacturer pairs, enabling the targeted selection of charging stations for field testing, whose results can then be extrapolated to all stations sharing the same combination. We demonstrate this methodology for Germany, covering over 40000 CCS charging points as of December 2025. With a manageable number of field tests, our extrapolated data examines 51.9% of german CCS charging stations. It shows that only 27.4% of charging stations in our scope provide TLS-protected communication, despite widespread theoretical support.

3. workshop Threat Modeling for Digital Twin-Driven Agri-Food Supply Chain

   Sabah Suhail, Mubashar Iqbal, George O’ Mahony and Kieran Mclaughlin

   Digital twins (DT) are increasingly deployed across agri-food supply chains to support monitoring, optimization, and decision-making. The bidirectional interactions between DTs and their cyber-physical system (CPS) create complex security risks that span both the digital and physical domains. Compromised physical assets can serve as a springboard for attacks on the DT, while tampering with data, resources, or services in the DT can, in turn, propagate to the CPS, disrupting its operations and decision-making. Consequently, security analysis must consider all three dimensions, including CPS, DT, and their bidirectional interactions. In DT-driven agri-food supply chains, such analyses remain underexplored. To address this gap, we propose a six-step STRIDE-based threat modeling that encompasses the DTs and their bidirectional interactions, following a CPS-first approach to DT construction. Using a strawberry greenhouse, which represents the pre-harvest phase of the strawberry supply chain, as a use case, we identify threats and assess their impact on greenhouse operations. We also examine security risks across DT lifecycle phases, design-and-engineering, operation-and-maintenance, and end-of-life, adopting a DT-first perspective to highlight how lifecycle decisions influence system exposure and operational risk.

International Workshop on Advances on Security and Privacy Technologies and Solutions

1. workshop Evaluation of Confidentiality-Protecting Technologies for Industrial Data Collaboration

   Andy Izaber-Ludwig, Miriam Fehn and Alexander Giehl

   Machine learning applications, such as predictive maintenance and tool condition monitoring, can enhance the productivity of manufacturing companies. The performance of these models depends on the quantity and quality of training data. Small and medium-sized companies often fail to meet these requirements, therefore, industrial data collaboration can offer a solution. By sharing data, companies can jointly benefit from improved models to optimize their processes. However, concerns about intellectual property contained in training data and the potential loss of competitive advantage often hinder data sharing. This study presents a single-source case study on confidentiality-protecting technologies (CPTs) in a real-world milling scenario. While motivated by cross-company industrial data collaboration, our empirical findings are derived from one production environment and provide a first step towards understanding confidentiality–utility trade-offs in such settings. Thirteen techniques derived from privacy-enhancing technologies were applied to original manufacturing data and evaluated for their impact on a tool condition monitoring model. These techniques fall into the categories of noise masking, information reduction, affine transformation, and time-series permutation. We quantified and compared the influence on tool condition monitoring model performance across different techniques and their parameter settings. Employing diverse intellectual property protection strategies may increase companies' willingness to engage in industrial data collaborations. Finally, individual protection methods allow for the incorporation of expert assessments.

2. workshop Federated Learning for Electric Vehicle Energy Demand Prediction Across Distributed Users

   Vasilis Perifanis, Foteini Nikolaidou, Panagiotis Thomakos, Nikolaos Pavlidis, Andreas Sendros, Ignacio Lacalle, Felix Mondl and Michael Glensvig

   Accurate prediction of daily electric vehicle (EV) energy demand supports charging planning across home users, commercial fleets, depots, and charging service providers. We study this problem as a supervised regression task under centralized and Federated Learning (FL) settings, using heterogeneous EV data sources that include two public datasets and a private commercial dataset from a postal service. Raw EV records are transformed into vehicle-day samples through a unified preprocessing pipeline based on a common schema of vehicle identifier, date, time, state of charge (SOC), and odometer readings. Daily travelled distance and energy demand are derived from these records, and the prediction target is estimated from discharge segments between charging events. The input features also combine calendar, historical demand, and weather descriptors. We evaluate local, centralized, cross-device, and cross-silo FL across three deep learning architectures, and implement a buffered asynchronous FL orchestration pipeline on a Raspberry Pi testbed to assess practical deployment. The results show that distributed EV energy demand models can approach centralized performance while preserving data locality, and that buffered asynchronous FL is practical for heterogeneous EV deployments.

3. workshop Three-Layer Hierarchical Runtime Verification for Edge-IoT Security Monitoring

   Anastasios Temperekidis, Stylianos Basagiannis, Marinelio Chintri, Panagiotis Katsaros, Nikolaos Kekatos, Alexios Lekidis, Tom Nianios and Ioannis Seitoglou

   Edge-IoT deployments host security-relevant decisions on low-power devices but face an asymmetric attacker–defender cost balance: centralised cloud monitoring is expressive but bandwidth-prohibitive; pure edge-local monitoring is cheap but structurally blind to attacks that coordinate across devices. We present a three-layer hierarchical runtime-verification framework for edge-IoT security monitoring, instantiated in Python at the edge (L1 canonicaliser) and at the gateway (L2 temporal aggregator) and in MonPoly metric first-order temporal logic at the cloud correlator (L3). L1 performs per-event classification (buffer overflow, time spoofing, fuzzing, safe transactions); L2 evaluates 5 s temporal patterns (stealth overflow, spam DoS, immediate fuzz/time alerts); L3 evaluates four MFOTL correlation properties over multi-device alert streams (multi-vector APT, coordinated attack, escalation pattern, persistent low-and-slow campaign). We evaluate the framework on a 15-actor Docker testbed covering eight attack profiles including stealth overflow, pulsing DoS, and mixed APT. Over a 120 s run the composed L1+L2+L3 monitor processes 1462 raw events, emits 1421 L2 alerts and 15 L3 incidents across the four MFOTL properties, with 100% detection on the escalation pattern property (P3.3) and 0.2 s mean alert-to-incident latency. Each incident is accompanied by a witness set naming the layer, device, and predicate that fired, yielding an auditable record-of-decision aligned with cyber-resiliency engineering frameworks (MITRE CREF, NIST SP 800-160 Vol. 2)

Programme to be announced.

Workshop on Education, Training and Awareness in Cybersecurity

Session chair: Lisa Moravek (Brno University of Technology)

1. workshop A Structured Method for Designing Capture-the-Flag Challenges in Higher Education

   Holger Schmidt, Sven Jörges and Anthony Brunner

   Capture-the-Flag (CTF) challenges are widely used in computer science education to support hands-on learning, problem-solving, and student engagement. However, the design of educational CTF challenges is often experience-driven and lacks systematic methodological support, particularly in higher education contexts with heterogeneous student cohorts and varying prerequisite knowledge. This paper proposes a structured method for designing CTF challenges in higher education. The approach supports the alignment of challenges with prerequisite knowledge from different computer science domains and introduces a systematic approach for calibrating and controlling challenge difficulty in heterogeneous student cohorts. In addition, a reusable concept template is provided to support the documentation and implementation of CTF challenge designs. The proposed method aims to facilitate curriculum-aligned and pedagogically grounded challenge-based learning (CBL) experiences.

2. CHESS Project Networking and Discussion
3. closing Workshop Closing

9th International Workshop on Emerging Network Security

1. workshop Evaluation of Machine Learning Approaches for Intrusion Detection in UAV Networks

   Sebastian Szelest, Marek Pawlicki, Rafał Kozik and Michał Choraś

   Unmanned aerial vehicles are more and more often being deployed in both civilian and military contexts. One of the pressing issues of the technology is their resilience to network intrusions. This paper addresses issues related to the growing problem of cyberattacks on unmanned aerial vehicles (UAV). This paper presents an empirical evaluation of a novel benchmark dataset, UAVIDS-2025, and its suitability for training machine learning-based network intrusion detection systems. The authors used this dataset to train three different artificial intelligence models: Random Forest, XGBoost, and Deep Neural Network, trained with minimal processing and default hyperparameters. All three models achieve strong classification performance without any additional feature engineering. The findings confirm initial machine learning viability for detection of cyberattacks targeting UAV.

2. workshop Experimental Analysis of Authentication-Based Privacy Leakage in 5G SA

   Hamza Ahmed Farah, Azza H. Ahmed and Thomas Dreibholz

   The fifth generation (5G) of wireless communication offers gigabit-per-second speeds, ultra-low latency, and massive device connectivity. However, the introduction of network function virtualization (NFV), software-defined networking (SDN), network slicing, and mobile edge computing (MEC) has also created a complex security frontier. Addressing these challenges requires continuous and realistic validation of defenses in controlled experimentation environments. In this paper, we present an open-source, low-cost, fully software-based 5G testbed designed as a cyber range platform for security research and education. Built upon the OpenAirInterface (OAI) framework and commercial off-the-shelf hardware, the testbed supports an end-to-end 5G Stand-Alone (SA) deployment with gNodeB, core network, and user equipment (UE). It enables reproducible experimentation that may demonstrate a broad range of security scenarios, including privacy and tracking-based vulnerabilities like capturing user identifiers, as well as availability attacks such as Denial of Service (DoS) attacks targeting core network functions. The paper outlines our reproducible implementation and shares our experiences in building and operating the platform as a cyber range.

3. workshop Disrupting LoRaWAN IoT Deployments: Analysis of Join DoS Attacks in Practical Scenarios

   Enrico Cambiaso, Taregh Khanjari, Amirhossein Noshadi, Matteo Repetto and Luca Caviglione

   The massive deployment of resource-constrained IoT ecosystems has been made possible owing to efficient transmission technologies. To this aim, the LoRaWAN standard is gaining momentum, especially since it supports long-range transmission capabilities with a reduced energy consumption. Despite its security model is becoming well understood, issues of the process used by nodes to join the network have been only partially assessed, especially in real-world scenarios. Therefore, this paper investigates practical aspects of the Join DoS attack, i.e., a novel threat that can prevent nodes to join a LoRaWAN network. To assess its impact, we conducted tests in both simulated and real network conditions. Results demonstrated the effectiveness of the attack and allowed us to elaborate some prime mitigation techniques, especially in the view of supporting the deployment of LoRaWAN in softwarized environments.

4. workshop Unified Incident Monitoring and Response in Softwarized Networks with OpenC2

   Hani Zeid, Daniele Canavese and Matteo Repetto

   Security operations in software-defined and virtualized networks often require coordinating heterogeneous tools for monitoring, evidence collection, and response. However, these tools expose different configuration models, APIs, and execution semantics, which complicates automation and incident response workflows. This paper presents an OpenC2-based orchestration layer that extends command-level cyber-defense coordination beyond classical enforcement actions. We introduce three actuator profiles for network-flow monitoring, file/log collection, and constrained remote command execution, and implement them using nProbe, Packetbeat, Filebeat, and Linux-based actuators. The resulting prototype provides a uniform command interface for activating monitoring functions, collecting operational evidence, and executing controlled response actions. We validate the approach through schema-conformance tests, positive and negative command cases, safety checks, and latency measurements in representative orchestration workflows.

The Sixth International Workshop on Security Testing and Monitoring

1. workshop DREAMER: Domain-oriented Realistic Emulation for Attack Monitoring and Evaluation Research

   Vincenzo Carletti, Pasquale Foggia, Speranza Ranieri and Mario Vento

   The growing complexity of modern IT infrastructures, combined with the proliferation of stealthy and persistent attack techniques, has made the validation of security monitoring systems a major challenge for both industry and academia. Evaluating such systems requires experimental environments that combine realism, controllability, observability, and reproducibility. However, production networks cannot safely support repeatable adversarial experimentation, and existing evaluation approaches often provide limited support for distributed attack scenarios and benchmarking. Motivated by this limitation, this paper introduces DREAMER, a domain-oriented network emulation and virtualization environment designed to support advanced security testing, monitoring, and reproducible evaluation. The proposed network integrates multiple hosts and security components, enabling the creation of a high-fidelity experimental testbed.

2. workshop Memory Sanitization for Bare-Metal Firmware Fuzzing via Static Analysis and Memory Access Observation

   Luca Jungnickel, Karsten Isakovic, Ramon Barakat and Martin Schneider

   Memory sanitization is a key technique for detecting memory corruption bugs during fuzzing. While tools such as AddressSanitizer are widely used in OS-hosted environments, they cannot be applied to bare-metal firmware due to the absence of operating system abstractions. We propose a sanitization architecture for bare-metal firmware fuzzing that combines static analysis of the firmware binary with runtime memory access observation inside an emulator. Built on top of the Hoedur firmware fuzzer, our approach tracks accesses to global, stack, and heap memory regions without requiring source-code instrumentation. Evaluation on 22 real-world firmware targets demonstrates that the architecture correctly reconstructs program flow and intercepts memory accesses that remain invisible to conventional crash-and hang-based fuzzing.

3. closing Workshop Closing

International Workshop on Security and Privacy in Intelligent Infrastructures

1. workshop On the Structural Dependencies of Post-Quantum Cryptographic Standards

   Sara Ricci, Petr Dzurenda, Lucia Hirnerová and Petr Muzikant

   Post-Quantum Cryptography (PQC) standardization efforts have led to the selection of multiple algorithms across different international organizations. While these schemes appear diverse at the algorithmic level, their security ultimately relies on a limited set of underlying hardness assumptions. In this work, we propose a graph-based representation of PQC standards that explicitly links standardized algorithms to their computational problems and captures structural relationships between these assumptions. Using network analysis techniques, we study the organization of the resulting dependency graph. Modularity analysis reveals a strongly structured ecosystem, with a densely connected algebraic core and distinct peripheral components corresponding to alternative paradigms such as hash-based and MPC-in-the-head constructions. Betweenness centrality further identifies a small number of core problems, in particular, the Shortest Vector Problem (SVP), as critical connectors within the network. Extending the analysis across standardization bodies, we observe a significant convergence toward lattice-based constructions, resulting in a concentration of dependencies on closely related hardness assumptions. This structural concentration suggests potential systemic risks, as advances in cryptanalysis could simultaneously affect multiple schemes and standards.

2. workshop Private Quantised Neural Network Inference

   Hendrik Eerikson, Pille Pullonen-Raudvere and Sven Laur

   Neural networks based machine learning models are used in many classification problems yet privacy issues in model usage are mostly unresolved. When a model owner provides their model to other parties for inference, either the model owner has to share the parameters of the model or the model user must share their query and result with the model owner. Depending on the usage scenario, the user's query or query result could contain sensitive information that the model provider should not see. And on the other hand, the model parameters themselves could be a valuable business secret or leak private training data. In such cases, neural network inference must be performed in a privacy preserving manner, for example using secure multi-party computation (MPC). We propose protocols for the private inference of neural networks and evaluate them within the Sharemind MPC secure computation framework. Our protocols are based on the per-tensor quantisation scheme in PyTorch which maps floating point model parameters to 8-bit integer values. Quantisation improves the efficiency of our protocols and our protocols are interoperable with models trained using PyTorch. The resulting protocols are used to evaluate the VGG16 image classification network with an amortised throughput of 24.3 seconds per image classification in a LAN setting.

3. workshop Privacy Preserving Distributed Complex Event Processing using Order Revealing Encryption

   Sehrish Shafeeq and Mathias Fischer

   Complex Event Processing (CEP) enables real-timeprocessing and analysis of large event streams across various Internet of Things (IoT) applications. Despite the deployment of CEP systems in areas that handle sensitive data, privacy protection in CEP systems has remained largely unexplored in the literature. In particular, existing approaches assume a trusted CEP system and focus mainly on pattern-level privacy, often neglecting event-level privacy. Order-revealing encryption enables comparison-based pattern detection over encrypted events without decryption, making it suitable for CEP systems, but it remains vulnerable to inference attacks from order leakage. In this paper, we propose a distributed privacy-preserving CEP framework that applies differential privacy before order-revealing encryption to reduce inference leakage. The proposed scheme achieves both event-level and pattern-level privacy against passive external adversaries and honest-but-curious internal adversaries. We formally analyze the privacy guarantees of our approach under the defined threat model and demonstrate that it achieves high detection accuracy under privacy protection and improves scalability by reducing per-node computational burden compared to a centralized CEP system.

4. closing Workshop Closing

International Workshop on Advances on Security and Privacy Technologies and Solutions

1. workshop Asymmetric Resource Constrained Decoding for Lightweight Linguistic Steganography in Causal LLMs

   Paweł Moszczyński, Szymon Tokarski, Jakub Nowakowski and Wojciech Mazurczyk

   This paper presents ARCDStego, a lightweight linguistic steganography framework for causal large language models that embeds hidden information directly into token generation using two-universal hash-based token masking. Unlike many existing neural steganography methods, ARCDStego does not require access to the original language model, logits, or token probability distributions during decoding. Instead, hidden messages can be recovered using only a shared secret key, the tokenizer, and the embedding matrix, making the method practical for black-box communication settings. Experiments with the Qwen1.5-0.5B model show that ARCDStego effectively hides information while maintaining plausible text generation. The results demonstrate a trade-off between embedding rate and perplexity, where higher payload capacity leads to stronger distributional deviations. The evaluation also highlights the importance of context selection for improving statistical plausibility and generation quality. Overall, the proposed method demonstrates that practical, lightweight LLM-based linguistic steganography is possible without requiring access to the model internals during message extraction.

2. workshop A Post-Quantum Security Framework for European Digital Identities

   Jose Manuel Merlos Espin, Jesus Garcia Rodriguez, Antonio Fernando Skarmeta Gomez, Stefan More, Sakshyam Panda, Iakovos Pittaras and Vasilios Siris

   Quantum computing threatens the foundations of current cryptography, posing critical risks to digital identity systems. This paper presents a modular framework to support the transition of European digital identities toward post-quantum cryptography (PQC). Developed within the context of the [REDACTED] project, the framework considers both Self-Sovereign Identity (SSI) principles and the European Digital Identity (EUDI) Wallet ecosystem. Our framework centers on crypto-agile abstraction layers and decouples identity components from underlying cryptographic primitives, enabling the adoption of classical, hybrid, and post-quantum algorithms. The framework supports user-centric credential management, qualified signatures, and resource-constrained IoT environments through interoperable building blocks and lightweight components. Additionally, we complement our framework with the Quantum Risk Assessment Toolkit, a lifecycle-aware recommendation platform that rounds out the framework's capabilities for achieving an agile PQC transition across different deployment scenarios.

3. workshop A Multimodal Digital Twin Framework for CBAM-Oriented Maritime Trade Integrity

   Muhammad Faisal and Amna Shifa

   As maritime trade becomes increasingly digitised, the effectiveness of the Carbon Border Adjustment Mechanism (CBAM) enforcement depends on the integrity of digital declarations that remain only weakly linked to the physical cargo they describe. Existing Digital Twin (DT) systems in logistics primarily focus on operational visibility and efficiency, while offering limited mechanisms for adversarial verification, provenance assurance, or compliance-oriented anomaly detection. This creates significant risks in CBAM-regulated trade environments, including manifest manipulation, route spoofing, origin fraud, and falsified emissions declarations. This paper proposes a Multimodal Digital Twin Framework for CBAM-oriented maritime trade integrity. The framework integrates customs profiling, multimodal sensor fusion, and Digital Twin synchronisation to support continuous cross-verification between declared shipment data and independently observable physical evidence. The proposed architecture combines visual inspection, weight-based verification, and vessel-tracking intelligence within a provenance-aware enforcement layer capable of detecting inconsistencies between declared and observed cargo states. To demonstrate the feasibility of the approach, a synthetic proof-of-concept simulation was developed using density-based anomaly detection aligned with HS-code cargo profiles. The results illustrate how discrepancy detection mechanisms can identify one class of manifest divergence under controlled conditions. The framework further introduces a trust-oriented Digital Twin model incorporating multimodal validation, integrity risk scoring, and closed-loop synchronisation between sensor events and customs verification systems. The study argues that future Digital Twin infrastructures for maritime logistics should evolve beyond passive visibility platforms toward enforcement-oriented compliance systems capable of supporting secure, transparent, and low-carbon maritime trade within CBAM-regulated supply chains.

4. short Physics-Informed Generative AI-Framework for Secure Anomaly Detection in Class-Imbalanced Industrial Control Systems

   Veysel Alevcan, Urvashi Chaudhary, Yakubu Tsado, Zehra Civan, Mohammad Furqan Ali and Luis Miguel Campos

   Anomaly detection in Industrial Control Systems (ICS) is critically undermined by severe class imbalance as in SWaT and HAI, normal samples outnumber attacks by ratios exceeding 100:1, collapsing standard models toward the majority class and producing dangerously low attack recall. This imbalance is compounded by physical ICS telemetry constraints, including hydraulic dependencies, temporal correlations, and bounded operational ranges, that generic oversampling methods such as SMOTE cannot faithfully reproduce. We present a physics-aware data augmentation framework based on Wasserstein GAN with Gradient Penalty (WGAN-GP), evaluated on two ICS benchmarks: SWaT (water treatment) and HAI (power grid). The generator enforces physical plausibility through bounded tanh activations and max-norm weight regularization. An autoencoder-based anomaly detector is trained under three controlled configurations (real data only, real augmented with WGAN-GP synthetic samples, and synthetic only), isolating the augmentation contribution with recall as the primary safety metric. A secondary contribution is an IQR-based adaptive thresholding mechanism that self-calibrates to false-positive feedback, eliminating manual tuning across heterogeneous industrial environments. On SWaT, WGAN-GP augmentation raises attack recall from 19.6% to 77.5% and accuracy from 78.3% to 91.1%. On HAI, all metrics exceed 92%. These results confirm that physics-aware generative augmentation is a principled, deployable solution to class imbalance in safety-critical ICS environments.

5. short Optimized DYST-like Amplification Covert Channel

   Carina Heßeling, Jörg Keller and Steffen Wendzel

   Covert channels are tailored to enable a stealthy communication of secret data. Methods to establish covert channels have been optimized for several decades. Recently, covert channel amplification was proposed, which allows to signal more data to a receiver than are embedded by a sender. However, an in-depth analysis of optimal configurations for covert channel amplification is still missing. To this end, we formulate an amplification channel optimization problem and investigate optimal configurations for such covert channel amplifications.

Main conference paper track

1. full A Unified Evaluation Framework for Privacy-Preserving Data Publication Techniques

   Jenno Verdonck, Qianying Liao, Michiel Willocx, Wouter Joosen, Vincent Naessens and Dimitri Van Landuyt

   Privacy-preserving data publication (PPDP) aims to reduce privacy risks before releasing datasets. As alternative techniques, (i) data de-identification alters original data values through generalization or suppression to weaken their link to data subject identities, whereas (ii) synthetic data generation produces artificial datasets that do not contain any original data yet preserve statistical similarity to the original data. Given that their outcomes lack direct comparability, it remains unclear which technique leads to better privacy protections while retaining data utility. To address this gap, we present (i) a novel quantitative evaluation framework for comparing privacy and utility across synthetic and de-identified datasets, and (ii) a comparative study based on a location optimisation task and a predictive machine learning application. Our results reveal a nuanced trade-off. De-identified datasets perform better on traditional statistical privacy metrics but are more vulnerable to adversarial attacks such as attribute inference. Conversely, utility outcomes vary widely by use case, indicating that the selection of a PPDP technique remains highly dependent on the application context.

2. full Preserving Socio-Connective Diversity in Locally Private Social Graph Synthesis

   Manel Jerbi, Reynaldo Gil Pons and Sjouke Mauw

   In decentralised social networks, users typically hold only partial views of the overall network structure. Synthesising a global social graph from such distributed data, while protecting user privacy, remains an open challenge. We present DHSG-LDP, a framework and reference architecture for privacy-preserving heterogeneous graph synthesis in decentralised settings. Each client perturbs locally held ego-network information before sharing it with an untrusted aggregator, which reconstructs a synthetic user--user graph for downstream analysis without collecting raw relationship data. DHSG-LDP preserves \emph{socio-connective diversity}, capturing both homophilous and heterophilous interaction patterns. Privacy is enforced locally: individual user connections cannot be reliably inferred from reported information, even when multiple reports are combined. We implement a prototype and evaluate it on real-world datasets using link prediction and community detection tasks. Results show that synthesised graphs retain key structural properties and sustain competitive downstream performance. At moderate privacy levels, utility approaches that of the original graph while meaningful privacy protection is maintained.

