Security Code Research Articles

Dual-information and large-scale structural color patterns by laser direct writing with a low-index tailored nanostructure array

Dielectric nanostructures are widely embraced in the field of structural color design due to their low-cost characteristics, enabling sub-micron scale color printing. However, challenges still exist in the selection of structures and image encryption. In this study, we propose a method for printing dual patterns using tailored scattering structures based on two-photon polymerization. We extensively analyze the color performance of each structure in zeroth-order diffraction under cross-polarized transmission and bright-field transmission illumination. By selecting appropriate structures based on their characteristics, we prepared full-color panels and successfully utilized these panels to print both color patterns and dual patterns, achieving multi-level control of color and information. Based on the above study, a large-sale color pattern with a hidden message in an area of 3.2 cm×2.4 cm is printed, which can be directly observed. Our results demonstrate a sustainable and eco-friendly approach to color preparation, offering innovative strategies and methods for the fields of color science and steganography for information security.

Resilient, Secure, and Private Coded Distributed Convolution Computing for Mobile-Assisted Metaverse

Resilient, Secure, and Private Coded Distributed Convolution Computing for Mobile-Assisted Metaverse

StegaCrypt Integrating Hybrid Cryptography and Image Steganography

This paper discusses the combination of cryptography and steganography for digital data security. Cryptography and steganography are two of the most significant techniques in information security, to be used differently: data is secured against unauthorized use and ensured integrity by way of transforming it into some unreadable format, whilst steganography hides a file inside another file. The project aim is to synthesize the techniques for a robust system to protect secure communication and data. We use RSA cryptography for the encryption, which is the asymmetric algorithm of high-level security, and image-based steganography to place the encrypted data within a digital image. The processes of cryptography will ensure decrypting the data only in the hands of authorized recipient parties, and steganography provides additional protection on the data invisibility front. This project shows that this integration of two technologies will safeguard sensitive information from all types of threats. In view of various methods to combine cryptography and steganography, this project puts forward the significance of incorporating multi-layer security to combat different types of cyber-attacks. The implementation also includes an elaborated coding using algorithms and development of a GUI to facilitate user interaction with the system. This further ensures that it is not only technically sound but also user-friendly. The last system is to send confidential data toward the broader field of secure communications and information protection, efficiently, securely, and in a user-friendly way

Enhancing Data Security through Digital Image Steganography: An Implementation of the Two Least Significant Bits (2LSB) Method

The rapid advancement of digital communication technologies has heightened the demand for robust data security methods, particularly for safeguarding sensitive information against cyber threats. Steganography, the art of concealing data within digital media, offers an effective means of securing communication by masking the very existence of hidden messages. This study evaluates the Two Least Significant Bits (2LSB) method as an enhancement to the conventional Least Significant Bit (LSB) technique, focusing on improving storage capacity and resistance to detection. The research employs a quantitative methodology, conducting experiments to analyze the impact of data embedding on image quality using metrics such as Mean Squared Error (MSE) and Peak Signal-to-Noise Ratio (PSNR). Data embedding was tested on images of varying sizes and resolutions, with results compared before and after embedding. The study also evaluates the system’s tolerance to compression and robustness against steganalysis attacks, such as histogram analysis and noise detection. The results demonstrate that the 2LSB method significantly enhances storage capacity while maintaining high image quality. For instance, PSNR values remained above 40 dB across all tested images, indicating minimal visual distortion. The method also showed resilience to lossless compression formats such as PNG, with minimal impact on data integrity. However, lossy compression formats like JPEG posed challenges in maintaining the embedded data. The MSE values before and after embedding were minor, ensuring that the hidden data remained undetectable under standard analysis. This research contributes to developing more efficient and secure steganography techniques, providing practical applications in protecting sensitive data during transmission. The findings underline the 2LSB method's potential as a viable solution for digital security, balancing enhanced storage capacity with robust resistance to detection. Future work should further explore integrating advanced encryption with 2LSB to strengthen data protection in diverse digital environments

Leveraging machine learning for the detection of structured interference in Global Navigation Satellite Systems

Radio frequency interference disrupts services offered by Global Navigation Satellite Systems (GNSS). Spoofing is the transmission of structured interference signals intended to deceive GNSS location and timing services. The identification of spoofing is vital, especially for safety-of-life aviation services, since the receiver is unaware of counterfeit signals. Although numerous spoofing detection and mitigation techniques have been developed, spoofing attacks are becoming more sophisticated, limiting most of these methods. This study explores the application of machine learning techniques for discerning authentic signals from counterfeit ones. The investigation particularly focuses on the secure code estimation and replay (SCER) spoofing attack, one of the most challenging type of spoofing attacks, ds8 scenario of the Texas Spoofing Test Battery (TEXBAT) dataset. The proposed framework uses tracking data from delay lock loop correlators as intrinsic features to train four distinct machine learning (ML) models: logistic regression, support vector machines (SVM) classifier, K-nearest neighbors (KNN), and decision tree. The models are trained employing a random six-fold cross-validation methodology. It can be observed that both logistic regression and SVM can detect spoofing with a mean F1-score of 94%. However, logistic regression provides 165dB gain in terms of time efficiency as compared to SVM and 3 better than decision tree-based classifier. These performance metrics as well as receiver operating characteristic curve analysis make logistic regression the desirable approach for identifying SCER structured interference.