3. short A Robust and Privacy Preserving Crowd Monitoring Framework

   Raphael Ritz, Marc Damie, Thijs van Ede and Fatemeh Marzani

   A key aspect of crowd monitoring is quantifying crowd size. While determining the size of a crowd in a single location at a spe-cific moment is straightforward, measuring crowd flow across locations or over extended periods requires estimating the intersection of unique individuals observed at different points in space or time. In this work, we look at the re-identification of facial data, which inherently poses significant privacy risks. We propose a privacy-preserving framework for crowd flow estimation providing both robustness against variations in images captured at different cameras (using LSH) and privacy protec-tion to ensure biometric data is not visible outside the camera (using garbled circuits). Facial embeddings are first transformed into binary representations (LSH), ensuring that embeddings belonging to the same individual (intra-class) have low Hamming distances, while embeddings from different individuals (inter-class) are well separated. This design enables robust matching in the presence of biometric noise. To compute the crowd flow, we compare the hashes using garbled circuits, allowing collaborating camera nodes to jointly estimate crowd flow without reveal-ing raw facial data or intermediate representations. Experimental results show that a 128-bit configuration achieves an average F1-score of 96.18% with an amortized execution time of 10.21 ms per comparison, demon-strating the practicality of the proposed approach for privacy-compliant crowd monitoring.

Main conference paper track

1. SoK SoK: Decentralized Agentic AI Security Agents in Smart Infrastructures

   Olumba Chima Anya, Mubashar Iqbal and Raimundas Matulevicius

   Smart infrastructures, including smart grid, industrial IoT (IIoT), and intelligent transportation systems (ITS), represent high-value targets for cyberattacks due to their potential to cause blackouts, process disruptions, and safety incidents. Traditional centralized security approaches introduce single points of failure and struggle with real-time constraints and distributed operation. Emerging research explores decentralized architectures that integrate agentic AI agents capable of perception, reasoning, and action with blockchain-based coordination to enable resilient, distributed security. This paper presents a systematization of knowledge (SoK) in this emerging domain through a systematic literature review. We develop a three-dimensional taxonomy that classifies approaches along the dimensions of intelligence (perception and learning), action (security operations performed), and coordination (consensus and consistency mechanisms). Our analysis reveals persistent integration challenges when individual capabilities operate in isolation; no architecture fully combines threat detection, autonomous response, and decentralized coordination under the strict timing, safety, and resource constraints of real-world smart infrastructures. This work exposes critical gaps, including deception, automated recovery, and governance, and points to an integration-focused research agenda.

2. full Quantization-Triggered Backdoors in Language Models: The Validation–Deployment Gap in Military AI Pipelines

   Jacopo Dardini, Claudio Stanzione, Giordano Colò and Giuseppe Fenza

   Post-training quantization is routinely treated as a semantically neutral optimization for edge deployment of Large Language Models, yet security audits are performed exclusively on full-precision models. We show that this practice introduces a structural validation-deployment gap: because quantization is a many-to-one mapping over parameter space, full-precision certification does not guarantee behavioral equivalence in the deployed configuration. We formalize this gap through Quantization Behavioral Equivalence Classes (QBECs) and prove that QBEC membership does not imply behavioral equivalence, providing a theoretical basis for quantization-triggered backdoor attacks. Building on a three-stage adversarial fine-tuning framework, we embed latent malicious payloads into models that pass standard FP16/FP32 safety audits, yet reliably activate targeted adversarial behavior upon INT8 or 4-bit compression. We evaluate this threat in two operationally critical scenarios, tactical machine translation and political content analysis, extending prior work from decoder-only causal LMs to multilingual encoder-decoder seq2seq models. Results show that backdoored translation models achieve over 85% friend-foe identification inversion after quantization while maintaining plausible full-precision quality, and that political analysis models inject measurable ideological bias (Delta Bias > 0.22) upon compression. A cross-quantizer transferability analysis further reveals that attack persistence is governed by quantizer geometry and model architecture rather than nominal bit-width alone. These findings demonstrate that auditing models only at full precision provides illusory safety, and that behavioral certification in final deployed configurations is necessary for trustworthy edge AI.

3. full Steganography Without Modification: Hidden Communication via LLM Seeds

   Felix Mächtle, Jonas Sander, Sebastian Berndt, Ben Weimar, Nils Loose and Thomas Eisenbarth

   We demonstrate that widely deployed Large Language Model (LLM) inference stacks harbor a steganographic channel that requires no modification to model weights, sampling code, or output distributions. The channel exploits a structural property of deterministic decoding: pseudo-random number generators (PRNGs) used in inverse-transform sampling produce a seed-dependent sequence of token-level probability intervals that can be reconstructed from the generated text alone. A sender encodes a secret message in the PRNG seed before generation; a receiver reconstructs the intervals and recovers the seed, and thus the hidden payload, by exhaustive search over the seed space. We formalize two operational modes. In the known-prompt setting, sender and receiver share the prompt, enabling exact interval reconstruction and perfect seed recovery via forced alignment. In the unknown-prompt setting, only the generated text is available; approximate interval reconstruction combined with a maximum-hit-count scoring strategy still permits reliable recovery from sufficiently long outputs. Because the channel alters neither the token distribution nor the model internals, it leaves no statistical footprint beyond the inherent determinism of sampling. Extensive experiments across six model families and five heterogeneous text domains show that, in the known-prompt setting, full 32-bit seed recovery from the complete 2^32 candidate space achieves up to 100% accuracy, depending on model and text domain, within 300 tokens and under 35 seconds on a single GPU. In the unknown-prompt setting, recovery reaches near-perfect accuracy at 600-800 tokens in about 12~seconds. We further analyze the influence of prompting strategies, tokenization ambiguities, and sampling hyperparameters on channel reliability. Moreover, we discuss several applications of our results: First, it allows for the steganographic transmission of 32 bits, but also shows that ignorance of the prompt is not a valid security assumption.

Main conference paper track

1. full Secure Wi-Fi Ranging Today: Security and Adoption of IEEE 802.11az/ bk

   Nikola Antonijević, Bernhard Etzlinger, Dave Singelée and Bart Preneel

   Ranging and localisation have become critical for many applications and services. The Wi-Fi (IEEE 802.11) standard is a natural candidate for providing these functions across diverse environments, given its widespread deployment. The IEEE 802.11az amendment, finalised in 2023, introduces Next Generation Positioning mechanisms to secure and harden the existing insecure Wi-Fi Fine Timing Measurement (FTM) ranging solution. Moreover, the recent IEEE 802.11bk amendment increases the available bandwidth with the goal of approaching the centimetre-level ranging accuracy of ultra-wideband (UWB) systems. This paper examines to what extent these promises hold from a security and deployability perspective. We analyse the core mechanisms of secure Wi-Fi ranging as defined in IEEE 802.11az and IEEE 802.11bk at both the logical and physical layers, combining standards analysis with simulations and measurements on commercial and development hardware. At the logical layer, we show how common deployment choices can result in unauthenticated ranging, downgrade attacks, and simple denial-of-service attacks, making it difficult to securely realise many high-stakes use cases. At the physical layer, we study the predictability of secure ranging waveforms, the security impact of symbol repetition, and how waveform design choices affect compliance with spectral masks under realistic RF behaviour. Our results show that secure Wi-Fi ranging is highly sensitive to configuration choices and is non-trivial to implement on existing hardware. This is also evidenced by the currently limited support for secure Wi-Fi ranging in commodity devices. This paper provides practical guidelines for using secure FTM safely and recommendations to vendors and standardisation bodies to improve its robustness and deployability.

2. full LNTest: A Testbed for Evaluating Bitcoin Lightning Network-Based Botnets

   Thomas Bakaysa, Abdul-Salem Byeibitkhan, Jesus Maria Romo Diaz de Leon, Tag Kalat, Joshua Kramer, Estela Rodriguez, Abraham Watkins, Abdullah Aydeger and Ahmet Kurt

   Bitcoin's Lightning Network (LN) can be exploited as a covert, low-cost command-and-control (C&C) channel for botnets, as demonstrated by the LNBot and D-LNBot designs. However, both remain proof-of-concept prototypes evaluated only through simulation, leaving key questions about real-world topology formation, propagation complexity, and resilience to takedowns unanswered. We present LNTest, the first reusable testbed for LN-based botnets, built from Bitcoin Core and Core Lightning nodes orchestrated via Docker on Bitcoin regtest. LNTest supports three overlay topology modes — a deterministic chain, autonomous peer discovery, and user-supplied graphs — enabling controlled experiments across different botnet structures. Using LNTest, we report three main findings. First, D-LNBot's autonomous formation protocol does not produce the uniform chain from its design; instead, it creates a clustered chain in which 12% of the nodes are bridges whose removal fragments the network. Second, command propagation scales as O(n/m), not O(m log n) as previously claimed. Third, the overlay topology determines the effectiveness of takedown strategies: uniform-degree chains resist targeted removal but fragment under random failure, scale-free topologies show the opposite pattern, and the autonomous clustered chain is fragile under both — making it the most vulnerable of the three. LNTest and all experimental data are released as open source to support reproducible research on LN-based botnet defenses.

3. full A Communication Channel Redundancy Extension for Data Distribution Service

   Lóránt Meszlényi, Florian Hartl and Stefan Katzenbeisser

   The Data Distribution Service (DDS) middleware standard has gained widespread adoption in safety-critical systems, including automotive, aerospace, and industrial automation, where communication reliability is a foundational requirement. However, deployments operating under high safety integrity levels, like railway systems, mandate the presence of multiple redundant communication channels. While DDS supports component redundancy with Quality of Service (QoS) attributes, it lacks a standardized way for communication redundancy mechanisms. In this paper, we propose a communication channel-redundancy extension to DDS. We evaluate our extension under diverse simulated network conditions, including packet loss, link degradation, and full channel failure, comparing it against standard DDS protocol. Our results demonstrate that the proposed extension achieves highly available communication with no measurable performance degradation under nominal conditions, positioning DDS as a modern solution for high safety requirements.

15th International Workshop on Cyber Crime

1. keynote TBA

   TBA

   TBA

2. workshop Bypassing Locked eMMC in Investigations: Measuring Evidence Alteration Risk in Fault-Assisted Access Restoration

   Nicolas Hugget, Hadrien Barral, Thibaut Heckmann and David Naccache

   Digital forensic acquisition of mobile and embedded systems increasingly encounters managed storage that enforces access control inside the component itself. When conventional acquisition paths fail, hardware-level access restoration (using methods such as fault injection) may be considered as a last resort, but this raises a question central to evidence handling: does the unlocking procedure alter the evidence, and if so, where? This paper formalizes byte-level integrity assessment for fault-assisted acquisition through a measurement framework combining three elements: auditable scalar summaries of divergence concentration (top-share, Gini, Herfindahl–Hirschman Index (HHI)) computed on a windowed partition of the address space, an explicit persistence check separating transient read-path effects from lasting alterations, and a shared-baseline protocol under which the same physical target is exposed to two distinct injection vectors. The framework is evaluated on an Embedded MultiMediaCard (eMMC) locked with the standard password-based mechanism (CMD42), comparing Voltage Fault Injection (VFI) and Electromagnetic Fault Injection (EMFI) when used to defeat the lock without the password. On this device, both vectors restore access but produce non-zero, persistent differences relative to a nominal reference. Their alteration patterns differ: EMFI produces a lower divergence volume and stronger sector-scale concentration, whereas VFI shows stronger dominance after page-scale aggregation. The sensitivity analysis shows that vector ranking depends on the aggregation scale and metric, so injection vectors cannot be compared using a single concentration indicator. These observations argue for treating the injection vector and its parameters as first-order forensic variables that must be documented, constrained, and audited as part of the evidentiary acquisition conditions.

3. workshop AGenCi: Age and Gender Audio Classification for Forensic Investigations of Child Sexual Abuse and Exploitation

   Callum McHugh, Haiyue Yuan, Jamie Pont, Virginia Franqueira, Budi Arief and Julio Hernandez-Castro

   Age and gender classification using speech signals is a critical task in digital forensics, with many important applications including investigations of child sexual abuse and exploitation (CSAE). While a large amount of research has explored various machine learning (ML) and deep learning (DL) techniques for this, challenges remain in accurately identifying children's speech, especially in the context of detecting child sexual abuse material (CSAM). This is largely due to the lack of reliable/ balanced datasets and the variability of children's speech data. In this study, we present a framework based on OpenAI's Whisper-medium model, integrating a custom multi-layer feedforward classification network to perform binary gender classification, binary age classification, and multi-class age classification. We call this framework AGenCi (Age and Gender audio Classification for forensic Investigations of CSAE). To fill the research gap and facilitate evaluation, three datasets are curated using well-known and publicly available speech corpora to address biases related to age, gender, and linguistic diversity. Several traditional ML models and recent DL models are selected in our benchmarking experiments. The results indicate that our framework achieves the highest accuracy of 95.6%, 94.5%, and 87.6% for the binary gender, binary age, and multi-age classification, respectively, consistently outperforming other models.

International Workshop on Applied Trust and Cyber Resilience

Session chair: Michael Eckel, Georgios Gkoktsis

1. Welcome
2. keynote TBD

   TBA

   TBA

3. workshop Bootstrapping Secure Next-Generation Vehicle Access Control from a Centralized Hardware Security-based Trust Anchor

   Marco Leeske, Dirk Scheuermann, Ludger Peters and Christian Plappert

   Access control in vehicles is a critical component of modern automotive security, particularly as vehicles become increasingly connected. Recent cyberattacks have demonstrated that vehicles are vulnerable to cyberattacks, which not only have financial implications but, with the increase in automated driving functions, also pose safety risks for all road users. The Service-Oriented Vehicle Diagnostics (SOVD) standard addresses these issues for next-generation vehicle architectures. However, the standard does not specify how to secure the corresponding security-sensitive credentials. In this work, we propose an enhancement to the SOVD standard, which secures the credentials within a Hardware Security-based Trust Anchor (HTA) concept.

4. workshop HIEST: Hierarchical Attestation to Support Trusted Dynamic Workloads

   Ardhi Putra Pratama Hartono, Andrey Brito and Christof Fetzer

   Confidential computing leverages VM-based Trusted Execution Environments (TEEs) to protect workloads without modification. However, dynamic workloads, where applications execute atop a Process VM (PVM) such as Python, remain inadequately addressed. Existing solutions, such as Confidential Containers (CoCo), restrict attestation to the first execution layer and deploy workloads using generic micro-VM images, producing identical TEE evidence irrespective of the actual application. This enables an adversary to reuse an attested environment to run unintended or malicious applications. We propose HIEST, a hierarchical attestation mechanism that chains the execution stack, from the Trusted Computing Base (TCB) through the PVM to the application and beyond. Execution is allowed only after successful verification by a trusted remote Key Broker Service (KBS). HIEST is runtime-agnostic, supports user-defined constraints, assumes no specific certificate standard or cryptographic algorithm, and extends naturally to additional layers such as data input. Our reference implementation requires no direct PVM modifications and leverages mature components like Kata Containers. Evaluation across multiple use cases demonstrates that HIEST mitigates reuse attacks, adding 12-15 ms of overhead that scales inversely with workload duration in our setup.

5. workshop Decentralizing Trust: Distributed Signature Activation Modules for Resilient Key Management

   Stefan Genchev, Veronika Bauer, Sebastian Gallenmüller and Georg Carle

   Signature Activation Modules (SAMs) are an established security mechanism in key management systems that enforce strict usage control over keys. However, current deployments face multiple challenges, such as overreliance on individual external providers and proprietary protocols. In this paper, we address several constraints of local SAM deployments and introduce a novel architecture for distributed SAMs. A core element of this architecture is an evaluation of authentication and authorization evidence for a signing operation through several independent instances. We strengthen this strategy through hardware-anchored trust, leveraging different Trusted Computing technologies, including HSMs, security microcontrollers, and Trusted Execution Environments on general-purpose CPUs. Thereby, we improve the operational resilience of SAMs and enable their operation in possibly untrusted physical environments. Through a proof-of-concept implementation based on off-the-shelf components, we show the general feasibility of our architecture for a conservative security model. We perform measurements for three relevant signing use cases—automated signing using symmetric and asymmetric keys as well as human-in-the-loop signing. Our results demonstrate that distributed SAMs are a practical solution for exercising sovereign control over important key material. 

SecAviation meets SecHealth: Cybersecurity in Critical Infrastructure

1. workshop Unifying Heterogeneous IoMT Datasets for Intrusion Detection: From Laboratory Testbeds to Real Hospital Network Evaluation

   Pantelis Petrakis, Jordi Doménech, Olga León, Isabel V. Martin-Faus and Josep Pegueroles

   The growing adoption of Internet of Medical Things (IoMT) devices in healthcare has introduced significant cybersecurity challenges. While machine-learning-based Intrusion Detection Systems (IDS) show promising performance, their practical deployment is hindered by reliance on isolated, single-domain datasets that fail to capture the heterogeneity of the IoMT threat landscape. This paper addresses this critical limitation by proposing a systematic methodology to unify heterogeneous IoMT network traffic datasets into a standardized, ML-ready representation. Using MIOTTA-NPT, a network preprocessing tool that operates directly on raw packet captures, we extract a uniform set of statistical features that resolves feature heterogeneity at the source. We integrate two distinct public datasets (CICIoMT2024 and IoMT-TrafficData) into a unified collection of more than 8×10^6 records and train three tree-based classifiers (Decision Tree, Random Forest, XGBoost) on isolated and unified regimes. Extensive evaluation shows that single-source models collapse under true cross-domain transfer, whereas models trained on the unified dataset reach Macro-F1 up to 0.952 across both constituent domains. We additionally test the unified models on HospNet26, the first public dataset of real hospital network traffic. This real-world evaluation reveals a substantial laboratory-to-clinic covariate shift, motivating concrete recalibration strategies for safe deployment of IDS in operational hospital environments.

2. workshop Constraint-Aware Evolutionary Design of Hierarchical Collaborative Intrusion Detection Architectures for UAV Swarms

   Ines Rieger, Andre Garcia-Gomez, Marietheres Dietz, Markus Wurzenberger, Joscha Eirich, Max Landauer and Florian Skopik

   Securing large-scale unmanned aerial vehicle (UAV) swarms requires collaborative intrusion detection systems (CIDS) that operate under communication, resource, and latency constraints. Manually designing CIDS communication and aggregation is challenging due to system complexity, evolving threats, and avionics limitations. This work presents a constraint-aware evolutionary algorithm that automatically generates hierarchical CIDS architectures optimized for alert classification performance, aggregation efficiency, and end-to-end latency. Using domain-aware genetic operators, our approach ensures valid, interpretable, and mission-adapted architectures. Evaluation across synthetic, real-world (T-ITS), and emulated UAV swarm datasets demonstrates that the evolutionary search produces interpretable architectures adapting to performance-latency trade-offs and different attack scenarios. In particular, the experiments reveal that the preferred aggregation strategy and design patterns depend on the attack type. These findings highlight the potential of search-based design for CIDS architectures in future swarm-based aerial systems.

3. workshop Objective-Induced Representation Geometry Tradeoffs for Trustworthy Autism Neuro-imaging

   Kainat Khan and Abdul Wahid

   Neuro-imaging data from individuals with Autism Spectrum Disorder (ASD) exhibits substantial heterogeneity arising from inter-subject variability, distributed neuro-functional patterns and multi-site acquisition effects. Although contrastive representation learning has recently shown promise in modelling such heterogeneous neuro-imaging manifolds, the geometric consequences of different learning objectives are not well understood. In this work, we present an analysis of the geometry of representations induced by different objectives in ASD neuro-imaging, using rs-fMRI-ALFF features. We compare supervised convolutional learning, supervised contrastive learning and subject-aware contrastive learning within a unified embedding analysis framework. Beyond predictive evaluation, we characterize latent representations through spectral structure, pairwise geometry, local manifold density, cluster organization and calibration behavior. Our experiments reveal that different objectives induce fundamentally distinct geometry regimes. CNN learns compressed discriminative manifolds with stronger class separation but inferior calibration, whereas SACL preserves broader heterogeneous structure with improved calibration and reduced geometric concentration. In contrast, SupCon produces near-isotropic representations with extremely high spectral rank and near-perfect calibration, albeit with weakened discriminative organization. These findings demonstrate that learning objectives play a key role in reshaping latent geometry and uncertainty structure in ASD neuro-imaging, highlighting important trade-offs between discrimination, geometric diversity, and calibration.

4. workshop Hardware-Rooted Security for Aviation Cyber-Physical Systems: Trusted Computing, PKI Lifecycle Management, and Attestation-Based SBOM Compliance

   Nicolai Kuntze and Hagen Lauer

   Aviation systems are safety-critical cyber-physical systems in which compromised software can have direct, life-threatening consequences with complex supply chains. As the security architecture of most avionics platforms is focused on safety aspects, trust mechanisms that have become standard in terrestrial computing are not yet part of the general architectures in the aviation sector. This paper presents the application of well developed and standardized security technologies — specifically Trusted Platform Module (TPM) 2.0 (ISO/IEC 11889) and the DICE architecture — providing the missing foundation for three interconnected security problems: (i) trusted computing in an environment where avionics software cannot be arbitrarily updated without certification oversight; (ii) public-key infrastructure and key lifecycle management across maintenance windows and connectivity-constrained operational phases; and (iii) Software Bill of Materials (SBOM) compliance verification, where the EU Cyber Resilience Act creates SBOM obligations for ground systems, Electronic Flight Bags, and cabin IT, and attestation provides a technically sound mechanism to verify that a running system matches its declared component inventory. We present a structured STRIDE threat model for aviation, a concrete reference architecture for an Integrated Modular Avionics platform with TPM-anchored trust, and a novel attestation-based SBOM compliance framework that maps the TCG Reference Integrity Manifest specification onto EU regulatory requirements.

Main conference paper track

1. full SPiRiT: Verifiable Contact Tracing for Balanced Security, Privacy, and Safety

   Reyhaneh Rabaninejad, Azra Abtahi, Antonis Michalas and Amir Aminifar

   Digital contact tracing systems can play a pivotal role in mitigating the spread of infectious diseases during pandemics by identifying individuals exposed to confirmed cases. In decentralized privacy-preserving contact tracing protocols, users broadcast pseudo-random IDs and, upon infection, upload the relevant IDs to a cloud server. Other users can then download these IDs to determine if they have been in proximity to infected individuals. However, existing protocols often lack verifiability, implicitly assuming honest user behavior when uploading data to the server. This gap creates vulnerabilities, including false positives and false negatives, which hinder the widespread adoption crucial for the effectiveness of contact tracing apps. This paper introduces SPiRiT, a secure and privacy-preserving verifiable contact tracing protocol, designed to address these shortcomings by introducing and defining verifiability, ensuring the legitimacy of uploaded IDs, while still maintaining user privacy. Verifiability ensures whether an upload contains a valid set of pseudo-random IDs with respect to the contagious period of the infected individual, and that the individual claiming those IDs is the legitimate owner, in a privacy-preserving manner. The goal of our design is to maintain a balance between the competing objectives of privacy, security, and decentralization while fostering greater public trust and adoption by addressing the aforementioned vulnerabilities. Through rigorous evaluation using a face-to-face individual interaction dataset, we demonstrate that SPiRiT not only reduces false alarms but also can be on par with or even outperform existing protocols in detecting high-risk contacts.

2. full Beyond Theory: Identifying Barriers to Applied GDPR Compliance in a Privacy Range

   Sophia Mittelbach, Florian Seida and Dominik Herrmann

   Prior work identifies insufficient GDPR knowledge as a main barrier to privacy-compliant software development and recommends formal education as a remedy. But how does theoretical knowledge translate into applied competence? We investigate this question through a qualitative lab study (N=10) in which IT students who had recently completed formal GDPR training attempted to identify privacy issues in the Privacy Range, a high-fidelity web environment with 13 intentional GDPR-related problems. Using thematic analysis, framework analysis, and qualitative content analysis, we examined participants' investigative behavior, translation successes and failures, and their perception of the environment as a training tool. Findings suggest that barriers arose less from absent conceptual knowledge than from difficulties in procedural application of that knowledge in context. Participants lacked systematic investigation routines, defaulted to trusting interface claims rather than verifying system behavior, and struggled to connect legal concepts to their technical manifestations. We further observed that habituated exposure to non-compliant web patterns could override formal knowledge, which led to normalizing problems instead of triggering detection. Post-session interviews indicate that participants valued the Privacy Range less as a knowledge delivery mechanism than as a diagnostic instrument that made their own competence gaps visible. These findings inform the development of practice-oriented GDPR training that targets procedural skills alongside conceptual understanding.

3. full A quantitative evaluation of textual, visual, and interactive explanations of a privacy concept in a hospital setting

   Michael Mühlhauser, Angela Fiedler, Sabine Patzl, Melissa Schütz, Marcel Soler Lopez, Simon Steuer, Dominik Herrmann, Daniela Nicklas and Astrid Schütz

   Although the GDPR often requires informed consent, many people do not understand how their data and privacy are protected when they consent to data collection. In practical settings, however, it is still unclear how such understanding can be established. This is particularly challenging in hospitals, where patients consent to processing of sensitive data under time pressure. Related work and learning theories suggest that richer explanation formats could improve understanding of privacy-preserving approaches. We consider the use case of privacy-preserving tracking of vacuum pumps in a hospital setting. As vacuum pumps are attached to patients during wound therapy, patients would be continuously tracked without privacy protections. For our privacy concept, we created three different explanation formats: text-only, text-and-image, and text-and-interactive. In a between-subjects online survey (N=766), we measured subjective and objective understanding, trust, and willingness to use a tracked vacuum pump for these formats and a control group. At least 90% of participants would use a tracked pump, without significant differences between groups. However, all explanation formats significantly improved subjective understanding and trust compared with the control group, with no differences between formats. For objective understanding, text-and-image and text-and-interactive significantly outperformed text-only, though effect sizes were small. While text-and-interactive showed a non-significant trend toward better understanding the limitations of our privacy concept, this understanding remained low. Furthermore, regardless of actual correctness, participants reported high confidence in their answers. This discrepancy questions current consent mechanisms, as no explanation format alone led to sufficient understanding for informed consent. 

Main conference paper track

1. full One Problem, Three Truths: On the Impact of Ground Truth Definitions in Commit-Level Defect Prediction

   Philip König, Sebastian Raubitzek, Alexander Schatten, Fabian Obermann, Dennis Toth, Caroline König, Georg Goldenits and Kevin Mallinger

   Defect prediction models are shaped not only by their features and classifiers but also by how defects are defined. Most studies adopt a single labeling strategy without examining how this choice affects what the model learns and which metrics appear most relevant. In this work, we treat the ground truth definition as an explicit experimental variable. We construct three commit-level targets from a large and diverse dataset of open-source repositories: fix-based labels derived from commit messages, file-level preceding-commit labels that approximate latent defect presence before a fix, and defect-inducing labels identified through SZZ tracing. All three definitions inherit limitations from their construction, and each captures a different aspect of the defect lifecycle. Using a shared set of process, structural, entropy, social, and dependency metrics, we train gradient boosting classifiers under identical conditions for each target and compare predictive performance, feature importance profiles, and the discriminative behavior of top-ranked metrics. Beyond predictive accuracy, we analyze what each model reveals about the relationship between code evolution patterns and different notions of defectiveness, contributing to a more interpretable and practically grounded understanding of defect prediction. Our goal is to clarify whether and how labeling assumptions influence empirical conclusions, arguing that ground truth selection should be treated as a first-class methodological decision in empirical software engineering.

2. full Mirror, Mirror on the Wall, What’s the Best Model to Install?

   Franka Schuster and Hartmut König

   Machine learning (ML) applications in practice are currently dominated by generative models, which are used for non-critical applications because their weaknesses, such as imprecision, hallucinations, bias and lack of transparency can be tolerated in these contexts. In contrast, ML-driven real-time applications for critical environments are rare. High requirements regarding availability, reliability, maintainability and interpretability in this area, make the development of ML-based methods significantly more challenging. Furthermore, methods helping to verify the compliance of ML with all four requirements are missing. The latest regulations for the resilience of European infrastructures raise the bar even higher for the use of ML in operations, although self-learning methods will be necessary for complex tasks such as process regulation or attack detection in the future energy grid. To overcome this situation, in this paper we present a comprehensive approach for the objective and automated measurement of the characteristics of ML-based systems. For the first time, it systematically quantifies properties of the entire application life cycle and all four practicality aspects. The resulting practicality scores further reveal strengths and weaknesses of different system design options and thus can support risk assessment and a compliance-driven improvement of ML applications. We demonstrate the approach with the use case of ML-driven attack detection for large power generation networks. Based on a pool of about 80 detection models that were initially evaluated in productive cyber-physical infrastructures, we show that the method can be used to systematically identify a particularly suitable design for ML-based applications for critical infrastructures.

3. full H-NODE: Learning Multi-Scale Dynamics for Detecting Denial-of-Wallet Attacks in Serverless Systems

   Deepanjan Mitra, Erik Elmroth, Nabendu Chaki and Monowar Bhuyan

   Serverless computing has proven to be an exciting paradigm for deploying applications and services, which brings emerging economic threats, including Denial of Wallet (DoW) attacks. DoW employs autoscaling and pay-as-you-go billing to induce financial exhaustion. The co-existence of Blast and Leech variants induces multi-scale temporal dynamics in user traffic, thereby making DoW attack identification difficult. Classical discrete-time recurrent models compress these dynamics into a single latent state, thereby coupling slow baseline drift with fast transients in event-driven workloads, producing higher false positives. Mitigating this requires a continuous-time model capable of representing latent trajectories at multiple temporal resolutions. Neural Ordinary Differential Equations (NODEs) provide an alternative by modeling hidden-state evolution as a continuous flow. This work proposes H-NODE (Hierarchical Neural ODE), a framework for uncovering multi-scale DoW attacks by explicitly decoupling multi-scale dynamics. H-NODE decomposes the latent state evolution into two coupled streams, a slow context state and a fast transient state. The slow stream tracks long-horizon baseline drift, whereas the fast stream captures short-lived deviations. The fast state is conditioned on the current slow context, enabling transients to be interpreted relative to the baseline and effectively disentangling slow and fast trends. Evaluation on a controlled serverless testbed demonstrates that H-NODE outperforms recurrent discrete-time baselines and remains robust under irregularly sampled observations. Moreover, these gains are achieved with a highly compact architecture with much fewer parameters compared to the baseline models. Beyond the testbed, H-NODE performs consistently on established benchmark datasets and achieves generalizability across heterogeneous traffic conditions and deployment contexts.

Main conference paper track

1. full WardenMind: Flow-Driven Bayesian Detection of Storage Covert Channels

   Kevin Thiry, Mehdi Chourib, Baptiste Bazin and Alexis Bonnecaze

   Covert channels enable stealthy data exfiltration inside otherwise legitimate traffic. In practice, a warden cannot block all covert exfiltration without harming legitimate traffic. The realistic goal is therefore to reduce leakage while preserving acceptable Quality of Service. We present WardenMind, a software warden designed to be deployable by resource-constrained operators. The system relies only on standard IPFIX flow records and software mechanisms available on commodity systems, without requiring programmable hardware or privileged changes to the network stack. Only a small fraction of high-risk flows triggers costly interventions. For each flow, WardenMind computes a calibrated covert-risk estimate. It then selects among progressively stronger actions with a Bayesian cost model that balances residual leakage against QoS impact. The policy is updated online so that fixed thresholds do not have to be retuned every time traffic conditions change. On a controlled flow-level dataset built from MAWI traffic and CIC-Bell DNS exfiltration traces, WardenMind's achieves strong detection performance, reaching 92.4% TPR with 0.47% FPR with two actions, and 81.2% TPR with 0.33% FPR with three actions, while capturing only 0.85% of legitimate traffic.

2. full Encrypted but Detectable: Malware Detection in TLS traffic using JA4/JA4S Fingerprints and Machine Learning

   Faisal Alsubaiei, Hamed Alhusseini and Tassos Dimitriou

   The widespread adoption of encryption has greatly enhanced user privacy but also complicated network security monitoring. Traditional intrusion detection systems (IDS) that rely on payload inspection have become ineffective as most communications are now secured using Transport Layer Security (TLS). This work proposes a privacy-preserving framework for detecting malware in TLS-encrypted traffic by combining JA4 and JA4S fingerprinting techniques with supervised machine learning algorithms on a large-scale dataset of 72,816 TLS flows spanning 19 malware families. The proposed approach extracts unique TLS handshake fingerprints and leverages classifiers such as Random Forest, XGBoost, and Logistic Regression to classify encrypted traffic. By analyzing metadata rather than payloads, the system maintains data confidentiality and regulatory compliance. A rigorous fingerprint-level splitting protocol ensures zero overlap between training and test fingerprint combinations, with all 20,815 test flows corresponding to entirely unseen fingerprints. To validate that ML classifiers contribute genuine generalization beyond fingerprint memorization, we introduce a non-ML majority-label baseline, which achieves only 26.09% accuracy when forced to generalize to unseen fingerprints. XGBoost outperforms this baseline by +72.71%, achieving 98.80% accuracy and 97.69% F1-score, while Random Forest achieves 96.79% accuracy. Prior statistical analysis demonstrated 87% fingerprint uniqueness for distinguishing malware families. We show these distinctive fingerprints enable highly accurate, machine-learning classification and provide an effective, privacy-preserving method for detecting malware in encrypted traffic.

3. short NetFlowMeter: High-performance Network Flow Feature Extraction

   Ettore Ermes Pennucci, Gregorio Dalia, Andrea Di Sorbo and Corrado Aaron Visaggio

   Network flow feature extraction is a critical component of machine learning-based network IPS/IDS systems. In this context, many promising approaches and benchmark databases have been proposed in the literature. However, when they rely on offline processing of packet captures (pcap files), the real-world applicability of these approaches is limited due to performance overhead. To bridge this gap, this short paper presents NetFlowMeter, a tool aimed at significantly enhancing the practicality of large-scale network flow feature extraction, enabling the processing of multi-gigabyte pcap files on commodity hardware. Since NetFlowMeter's design is based on the specifications of CICFlowMeter, the tool behind widely used datasets such as CICIDS2017, it represents a seamless drop-in replacement for current machine learning pipelines. We validate performance and accuracy by comparing the two tools; experimental results show an order of magnitude improvement in processing speed while maintaining the same flow features. Besides, we identify and report a number of bugs in CICFlowMeter that led to incorrect feature extraction in published datasets.

4. short Network-based Detection of Mobile Fake Base Stations

   Sanish Gurung, Tuomo Lehtilä, Amy Sokhna Sidibé, Gizem Akman and Valtteri Niemi

   Fake Base Station (FBS) impersonates a legitimate base station (BS) to deceive mobile devices, facilitating attacks such as Man-in-the-Middle, Denial-of-Service, call eavesdropping, message interception, and location tracking. One method involves manipulating the physical cell identifier to deceive User Equipment (UE). Attackers also evade detection by dynamically adjusting transmission power and intermittently activating FBS. This paper proposes a robust FBS detection method using 3GPP-standardized measurement reports that BSs receive from UEs. Before evaluating detection performance, the ns-3 derived datasets are compared with data from a real test network. We show that the method provides high detection accuracy, and an alarm is raised reasonably fast.

15th International Workshop on Cyber Crime

1. workshop Weaponizing Social Networks for Phishing Target Selection at Scale

   Fatine Majaiti, Bernardo Breve, Luca Allodi and Nicola Zannone

   Social engineering attacks increasingly exploit Open Source Intelligence (OSINT) to gather public information on employees and organizations. Yet, systematically assessing an organization's human attack surface remains underexplored, particularly given that attackers can exploit multi-platform exposure on a large scale. This study examines how attackers can use OSINT in reconnaissance. We present an automated multi-platform OSINT pipeline that collects and categorizes employees' personal and professional data from online social networks. By simulating attack reconnaissance across four sectors, we demonstrate how it can be used to construct detailed cross-platform profiles and prioritize targets by identifying the most exposed employee groups.

2. workshop TeleHUNT: A Framework and Tool for Efficient Cybercrime Community Discovery on Telegram

   Roy Ricaldi, Victor Asanache and Luca Allodi

   This paper presents TeleHUNT, a framework and tool for evaluating the effectiveness of different strategies to discover cybercriminal communities on Telegram. TeleHUNT employs a set of reference-driven snowballing strategies, integrating message-level classification, contextual filtering, and market-segment labeling. Using open-and dark-web seeds, we systematically evaluate how seed source, pointer type, and exploration strategy influence discovery outcomes in three dimensions: efficiency, accessibility, and rediscovery. Our work provides (i) a modular cybercrime content discovery pipeline, (ii) the first systematic comparison of Telegram discovery strategies with an empirical characterization of market-segment accessibility, and (iii) a labeled dataset of over 172 million messages from 6,022 Telegram communities.

3. workshop User-Side Engagement on a Darknet Market

   Julian Heeger, Ben Vollrath, York Yannikos and Martin Steinebach

   Empirical darknet marketplace research has predominantly focused on supply-side signals such as listings, vendor profiles, and transaction volumes. User-side engagement remains largely unmeasured. This paper investigates whether automated crawling can overcome the anti-automation defenses of Kerberos Market and what insights the resulting data can yield about user demand. We deployed a fault-tolerant, distributed crawling system incorporating a pipeline for solving six CAPTCHAs, operating continuously for 32 days across 128 crawl runs at six-hour intervals. The system captured over 2.5 million listing snapshots from 22,807 listings across 292 vendors, using longitudinal view counts as a proxy for user engagement.

4. workshop From Fake Job Offer to Full Environment Compromise: Anatomy of the Contagious Interview Campaign

   Abisheka Pitumpe, Jan Podleski, Amirhossein Khanlari, Amir Rahmati, Piotr Dziubecki and Devendran Muthukumaramani

   This paper presents a comparative static analysis of six trojanized npm repositories linked to the ``Contagious Interview'' campaign: a sustained operation targeting software engineers through fabricated job offers. Each repository was submitted independently to the analysis platform and analyzed using rule-based static scanning without code execution. The analysis reveals a shared malware framework with three invariant components: (1) automatic execution via npm lifecycle hooks, (2) full process.env exfiltration to attacker-controlled Command and Control servers, and (3) Remote Code Execution through dynamic function construction. Despite this technical uniformity, the campaign employs diverse social engineering ``skins'', from DeFi platforms to World Cup NFT games, which suggests a deliberate strategy to target different developer personas. The findings have implications for software supply chain security, recruitment practices in the tech industry, and the development of automated malware detection heuristics.

International Workshop on Applied Trust and Cyber Resilience

Session chair: Michael Eckel, Georgios Gkoktsis

1. workshop Towards Zero Trust Attestation for Confidential VMs in Public Clouds

   Simon Ott, Joana Pecholt, Albert Stark, Jonathan Hettwer and Sascha Wessel

   Confidential Computing promises to remove the hypervisor from the Trusted Computing Base (TCB), enabling data processing protected from Cloud Service Providers (CSPs). This requires verifying the integrity of the entire software stack running in Confidential Virtual Machines (CVMs), i.e., remote attestation. While an established concept, its potential often remains untapped. One of the primary obstacles to practical deployment is that the verifier requires a list of reference hashes for all software running on the proving platform. Given the complexity and frequent updates of software, collecting such a list is a tedious task. In this paper, we analyze the contents of the measurement registers in CVMs and demonstrate how to deterministically precompute their values based on reproducible software builds, extending supply chain security to the runtime phase. We further evaluate the feasibility by examining the reproducibility of different CVM images, and show that, while precomputation is possible, it remains a tedious process with several practical gaps that need to be addressed. We present a comprehensive evaluation of CVM solutions across major hyperscalers and assess the feasibility of attesting CVMs without implicitly relying on trust in the CSP, enabling Zero Trust architectures. Based on our findings, we provide recommendations for streamlining measurement register computation.

2. workshop PQ-PRIVÉ: A Post-Quantum Privacy-Preserving Swarm Attestation

   Nada El Kassem, Stefanos Vasileiadis, Evgenia-Niovi Sassalou, Georgios Fotiadis, Yalan Wang, Ioannis Siachos, Liqun Chen, Thanassis Giannetsos, Bruno Crispo and Constantinos Patsakis

   In modern large-scale systems composed of heterogeneous devices, swarm attestation schemes have emerged to address the scalability and efficiency limitations of traditional single-Prover and single-Verifier approaches. While PRIVÉ represents the first privacy-preserving swarm attestation scheme, its reliance on classical cryptographic techniques renders it vulnerable to quantum attacks. In this paper, we propose PQ-PRIVÉ, a post-quantum (PQ), privacy-preserving, scalable, and accountable swarm attestation scheme. Our design enables anonymous attestation while preserving device attribute privacy, and its quantum-resistant construction ensures suitability for deployment in the post-quantum era. To the best of our knowledge, this work presents the first PQ-secure swarm attestation scheme. We model our protocol within the Universally Composable (UC) framework and provide formal UC security proofs. Furthermore, we present experimental benchmarking results that demonstrate the efficiency and scalability of the proposed approach.

3. workshop fRE: A TEE-Based Firmware Resilience Engine with Efficient Local Detection and Recovery

   Utku Budak, Yigit Arda Ozen, Fabrizio De Santis, Malek Safieh and Georg Sigl

   Firmware resilience refers to a device's ability to protect its firmware from malicious attacks, quickly detect manipulations, and recover from such attacks to minimize downtime. To enhance firmware resilience, the Trusted Computing Group (TCG) introduced the Resilience Engine (RE), a trusted component designed to remain secure and operational even if the rest of the device firmware is compromised, with the primary role of recovering to a functional state. This paper presents a firmware RE (fRE) architecture that leverages Trusted Execution Environment (TEE) to isolate the RE from the rest of the device firmware. The proposed architecture is designed to effectively accelerate both computationally intensive runtime local detection and recovery processes, while addressing on-chip memory constraints through chunkwise firmware verification and stepwise recovery. To demonstrate the feasibility of the proposed architecture, fRE is implemented on an ARM Cortex-M33-based microcontroller unit (MCU) leveraging TrustZone-M. The implementation is also evaluated using various cryptographic hash functions, such as SHA256, hardware-accelerated SHA256, SHA512, Ascon-Hash256, Blake3, and SipHash, to evaluate the runtime overheads of firmware verification and recovery. The implementation results indicate that integrating the proposed architecture into embedded devices with TEE support results in manageable overhead in terms of memory usage and execution time, while enabling faster, efficient firmware verification and recovery.

4. Best Paper Award Ceremony

Main conference paper track

1. full Detecting Bot Detection: Prevalence, Techniques, and Implications for Web Measurement Research

   Ralf Gundelach, Michael Mühlhauser and Dominik Herrmann

   Browser automation frameworks are essential tools for security and privacy research on the web, yet bot detection scripts increasingly probe their artifacts, threatening measurement validity as automated browsers may be blocked or served different content. Prior work measures detection deployment, while we measure blocking-induced sample loss. Through a literature survey of top-tier security, privacy, and web measurement venues, we find that 83% of papers omit any discussion of bot detection blocking. To address this gap, we conduct a measurement study of 10,000 websites across four browser configurations (40K page visits in total) to quantify detection prevalence and employed techniques. Using custom instrumentation to detect when sites probe for automation, we develop a taxonomy of bot detection techniques and measure how often they appear in practice. Chromium headless encounters a 15% soft block rate compared to 7% for other configurations. Across all conditions, 82% of blocks are attributable to bot detection (59% vendor-confirmed, 23% inferred from condition-dependent blocking), predominantly by providers with integrated bot detection such as Cloudflare (37% block rate) and Akamai (26%). A header spoofing experiment establishes that 75% of Chromium-headless-only blocks are caused by header-level signals alone, yet JavaScript-based environment probing is more extensive than current blocking rates suggest. These findings demonstrate that bot detection creates systematic, provider-correlated sample loss that the web measurement community neither measures nor reports. The downstream effect on specific measurement outcomes remains future work.

2. full Detecting Phishing on Shared-Domain Hosting Services Using LLM-Based Contextual Mismatch Reasoning

   Sho Inuzuka, Takaaki Toda, Daiki Chiba and Tatsuya Mori

   Phishing attacks that exploit Free Website Building services (FWBs) are increasing. Because these services operate as Shared-domain Hosting Services (SHSs), where both benign and malicious sites coexist under the same provider-managed domain, conventional URL-and domain-based detection features become ineffective. In this study, we propose an LLM-workflow-based detection method that addresses this challenge. The proposed method consists of three components: Brand Analyzer, Content Analyzer, and Judge. It estimates brand popularity and identifies elements that prompt sensitive actions from the content of a web page, and classifies benignness or maliciousness based on contextual mismatch arising from their combination. Furthermore, the method outputs the rationale behind its verdict, thereby improving explainability. We implemented the proposed method using two LLM configurations, GPT-4.1-mini and Qwen3-8B, and conducted a comparative evaluation against an ML-based baseline (FreePhish) and an LLM-based baseline (PhishLLM). On a 100-sample test set collected from 10 SHSs, the proposed method achieved a recall of 1.00 under both LLM configurations and under both Seen (services included in the baseline's training data) and Unseen (services not included) conditions, demonstrating service-agnostic detection. In particular, with GPT-4.1-mini, it achieved F1 scores of 0.96 (Seen) and 0.98 (Unseen), overcoming the performance degradation on unseen services and the low recall observed in the baselines. On a supplementary dataset of non-impersonation malicious sites, which neither baseline could detect, the proposed method also exhibited detection capability, indicating its potential to generalize beyond brand-impersonation phishing. Case studies further confirmed that the method can present its decision-making process grounded in contextual mismatch in an explainable manner.

3. short DomainBERT: Transformer-based Domain Generation Algorithm Detection

   Arthur Drichel, Yannick Sautter and Ulrike Meyer

   Modern botnets use Domain Generation Algorithms (DGAs) to create resilient Command and Control (C2) channels to the botnet master. Although Machine Learning (ML) classifiers have been demonstrated to achieve high detection rates, recent studies reveal intrinsic biases that adversaries can exploit to evade detection. To mitigate these biases, a bias‑reduced classification framework has been proposed, which limits bias in the detection process, albeit at the expense of detection performance. This trade-off presents opportunities for additional improvements in DGA detection. In this context, we propose a novel model, DomainBERT, which outperforms the state-of-the-art by 11.23% in ROC AUC within the FPR interval of $[0,0.01]$, and raises the TPR by 13.98% at a fixed FPR of 0.0014. These results are achieved in a temporal and spatial bias-free setting, demonstrating the classifier's ability to generalize well across time and across different networks.

4. short Operationalizing Zero-Day Malware: A Detection-Space Framework with Time-Split Experimental Validation

   Nasser Al-Hadhrami

   The term zero-day malware is frequently used in cybersecurity discourse, yet it lacks a consistent operational definition suitable for experimental evaluation. While zero-day vulnerabilities are formally defined as previously unknown software flaws, the notion of zero-day malware is often conflated with newly discovered variants, polymorphic samples, or malware exploiting zero-day vulnerabilities. This ambiguity complicates benchmarking and obscures evaluation of detection systems under realistic unseen-threat conditions. In this paper, we introduce a detection-space-based operational definition of Zero-Day Malware (ZDM) as malicious code that lies outside the decision boundary of deployed detection models at time t0, remaining undetected until model update at time t1. We formalize the Zero-Day Window Δt = t1 − t0 as a measurable performance metric. To validate this framework, we conduct time-split experiments using a real-world malware dataset and compare signature-based detection, closed-set machine learning, and open-set recognition models. Results demonstrate that traditional closed-set classifiers significantly overestimate zero-day performance when temporal separation is ignored, while open-set methods better approximate true ZDM detection. Our findings provide a reproducible methodology for evaluating zero-day malware detection and establish a measurable bridge between conceptual definition and experimental validation.

Main conference paper track

1. full PROPS: Learning Stack Patterns for ROP Detection on Legacy ARM-based Devices

   József Sándor, Roland Nagy and Levente Buttyán

   Return-oriented programming (ROP) remains a potent threat to legacy systems running on 32-bit ARM architectures, where modern hardware defenses like Pointer Authentication Code and Branch Target Identification are unavailable. We present PROPS (Precision ROP Scanner), a novel detection mechanism for identifying ROP attacks on ARMv7 and older ARM platforms. Using Linux kernel uprobes, PROPS monitors exclusively the return points of known (or potentially) vulnerable functions without modifying the existing software stack. PROPS applies Principal Component Analysis (PCA)-based anomaly detection to the stack content of monitored programs. By learning normal stack patterns from benign execution, it detects deviations that likely indicate ROP attacks, achieving 98.24% detection accuracy on generated ROP chains. This approach represents the first purely stack-based ROP detection method for ARM architectures, offering a practical solution for protecting legacy systems.

2. full SPUF-UP: ID-PUF-based Secure Firmware Update Protocol for IoT Devices

   Emiliia Geloczi, Nico Mexis and Stefan Katzenbeisser

   Firmware is a critical component of Internet of Things (IoT) devices, and its secure and timely update is essential. However, the update process itself introduces additional attack vectors, as compromising firmware can grant adversaries extensive control over a device. Existing solutions often focus on mitigating only specific attacks or satisfying a subset of security properties. Moreover, they are typically evaluated from different perspectives, making a comprehensive comparison difficult. In this paper, we first introduce a structured and unified framework for the systematic security evaluation of IoT firmware update solutions, covering aspects from a generalised system model to typical adversary characteristics. We then propose a novel secure firmware update protocol, SPUF-UP, which leverages the recently introduced unconventional Inter-Device Physical Unclonable Function (ID-PUF) concept. ID-PUF establishes a shared hardware fingerprint between two devices, enabling them simultaneously and on demand to derive a shared cryptographic key. This property allows SPUF-UP to rely entirely on symmetric cryptography without pre-sharing or persistent storage of secret keys. Our security analysis and proof-of-concept implementation show that SPUF-UP is resistant to common attacks, satisfies the desired security properties, and remains lightweight.

3. full When Authenticated Encryption Meets Interleaved Error Correction Coding: Secure Networks-on-Chip Communication

   Elke Franz, Sebastian Jaster and Rebecca Uecker

   In recent years, Networks-on-Chip has emerged as a flexible and powerful solution for data transmission in Multiprocessor System-on-Chip systems. However, the security of these systems may be threatened by Hardware Trojans (HTs) injected during manufacturing. In this paper, we focus on HTs that modify data during transmission. Due to the stealthy nature of HTs, it is a plausible assumption that only a few bits are modified. Hence, the use of Error Correcting Codes (ECC) to mitigate the impact of HTs have been investigated in the literature. However, ECC cannot detect every possible modification. On the other hand, authentication by means of cryptography can ensure the detection of any modification but requires a retransmission of the affected data. Within this paper, we investigate the combination of ECC and authentication in order to increase the reliability of data transmission while keeping the communication overhead low by avoiding retransmissions. We evaluated the efficiency and reliability of the proposed protocol using the PANACA simulation platform. The results of the comprehensive evaluation clearly show the advantages compared to the use of ECC or authentication alone. 

Recent Advances in Cyber Situational Awareness and Data-Centric Innovations

1. Welcome
2. workshop Analysis on Captured Traffic of Internet of Things Botnets using T-Pot

   Jan Schröder, Ulrich Meissen and Salifou Keita

   As the Internet of Things (IoT) continues to expand, defenders need real-world data that captures the early stages of botnet activity. We report a 10-week operational measurement using ten T-Pot honeypots (Cowrie, Dionaea, Honeytrap) augmented with Suricata, and correlate observations with URLhaus and MalwareBazaar via IoT-BDA without relying on packet captures. Our sensors recorded 3,154,762 SSH/Telnet login attempts and identified 18 Command and Control (C&C) ports. We matched 349 of 357 URLs to IoT malware, yielding 20 distinct ELF binaries across multiple CPU architectures. Our findings demonstrate that combining Honeytrap and Suricata with public threat intelligence expands coverage beyond interactive honeypots.

3. workshop Investigating connection attempts traffic: Temporal and Geographical Analysis

   Yohann Morel, Gilles Guette and Valérie Viet Triem Tong

   As tens of thousands of malicious IP addresses continuously scan every machines exposed to the Internet on a daily basis, it is crucial to better understand their behavior, their objectives, and the groups orchestrating these attacks. In this paper, we investigate unsolicited connection attempts observed through a distributed deployment of identically configured machines across multiple geographical regions, complemented by a months-long dataset collected at a single location. Using lightweight signature-based classification together with per-port, temporal, and geographical aggregation, we analyze the relative presence of widely used scanning tools and identify commonly targeted services. Our measurements highlight noticeable geographical differences in unsolicited traffic and temporal variations that correlate with public vulnerability disclosures.

4. workshop Forecasting Security-Relevant Event Persistence on Telegram for Cyber Situational Awareness

   Vladimir Rostok, Adrian Venables and Sven Nõmm

   Public social-media channels often provide early signals of security-relevant developments, including military escalation, infrastructure damage, protest activity, and humanitarian crises. For cyber situational awareness, however, early detection alone is insufficient: analysts also need to know which detected events are likely to remain relevant and therefore deserve continued monitoring. This paper studies how temporal event relevance on Telegram can be operationalised and forecast from message-level behavioural traces. Using a 2025 Telegram corpus of 537,723 text-bearing messages, the pipeline constructs event clusters and produces forecasting datasets for future relevance prediction. SHAP analysis indicates that recent relevance momentum, continuity of activity, cross-channel spread, and forwarding behaviour are the strongest predictors of future relevance.

5. workshop From Security Events to Conflict States: A Three-layer Cyber Defense Scenario Model for Enhanced Cyber Situational Awareness

   Miguel Requena Micó, Mario Fernandez-Tarraga, Daniel Díaz-López, Sergio López Bernal and Gregorio Martínez Pérez

   Cyber defense in mission-critical environments requires integrated approaches capable of representing adversarial progression, uncertainty in telemetry interpretation, and mission-oriented decision making within a unified framework. This paper presents a mission-oriented cyber-defense framework for Cyber Situational Awareness (CSA) and decision support based on a three-layer integrated mathematical probabilistic model and an executable simulation prototype. The model combines an attack-graph model representing possible adversarial progression, an event model that uses observed telemetry to update defender beliefs through Bayesian inference, and a state model that abstracts the inferred posture into conflict states and mission-risk levels.

19th International Workshop on Digital Forensics / 2nd International Workshop on Artificial Intelligence, Cyber and Cyber-Physical Security

1. keynote Reasonable Doubt: Digital Forensics in the Age of Large Language Models

   Stefan Axelsson

   For a quarter of a century, digital forensics has at bottom been a discipline about calibrated belief under uncertainty: how far should a given artifact move our confidence in a hypothesis? Large language models now promise to do much of that reasoning for us — which is precisely why they warrant scrutiny rather than enthusiasm. In this keynote I take the evaluation of evidence as the organising lens. LLMs have arrived in the forensic process in three roles at once: as a tool that triages, summarises and drafts; as a subject that must itself be examined, attributed and weighed as evidence; and as an adversary capable of generating exploits, anti-forensics and synthetic material. The field's instinct to treat only the first of these is a mistake. Running through all three is an old problem in new clothing — the base-rate fallacy — compounded by an awkward fit between the non-determinism and fluent hallucination of these models and the reproducibility that admissible evidence demands. I will argue that the right response is not more tools but better evaluation: benchmarks, validation, and decision frameworks that keep the model as one term in an inference the examiner still owns.

The 2nd International Workshop on Cybersecurity and Privacy Risk Assessments

1. Chair Opening Speech
2. workshop Systematic Cybersecurity Risk Analysis of European Rail Traffic Management System

   Kacper Darowski, Sebastian N. Peters and Lukas Lautenschlager

   European Rail Traffic Management System (ERTMS) is a widely adopted standard unifying train management in the EU. While the standard allows for use cases like fully autonomous driving, cybersecurity has been an afterthought. Risk analysis enables the systematic assessment and prioritization of threats and mitigations. Until now, it remains unclear which threats are most significant in ERTMS. This study systematically models components of ERTMS and analyzes their security in light of threats identified in the underlying technologies. The results suggest a concerning state of ERTMS, despite its critical role in railway safety. The use of legacy standards like EuroBalises and Global System for Mobile Communications - Railway (GSM-R) introduces vulnerabilities that persist across minimal ERTMS implementations, deployments incorporating various optional safety measures, and prospective future evolutions of the system, e.g., adopting Future Railway Mobile Communication System (FRMCS). Fully transitioning to European Train Control System (ETCS) level 2 was identified as the most significant measure for advancing ERTMS cybersecurity. The results indicate that a shift in standardization of ERTMS towards security is required to ensure availability and safe operation.

3. workshop SARA - Situationally Aware Risk Assessment

   Jannis Hamborg, Yannik Franke, Merlin Kling and Christoph Krauß

   Automotive systems are increasingly software-intensive and operate in highly dynamic environments, causing risk to vary with the operational context. Existing automotive risk assessment practices based on Threat Analysis and Risk Assessment (TARA) are performed statically at design time and assume worst-case scenarios. While this conservatism ensures homologation compatibility, it limits expressiveness during operation. In this paper, we propose Situationally Aware Risk Assessment (SARA), an extension of ISO/SAE 21434 that facilitates context-driven risk assessment during runtime, enabling the application of appropriate mitigation measures in specific situations. Building on a layered situational awareness model, SARA structures and interprets contextual information to project situation-specific risk while preserving traceability and compatibility with artifacts defined during an initial TARA. The approach preserves traceability and explainability through modular abstractions, supports generalized Threat and Damage Scenarios with situational differentiation, and minimizes overhead by reusing previously assessed information. A proof of concept instantiation demonstrates the feasibility of explainable situational perception using in-vehicle data.

4. workshop Closing The Gap: Empirically Validated Reference Threat Models for Consumer IoT Architectures

   Victor Goeman, Stef Verreydt, Tom Cordemans, Laurens Sion, Jorn Lapon and Vincent Naessens

   The Internet of Things (IoT) connects billions of devices, yet insecure design choices continue to introduce significant security weaknesses. Existing research often studies device-level vulnerabilities but rarely links them back to underlying design choices, and existing threat modeling approaches rarely demonstrate empirical relevance. In this paper, we introduce reference threat models for three prevalent consumer IoT architectures, highlighting common security threats rooted in the design of such systems. Additionally, we empirically validate these threat models through an in-depth security evaluation of ten representative consumer IoT devices (cameras and doorbells), using a combination of network analysis and firmware reverse engineering. Concretely, this validation shows that vulnerabilities identified in real-world IoT devices correspond to threats captured in the reference threat models. The publicly available threat models can be used as a reference by developers of consumer IoT devices, lowering the barrier to identifying and mitigating common vulnerabilities at design time. Additionally, by connecting potential threats described in the threat models to actual vulnerabilities encountered in practice, the empirical validation of our threat models provides evidence for the overall effectiveness of threat modeling.

AI for Secure and Trustworthy Critical Infrastructure

1. workshop SwedTI: Evidence-Grounded Multi-Source Web Threat Triage with Context-Aware Script Classification

   Emre Süren, Simon Hacks and Hávar Sigurðarson

   Security analysts investigating suspicious websites face a practical integration problem: major scanners provide useful but heterogeneous outputs, often without linking verdicts to concrete page-level evidence. This paper presents SwedTI, an end-to-end web-threat triage artefact for cyber threat intelligence workflows. SwedTI combines three evidence layers: (i) context-aware JavaScript snippet classification, (ii) asynchronous orchestration and schema-normalised fusion of external scanner results, and (iii) constrained large language model summarisation restricted to fused evidence. The classifier is implemented as a fine-tuned GPT-4o-mini model and trained on a curated corpus assembled from five sources. On a held-out validation split, the model reaches 0.9875 precision, 0.9875 recall, and 0.9875 F1. In ablation testing, removing surrounding HTML context reduces recall from 0.9875 to 0.90, indicating that page-level context is important for this triage setting.

2. workshop The Dark Side of LLMs: Agent-based Attack Vectors for System-level Compromise

   Matteo Lupinacci, Francesco Aurelio Pironti, Francesco Blefari, Francesco Romeo, Luigi Arena and Angelo Furfaro

   The rapid adoption of Large Language Model (LLM) agents and multi-agent systems enables remarkable capabilities in natural language processing and generation. However, these systems introduce security vulnerabilities that extend beyond traditional content generation to system-level compromises. This paper presents a comprehensive evaluation of the LLMs security used as reasoning engines within autonomous agents, highlighting how they can be exploited as attack vectors capable of achieving computer takeovers. We focus on how different attack surfaces and trust boundaries can be leveraged to orchestrate such takeovers. We demonstrate that adversaries can effectively coerce popular LLMs into autonomously installing and executing malware on victim machines. In our evaluation of 18 state-of-the-art LLMs we tested trust boundaries within multi-agent systems, where LLM agents interact and influence each other, and we revealed that LLMs which successfully resist direct or indirect injection attacks will execute identical payloads when requested by peer agents.

Main conference paper track

1. full Democratizing Threat Hunting: A Multimodal Hybrid Detection and Semantic XAI Framework for Tier-1 SOC Analysts

   Ayoub Labhih, Mustapha Hedabou and Laila Fetjah

   Security Operations Centers (SOCs) are routinely confronted with large volumes of alerts produced by heterogeneous telemetry sources. This diversity and scale make early-stage triage a non-trivial task for Tier-1 analysts. In this work, we investigate how initial investigative efforts can be better supported by combining multimodal data fusion with hybrid detection strategies that integrate both rule-based logic and machine-learning methods. In addition, we incorporate a semantic explainable artificial intelligence (XAI) component to provide contextual support for analyst reasoning within a unified operational framework. The proposed system correlates system logs, network flows, and endpoint telemetry using a weighted semantic graph to surface contextually relevant indicators. To support analyst decision-making, the XAI module generates concise natural-language explanations aligned with MITRE ATT&CK techniques, translating detection outputs into actionable investigative guidance tailored to Tier-1 workflows. In our experimental evaluation, the framework achieved an approximately 70% reduction in Mean Time to Detect (MTTD), a false-positive rate of 6.1%, and an increase in Tier-1 investigative accuracy from 54.2% to 85.6%. While the reduction in MTTD reflects improvements in automated detection and contextual correlation, the explanation module primarily influences analyst decision time and perceived cognitive workload, as measured using NASA-TLX (detailed in Section 3). By reducing detection latency and analyst cognitive load, the framework contributes to the reliability and availability of SOC operations under high-alert conditions.

2. full Can We Unmask the Underground? Detecting and Predicting Hidden Forum Interactions

   Abdoul Nasser Hassane Amadou, Imane Fouad and Anas Motii

   Cybercriminal underground forums enable anonymous collaboration, allowing users to trade illicit tools, discuss vulnerabilities, and distribute stolen data. Driven by shared interests and specialized skills, users on these platforms organize into distinct threat communities. However, identifying these communities is challenging due to their dynamic and opaque structures; traditional graph-based methods typically isolate dominant groups while overlooking smaller, hidden subgroups. This paper introduces LLMHackScape, an unsupervised framework designed to detect both dominant and hidden communities in underground forums. The framework models users based on their textual interactions and leverages pretrained language models to generate semantic embeddings that encode latent behavioral and thematic patterns. By clustering users based on semantic similarity and assigning topic labels to the resulting clusters, LLMHackScape identifies specific threat communities to support Cyber Threat Intelligence (CTI). The framework was evaluated on three major underground forums: HackForums, Cracked, and BreachForums. Results demonstrate that BERT embeddings consistently outperform alternative baselines, improving cluster coherence and achieving higher silhouette scores. Across these platforms, LLMHackScape identified dozens of distinct communities, effectively isolating small, specialized subgroups (fewer than 100 users) that evade traditional detection. Furthermore, because shared thematic interests frequently precede explicit structural connections, tracking these semantic patterns enables the framework to anticipate the formation of threat communities up to a year before they become detectable by traditional graph-based methods.

3. full It’s a Match! Transitioning from Manual Search to Deterministic Expert Routing

   Mathis Müller, Raphael Neudert and Günther Pernul

   The number of incidents in modern SOCs creates a high workload for the security experts involved, especially due to overhead in the routing layer: once an incident is deemed relevant, it must be assigned to a domain expert responsible for the affected system. As enterprise system landscapes and ownership structures grow, manual ownership identification and ticket handoffs become a dominant source of delay, variance, and misrouting. We present a generalized process model that automatically connects SOCs to security systems. We apply this process to the connection between SOCs and IAM systems, arguing that IAM systems serve as the latest and most reliable source of truth for knowledge about people and their responsibilities. Our contributions include a formalized queuing and process model as well as a technical implementation that utilizes CTI data to identify a responsible domain expert via IAM, thereby enabling automated assignment. This approach reduces both workload and the mean time to resolve incidents. We evaluate the approach with model-level extraction accuracy and a discrete-event simulation of the routing stage, embedding the model in a real-world-data SOC use case.

Main conference paper track

1. full Taming Timing: Testing Side-Channel Resistance on Java Card Platform

   Veronika Hanulíková and Petr Švenda

   Smart cards are widely deployed secure hardware devices used to store sensitive data and execute cryptographic operations. Although direct extraction of secrets is usually infeasible, implementations can still be compromised through side-channel attacks such as timing leakage. Developers frequently rely on custom cryptographic routines because of limitations in the standard API, thereby increasing the risk of this vulnerability. However, validating constant-time behavior is difficult because there are no internal measurement triggers on the card itself. This paper presents a methodology for systematically discovering timing-side-channel vulnerabilities in Java Card applets. The key contribution is the combination of three techniques enabling practical leakage detection on real smart cards: precise timing measurements obtained via automatic source-code instrumentation, synchronization using distinctive operations visible in simple power analysis traces when native triggers are unavailable, and differential fuzzing to identify inputs that maximize data-dependent timing differences --- first on a simulator and then validated on real hardware. We further propose a practical exploitability-oriented metric for side-channel evaluation, enabling quantification of leakage from an attacker's perspective. We evaluate the methodology on controlled examples and real-world Java Card applets running on physical cards, including the Satochip hardware wallet and the JCMathLib mathematical library, where it reliably detects subtle timing side-channel vulnerabilities.

2. full Towards a Side-Channel-Resistant and Scalable ChaCha20-Poly1305 Hardware Implementation

   Francisco J. Rubio-Barbero, Pablo Navarro-Torrero, Eros Camacho-Ruiz, Macarena C. Martínez-Rodríguez and Piedad Brox

   This paper presents a secure, scalable, and extensible hardware design for the ChaCha20–Poly1305 Authenticated Encryption with Associated Data algorithm. This integration of a stream cipher with an authentication algorithm has emerged as a fast and reliable alternative in encrypted data transfer protocols such as TLS 1.3, particularly for resource-constrained Internet of Things devices where the default AES-GCM is computationally prohibitive. We propose an architecture founded on a configurable pipelining of ChaCha20 core rounds as well as a folded Karatsuba-based Poly1305 Multiplier Accumulator, providing a flexible trade-off between area, throughput, and power consumption. To deal with physical security vulnerabilities inherent to edge devices, we also introduce a protected variant of the core featuring first-order masking. The secure architecture integrates Threshold Implementations for non-linear Add-Rotate-Xor operations, Secure Double Rate Registers for domain conversion, and a masked Galois field multiplier to prevent intermediate leakage. Implemented on the Artix-7 platform, the unprotected core achieves up to 0.66 Gbps for unmasked version. The protected variant successfully mitigates first-order Differential Power Analysis when evaluated under Welch's $t$-test on a $2 imes 10^6$ trace dataset, with a quantifiable evaluation of the area and performance overhead required to achieve Side-Channel resistance.

3. full DeepCT: A Statistical Test Tool for Evaluating Constant-Time on a Functional Level

   Paul Fuchs and Kerstin Lemke-Rust

   Constant-time (CT) is an effective countermeasure that is widely aimed in cryptographic software implementations in order to prevent timing side channel leakage. In this work, we present DeepCT, a new dynamic statistical test tool that bridges the gap between simple statistical CT verification tools that measure the overall execution time of program code and more advanced dynamic CT~verification tools which make use of dynamic binary instrumentation (DBI) to create program traces at run-time for subsequent statistical analysis. DeepCT is built upon a novel DBI use case that inserts code into a program code in order to measure program execution times at the granularity of functions. As outcome, DeepCT provides timing statistics on the functional level for each function that is part of the entire call tree, which helps the developer to locate and resolve the leakage sources. This is especially desirable when calls to cryptographic libraries are under test that use numerous subfunctions, e.g., for multi-precision arithmetic. Experimental results for DeepCT are included using the OpenSSL library for an AES T-tables implementation and an RSA decryption. Further, we present results of DeepCT using an intentionally leaking implementation for educational purposes.

Recent Advances in Cyber Situational Awareness and Data-Centric Innovations

1. workshop Measuring and Visualising Data Center Resilience Using Data-Driven Performance Curves

   Edward Austin and Tessa Wilkie

   Owing to the crucial role they play in today's digital society, methods and designs for improving data center resilience have received growing attention in recent years. What has received less attention, however, is the measurement of the resilience of this critical digital infrastructure. This work addresses this by introducing an approach for measuring the resilience of different data centers in terms of their robustness to disruption, and ability to recover from it. A key benefit of our approach is that it is flexible: it does not prescribe the data center performance metrics required to measure resilience, or the type of disruption that affects it. Moreover, we outline how multiple performance metrics can be aggregated to give a bigger picture view of resilience.

2. full Distributed Cyber Situational Awareness: An Architectural Exploration of Epistemic Resilience Strategies for European Cybersecurity

   Antonio Legaz Sanz and Roberto Sáez Ruiz

   This paper addresses a fundamental and underexplored gap in European cybersecurity architecture: the epistemic discontinuity that emerges when institutionally diverse actors consume identical threat data through divergent analytical frameworks, reaching contradictory operational conclusions. Current information-sharing infrastructures systematically strip threat intelligence of the metacognitive dimensions prerequisite to coordinated decision-making under uncertainty. To address this structural deficiency, we propose a Distributed Epistemic Architecture comprising three logic-layer modules: a Frame Articulator, a Context Translator, and a Confidence Calibrator. The architecture is validated through a concrete implementation using STIX 2.1 extension objects, demonstrating that epistemic enrichment is achievable within existing interoperability standards without requiring new wire formats.

3. workshop Cyber-Electromagnetic Anomaly Detection Through Time-Series Analysis

   María Teresa Guillén Navarro, Juan Luis Serradilla Tormos, Sergio López Bernal, Daniel Orlando Díaz López and Gregorio Martínez Pérez

   Military operations benefit from the coordination between kinetic and non-kinetic domains. In particular, the coordination of cyber operations and electromagnetic warfare has become increasingly relevant for gaining operational advantage. This coordination is also relevant for Cyber Situational Awareness (CSA), where the Observe-Orient-Decide-Act (OODA) loop requires monitoring and interpreting evidence from heterogeneous sources. To address this limitation, this work develops and evaluates two anomaly detection models that combine features from both domains. We use the ZBDS2023 dataset, which contains traffic from nodes in a mesh network, including benign and attack behaviors. Two detection approaches are evaluated: a supervised model based on Random Forest and an unsupervised model using LSTM-Autoencoder, achieving an F1-score of 89.76% and 64.09% respectively.

4. workshop Explainable and Interoperable SIEM-Driven Adversary Engagement Based on MITRE Engage

   Daniel Martín García, Carmen Sánchez Zas, Víctor Villagrá González, Andrés Marín López and Sonia Solera Cotanilla

   Modern architectures and information systems are increasingly distributed, heterogeneous, and dynamic. This makes it difficult for Secure Defense Teams to rely only on traditional defensive mechanisms. Although Security Information and Event Management (SIEM) platforms centralize logs and provide actionable information, their alerts often differ in format, detail, and operational context. This paper proposes an adversary engagement model triggered by SIEM alerts and guided by MITRE Engage. The main contribution is an interoperable and explainable model for translating heterogeneous alerts into a common representation, selecting MITRE Engage Goals, Approaches, and activities, and generating a traceable playbook-like output.

19th International Workshop on Digital Forensics / 2nd International Workshop on Artificial Intelligence, Cyber and Cyber-Physical Security

1. workshop Leveraging Remote Attestation for Trustworthy Network Forensics

   Nicolai Kuntze and Robin Krämer

   Monitoring systems for network forensics are only as trustworthy as the software running on them. An adversary who has gained control of a monitoring host can cause every agent on that host - malware scanners, configuration checkers, log collectors, traffic capture daemons - to report a clean, expected state while concealing malicious activity. This constitutes a targeted anti-forensics technique: the attacker weaponises the forensic infrastructure against the investigation itself, and we term the resulting condition a lying endpoint. A compromised host controls its own self-reporting and can therefore never be trusted to accurately describe its own state through purely software-based means. This problem is especially acute during incident response, where responders rely on the very network-monitoring infrastructure that may already have been subverted. In this paper we demonstrate how remote attestation, grounded in Trusted Platform Module (TPM 2) hardware and the Linux Integrity Measurement Architecture (IMA), resolves the lying endpoint problem for network forensics infrastructure. We present a lightweight architecture composed of an attester agent and a central verifier that continuously validates the software state of each monitored host using hardware-rooted evidence that a compromised operating system cannot forge. Device identity is anchored to manufacturer-issued Endorsement Key (EK) certificates; system state is attested via TPM-signed quotes over Platform Configuration Registers (PCRs) augmented by IMA measurement logs; and file-level integrity is checked against a whitelist of known-good hashes. A trust failure is itself an indicator of compromise that can feed directly into incident response workflows.

2. workshop From Plots to Plain Language: Leveraging LLMs for Human-Centric Explanations of XAI Outputs in Digital Forensics

   Zainab Khalid, Farkhund Iqbal and Hamda Al Breiki

   Explainable Artificial Intelligence (XAI) tools such as LIME and SHAP, which are increasingly used in Digital Forensics (DF) to justify AI-driven decisions, present significant usability challenges for non-technical stakeholders. Their visual explanations, like feature attribution plots, are often difficult for forensic investigators, jurors, judges, and law enforcement personnel to interpret meaningfully. This study explores the potential of Large Language Models (LLMs) to translate complex XAI outputs into more accessible, natural language explanations. We evaluate and compare the performance of several state-of-the-art LLMs, including GPT, Gemini, DeepSeek, and LLaMA, in explaining XAI results across various DF scenarios. Evaluation is performed using quantitative metrics, and manual analysis. By introducing this LLM-driven interpretive module to our previously published framework, the research proposes a multi-layered explainability approach that enhances usability of AI models in DF workflows. Our findings highlight the strengths and limitations of each LLM in communicating model behavior, contributing to user-friendly forensic AI systems.

3. workshop Digital Forensic Artifacts of Spylogs from a DS7 Crossback NAC Wave 3 Infotainment Unit

   Patricio Domingues, Hélder Araújo, Miguel Frade and Miguel Negrao

   This paper presents a forensic analysis of spylogs files from the NAC Wave 3 infotainment system of a 2019 Stellantis DS7 Crossback vehicle. Although originally designed as diagnostic instruments for internal software malfunctions and application crashes, spylogs are a significant source of digital evidence that can be acquired non-invasively. This research presents a method for collecting data through the vehicle's Engineering Mode via USB, avoiding any physical disassembly or destructive hardware procedures. Through the analysis of over several million log rows, we identified several forensically relevant artifacts, including GPS coordinates, odometer readings, and engine crank events, which enable the partial reconstruction of a vehicle's movements and usage patterns. Furthermore, the study demonstrates the recovery of communication data, such as incoming SMS content, contact names, and Bluetooth MAC addresses of paired mobile devices. To simplify access to forensic artifacts, we provide an open-source Python script that extracts key data from selected portions of the spylogs content. Despite asynchronous logs, high noise-to-signal data, and a 200 MiB storage cap that causes older spylogs to be overwritten, this work shows that spylogs can be a valuable resource for investigations involving vehicles with NAC Wave 3 infotainment systems.

4. workshop The Residual Nondeterminism Gap in Forensic Record-and-Replay

   Jason Wright and Thomas Baldwin

   Record-and-replay is foundational to digital forensic analysis, enabling investigators to faithfully re-execute recorded program behavior for post-incident examination. These systems assume the CPU is deterministic: given identical inputs, an instruction produces identical results. Modern x86 processors violate this assumption through hardware entropy instructions (RDRAND and RDSEED; analogous instructions exist on other ISAs) that return unpredictable values at any privilege level with no existing mechanism for per-process interception. While other sources of instruction-level nondeterminism have been addressed by hardware mitigations (UMIP, CPUID faulting, CR4.TSD), entropy instructions remain a blind spot. We present a taxonomy that distinguishes environmental from entropic nondeterminism, document three concrete failure mechanisms in the widely deployed rr record-and-replay system, and show that the scope of the gap has expanded as libraries silently extend their RDRAND dispatch to new hardware platforms. We analyze the implications for forensic evidence integrity (including silent trace divergence when entropy-derived values affect only data, and adversarial exploitation) and survey the design space for solutions. The gap we characterize affects any process-level record-and-replay system that captures nondeterminism at the syscall boundary, and represents a concrete threat to the reliability of replay-based forensic analysis. 

The 2nd International Workshop on Cybersecurity and Privacy Risk Assessments

1. workshop A PDCA-Based OT Security Framework for Small and Medium-Sized Enterprises: Design and Preliminary Evaluation

   Nico Mexis and Stefan Katzenbeisser

   Small and Medium-sized Enterprises (SMEs) are increasingly reliant on connected Operational Technology (OT), which can include manufacturing machinery, cameras and access control systems, among other things. However, most cybersecurity resources tend to be either too complex or too generic to be of any practical use. This paper presents a concise and practitioner-tested OT security guide designed specifically for SMEs and structured around the familiar Plan-Do-Check-Act (PDCA) cycle. We distilled eight prioritised best practices through a non-systematic and prior systematic literature review, SME surveys, and iterative expert feedback, and iteratively refined and formatively assessed these through a conference workshop, three pilot SMEs, and expert interviews. To help SMEs evaluate and improve their OT security, we also provide a Gantt chart template and five quick self-assessment questions. Our solution's main strength lies in its unique combination of these components.

2. workshop Experience-driven Framework for Risk-Priorization in Leased Datacenters

   Hadi Chamas, Samiha Ayed, Alexandre Reiffers-Masson, Ranwa Al Mallah and Guillaume Antoine

   Leased colocation datacenters have become a critical component of modern digital infrastructure, hosting workloads for hyperscalers, financial institutions, healthcare providers, and cloud platforms. Although much of the cybersecurity literature focuses on tenant-facing cloud services, comparatively little attention has been paid to the operator-managed layer responsible for facility systems, physical security, and critical infrastructure technologies. This layer forms a shared dependency between multiple tenants and can therefore become a source of systemic risk. This paper proposes a structured framework to prioritize cybersecurity domains in colocation datacenters from the operator's perspective. Grounded in operational experience and feedback from DATA4, a European datacenter operator, the approach integrates established security standards and regulatory requirements into an analytical prioritization model aligned with operational objectives. The framework maps NIST CSF 2.0 subcategories to operator security objectives and evaluates cybersecurity topics through a contextualized risk index and interdependency modeling. The methodology is applied to four European colocation campuses operating under comparable technical architectures but different regulatory and geopolitical environments.

3. Best Paper Award Ceremony
4. closing CPRA Closing Speech

AI for Secure and Trustworthy Critical Infrastructure

1. workshop A Unified Privacy-preserving Federated Learning Framework for Horizontal and Vertical Data Partitioning

   Orhan Ermis, Farhad Khalilzadeh, Ruben Marques, Christophe Feltus, Manos Barmpounakis, Wang Heqi, Charalampos Sipetas, Marco Rinaldi, Claudio Roncoli, Chaopeng Tan and Francesco Vitale

   With the recent advancements in the field of computing, machine learning algorithms have increased their popularity in the last decade. Hence, it opened new opportunities for companies specifically for the ones that develop solutions for the digital transformation of businesses. One particular example for such a business scenario can be Connected Intelligent Transportation Systems since they enable to access various resources and enable authorities, stakeholders and citizens to use urban transportation systems in a more efficient manner. Yet, such a transformation comes with the burden of collecting, monitoring, managing and processing large amounts of data while complying with the rules and regulations such as the European GDPR. Therefore, in this work, we propose a unified secure and privacy-preserving federated data and learning framework that is able to operate for both horizontal and vertical data partitioning. Additionally, the framework provides means for introducing an additional privacy layers by incorporating secure aggregation and differential privacy mechanisms.

2. workshop Learning-Aware Anomaly Detection in Secure Federated Learning

   Thanweera Nourin A V and Mahendra Pratap Singh

   Federated Learning (FL) maintains data privacy by keeping raw data locally while facilitating coordinated model training among distributed clients. Nevertheless, model poisoning attacks in which malevolent clients introduce adversarial updates to taint the global model remain a threat to FL systems. By ensuring that the central server sees only aggregated changes, secure aggregation techniques reduce gradient leakage. However, this also prohibits per-client inspection, establishing a fundamental conflict between robustness and privacy. Current secure aggregation-compatible countermeasures mostly depend on magnitude based statistical measures, which are inadequate against subtle poisoning attacks that introduce directional anomalies in the learning curve while preserving the update magnitude. We propose Learning-Aware Anomaly Detection (LAAD), a privacy-preserving framework that enhances robustness in FL by incorporating learning dynamics into subgroup-level anomaly detection.

3. workshop Behavioral Privacy Leakage in Agentic Negotiation: Formalizing and Mitigating Inference Attacks via Randomized Policies

   Barkha Rani

   With the growing pervasiveness of computing, autonomous negotiation agents are becoming increasingly common in areas such as insurance and procurement, negotiating on behalf of their human counterparts. Current approaches to agent-based negotiation privacy focus on protecting users' private information and typically employ cryptographic techniques to that end. However, these approaches fail to address a further, significant channel of privacy leakage: that related to the behavioural properties of a user's negotiation agent that can be observed by the other parties involved in the negotiation, such as the concessions made, the timing of these concessions and the way in which the negotiation is brought to a close. This paper investigates behavioral differential privacy in multi-round negotiation protocols, constructing an adversarial inference framework that operates over observable negotiation traces.

Recent Advances in Cyber Situational Awareness and Data-Centric Innovations

1. workshop Evaluation of APT Simulation Tools: A case study

   Patrick Stöber and Siegfried Hollerer

   Due to the digitalized landscape and interconnected networks, the importance of proper detection of attacks is growing. Detection mechanisms have to be properly configured and tested with realistic threats to effectively defend them. Sophisticated attacks may be mapped to TM methodologies for analysis to get deeper insights into its attack patterns. This paper evaluates commonly used APT simulation tools and compares the expected versus the detected techniques and sub-techniques as observed by endpoint monitoring. The results indicate that each tool executed its simulated attacks differently, leading to a different number of detected techniques. This paper highlights the gap between the theoretical and the practical implementation of current APT simulation tools, as well as the limitations of the detection capabilities of endpoint monitoring tools.

2. workshop Let the Alerts Speak: LLM-Based IDS Alert Interpretation for SOC Triage

   Alina Schärmer, Max Landauer, Florian Skopik, Markus Wurzenberger and Marco Squarcina

   Interpreting the large volume of alerts produced by Intrusion Detection Systems (IDS) each day can be challenging and fatiguing for Security Operation Center (SOC) analysts, especially when encountering a high number of false positives. We present a concept to support alert triage by leveraging Large Language Models (LLMs) to classify IDS alerts and provide decision support for SOC analysts. Of particular interest is the ability of LLMs to distinguish attack-related alerts from false positives and to associate alerts with attack techniques. Our results show that supplying LLMs with additional information, especially carefully chosen few-shot examples and system context, supports effective alert classification.

3. closing Workshop Closing

Main conference paper track

1. full Beyond Theft: How Underestimated Smart Contract Vulnerabilities Enable Extortionware

   Riccardo Preatoni, Christian Scholz, Jens-Rene Giesen, Alessandro Brighente, Lucas Davi and Mauro Conti

   Smart contracts have become essential to decentralized applications and enable secure, transparent automation of agreements. However, their transparency and immutability also make them vulnerable to attacks. Traditional ransomware attacks encrypt data to demand a ransom, but such direct manipulation is impossible with smart contracts due to their immutability. This paper introduces Extortionware, a novel ransomware-inspired attack method that exploits vulnerabilities in smart contracts to demand a ransom without directly withdrawing assets. We explain the Extortionware framework and demonstrate its relevance in practice with three case studies in which attackers could have locked over $465,000 worth of assets. To mitigate this threat, we developed an analysis approach to detect potential Extortionware-relevant vulnerabilities. We evaluate our approach by demonstrating its effectiveness on these real-world case studies and applying it to a dataset of 20,137 Ethereum smart contracts, where the analysis uncovers three distinct instances of Extortionware-like behavior in audited projects.

2. full Should Miners be worried? Detecting Pool-Based Cryptocurrency Mining under Anonymity Preserving Tool

   Richa Gupta, Rachit Bhandari, Jithin S, Bhargav Jani, Vinayak Sharma and Sambuddho Chakravarty

   As governments increasingly regulate/restrict cryptocurrency mining due to financial, environmental, and policy concerns, detecting mining activity at the network level has become an important problem. In practice, miners can evade traditional deep packet inspection by tunneling pool communication through encrypted channels such as VPNs, Tor, or proxies. However, it is unclear whether these mechanisms meaningfully reduce the detectability of mining activity in network traffic. In this paper, we present the first systematic evaluation of whether pool-based cryptocurrency mining remains detectable at the network level under realistic deployment scenarios. Specifically, we investigate whether Stratum-based mining traffic—the de facto standard for pool mining—remains detectable when routed through anonymity-preserving channels such as VPNs and Tor. To answer this question, we design an evaluation methodology that operates exclusively on flow-level metadata and analyze mining traffic across 10 major cryptocurrencies and several widely used public mining pools. Our study includes plaintext traffic, VPN-tunneled traffic (OpenVPN TCP/ UDP and WireGuard), and Tor routed traffic in a realistic campus-gateway environment containing over 20 million background flows. Our results show that mining activity remains distinguishable from background traffic even when encrypted, achieving up to 0.85 precision and 0.88 recall under VPN tunneling, and 0.95 precision and 0.99 recall under Tor. Furthermore, the underlying cryptocurrency can be identified with high accuracy under VPN encryption (0.96 precision and recall), though cryptocurrency identification becomes significantly more challenging under Tor. These findings suggest that encrypted tunneling does not eliminate detectability risk and may provide miners with a false sense of invisibility.

3. SoK SoK: The Illusion of Additive Security: Censorship Resistance Across the Bitcoin Ecosystem

   Marc Schreiner and Pascal Tippe

   While Bitcoin is fundamentally designed as a censorship-resistant payment network, its operational reality faces increasing jurisdictional pressure from state-level sanctions. Current academic research evaluates these vulnerabilities in isolation: analyzing base-layer mining, Layer 2 routing, and federated sidechains using incompatible metrics. This methodological fragmentation obscures how censorship risks cascade across the protocol stack. To bridge this gap, we present a Systematization of Knowledge that introduces a unified, 17-indicator framework to systematically quantify censorship resistance across the Bitcoin ecosystem. Synthesizing 50 academic sources and additional data from January 2026, we demonstrate that censorship resistance inherits hierarchically. We find that while higher-layer protocols offer internal privacy mitigations like onion routing, their ultimate systemic security depends on the unilateral exit-option to a neutral base layer, which federated sidechains currently lack. Furthermore, we identify a critical gap: while advanced cryptographic mitigations like Stratum V2 and trustless rollups exist, operational friction and the pursuit of liquidity efficiency might slow down their adoption. Consequently, transaction flow remains bottlenecked by highly identifiable, centralized corporate entities acting as single points of coercion. We conclude that systemic resilience is currently limited by intermediary vulnerabilities and requires both base-layer upgrades (e.g., covenants) and the broader economic adoption of trust-minimized technologies.

Main conference paper track

1. full Content for Everyone: Detecting Misconfigurations of Android Content Providers

   Christopher Lenk, Tim Lange and Johannes Kinder

   Mobile apps record a plethora of personal and privacy-sensitive data. Within Android, apps can intentionally share data with each other through content providers, with access governed by settings and custom permissions. Misconfiguration of a content provider by a developer can allow an attacker to leak or tamper with private application data. In this paper, we study how content providers protect or do not protect private data in a systematic study on 321,340 Android apps. We identify potentially vulnerable apps using a staged approach employing static and dynamic analysis and are able to validate content provider leaks in 302 apps. In all cases, we successfully access information that is either directly privacy-relevant or would support further attacks. We select ten applications for detailed case studies that demonstrate the effects of data leakage from content providers in practice.

2. full What Enables Trust in IMA-Based Remote Attestation for CVMs?

   Kenichiro Muto and Kuniyasu Suzaki

   Trust in Remote Attestation (RA) based on the Linux Integrity Measurement Architecture (IMA) in Confidential Virtual Machines (CVMs) relies not only on the integrity of measured values, but also on the assumption that the IMA measurement logic remains unmodified. This study empirically evaluates under what conditions this assumption holds in real-world SEV-SNP--based CVM environments. We implemented an evaluation kernel module that dynamically modifies the IMA measurement logic using live patching (kpatch) and kernel probes (kprobe). Using this module, we constructed an evaluation scenario in which measurement values can be altered while maintaining consistency between the IMA log and the vTPM PCR values reported in the Quote, and conducted comparative experiments across Azure, GCP, AWS, and an on-premises environment. Our results show that the feasibility of this scenario strongly depends on the configuration and operational policies of Secure Boot and the Machine Owner Key (MOK). In environments where MOK enrollment is strictly controlled, the kernel modification via the evaluation module is effectively blocked. In contrast, when MOK enrollment is permitted, modification of the measurement logic becomes feasible, and RA based on the modified IMA measurements can still pass verification under a log--PCR consistency model. This study demonstrates that trust in IMA-based RA in CVMs varies depending on operational configuration conditions, and identifies configuration management requirements necessary to preserve trust in IMA-based RA.

3. full WasmStone: enabling transparent execution of standalone WebAssembly applications in Keystone

   Quentin Michaud, Lukas Hertel, Louis Cailliot, Dhouha Ayed, Olivier Levillain and Joaquin Garcia-Alfaro

   Confidential computing is experiencing rapid adoption as organizations increasingly seek to protect sensitive data during processing in cloud and edge environments. As this paradigm matures, there is a growing need for transparent, portable, and auditable solutions. However, existing solutions are often tied to proprietary solutions and architectures, limiting transparency, portability, and security. In this paper, we present a novel secure abstraction layer that combines WebAssembly (Wasm) with the open source RISC-V Trusted Execution Environment (TEE) framework Keystone. Our approach embeds a Wasm runtime inside a Keystone enclave and introduces a multiplexed edge call mechanism to transparently bridge the WebAssembly System Interface (WASI) with the untrusted host operating system, while respecting Keystone's architectural constraints. This design enables unmodified Wasm applications to execute securely inside enclaves without requiring developers to write TEE-specific code. We detail the runtime adaptations required to support the latest version of WASI, discuss design trade-offs, and analyze security implications of host-mediated system calls. We evaluate our prototype using a representative Rust-based web application on both QEMU and a VisionFive 2 RISC-V board. Experimental results show an average overhead of approximately 10% compared to non-enclave execution. Our work illustrates that combining Wasm with an open RISC-V TEE provides a transparent, lightweight, and sovereign alternative to proprietary confidential computing solutions. Our complete solution and all code presented in this paper is reproducible and available as open source.

19th International Workshop on Digital Forensics / 2nd International Workshop on Artificial Intelligence, Cyber and Cyber-Physical Security

1. workshop Revisiting Vul-RAG: Reproducibility and Replicability of RAG-based Vulnerability Detection with Open-Weight Models

   Sabrina Kaniewski, Fabian Schmidt and Tobias Heer

   Large language models (LLMs) have shown strong potential for automated software vulnerability detection, particularly in retrieval-augmented generation (RAG) settings. However, for approaches relying on proprietary models and APIs, reproducibility and replicability remain largely unexplored, raising the question of whether reported results generalize or depend primarily on specific model choices. In this work, we present a reproducibility study of Vul-RAG, a RAG-based framework for source code vulnerability detection that enhances LLMs with high-level vulnerability knowledge. We first replicate the results in a fully local and open-weights setting using the reported open-weight baseline models. We then extend the evaluation to a diverse set of recent open-weight LLMs, including code-specialized, general-purpose, and reasoning models of varying parameter sizes. The results confirm that the findings of Vul-RAG are reproducible under local deployment, but with minor deviations. Across all evaluated models, we observe a performance plateau at approximately 0.30 pairwise accuracy. Notably, this plateau persists even for more recent and advanced models, indicating that improvements in model capacity alone do not substantially enhance performance.

2. workshop Leveraging Code Slicing for LLMs-based Malicious NPM Package Detection

   Dang-Khoa Nguyen, Gia-Thang Ho, Quang-Minh Pham, Tuyet Dang-Thi Anh, Minh-Khanh Vu, Thanh Cong Nguyen, Phat T. Tran-Truong and Duc Ly Vu

   Software supply chain attacks on the npm ecosystem have grown increasingly sophisticated, exploiting obfuscation and complex logic to evade detection. Large language models (LLMs) offer strong semantic code-understanding capabilities but face practical constraints: limited context windows and high inference costs make full-package analysis infeasible, while naive token-based splitting fragments semantic context and degrades accuracy. This paper introduces an LLM-based framework for malicious npm package detection built on code-slicing techniques. We propose an adaptation of taint-based slicing for the npm ecosystem, guided by a curated inventory of JavaScript-specific sensitive APIs, to isolate security-relevant data flows from benign boilerplate. The approach reduces the mean input token count by 99.75% while preserving critical malicious behaviors. The framework is evaluated on over 7000 malicious and benign npm packages using DeepSeek-Coder-6.7B. On the 2537 packages amenable to static taint analysis, taint-based slicing achieves 87.04% detection accuracy, outperforming both a naive token-splitting baseline (75.41%) and a CFG-only static slicing approach (75.65%). These results demonstrate that semantically targeted input representations improve LLM reasoning precision beyond what is achievable by simple size reduction.

3. workshop Evaluating LLMs for Real-World Web Vulnerability Detection

   Sebastian Neef, Luca Jungnickel, Antonio Buchholz, Valene Spence and Vicente Birke Gonzalez

   Large Language Models (LLMs) have emerged as a promising tool for automated vulnerability detection, yet their effectiveness on web-specific vulnerabilities remains to be explored. This work benchmarks six frontier and open-weight models on their ability to detect real-world web vulnerabilities using static analysis in WordPress plugins, including SQL injection, stored cross-site scripting, path traversal, and remote code execution. Using five prompt designs of varying structure, scope, and complexity across three experiment iterations, we aim to answer how model or prompt choice affects vulnerability detection. Our results show that all models are capable of detecting valid security issues, but the detection rate varies depending on the model and prompt. Claude Opus 4.6 achieved the highest web vulnerability detection rate (63%), while open-weight MiniMax M2.5 performs on par with other frontier models (48%). We show that scoped prompts that narrow the vulnerability scope outperform open-ended ones, whereas the prompt complexity has little impact. Surprisingly, no model achieved full reporting consistency across three experiment iterations.

4. workshop How Secure Are LLM-Generated Full-Stack Web Applications? A Multi-Language Security Study

   Parth Patel, Aisha Dal, Nekel Mitchell, Andrew Sanders, Mahdieh Heidaripour and Hoda Maleki

   Large Language Models (LLMs) are increasingly used to generate full-stack web applications directly from natural-language prompts. While prior work has shown that LLM-generated code often contains vulnerabilities at the function or snippet level, much less is known about the security of complete applications, especially when developed by novice users. In this paper, we present a cross-language, application-level security evaluation of ten full-stack web applications generated by GPT-4 and Claude across five technology stacks. Two undergraduate students with no prior experience in secure coding generated the applications using only the web interfaces of the models under a constrained prompting protocol. We evaluated the resulting applications using a hybrid methodology combining static and dynamic security testing. Across the evaluated applications, we identified 275 findings, dominated by security misconfiguration and authentication/session-management weaknesses. Overall, current LLMs can generate functionally complete web applications, but they do not reliably produce security-hardened ones.

International Workshop on securing supply chains and mobile communication

Session chair: Peter Kieseberg

1. workshop Inferring Organisational Supply Chain Dependencies from External Attack Surface Analysis

   Martin Price, Edward Austin, Paul Smith and Nicholas Race

   External Attack Surface Management (EASM) tools allow organisations to view their Internet-facing assets like an adversary could, helping analysts determine where best to protect against cyber attacks. To date, research has focused on the usage of these tools to detect exposed and vulnerable computers. This takes a narrow view of the attack surface and excludes third-party dependencies that can be found in the supply chain, which adversaries now target. We help to address this by proposing an EASM-based methodology that combines open source seed data with traditional online EASM tools. This enables analysts to map the visible parts of this attack surface that could be targeted by an adversary, highlighting shared risks across organisations and identifying targetable single points of failure. We demonstrate our approach on two use cases: mapping multiple levels of the UK Government's digital estate, where we observe systemic dependence on a small number of cloud providers; and on a set of European corporate targets from the Fortune 500, where we identify substantial overlap in third-party vendors. These results show analysts where indirect attacks can have cascading effects across multiple organisations, providing a new view of the risks faced.

2. workshop Supply chain insecurity: Why SBOMs cannot be fully trusted

   Can Ozkan, Xinhai Zou and Dave Singelée

   The SolarWinds attack, which exploited weaknesses in a software update mechanism, highlights the critical need for organizations to have better visibility into their software dependencies and potential vulnerabilities associated with them. The Software Bill of Materials (SBOM) is paramount in ensuring software supply chain security. Under the Executive Order issued by President Biden, the adoption of the SBOM has become mandatory within the United States. SBOMs are being put forward as one of the key pillars in vulnerability management. In this paper, we investigate whether the output of SBOMs can be trusted under the assumption that a so-called codebase attacker is present. Our research reveals that the SBOM generation process across popular programming languages is susceptible to stealthy manipulation, leading to significant supply chain insecurities and organizations falsely believing that their software assets are free from vulnerabilities. Our analysis also revealed several security shortcomings in popular SBOM consumption tools. To address these security issues, we analyze the use of public repositories for software libraries to validate the integrity of the dependency information within an SBOM and demonstrate the feasibility of this approach by a proof-of-concept implementation.

3. workshop A Propagation Model for SSC Attacks: Why SBOM Tools Do Not Tell the Whole Story

   Ljubica Grgic, Lazar Maksimovic and Pavel Laskov

   Ensuring the security of software supply chains (SSC) has become indispensable in today's ecosystem of highly complex software products. The Software Bill of Materials (SBOM), together with the associated tools, has emerged as a pragmatic approach to improving software transparency, particularly in response to growing SSC attack risks. However, both the SBOM concept itself and the capabilities of existing SBOM tools exhibit substantial practical limitations. In particular, their vulnerability detection and interpretation capabilities are insufficient to explain exploitability effects that propagate through complex software supply chains. To address this gap, we propose a propagation-centred approach to SSC security and introduce a four-stage propagation model. We empirically evaluate four open-source SBOM tools against each stage of the model using three software projects and the Log4j vulnerability as a case study. Our results show that current SBOM tools systematically support only Stage 1 (Structural Exposure) and Stage 2 (Vulnerability Class Presence), whereas Stage 3 (Code Reachability) and Stage 4 (Taint Path Analysis) require capabilities that extend beyond the current SBOM ecosystem. We argue that placing propagation effects at the centre of SSC security research is essential to prevent cyber risks from evolving into systemic risks.

AI for Secure and Trustworthy Critical Infrastructure

1. full Small Models, Big Standards: Can Low-Compute LLMs Recall ISO 27002:2022 Control Guidance?

   Rohit Negi, Rishik Jain and Sandeep K Shukla

   Large language models are increasingly proposed for the automation of cybersecurity policy compliance workflows, but state-of-the-art systems typically rely on closed-source APIs or GPU-class infrastructure that many organizations — particularly small and medium enterprises — cannot afford. This paper investigates whether open-weight, low-resource language models that run on commodity CPU hardware retain enough knowledge of international information-security standards to be useful for policy compliance automation. We construct a benchmark from the 93 controls of ISO/IEC 27002:2022, treating the standard's per-control purpose, implementation guidance, and other information fields as ground-truth references. Several open-weight models deployable without GPUs, alongside closed-source frontier models as an upper-bound reference, are prompted to reproduce these fields for each control. We score each such generation against the reference text using sentence-embedding cosine similarity.

2. workshop Trustworthy AI in Warfare: Autonomous Weapons Systems, Meaningful Human Control, and Legal Constraints on the Protection of Critical Infrastructure

   Yulia Razmetaeva

   This paper examines the intersection of AI-supported warfare, particularly autonomous weapons systems (AWS), and international legal frameworks, with a focus on international humanitarian law (IHL), human rights law, and just war theory. It argues that increasing autonomy in weapon systems challenges established assumptions concerning accountability and compliance with the principles of distinction, proportionality, military necessity, and humanity. Particular attention is devoted to the concept of meaningful human control as both a normative and operational requirement for the lawful and trustworthy development and deployment of AWS. The paper further argues that meaningful human control should not be limited to operational oversight during the use of AI systems, especially in adversarial attacks and the defence of critical infrastructure, but must instead function throughout the entire lifecycle of AI systems, including design, model training, testing, and deployment.

Sustainable security and Awareness For nExt generation infRastructures

1. workshop An Analysis of the Impact of Psychological Factors and Techniques Across Different Types of Social Engineering

   Helin Omer and Daniela Pöhn

   Phishing is a well-known social engineering (SE) type used to trick individuals into revealing personal information or performing desired actions, like downloading and installing malware. Other SE types, like vishing and smishing, have emerged and are increasingly being used. As SE continues to successfully persuade victims into actions, the questions arise of which SE attack types are most effective for specific psychological factors (PFs) and, conversely, which PFs are most effective for particular attack types. To answer these questions, we conducted a laboratory study with n=12 participants, in which each participant was shown all 25 stimuli (five PFs and five SE types). The results of this study show that the most effective SE attack type for authority, trust, and greed was spear-phishing. The most successful combination of PF and attack type was spear-phishing using greed. The least successful combinations were pop-ups using authority, smishing using authority, and vishing using curiosity, each having had no success at all.

2. workshop ABAC-NDN: An Open-Source Security Library for Attribute-Based Access Control in NDN

   Ferhat Mecerhed, Youcef Imine, Antoine Gallais, Stefan Fischer and Mohamed Ahmed Hail

   Named Data Networking (NDN) introduces a data-centric communication paradigm with inherent benefits such as multicast delivery, in-network caching, and built-in integrity. However, it also raises new challenges for data confidentiality and access control. Attribute-based encryption (ABE) has emerged as a powerful cryptographic primitive for enforcing fine-grained access control centered on attributes rather than identities, making it a natural fit for NDN. While several ABE-based access control mechanisms have been proposed in the NDN literature, none, to the best of our knowledge, provide a publicly available implementation nor a detailed description of a reusable library design for NDN. In this paper, we present ABAC-NDN, the first open-source library implementing a decentralized Attribute-Based Access Control scheme for NDN. The library enables NDN entities to operate as authorities or clients, providing automated configuration of security parameters, key management, and attribute revocation for authorities, while supporting fine-grained access control and secure data exchange for producers and consumers. Its modular architecture enables easy integration with existing NDN applications and supports future extensions, effectively connecting theoretical attribute-based encryption schemes with practical security solutions for NDN.

3. workshop Bridging Digitalization Gaps: OCR and NER for Crime Report Automation in the Italian Criminal Justice System

   Samuele Yves Cerini, Nicola Deidda, Sara Lilli, Maria Vittoria Zucca, Giorgio Fumera, Giorgio Giacinto and Paolo Prinetto

   In the Italian judiciary system, Public Prosecutors' Offices still rely on heterogeneous and partially paper-based document workflows, where crime reports and related attachments are often printed, manually signed and annotated, scanned, and finally stored as imagebased files. As a consequence, a significant portion of prosecutorial documentation remains only partially machine-readable, limiting the effectiveness of digital case-management systems. In this context, Optical Character Recognition (OCR) and Named Entity Recognition (NER) are enabling technologies that transform unstructured, non-searchable judicial documents into computationally usable legal information. This paper analyzes the technical, organizational, and legal challenges associated with OCR-based processing of crime reports, in the Italian and foreign jurisdictions, and identifies the main methodological requirements for governance-aware NER models used in judicial environments. These include layout-aware document analysis, legal-domain adaptation, human-in-the-loop validation, and privacy-aware processing mechanisms that support pseudonymization and controlled access to sensitive data. Finally, the paper discusses the broader topic of computer-aided judicial digitalization, highlighting the need for reliable, privacy-aware pipelines capable of processing documents at scale in contemporary criminal justice systems.

4. workshop SentiSteg: A Linguistic Steganography System Based on Sentiment Recognition

   Bartosz Gutowski, Karolina Gabor-Siatkowska and Artur Janicki

   In this paper, we propose a novel linguistic steganography system called SentiSteg. It is based on generating or forwarding microblog posts (such as former Twitter tweets or X platform posts) so that their sentiment forms a desired binary sequence. We demonstrate a proof-of-concept of SentiSteg and run preliminary experiments using posts from the FIFA World Cup 2022 dataset. We show that the proposed method allows hiding an arbitrary binary message. We discuss the steganographic bandwidth offered by SentiSteg and the detectability of the proposed method.

Main conference paper track

1. full AGORA: Human-Supervised Automated Recommendations for Cybersecurity Compliance Auditing

   Jonathan Christof Orth, Alessandro Palma and Marco Angelini

   Ensuring compliance with cybersecurity standards is essential for maintaining auditable, consistent, and legally aligned security processes. Manual compliance from security experts may be prone to subjectivity, cost, and possible bias during the assessments. On the contrary, full automation may lack accountability and present corner cases where a human analysis is crucial to correctly assess the situation. Existing compliance management approaches emphasize technical enforcement, while the procedural dimension that governs security activities is less explored. This paper introduces an audit support system that unifies technical compliance, process compliance, and automated recommendations. Grounded in international standards and research, the system formalizes compliance requirements and models analytic utilization regarding the execution of security governance processes (specifically, Incident Management) against relevant standards. It enables automatic auditing through conformity assessment and contextualized recommendations using process trace alignment and generative AI, with human oversight. Evaluation through two case studies, expert reviews, and quantitative analysis shows the system delivers accurate, context-aware compliance insights.

2. full Securing The Forgotten Link: Selecting and Evaluating Compensating Security Measures for Legacy Device Integration Paths

   Sabrina Kaniewski, Nils Lohmiller, Michael Menth and Tobias Heer

   A common solution to integrating older devices without state-of-the-art security features, i.e., legacy devices, in industrial networks is the use of security gateways. The gateway sits between the legacy device and the network and can enforce features such as authentication and encryption. However, the gateway secures only the communication on the network side but does not mitigate the absence of security features in the legacy device. Consequently, the link connecting the legacy device to the gateway, which we refer to as legacy link, remains vulnerable and unaddressed. In this work, we provide a systematic analysis of compensating security measures to address this vulnerable legacy link. We examine physical, technical, and operational measures, assessing their ability to prevent or detect physical tampering and unauthorized access to communication. For a structured comparison of their effectiveness, we introduce an evaluation framework that considers detection properties, applicability specifics, costs, attack mitigation, and adherence to security controls from international standards (i.e., ISO/IEC 27002 and ISO/ IEC 62443). Using this framework, we discuss two use cases to demonstrate how practitioners can derive complementary measures to form minimal yet effective security concepts tailored to specific environmental and regulatory constraints. This work supports practitioners in enhancing the secure integration of legacy devices in diverse industrial domains.

3. short Beyond the Roots: Exploring the Intermediate CA Ecosystem in the Web PKI

   Mauro Farina, Martino Trevisan and Alberto Bartoli

   Certificate Authorities (CAs) are a cornerstone of web security, as browsers and applications fully trust authentication assertions issued by them. Root stores in user devices contain the CAs that serve as trust anchors for certificate validation. However, these root CAs often extend their authority to organizations outside their administrative boundaries, known as intermediate CAs. Although root stores have been extensively studied in previous work, intermediate CAs have received little attention, despite their equivalent authentication capabilities and crucial role in determining the actual perimeter of trust. This work provides the first systematic overview of the intermediate CA ecosystem in the Web Public Key Infrastructure (Web PKI). Starting from the Mozilla root store, we investigate over 1800 CA certificates and find that trust extends well beyond the root store: 150 additional CAs from 18 countries not represented among root CAs are implicitly trusted by any relying party. We show that root CAs delegate trust to intermediate CAs in countries with substantial political distance from their own, substantially expanding the geopolitical diversity of trusted certificate issuers. Finally, by cross-referencing our dataset against Certificate Transparency Logs, we identify CAs that violate Mozilla's mandatory disclosure policies, further undermining the ecosystem's transparency.

4. short A Comparison of Kubernetes Compliance Standards and Configuration Scanners

   Michael Krieger, Markus Gierlinger, Farooq Shaikh and Mario Kahlhofer

   Kubernetes has become the industry standard for orchestrating containers in microservice-based software architectures. While several hardening guidelines and scanning tools for securing Kubernetes clusters and deployments have emerged in recent years, their differing guidance and outputs often lead to inconsistent configuration and prioritization decisions. This work presents the first structured comparison of eight commonly used Kubernetes hardening guidelines. Through this comparison and the addition of best practices, we established a benchmark of 79 Kubernetes configuration recommendations and conducted the first structured assessment of 10 popular static configuration scanning tools and their scoring outputs. Our findings reveal substantial disparities in the coverage of configuration issues across hardening guidelines and scanners, as well as inconsistencies in how configuration issues are scored and ranked by different scanners. These results highlight the need for more standardized, transparent, and consistent approaches to risk and severity assessment of Kubernetes configuration issues.

Main conference paper track

1. full Varys: A Testbed to Automate Interactions with Voice Interfaces

   Shiva Parsarad, Anastasiya Merkushova, Milan Van Zanten and Isabel Wagner

   Devices with voice interfaces, including voice assistants (Apple Siri, Amazon Alexa), AI assistants (Plaud Notepin, Omi AI), and smart toys (Grok Curio, Miko 3), are increasingly common in everyday life, raising privacy concerns about whether encrypted network traffic can reveal the spoken commands issued by users. Studying such traffic fingerprinting attacks requires large datasets of interactions with voice interfaces. Previous research often relied on limited or manually collected traces, which restricts reproducibility and large-scale evaluation. In this paper, we present Varys, a modular and extensible testbed for large-scale, automated collection of interactions with voice interfaces. Varys records encrypted packet captures together with query and response audio, transcripts, and structured metadata, enabling reproducible experimentation. Using this framework, we release large-scale datasets for Siri and Alexa and reimplement representative fingerprinting pipelines from prior work. We evaluate fingerprinting performance under increasing label cardinalities and across semantic categories. Overall, fingerprinting performance decreases as the number of possible commands increases, with a particularly sharp decline for Alexa. Across settings, Siri traffic remains more distinguishable than Alexa traffic.

2. full MIPSBLEED: Uncovering Microarchitectural Timing Leaks in Pervasive Embedded Processors

   Ahmed Najeeb and Billy Brumley

   Despite their age, MIPS processors remain deeply embedded in routers, industrial controllers, and IoT systems, yet their security against modern side-channel attacks has received little attention. This paper exposes how Simultaneous Multithreading (SMT), a feature increasingly used to boost performance in these environments, creates powerful cross-core timing channels on MIPS-based platforms. We introduce MIPSBLEED, a systematic analysis and exploitation framework that uncovers leakage in three shared microarchitectural components: the L1 data cache, L1 instruction cache, and the execution engine. Through carefully crafted assembly-level probes and quantitative leakage assessment, we demonstrate practical, high-resolution timing attacks that operate without requiring privileged access. Our evaluation reveals significant information leakage across all three channels and culminates in a single trace key recovery attack on a real elliptic curve cryptographic toolkit. These results position MIPS as an overlooked yet critical target in the study of microarchitectural security and underscore the urgent need for lightweight isolation mechanisms in resource-constrained, SMT-enabled embedded systems.

3. short SimTIM: A Temporal Cybersecurity Simulator

   Noah Niclas Behrisch and Zoltán Ádám Mann

   Companies and other organizations are increasingly exposed to cyber threats. To effectively prepare their defense, organizations need to understand possible attacks and their implications, as well as the effects of possible countermeasures. These insights are necessary for making sound decisions on where to focus the organization's efforts: e.g., which nodes are especially critical and need hardening, how to optimize the network topology, how to best implement intrusion protection etc. This paper presents simTIM, a simulator that helps organizations obtain clarity about these aspects, thus enabling sound decision making on cyber defense. The simulator is model-based, built on the TIM meta-model introduced in recent work. simTIM allows the modeling of the organization's IT assets, potential attacks and their effects, and mitigations. simTIM supports probabilistic reasoning, temporal aspects, partial observability, and financial incentives. With simTIM, organizations can easily perform what-if analysis to assess the implications of different cyber defense strategies. The paper describes the design and implementation, and illustrates the practical use of simTIM.

4. short Hardening OS Schedulers to Mitigate Concurrency Vulnerabilities

   Pierre Graux and Gilles Grimaud

   Concurrency bugs occur when a resource is accessed by several entities without proper synchronization. These bugs can lead to highly critical vulnerabilities, including kernel and software CVEs. That is why numerous studies have already explored how to detect and prevent the introduction of concurrency bugs in programs and source code. However, little attention has been given to mitigation techniques aimed at preventing the exploitation of remaining concurrency vulnerabilities. Instead, security relies only on hindering exploitation steps that follows the vulnerability triggering. This article explores how operating system schedulers can be hardened to mitigate the exploitation of concurrency vulnerabilities. Such exploitation consists of triggering specific scheduling orders between entities that invalidate the property of the accessed resource. Drawing inspiration from successful mitigation techniques such as ASLR, the Linux EEVDF scheduling algorithm is modified to lower its predictability so that an attacker cannot determine when the target is executing and fails to reliably trigger the exploit within the vulnerability window. To ensure that the proposed techniques are practical, the evaluation is conducted against the exploitation of real-world CVEs. We show that implementation of our techniques are effective against these exploits. We also show the existence of a trade-off between the execution time overhead introduced by the scheduler modification and the resulting security guarantees. These promising results advocate the conception of new scheduling algorithms that integrate unpredictability by design.

1. workshop Semi-Supervised Novel Intrusion Detection via Orthogonal Feature Extraction and Score-Space Meta-Classifier Assembly

   Minh-Khanh Vu, Laurent Mounier, Cristian Ene and Mathias Ramparison

   Signature-based endpoint detection fails against novel payloads whose behavioral patterns do not match any catalogued specimen. A semi-supervised host-based intrusion detection system is introduced that decomposes each system-call window into three structurally independent views, each trained exclusively on benign traces: frequency and rarity (TF-IDF with a one-class SVM), local topology (a 1D convolutional autoencoder), and chronological grammar (a GRU next-event predictor). The three anomaly scalars are assembled into a score-space meta-matrix over which an XGBoost layer learns the final decision boundary without accessing raw syscall sequences or malware signatures directly. On the ADFA-LD 32-bit benchmark, the fusion model achieves AUC 0.9113, AUPR 0.8950, and F1 0.8523 at a full-pipeline latency of 0.2217 ms per window. Per-family evaluation across six attack families yields average AUC 0.9073, and cross-path Pearson correlations of 0.43 to 0.46 indicate that the three views occupy productively distinct operating regimes and increase the number of behavioural constraints an attacker must preserve to evade detection.

2. workshop Automatically Benchmarking Biases in ML-based WAFs

   Hamza Sajjad and Gabriele Costa

   Web Application Firewalls (WAFs) are the first line of defense, inspecting incoming HTTP requests to detect malicious payloads. Distinguishing between malicious and benign payloads is complex, and universal criteria do not exist. In recent decades, Machine Learning (ML) has emerged as an alternative to rule-based WAFs, using trained models instead of manually crafted rules. However, the reliability of ML-WAFs is questionable, mainly due to recurrent biases and the lack of a standardized assessment framework. This paper introduces a benchmarking framework to systematically identify and measure biases in ML-WAFs, evaluating dataset diversity, training validity, and evaluation robustness. We conduct an in-depth case study on WafBrain and further validate the proposed framework by applying it to the Barracuda WAF, a widely deployed commercial product. Such biases determine inflated performances in controlled environments, but they make WAFs fragile in adversarial settings.

3. Best Paper Award Ceremony (WSDF and AI&CCPS)
4. closing Wrap-Up

International Workshop on securing supply chains and mobile communication

Session chair: Peter Kieseberg

1. workshop Tapis: Android Tracing Tool for Framework-Wide Scalable Analysis

   Benoit Picot, Pierre Graux, Nicolas Dejon and Gilles Grimaud

   Static analysis of Android malware faces growing difficulty due to increased obfuscation, dynamic code loading, and abuse of system permissions. As a result, behavior identification often depends on dynamic analyses that trace parts of Android execution. However, existing dynamic analyses typically provide limited context about how an application interacts with the framework at runtime. To characterize this gap, we manually analyze six recent samples from the Android malware landscape. We identify recurring patterns in which the Android and Java frameworks are abused and hijacked to carry out malicious behaviors, evade analysis, and appear benign to users. We present Tapis, a system that traces application interactions with the Android framework at the Java API level. Tapis instruments the framework by inserting trace points directly into its bytecode, while accounting for the control-flow patterns of the Android framework. This architecture does not depend on changes to the framework code itself, and it enables Tapis to generically hook any number of Android and Java APIs. Our evaluation shows that the approach scales to large numbers of hooks and outperforms off-the-shelf tools used by security analysts.

2. workshop Evaluating robustness of manifest-based malware detection methods for Android OS

   Szymon Tokarski, Paweł Moszczyński and Wojciech Mazurczyk

   In this paper, we investigate the vulnerabilities of AI-based malware detection methods that rely on Android application manifest files. Specifically, we analyze two approaches: permission-based and manifest-based, to evaluate their robustness against adversarial manipulations and demonstrate various pitfalls that can weaken their reliability and effectiveness. Our study reveals that a permission-based approach faces severe limitations due to the presence of identical permission sets in both benign and malicious applications. This ambiguity introduces vulnerabilities that attackers can exploit by developing malware with common permission sets. While those models achieve high accuracy, we show that this does not translate to robustness on larger or more diverse datasets. We also evaluate MalBERT, a state-of-the-art manifest-based malware detection method that processes the full manifest file using a transformer-based model, BERT. By leveraging the Local Interpretable Model-Agnostic Explanations (LIME) framework, we identify which variables most influence classification outcomes. Our experiments demonstrated that the model is highly sensitive to specific manifest fields, as well as to manipulations of the manifest structure. Even minor changes can drastically alter model predictions, exposing critical weaknesses.

10th International Workshop on Cyber Use of Information Hiding

1. workshop On the Effectiveness of Side-Informed Steganography in Diffusion-Generated Images

   Daniel Lerch-Hostalot and David Megías

   Recent advances in text-to-image diffusion models have led to the widespread use of AI-generated imagery, raising new questions regarding their suitability as steganographic carriers. While most prior work has focused on embedding information directly in the latent space of generative models, considerably less attention has been paid to spatial-domain embedding in the final synthesized images. In this work, we investigate the effectiveness of side-informed spatial-domain steganography in images generated by diffusion models. We show that the quantization and rounding operations inherent to the image synthesis pipeline provide valuable side information that can be exploited by modern cost-based embedding schemes. Through extensive experiments using HILL and UNIWARD and evaluating detectability with state-of-the-art steganalysis networks, including SRNet, a dedicated steganalysis architecture, and EfficientNet-B0 as a general-purpose CNN baseline, we demonstrate that payloads of up to 0.10 bits per pixel remain consistent with chance-level detection under the evaluated protocol. Our results show that incorporating quantization residuals as side information substantially reduces detectability. In particular, at 0.10 bpp, side-informed HILL and UNIWARD achieve near chance-level performance against both SRNet and EfficientNet-B0 under the evaluated same-source supervised steganalysis setting.

2. workshop A Warden to Analyze and Counter Stegomalware Activities

   Friedrich Gross, Denis Petrov, Pascal Ruffing, Sebastian Zillien and Steffen Wendzel

   Malware has increasingly been observed using covert communications. However, it is possible to perform network-level counterattacks against such malware. For this purpose, the connection may be manipulated in a way that causes malware to reconnect frequently, slow down the execution of instructions, or even cause fail-states in the malware. We present a highly configurable and scalable active warden capable of performing such countermeasures in a lab environment. Its purpose is to provide the scientific community with the ability to arbitrarily edit packets in real time to aid in malware analysis and the development of countermeasures. Our implementation has multiple manipulation options available, including the ability to search a packet for regular expressions and subsequently replace specifiable occurrences of these. The warden can also provide cross-packet protocol field tracking to precisely target a packet in a sequence. Packet manipulation is performed in real-time and entirely in-flow. Furthermore, the warden is evaluated against remote access tools commonly used for malicious purposes. We show that it can be used to cause targeted erroneous behavior in command-and-control servers and debilitate the connection without outright dropping it. We also evaluated its effects when deployed against legitimate browser traffic.

3. workshop Towards Environment-derived Bytecode Generation for Virtualization-Based Obfuscation

   Anatoli Kalysch

   Virtualization-based obfuscation hides original executable logic behind a custom virtual machine, but the VM bytecode must reside somewhere in the binary as inspectable data, exposing executable semantics to static analysis regardless of how well access to that data is guarded. We ask whether a compact learned model can instead implicitly encode these semantics: emitting the correct instruction sequence on demand when conditioned on a matching environment fingerprint, and producing structurally plausible but semantically incorrect output otherwise. Hence we present the first feasibility study for environment-learned bytecode generation comprising a custom stack-based VM with seed-randomizable ISA, a GRU encoder-decoder conditioned on a 23-dimensional environment-function vector, and a fully reproducible synthetic evaluation framework. A 238K-parameter GRU achieves an exact-sequence-matching rate of ESM = 0.948 (95% CI [0.874, 0.980], n=77) when the correct environment is supplied, stable across three independent training seeds (0.909 ± 0.028; per-seed: 0.948, 0.896, 0.883). Our test set also evaluates distractor robustness, not generalization to unseen ISA seeds. An unconditioned ablation collapses to ESM = 0.013 (∆ESM = 0.935), establishing that the environment conditioning is load-bearing. On wrong-environment inputs, our model's CMR is 0 on 1,200 probes; the model instead produces sequences matching other valid training targets 67.3% of the time (95% CI [0.646, 0.699]) – a camouflage-like behavioral property at the probing-signal level. However, this property does not prevent recovery via faithful dynamic execution on the actual target environment due to its size. While the current prototype spans merely 64 enumerable environments, with 8 distinct underlying ISA seeds at most, making exhaustive probing feasible. To scale the concealment barrier to practical levels the environment space needs to grow, which is quite feasible on modern environments. Our results establish this positive feasibility on controlled synthetic benchmarks; scaling implications are discussed candidly.

4. workshop Hiding in Plain Documents: PDF Steganography Techniques, Detection, and Criminal-Use Implications

   Manan Jain and Sandro Wefel

   The Portable Document Format (PDF) is structurally rich, internally composed of objects, streams, metadata, and content operators, which means many modifications can be made without changing what appears on the page. This paper presents a taxonomy of PDF steganography techniques organized by embedding domain (metadata, structure, content streams, media, hybrid), combined with a large-scale empirical study and classifier-based detection evaluation. We embed short UTF-8 text messages into over 18,000 unique PDFs across more than 373,000 runs using four representative methods, and measure structural impact, entropy change, and statistical deviation. We train classifiers (Random Forest, SVM, LightGBM) for binary stego detection, achieving 0.832 ROC-AUC and 0.851 average precision with RF despite a 20.7:1 class imbalance, and for four-class method attribution (0.864 accuracy, 0.510 macro-F1). As an embedding-lifecycle robustness check on the Chunk 5 Stego Dataset subsample, we re-process already-generated stego PDFs with fixed normalizers: pikepdf re-save preserves exact payload extractability for xref (100%), xmp (92.4%), and a0 (100%), while Ghostscript pdfwrite with /prepress destroys almost all payloads (only 4/65,677 exact matches overall). We frame these results within three threat scenarios relevant to criminal use: insider data exfiltration, manipulation of LLMs that parse untrusted PDFs, and steganographic files that evade malware scanners. No single method dominates on all axes; the appropriate choice depends on the expected document lifecycle and threat model.

23rd International Workshop on Trust, Privacy and Security in the Digital Society

1. workshop Enabling Decentralized Identities in Metaverses Leveraging Self-sovereign Identity

   Fahmidur Iqbal Swapnil, Anthonio Alex D Costa, Arpita Saha, Abdul Hye, Faysal Mohammed Abir, Md Yeasin Ali, Masum Alam Nahid, Sagar Karmoker, Md Faisal Ahmed, Mohammad Jabed Morshed Chowdhury and Md Sadek Ferdous

   Metaverse is a virtual world which is gaining popularity in recent years. In order to ensure a seamless and secure service access, a metaverse needs to deploy an identity management system. Unfortunately, the widely used identity systems are centralized in nature, exhibiting many security and privacy issues. Integrating any centralized identity system into a metaverse is thus problematic. In order to mitigate this issue, we present a fully operational Self-sovereign Identity (SSI) based decentralized identity solution for metaverses. We present its architecture which is based on a rigorous threat model, discuss it implementation details, protocol flow and use-cases along with a security and privacy analysis. Furthermore, the solution introduces a complementary web wallet that allows users to authenticate without mobile device as required in SSI stacks, eliminating the need to unmount VR headsets during the authentication process. With these contributions, this work represents one of the most comprehensive SSI-based decentralized identity solutions for metaverses.

2. workshop A Query Execution Integrity Proof Protocol Using TDX Remote Attestation

   Taisho Sasada, N’Guessan Yves-Roland Douha and Bernard Ousmane Sane

   In use cases where confidential data is entrusted to a database server managed by a cloud provider, an attacker with hypervisor-level privileges inherently possesses the ability to tamper with the database execution process and returned data. It is therefore essential to provide a mechanism by which clients can post-verify query execution based on cryptographic evidence. Recently, Trusted Execution Environment (TEE) technologies, which isolate execution environments at the hardware level and provide verifiability, have been considered effective against such threats. However, the Remote Attestation mechanism of Intel TDX, a representative TEE implementation, is limited to static environment attestation at boot time and cannot guarantee the integrity of individual queries executed after startup. Consequently, establishing a protocol that systematically achieves per-query verifiability has remained an open challenge. In this work, we propose QueryAttest, a protocol that extends the TDX attestation mechanism to the granularity of query execution, thereby guaranteeing the integrity of execution contents. QueryAttest operates as an external wrapper that can be deployed without modifying the existing database engine. It constructs attestation data within the TDX environment that integrates the query request, the selected execution plan, and the execution result. By presenting this data to the client together with a hardware signature, post-verification that excludes intervention by privileged attackers is made possible.

3. workshop Authenticity Completeness: Why SMTP Authentication Extensions Fail

   Ye Li

   Deployed SMTP authentication extensions, including SPF, DKIM, and DMARC, are authentication-observing systems: they compute authentication results but do not force subsequent delivery behaviour to depend on those results. As a consequence, no deployed mechanism guarantees that only successfully verified messages can enter an authenticated presentation state, where a message is presented to the recipient as originating from the claimed sender identity without requiring further authentication decisions. This paper formalises this missing property as authenticity completeness, defined as a safety property over all execution paths of an email system. The paper makes three contributions. First, it formally defines authenticity completeness using a labelled state-machine model together with the Authenticated Delivery Invariant, where the set of messages accepted as authentic must be a subset of the set of successfully verified messages. Second, it proves that deployed domain-based authentication mechanisms structurally cannot satisfy this property because of coarse identity granularity, optional enforcement semantics, and multi-valued delivery outcomes, and derives a general impossibility result for all authentication-observing architectures. Third, it constructs a minimal authenticated-delivery witness that satisfies authenticity completeness by design and proves its correctness through six state-machine invariants. Together, these results establish authenticity completeness as a necessary condition for end-to-end sender authenticity, while demonstrating both why existing mechanisms cannot achieve it and how it can nevertheless be achieved architecturally.

4. workshop Enhancing User Privacy in Gamified Applications: A Structured Approach to Analysing Data Flows and Risks

   Aikaterini-Georgia Mavroeidi, Vasiliki Diamantopoulou, Christos Kalloniatis and Stefanos Gritzalis

   Gamified applications are widely used across domains such as education, healthcare, and the workplace, offering a way to improve user engagement and motivation. However, their collection and processing of personal data pose significant privacy challenges. This paper examines how gamified systems manage user data and proposes a structured approach to support privacy-risk analysis by mapping system modules to the data elements they process and examining their structural interrelations. To this end, we examine the elements and data that, if compromised or misused, can harm users' privacy. Building on this analysis, we explain how data elements connect to privacy risks and derive practical safeguards for privacy-aware design. The findings suggest that while gamification can increase user motivation and engagement, it simultaneously creates additional opportunities for privacy violations, especially where authentication, profiling, analytics, and interaction features are tightly coupled. The study concludes by highlighting the importance of integrating privacy-by-design principles when developing gamified systems and by discussing the limitations of a connectivity-based assessment.

The 5th Workshop on Cybersecurity in Industry 4.0 and Beyond

1. Welcome
2. workshop A Hardware-Integrity Architecture for Remote Attestation of Safety-Critical Embedded Systems

   Michael Eckel, Georgios Gkoktsis, Anselm Angert and André Rein

   Remote attestation is a well-established mechanism for verifying the software and firmware state of embedded systems, yet it offers only limited support for assessing hardware integrity. This limitation is particularly relevant for safety-critical embedded and cyber-physical systems, where subtle hardware manipulation, component replacement, or degradation may affect trustworthiness without necessarily changing the measured software state. In this paper, we present a hardware-integrity-aware remote attestation architecture that incorporates analog hardware measurements into established attestation workflows. Our approach integrates such measurements as interoperable attestation evidence within CHARRA-and CEL-based environments, thereby extending existing remote attestation ecosystems rather than replacing them. We describe the architecture, its supporting implementation components, and its integration into a demonstrator on a medical IoMT platform, which serves as a representative safety-critical embedded setting. Furthermore, we evaluate the ability of the approach to distinguish between different hardware configurations and to support appraisal beyond conventional software-centric evidence.

3. workshop Evaluation of Trusted Computing Technologies for Cyber-Physical Systems

   Dominik Lorych, George Gkoktsis, Christoph Krauß, Michael Eckel and Christian Plappert

   The complexity and security requirements of cyber-physical systems are rising with Industry 4.0, autonomous driving, and energy-system digitization. This also includes small embedded controllers and sensors, which often contribute in safety-critical processes. However, advanced security mechanisms are often infeasible here due to cost and resource limitations. The Device Identifier Composition Engine (DICE) addresses this by implementing a measured boot system, targeting resource-constrained systems. The DICE Protection Environment extends this with a protected environment for cryptographic secrets for increased protection. In this paper, we evaluate the security properties of DICE and DPE in the context of resource-constrained cyber-physical systems. We propose an empirical comparative framework that assesses these technologies across multiple criteria. Our methodology is designed to be suitable for many use cases and trust anchors. Our evaluation shows that DICE offers the best performance and lowest hardware cost but provides weaker protection against SL3/SL4 attackers, while local and remote DPE variants improve protection of long-term secrets at the cost of additional hardware or backend infrastructure.

Agentic AI for Cybersecurity

1. Welcome
2. workshop RedShell: A Generative AI-based Approach to Ethical Hacking

   Ricardo Bessa, Rui Claro, João Trindade and João Lourenço

   Large Language Models (LLMs) are redefining offensive cybersecurity by allowing the generation of harmful machine code with minimal human intervention. While attackers take advantage of dark LLMs such as XXXGPT and WolfGPT to produce malicious code, ethical hackers can follow similar approaches to automate traditional pentesting workflows. In this work, we present RedShell, a privacy-preserving, hardware-efficient framework that leverages fine-tuned LLMs to assist pentesters in generating offensive PowerShell code targeting Microsoft Windows vulnerabilities. RedShell was trained on a malicious PowerShell dataset from the literature, which we further enhanced with manually curated code samples. Experiments show that our framework achieves over 90% syntactic validity in generated samples and strong semantic alignment with reference pentesting snippets, outperforming state-of-the-art counterparts in distance metrics such as edit distance (above 50% average code similarity). Additionally, functional experiments emphasize the execution reliability of the snippets produced by RedShell in a testing scenario that mirrors real-world settings.

3. workshop FORGE: Multi-Agent Graduated Exploitation and Detection Engineering

   Farooq Shaikh

   Vulnerability disclosure volumes now far exceed organizational assessment capacity, yet three adjacent research communities (proof-of-concept generation, vulnerability prioritization, and detection rule engineering) operate largely in isolation. Existing automated exploit generation systems report binary pass/fail outcomes, discarding partial progress and producing no signal for the other two communities. This paper presents FORGE, a multi-agent system that bridges these three silos through graduated exploitation depth. Five specialized agents (Intel, Generator, Planner, Exploit, and Detector) execute in a fixed pipeline that (1) generates targeted vulnerable applications from CVE metadata, (2) conducts coached, multi-turn exploitation assessed by an LLM-primary oracle on a four-level taxonomy (L0: no evidence through L3: full compromise), and (3) produces Sigma and Snort detection rules grounded in OpenTelemetry exploitation traces. Evaluation on 603 CVEs from the CVE-GENIE dataset achieves 67.8% end-to-end L1+ exploitation at $1.50 per CVE across eight languages and 187 CWE types.

4. full VIDAR: Leveraging Reinforcement Learning to Minimize SQL Injection Footprint

   Michael Vaagland and Nelson Uto

   SQL injection remains a significant vulnerability in web application security in 2026. Most automated exploitation tools rely on extensive heuristic tests that generate substantial network traffic. This study introduces VIDAR, a semi-autonomous agent based on Reinforcement Learning (RL) that utilizes the Recurrent Proximal Policy Optimization (PPO) algorithm to minimize network footprint during database exfiltration. The development process comprised two phases. In the initial offline training phase, the agent interacted directly with a local SQLite database via a custom Python environment, reducing HTTP overhead and training time. During this phase, a human-designed Curriculum Learning (CL) framework and a Potential-Based Reward System (PBRS) accelerated convergence toward an optimal policy while enabling the agent to learn complex sequential actions. Evaluation results indicated that VIDAR achieved up to an 88% and 96% reduction in network packet volume compared to sqlmap and jSQL, respectively.

International Workshop on Graph-based Approaches for CyberSecurity

1. workshop Graph Analysis of Incident Response Process Activities and Communications

   Haula Sani Galadima, Cormac Doherty and Rob Brennan

   This paper presents a knowledge graph approach to analysing incident response (IR) processes by creating a unified graph of IR activities and responder communication data from tool logs. A common ontology enables representation and analysis of IR processes performed on heterogeneous tools. This supports investigation analysis, process mining, knowledge management and learning across end to end IR workflows to enhance organisational cyber resilience. Gaps in current knowledge graph representations of IR include a lack of responder communication data, linking responder pivots across tools, and connecting initial incident detection to post-incident actions. Our Cyber Incident Response Process Ontology (CIRPO) extends the Computer Security Incident Handling Ontology (CSIHO). It supports unified investigation analysis of IR workflows and teams by linking events, artefacts, response actions, case workflows, responder activities, timelines, communication content and sentiment, and threat intelligence. The modelling and analysis approach was evaluated through a case study based on a live simulated ransomware incident response exercise involving professional security teams, generating realistic multi-tool IR data across the full NIST IR lifecycle. The collected data was structured using CIRPO and stored in a GraphDB repository, enabling graph-based querying and visualisation.

2. workshop k-Anonymity by Partitions Maximizes Perfect Matchings

   Ewa Infeld

   The number of perfect matchings in a user-behavior bipartite graph is a natural measure of anonymity: more matchings mean greater uncertainty for an attacker. A fundamental question is which graph structure maximizes this count for a fixed infrastructure cost (number of edges). We prove that the answer is $k$-anonymity by partitions. Using Brégman's Theorem, we show that partitioning users into equal-sized groups and making each group a complete bipartite component achieves the theoretical upper bound on perfect matchings. For edge counts where an exact partition is impossible, we construct a family of graphs that asymptotically attains this bound as the group size grows. We further prove that this optimality is robust: after an attacker de-anonymizes a user by the most damaging choice, the resulting graph is still a partition graph and remains optimal. Together, these results provide a combinatorial justification for the widespread use of $k$-anonymity by partitions in anonymity system design.

International Workshop on Post-Quantum Cybersecurity Readiness and Migration

1. SoK SoK: Classifying and Prioritizing Side-Channel Vulnerabilities in Kyber with Security Impact and Countermeasure Assessment

   Bukhtawar Umbreen and Oğuz Yayla

   Kyber Key Encapsulation Mechanism (KEM) is one of the main candidates for post-quantum key establishment. Its black-box security relies on the hardness of the Module Learning With Errors (MLWE) problem, however, physical implementations expose power, electromagnetic, timing, microarchitectural leakage from intermediate computations that can enable side channel based attacks. Kyber's implementation surface contains several exploitable regions which support different attack styles. This paper develops a structured vulnerability analysis and countermeasure framework for Kyber KEM. We identify vulnerabilities and how they might aid breach of Indistinguishability under chosen plaintext/ chosen ciphertext based attacks (IND-CPA/CCA) of Kyber public key encryption (PKE)/KEM. We classify these vulnerabilities, measure the byte exposure, and introduce a four-factor scoring method based on sensitive-variable exposure, attacker input control, randomness openness, and distinguisher strength. This classification helps us identify high risk regions and suggest possible mitigation techniques. No single countermeasure is sufficient for full immunity, we recommend a fusion of various techniques for side-channel resilient Kyber decapsulation.

23rd International Workshop on Trust, Privacy and Security in the Digital Society

1. SoK Machine Learning and Cyber Threat Intelligence for Proactive Cybersecurity Risk Management: A Systematic Review and Operational Synthesis

   Stratos Krystallidis and Spyros Kokolakis

   Cybersecurity organizations increasingly face sophisticated and rapidly evolving threats, including ransomware, supply-chain attacks, and the malicious use of artificial intelligence (AI), creating a growing need for proactive cybersecurity risk management. Integrating Machine Learning (ML) with Cyber Threat Intelligence (CTI) has emerged as a promising approach for enhancing predictive, adaptive, and intelligence-driven cybersecurity capabilities. This study presents a systematic literature review (SLR) conducted across major scholarly and technical databases using a rigorously refined and reproducible search strategy. The analysis maps ML techniques, CTI sources, and research themes to the National Institute of Standards and Technology (NIST) cybersecurity risk-management framework, while examining operational maturity, deployment readiness, and intelligence integration patterns across strategic, operational, and technical cybersecurity functions. Comparative evaluation of major ML families highlights predictive capabilities, implementation trade-offs, and deployment limitations. The findings indicate that although several ML–CTI applications are approaching operational maturity, broader adoption remains constrained by limited reproducibility, inconsistent evaluation methodologies, fragmented datasets, and the underutilization of strategic CTI. Unlike prior reviews that primarily focus on isolated technical applications or domain-specific implementations, this study provides an operational synthesis of ML–CTI integration for proactive cybersecurity risk management. The paper contributes a consolidated synthesis framework, a reference architecture for continuous intelligence-driven cybersecurity workflows, and a structured assessment of deployment and governance challenges. Finally, the study identifies critical research gaps and outlines future directions for scalable, evidence-based, and operationally integrated cybersecurity defense strategies.

2. workshop Analysing the Cyber Security Support Journeys of Small and Medium Sized Organisations

   Matthew Rand, Neeshe Khan, Steven Furnell, Maria Bada, Jason Nurse and Ram Herkanaidu

   Small and medium-sized enterprises (SMEs) frequently find themselves as exposed to cyber security threats as larger organisations. However, most SMEs are not experts in cyber security and therefore need additional support to enhance their cyber resilience. Furthermore, although they may seek related support, there is minimal knowledge about how they approach this or how effective the support is. This study aimed to understand the support journeys that SMEs pursue when they have a question or concern about cyber security, sampling both SMEs and cyber security providers. Both groups were asked to record each time they had a support journey instance, to outline factors such as what the instance involved, how satisfied they were with the support, and what the resulting outcomes were. This enabled comparison of how support was accessed, experienced, and resolved across cases, from the initial trigger for support through to the outcome. A series of practical recommendations are provided within this paper following the analysis of these support journeys, to consider how both SMEs and providers can benefit from the support journey experience. The experiences also highlight some of the broader challenges of supporting SME engagement with cyber security, including the constraints they face in terms of time and understanding.

3. workshop A Socio-Technical Trust Model for Security Information Sharing

   Clemens Sauerwein and Ruth Breu

   Security information sharing is widely recognized as an important enabler of collective cyber defense, yet organizations often remain reluctant both to disclose relevant information and to rely on information received from others. While prior research has identified a range of barriers, trust factors, and enabling mechanisms, the literature remains conceptually fragmented. This paper addresses that gap by developing a socio-technical trust model for security information sharing based on a systematic review of the existing literature. The model uses the dimensions of ability, benevolence, and integrity to integrate recurring trust-relevant factors, including actionability, community reliability, confidentiality, identifiability, legal assurance, operational reliability, provenance, recipient sensitivity, reciprocity, source quality, and use clarity. These factors are linked to technical, procedural, and governance controls that shape perceptions of trustworthiness. The paper argues that such controls do not generate trust directly. Rather, they make trustworthiness more visible and assessable. The resulting model explains how observable trust factors inform trust assessments and how they shape both the willingness to share security information and the willingness to rely on shared security information. It thus provides an integrative framework for analyzing and designing trustworthy security information-sharing practices.

4. workshop What Drives Privacy-Enhancing Technology Choice? A Scenario-and Context-Based Interview Study in Germany

   Shirin Shams, Nils Hein, Paula Marie Kopplow, Sebastian Schillinger and Delphine Reinhardt

   Privacy-Enhancing Technologies (PETs) are widely promoted as solutions to privacy risks, yet adoption remains low. To bridge this gap, we replicated and extended existing results from the UK and Japan on the decision to adopt Virtual Private Networks (VPNs). As conceptions of privacy are known to be culture-dependent, we consider a German-based sample. Moreover, we broaden its scope to three additional PETs: private browsers, private search engines, and proxies. We further introduce complementary perspectives: scenario-based to capture contextual influences and background-based to examine differences by IT expertise and gender. We conducted 24 interviews, balanced between IT backgrounds and genders. Compared to the original work, our findings indicate that the Use review, Price, and Speed factors remain predominant in decision-making, but also across PETs and scenarios. In contrast, we identify new factors, including Provider Trust and Task Impact. In our sample, factor importance in choosing PET varies across scenarios, IT backgrounds, and genders. Overall, our findings provide a user-centred account of the factors affecting PET selection and underscore the need for context-sensitive and personalised PET presentations, moving beyond the prevailing one-size-fits-all paradigm.

The 5th Workshop on Cybersecurity in Industry 4.0 and Beyond

1. workshop Structural Blind Spots in AI-based IIoT Anomaly Detection

   Kaan Bilgic, Sofiane Aissani and Mawloud Omar

   Unsupervised anomaly detection is widely used in Industrial IoT (IIoT) because labeled attack data is rare. These models are expected to learn normal behavior and flag anything unusual. Still, their behavior is not well understood when attacks are made to look realistic instead of clearly abnormal. We study this using the Edge-IIoTset dataset and two models: Isolation Forest and an Autoencoder trained only on benign traffic. We apply a progressive feature removal process. Results show a clear pattern. When semantic features (like identifiers or payload information) are available, detection is relatively stable. Once we remove them and keep only geometric features, performance drops a lot. In our case, Isolation Forest recall goes down to about 1.3%, meaning most attacks are missed. We also test False Data Injection Attacks (FDIA) that follow smooth behaviors such as drift or oscillation. Because of this, they can remain hidden for long periods. We observe detection delays up to 6700 timesteps, and in some runs, no alert is triggered at all. To describe this effect, we introduce a simple metric: Time-to-Detection (TTD). Overall, our results show that anomaly detection strongly depends on feature quality. When representations are reduced too much, separating normal and malicious behavior becomes difficult.

2. workshop IC3SA Taxonomy: A Safety and Security Awareness Taxonomy for Industrial Control Systems

   Fabien Sechi, Gil Agmon, Nadia Saad Noori, Rami Puzis, Ofir Cohen and Asaf Shabtai

   Industrial Control Systems (ICS) increasingly operate as tightly coupled cyber-physical environments where cybersecurity incidents can propagate into operational disruptions and safety consequences. Yet, safety and cybersecurity are still commonly addressed through separate culture, standards, roles, and training practices, leaving stakeholders with limited shared understanding of cross-domain risks, trade-offs, and role-relevant actions. Our work presents a hierarchical, psychologically grounded ICS Safety and Security Awareness Taxonomy that integrates operational safety considerations with cybersecurity awareness under ICS/Operation Technology, real-time and availability constraints. Building on established Information Security Awareness (ISA) theory, we introduce the IC3SA taxonomy, which structures the domain into Focus Areas (FAs), Sub-Focus Areas, and safety/security topics interpreted through knowledge, attitude, and behavior components (including preventive and confronting behaviors), enabling assessable and role-adaptive awareness constructs. We validate the taxonomy through a mixed-method, multi-stakeholder evaluation involving an industry expert group, a broader practitioner-oriented user group, and an academic group, using interviews and structured questionnaires.

3. workshop Honeyfarm: AI-based Honeypots for Industrial OPC-UA Communication via an On-Demand Deployment Architecture

   Olaf Sassnick, Florian Entleitner, Dalibor Sain, Thomas Rosenstatter, Andreas Unterweger, Simon Hoher and Stefan Huber

   Cyberattacks against Operational Technology (OT) and Industrial Cyber-Physical Systems (ICPS) are continuously increasing, demanding advanced defense mechanisms that are robust, adaptive, and resource-efficient. In this context, we propose an AI-based honeypot with an on-demand deployment architecture for ICPS communicating via the OPC UA protocol. The proposed system isolates attackers from production systems by dynamically redirecting malicious traffic to a honeypot instance, that seamlessly continues from the production system state. This redirect allows continued observation without alerting the attacker while protecting the industrial system. At the core of the architecture is a generative AI model that learns ICPS behaviour from OPC UA communication data, while existing approaches typically require a manually parameterised simulation model. The proposed approach enables automated creation of medium-interaction honeypot functionality with minimal manual effort. A proof-of-principle implementation is realised using real PLC hardware and a fully containerised environment for the honeypot. Performance results, including switchover time and interaction latency, are provided to demonstrate the practicality of the approach.

4. closing Workshop Closing

Agentic AI for Cybersecurity

1. workshop On the Adversarial Planning Capabilities of LLMs

   Bikash Saha, Nanda Rani and Sandeep Kumar Shukla

   Large Language Models (LLMs) are increasingly applied to cybersecurity, yet most evaluations focus on exploit execution, tool use, or static attack generation. Their ability to perform adaptive adversarial planning under uncertainty remains less understood. We introduce Adversarial Planner, a framework for evaluating how LLM agents maintain belief states, revise assumptions, use negative evidence, and replan in partially observable cyber environments. The framework includes 50 organizational cyber planning scenarios with hidden conditions, deceptive signals, dynamic constraints, and structured simulator feedback. We define metrics covering task success, replanning, dependency validity, looping behavior, detection-aware reasoning, and state consistency. Experiments across both open-source and closed-source LLM families show that stronger models adapt more effectively after failed paths, while smaller models more often repeat invalid actions, assume unsupported privileges, and lose state consistency.

2. workshop Fix or Break? Exploring Autonomous Remediation of IoT Device Security Misconfigurations Using LLM Agents

   Emina Ishihara, Akihito Takeuchi, Shota Fujii, Takayuki Sasaki and Katsunari Yoshioka

   Many IoT devices operate with security misconfigurations, making them vulnerable to unauthorized access and abuse. Although various user notifications have been proposed to mitigate these risks, users often lack the knowledge, skills, or motivation to carry out the recommended measures. This study examines the feasibility of automatically remediating IoT device security misconfigurations using an LLM agent. We evaluate to what extent the LLM agent (GPT-4.1 and Browser-use) can execute security remediations based on high-level instructions independent of device-specific web interfaces. Our evaluation covers experimentally feasible combinations of 5 types of remediation tasks across 11 router models. For devices with misconfigurations, the action plan success rate was 60.0% and the remediation task success rate was 51.1%. 72.7% of failures stemmed from technical limitations in the Browser-use-implemented execution component of the LLM agent, suggesting that automation feasibility may improve as these limitations are addressed.

3. SoK SoK: Security Vulnerabilities in Agentic AI Systems

   Shuyi Guan, Andrey Kovalev and Li Xie

   Agentic AI systems extend large language models with tools, retrieval, persistent memory, and multi-agent coordination, enabling autonomous, long-horizon execution beyond traditional chat interfaces. However, these capabilities introduce novel attack surfaces that existing LLM security frameworks fail to systematically capture. In this paper, we survey 70 papers (2022–2026) and three production CVEs, organizing prior work into a five-layer taxonomy structured by architectural execution boundaries. We demonstrate that seemingly distinct vulnerabilities—including indirect prompt injection, RAG poisoning, tool exploitation, memory persistence attacks, and inter-agent trust laundering—share a common structural root cause: instruction-data conflation at authority-bearing boundaries. To formalize these threats, we define four execution invariants governing instruction integrity, data confidentiality, privilege containment, and memory integrity. Our synthesis reveals a severe defense asymmetry: while prompt-and retrieval-level mitigations are heavily studied, architectural enforcement at the protocol-delegation and persistent-memory layers remains largely unaddressed.

4. closing Workshop Closing

International Workshop on Graph-based Approaches for CyberSecurity

1. workshop Distilling GNNs into Symbolic Equations for Explainable Anomaly Detection

   Fernando Ares, Helena Rifà-Pous and Robert Clarisó

   Graph neural networks are effective for anomaly detection in traffic graphs, but their message-passing computations are difficult to inspect. This paper presents a symbolic distillation framework that keeps Graph Neural Network (GNN) as the predictive model and uses symbolic regression to recover compact equations from its internal traces. The method is evaluated on NetFlow graphs as a representative anomaly detection setting and is compared with LIME and GNNExplainer. The extracted equation preserves high fidelity while providing an executable relation between traffic variables with much lower sequential inference cost than the full graph model. Transfer experiments show that concept drift still affects the symbolic surrogate, but lightweight calibration can recover part of the lost performance without rediscovering the full expression. The results suggest that symbolic distillation complements post hoc explanations by exposing how graph computations combine traffic evidence and by providing a lightweight signal for real-time monitoring

2. workshop Early Intent Forecasting on Partially Observed Process Graph Prefixes for LOLBin Abuse Detection

   Naga Venkata Hrushikesh Chunduri, Mohan Anand Putrevu, Venkata Sai Charan Putrevu, Lakshmi Prasanna Sai Rayapati and Sandeep Shukla

   Living-Off-the-Land Binaries (LOLBins) are trusted system utilities that can be abused to execute malicious behavior while blending into legitimate administrative activity. Their command lines are often syntactically similar to those of routine system operations, so the discriminating signal lies not in the command itself but in its surrounding context: the parent process that invoked it, the children it spawns, and the wider chain of activity it participates in. Process graphs encode this context directly, and analysis over the full graph has been shown to expose patterns of abuse that single command line analysis cannot. The graph that an attack produces, however, does not exist all at once. It grows as the program executes, and at any moment of observation only a prefix is available. This paper studies whether such a prefix can already be classified with confidence, before the surrounding activity has fully unfolded. We formulate this as a streaming selective prediction problem. At each step of graph growth, a Graph Attention Network (GAT) operates on the current prefix and produces a maliciousness score, and the framework commits to a verdict when the score is sufficiently confident and stable across consecutive steps. We evaluate three command line encoders that supply node features to the GAT: a TF-IDF baseline, a FastText model trained on the corpus, and a SecureBERT Plus model. On 5200 process graphs, the SecureBERT Plus configuration with GAT commits on 82% of test graphs after observing 6.3 nodes on average. Among committed verdicts, the model achieves 97.9% precision and 96.8% recall for the malicious class.

3. workshop Detecting Kernel-Level Intrusions Across Heterogeneous Datasets with Pure-Learned Provenance Models

   Dheeraj Muppiri and Madhav Rao

   A modern attacker breaching a server leaves traces in the kernel audit trail, and those traces, when assembled, form a provenance graph of processes, files, netflows, and the kernel operations that link them. Detecting attacks against this background is a severe needle-in-a-haystack problem: on DARPA Transparent Computing Engagement-3 telemetry the positive rate is 0.04% (nine attack process-windows per day among roughly twenty-two thousand). State-of-the-art systems reach high recall through hand-curated edge-type filters, trusted-object allow-lists, and per-dataset thresholds; learned alternatives have trailed without them. We describe a fully learned detector with no hand-curated per-dataset rules: no event-type filters, allow-lists, or per-day thresholds. It is built from a Transformer language model over composite kernel-event tokens, a Temporal Graph Network whose node memory persists across consecutive 15-minute windows, and five dataset-agnostic post-processors. Per-process-window AUC-ROC reaches 0.989–0.991 on CADETS and 0.77 on THEIA. Per-executable recall is 1.000 on every attack scenario at a triage budget of one to ten false positives per day.

International Workshop on Post-Quantum Cybersecurity Readiness and Migration

1. workshop Open-Source vs. Vendor Post-Quantum Cryptography on STM32H563ZI: A Performance, Memory, and Provenance Study

   Philipp Schubaur, Philipp Urlbauer and Dominik Merli

   Resource-constrained embedded systems increasingly need to migrate to post-quantum public-key cryptography, but this transition is constrained by tight timing, memory, and implementation-transparency requirements. This paper compares the open-source pqm4 framework with STMicroelectronics' proprietary X-CUBE-PQC library on the STM32H563ZI Cortex-M33 microcontroller targeted by the evaluated vendor package. We adapt selected pqm4 profiles to the STM32H563ZI target, align clock, flash, cache, and measurement conditions, and evaluate ML-KEM and ML-DSA with respect to execution cycles, runtime volatile memory, static footprint, Keccak/SHAKE share, and binary provenance. Across the evaluated ML-KEM parameter sets, X-CUBE-PQC is 3.54x to 4.73x slower than m4fspeed for encapsulation and 3.71x to 4.86x slower for decapsulation. For ML-DSA signing, standard X-CUBE-PQC is 2.71x to 2.94x slower than m4f, while its LowRAM variant reduces runtime memory at the cost of additional cycles. Static and dynamic binary analyses of the STM X-CUBE-PQC library show substantial PQClean-derived naming and evidence consistent with PQClean-derived implementation components, together with modular dispatch structures and explicit memory-buffer management. Overall, the evaluated pqm4 profiles outperform X-CUBE-PQC in the main measured performance dimensions and in several memory-footprint settings. The results show that vendor-supported Post-Quantum Cryptography availability alone does not imply deployment readiness on constrained embedded targets; architecture-specific arithmetic kernels, transparent provenance, and reproducible resource measurements remain necessary for practical migration.

2. workshop An Empirical Analysis of Open-Source Tools for Cryptographic Asset Discovery for PQC Readiness Assessment

   Aleksander Olewinski, Tatiana Sandler and Peter Ebinger

   The transition to post-quantum cryptography (PQC) requires organisations to identify and assess their deployed cryptographic assets, which is a prerequisite for structured PQC migration workflows. Although Cryptographic Asset Discovery and Inventorisation (CADI) tools support this task and enable continuous monitoring of cryptographic assets, the capabilities of open-source solutions in terms of cross-domain coverage, accuracy, and interoperability remain underexplored. This paper presents an empirical analysis of open-source CADI tools for PQC readiness assessment. We provide a structured analysis and comparison of the capabilities of open-source and commercial CADI solutions across multiple inventorisation domains. This is followed by benchmarking of selected open-source tools against defined cryptographic ground truth. The results reveal a fragmented open-source landscape, with significant gaps observed in some categories and strengths in others. Benchmarking also shows deficits in detection completeness and accuracy, and permissiveness in the current CBOM specification hinder interoperability and aggregation. Based on these findings, we derive recommendations, including orchestrating heterogeneous CADI tools and imposing stricter CBOM conformance requirements, to enable comprehensive, interoperable cryptographic inventories.

3. workshop Periodic Classification of Information Security Attack Signs: A Layered Framework for Detection and Response with Post-Quantum Cryptography Validation

   Simas Krušniauskas and Nerijus Šatkauskas

   Security operations centers reason about adversary activity through multiple disconnected artifacts, including indicators of compromise, telemetry alerts, incident reports, ATT&CK mappings, threat intelligence, and response playbooks. This fragmentation makes weak-signal correlation difficult, hides visibility gaps, and weakens traceability from early observations to operational response. This paper introduces a periodic classification of information-security attack signs: a layered framework that adapts the construction logic of the periodic table - stable ordering, recurring families, temporal periods, and explicit gaps - without importing chemical semantics. The framework represents attack signs as atomic elements assigned to canonical numbers, symbols, families, and periods. It defines 39 elements across eight digital families and an auxiliary human/physical series, then operationalizes them through a 39-entry detection backlog, a 10-playbook molecular layer, and 39 ATT&CK-oriented coverage profiles. The taxonomy is developed from incident-response guidance, indicator literature, adversary-behavior models, ATT&CK, and post-quantum cryptography transition guidance. Analytical validation is performed using a hybrid post-quantum cryptography migration scenario involving public-facing TLS/VPN services, federated identity, PKI management, and cloud workloads. The scenario activates 28 elements, all eight digital families, and five primary playbooks, while requiring no impact-period elements. The result is an operational grammar that structures heterogeneous attack evidence, correlates incident hypotheses, exposes telemetry gaps, and supports ATT&CK-aligned detection and incident-response planning.

Security, Availability, and Fault-Tolerance in Edge AI Systems

1. workshop Adaptive AI Task Partitioning and Safe Offloading in Heterogeneous Edge-Cloud Continuum

   Akuen Akoi Deng, Eimantas Butkus, Alfreds Lapkovskis and Praveen Kumar Donta

   In recent years, the use of artificial intelligence on resource-constrained IoT devices has grown significantly. However, existing approaches to AI task partitioning and offloading across the edge-cloud continuum typically rely on static methods that ignore runtime dynamics. Furthermore, they are often evaluated in simulated environments rather than on real hardware. To address this gap, we propose a framework that dynamically splits neural network layers across the heterogeneous continuum. The framework profiles the model at startup, measures network link conditions between nodes, and periodically re-evaluates the partition to adapt to environmental changes. We created a physical testbed comprising a Raspberry Pi edge device, a laptop fog, and a high-performance desktop PC as the cloud. We evaluated the framework over three widely adopted convolutional neural networks: VGG16, AlexNet, and MobileNetV2. Our results show that the framework achieves reductions in energy and end-to-end latency of 27.09-35.82% and 6.34-22.92%, respectively, compared to a static partitioning baseline. These findings confirm the superiority of adaptive to static partitioning.

2. workshop When We Talk Morse: Lightweight Parameter Encoding for Secure Federated Learning

   Huong Nguyen, Amirhossein Ghaffari and Lauri Lovén

   Federated Learning (FL) requires clients to send model updates over potentially untrusted networks, creating a need for confidentiality, integrity, and low overhead on resource-constrained edge devices. Existing approaches only partially meet these goals: quantization is lightweight but not cryptographically secure, secure aggregation mainly protects against server-side visibility, and homomorphic encryption (HE) is costly. We propose MoDuo, a lightweight FL protection scheme that combines AES-GCM authenticated encryption with a tailored Morse-based and base-32 encoding layer. Compared with HE baselines, including stock FATE and BatchCrypt, MoDuo secures training with negligible impact on accuracy (typically below 1% and in extreme configurations, below 2%), keeps protected payloads within about 4x the original size for a 4.02M-parameter model, reduces cryptographic time by over 187x compared with stock FATE, and saves more than half the cryptographic time compared with BatchCrypt. Compared with direct AES-GCM over decimal-serialized updates, MoDuo reduces the serialized representation size by mapping verbose floating-point values into more compact encoded tokens before encryption, reducing the protected payload by up to 49.3% at the cost of additional encoding time.

3. workshop Spatio-Temporal Scheduling Prediction Under Backhaul Delay for Resilient Coordinated Beamforming

   Prashant Kumar Singh, Shubham Vaishnav, Ahmet Hasim Gökceoglu and Li Wang

   Coordinated beamforming in distributed 5G networks relies on the timely exchange of inter-cell scheduling information, but backhaul latency makes this information stale. Even a single transmission time interval (TTI) of delay can reduce CBF-SLNR performance below the uncoordinated baseline, because the precoder suppresses interference toward users that are no longer active. Coordination on stale information is therefore worse than no coordination at all. To address this, we propose a two-stage predictive framework in which a Spectral Temporal Graph Neural Network (StemGNN) predicts future user equipment (UE) scheduling states from delayed historical observations, and the predictions replace stale inputs to the CBF-SLNR precoder. Evaluated on a three-cell massive MIMO downlink with 60 UEs and 64 antennas per base station under Quadriga Urban Micro (UMi) channels and a proportional fair scheduler, StemGNN achieves a mean scheduling prediction accuracy of 87.57%, outperforming LSTM, GRU, Simple RNN, and Markov chain baselines at all evaluated horizons. When integrated into coordinated beamforming, the predictions recover 57-73% of the sum rate loss caused by one TTI of backhaul delay, improving sum rate by 9.58-14.35% over the no-prediction baseline and recovering up to 83% of the Lag-1 fairness loss for cell-edge users.

4. workshop A Learning-to-Rank Framework for AS Prioritization to Support DDoS Attack Mitigation at CDN PoPs

   Ryosuke Araki, Yuzo Taenaka and Youki Kadobayashi

   Distributed Denial of Service (DDoS) attacks remain a persistent threat to the availability of cloud-based services, particularly at CDN Points of Presence (PoPs) where mitigation capacity is inherently limited. Because defensive resources cannot be uniformly applied to all traffic sources, accurate ranking of Autonomous Systems (ASes) is beneficial to support DDoS attack mitigation. This paper proposes a framework to rank ASes that are likely to contribute to Layer 7 DDoS attack traffic within the next 15 minutes. Analysis of real-world attack data from the Cloudflare Radar API reveals pronounced seasonal and trend components in AS-level attack traffic dynamics. Motivated by this observation, we extract temporal features using Seasonal-Trend decomposition based on LOESS. We then reformulate the task as a learning-to-rank problem rather than regression, directly optimizing AS ordering to match operational needs at PoPs. Experimental results show that the proposed method achieves 3.20% lower ranking MAE and 0.43% lower weighted ranking MAE compared to an LSTM regression baseline, with improvements in 23 of 24 test periods (95.83%) for ranking MAE and in 17 of 24 periods (70.83%) for weighted ranking MAE. These findings demonstrate stable and operationally aligned ranking performance for supporting CDN-based DDoS attack mitigation.

23rd International Workshop on Trust, Privacy and Security in the Digital Society

1. workshop Mapping Selected Cryptographic Weaknesses in FIPS-140 Certified Products

   Yasir Yakup Demircan, Vashek Matyáš and Adam Janovský

   FIPS 140 certification serves as a benchmark for cryptographic module security, yet certified modules often support deprecated algorithms long after their vulnerabilities are exposed. This study maps the persistence of several known cryptographic weaknesses for SHA-1, MD5, DES, Dual EC DRBG, and insecure TLS configurations within the FIPS 140 ecosystem. We analyze the lag between formal deprecation and industry remediation through machine learning classifiers. Our results suggest potential contrasts in how the industry responds to different types of findings. While algorithms associated with trust scandals, e.g., backdoored Dual EC DRBG, vanish rapidly, other broken standards like SHA-1 and DES exhibit significant inertia, estimated to persist in approximately 28% and 72% of our subset of inspected samples, respectively. Conversely, our classifiers detected no MD5 usage, though this may partly reflect model bias under extreme class imbalance, and TLS weaknesses suggest a prompt remediation.

2. workshop Learning to Leak: Data Exfiltration from LSTM-based Next-Token Prediction Models

   Mirta Medak, Anastasia Pustozerova and Rudolf Mayer

   Machine learning (ML) systems are increasingly used to analyse large volumes of sensitive data, including personal records, proprietary information, or security-critical logs. At the same time, organizations frequently rely on third-party training code, pretrained components, or outsourced model development, expanding the attack surface of the training pipeline. Data exfiltration attacks can exploit this surface, allowing adversaries to reconstruct sensitive data from a released ML model. Although prior work has demonstrated such attacks for image and text models, their applicability to Long Short-Term Memory (LSTM) architectures, frequently used to analyze sensitive sequential data such as operational logs or financial transaction streams, remains unexplored. In this work, we study data exfiltration attacks on LSTMs used for next-token prediction tasks. We strengthen white-box data exfiltration attacks by improving a least-significant-bit (LSB) parameter-encoding strategy to evade existing defenses. We introduce two variants of this adaptive attack, demonstrating that naive countermeasures are ineffective and that more robust mitigation strategies are necessary. Furthermore, we design a black-box attack in which the trigger-set generation is tailored to LSTM-based next-token predictors. Our results demonstrate the feasibility of data exfiltration under query access, analyze its practical limitations, and quantify its impact on model fidelity and computational cost.

3. workshop Exploring adversarial attacks against ransomware detection systems

   Dionysios Tsekouras, Thrasyvoulos Giannakopoulos, Pavlos Papadopoulos, Sana Ullah Jan, Alexios Mylonas and Nikolaos Pitropakis

   Ransomware remains an important cybersecurity threat that causes significant financial and operational damage to organisations worldwide. In order to combat the constant increase of ransomware threats, organisations are deploying defence systems that employ Machine Learning (ML) algorithms to distinguish legitimate from malicious applications. However, malicious actors attempt to compromise the performance of these systems with adversarial attacks. In the current work, our aim is to analyse the robustness of several ML algorithms under the influence of label flipping and Fast Gradient Sign Method (FGSM) attacks with variable perturbations. Our experiments showed that Gradient Boosted Regression Trees had the best results for label flipping, where with up to 28% flipped labels, they reached a remarkably high recall, which is essential for this domain. Random Forest was the second-best performing, while Gaussian Naive Bayes was last with no adequate metrics, even for little to no perturbations. Experiments on a Neural Network using FGSM attacks with a varying epsilon showed that the model was unaffected by very small perturbations of up to 0.02, but then showed a drastic drop in all the metrics, after 0.045. Thus, our findings emphasize the critical need to integrate defensive mechanisms in ML systems used for ransomware classification.

4. workshop CQR: A Privacy-Preserving Methodology for LLM Assistants

   Michael Psallidas and Christos Kalloniatis

   The proliferation of Large Language Model (LLM)-based digital assistants has introduced significant privacy risks, as user queries containing Personally Identifiable Information (PII) are routinely transmitted to external AI services without adequate filtering or anonymization. This paper presents the implementation and evaluation of Controlled Query Routing (CQR), a privacy-preserving methodology designed to govern how user queries are processed in hybrid AI systems. Building upon the architectural framework proposed in our previous work, CQR integrates four sequential stages: PII detection using Named Entity Recognition (NER), risk scoring, routing decision, and anonymization with GDPR-compliant audit logging. The methodology was implemented as a working prototype — a security and privacy awareness digital assistant — deployed using FastAPI, Microsoft Presidio, and the Claude API. Evaluation across nine query scenarios demonstrates that CQR correctly identifies sensitive entities, assigns appropriate risk scores, and routes queries without exposing personal data to external models. The results confirm the feasibility of combining privacy-by-design principles with LLM-based assistants while maintaining full compliance with the EU General Data Protection Regulation (GDPR) and the AI Act.

Workshop on Security, Privacy, and Identity Management for the Digital Transformation

1. Welcome
2. workshop Privacy Coverage Assessment of Code-based Privacy Analysis Tools

   Arun Poovelikunnel Varghese, Laurens Sion and Wouter Joosen

   Privacy-preserving software systems are a key requirement for compliance with data protection regulations. Software systems therefore need to be reviewed and evaluated to assess their privacy-friendly properties. However, evidence relevant to privacy analysis is distributed across heterogeneous artifacts, such as application code, configuration files, execution logs etc. These artifacts encode critical information about how data is collected, processed, stored, and disclosed by software systems. Performing manual analysis on these artifacts is inherently complex, making automated privacy analysis a necessary approach. In this paper, we present a comprehensive analysis of existing automated privacy analysis tools drawn from multiple sources and systematically evaluate their capability to identify privacy-relevant features from source code artifacts. Our analysis reviews tool outputs and maps detected information to privacy threat characteristics defined in the LINDDUN threat trees. Based on this mapping, we assess both the breadth of threat type coverage and the depth of the threat characteristic-level detection achieved by each tool. The evaluation enables a systematic comparison of existing studies and reveals that no single tool provides a comprehensive and detailed coverage of privacy threats.

3. workshop Secure and Privacy-Preserving Global Revocation for FIDO2-based Systems

   Nirav Pistolwala and Peter Ebinger

   The widespread adoption of Fast Identity Online 2 (FIDO2) introduces new challenges, including the efficient revocation of compromised authenticators across multiple services. This paper bridges the existing gap by presenting effective strategies for global revocation, thereby ensuring a secure and convenient authentication experience while safeguarding against potential privacy and security risks. Our contribution is a simple public-private key pair-based approach for efficient global revocation of FIDO2 authenticators, with (1) seamless integration with existing FIDO2 protocols, (2) privacy guarantees by providing strong unlinkability, and (3) protection against impersonation attacks and unauthorized revocation by revocation key protection. We demonstrate the feasibility of our method through a proof-of-concept implementation, ensuring compatibility with the FIDO2 ecosystem. The proposed solutions are not limited to FIDO2 and can be applied to other protocols that need revocation, making them a valuable contribution to the broader field of authentication.

4. workshop Deniability for Signed Credentials: Revisiting the Authenticated Channel vs. Signed Data Debate in the EUDI Wallet

   Magdalena Bertram and Anja Lehmann

   The European Digital Identity Wallet (EUDI Wallet) is currently adopting ECDSA-based signed credentials as part of its core architecture, which raised concerns that such designs inherently lack plausible deniability compared to authenticated-channel approaches such as the German electronic identity card. This paper revisits this perceived trade-off and argues that it is not a property of signature schemes themselves, but of the credential presentation protocol. We show that standard cryptographic techniques - specifically lightweight OR-proofs over the native ECDSA verification equation - can be used to transform signed credential presentations into non-transferable, verifier-bound transcripts. Our contribution is not a new cryptographic primitive, but a precise articulation and instantiation of well-established techniques within the EUDI context, demonstrating that deniability can be added to signed credentials while preserving their deployment advantages.

5. workshop Proactive Identity Protection: Leveraging Vision Language Models for PII Extraction from Leaked Documents

   Daniel Vogel, Marc Ohm, Antoine Warns, Lea Silberberg, Fabian Ermisch and Stephanie von Maltzan

   Leaked images of documents may contain Personally Identifiable Information (PII) that can be automatically extracted using open-source Vision Language Models (VLMs). However, the challenge lies in the heterogeneity of potential documents and the data therein, as well as the required precision of the extraction, which we tackle with a comprehensive study on combinations of different open-source VLMs, parameters, and prompting techniques. Where related research often evaluates average performance of VLM-based data extraction, the error-free extraction of PII requires a specialized handling, in particular with regard to the legal implications. Four open-source VLMs were selected that a set of tailor-made prompts for specific structured output formats was used on to extract data from images of German ID cards and invoices. For this, a data set of these images was synthesized, different combinations of parameters, formats and models were tested and the rate of error-free data extractions were evaluated. We show that data extraction quality depends on the required format and prompt given, as well as the amount of parameters the VLM uses. Additionally, parsable VLM output exactly matches the original data more reliably for PII that are not names, but numbers or dates.

6. closing Closing Remarks