A Framework for Real-Time AI-Driven Secure Code Analysis Integrated with DevSecOps in Cloud-Native CI/CD Pipelines

Abstract—This paper presents a novel framework for inte- grating real-time AI-driven secure code analysis into DevSecOps practices within cloud-native CI/CD pipelines. As organizations increasingly adopt cloud- native architectures and agile develop- ment methodologies, the need for robust, automated security mea- sures becomes paramount. Our proposed framework leverages advanced machine learning algorithms to perform continuous, real-time code analysis, identifying potential vulnerabilities and security risks throughout the development lifecycle. By seamlessly integrating with existing CI/CD tools and cloud platforms, our solution enables organizations to enforce security policies, detect threats, and remediate issues without compromising development velocity. We evaluate the effectiveness of our framework through a series of case studies across diverse software projects, demon- strating significant improvements in threat detection accuracy, reduced false positives, and overall security posture. Our results indicate that the proposed AI-driven approach can enhance code security by up to 40% compared to traditional static analysis tools, while maintaining the agility of modern development prac- tices. This research contributes to the evolving field of DevSecOps by offering a scalable, intelligent solution for embedding security into the heart of cloud-native software development processes. Index Terms—DevSecOps, AI-driven security, cloud- native, CI/CD pipelines, secure code analysis

Constructing Immune-Cover for Improving Holistic Security of Spatial Adaptive Steganography

Constructing Immune-Cover for Improving Holistic Security of Spatial Adaptive Steganography

The Fifth Industrial Revolution and the Gig Economy: Assessing Technological Advancements Gaps, Regulatory Gaps and Skills Development Needs in Delhi NCR, India

The gig economy in India has grown significantly over the past decade, with millions of workers engaging in platform-based employment. Simultaneously, the world is transitioning to the Fifth Industrial Revolution, characterized by the integration of advanced technologies such as artificial intelligence, robotics, and automation with human-centered values. This study explores the impact of the Fifth Industrial Revolution on gig workers, focusing on working conditions, job security, access to skills development, and the adequacy of current regulatory frameworks with special reference to Delhi &NCR region. A mixed-methods approach was employed, combining quantitative data from surveys of gig workers and qualitative insights from in-depth interviews with platform executives and policymakers. The study found that while technological advancements have improved working conditions in some areas, job security remains a significant concern for gig workers. Additionally, access to skills development is strongly correlated with workers' ability to adapt to new technologies, but many face barriers to acquiring necessary training. The study also reveals a widespread perception that current regulations, including the Social Security Code, 2020, are inadequate in addressing gig workers' needs. These findings highlight the urgent need for comprehensive regulatory reforms and greater investment in skills development to ensure that gig workers can fully benefit from the opportunities of the Fifth Industrial Revolution while being protected from its risks.

Heuristic machine learning approaches for identifying phishing threats across web and email platforms.

Life has become more comfortable in the era of advanced technology in this cutthroat competitive world. However, there are also emerging harmful technologies that pose a threat. Without a doubt, phishing is one of the rising concerns that leads to stealing vital information such as passwords, security codes, and personal data from any target node through communication hijacking techniques. In addition, phishing attacks include delivering false messages that originate from a trusted source. Moreover, a phishing attack aims to get the victim to run malicious programs and reveal confidential data, such as bank credentials, one-time passwords, and user login credentials. The sole intention is to collect personal information through malicious program-based attempts embedded in URLs, emails, and website-based attempts. Notably, this proposed technique detects URL, email, and website-based phishing attacks, which will be beneficial and secure us from scam attempts. Subsequently, the data are pre-processed to identify phishing attacks using data cleaning, attribute selection, and attacks detected using machine learning techniques. Furthermore, the proposed techniques use heuristic-based machine learning to identify phishing attacks. Admittedly, 56 features are used to analyze URL phishing findings, and experimental results show that the proposed technique has a better accuracy of 97.2%. Above all, the proposed techniques for email phishing detection obtain a higher accuracy of 97.4%. In addition, the proposed technique for website phishing detection has a better accuracy of 98.1%, and 48 features are used for analysis.

Organizational Influence on Security Development in Open-Source Software Projects

Increasing technological complexity, intensified competition, and security requirements have driven open-source software (OSS) projects to become a crucial part of organizations' software development. This study focuses on the OSS project TensorFlow (TF) and uses a case study to examine how organizations and their associated developers collaborate to identify, fix and prevent security vulnerabilities. Social Network Analysis (SNA) of archived security data from software repositories is used to gain insight into security activities. The study examines the internal structure and evolution of security code collaboration, organizational networks, and top organizational contributors to TF. It also examines productivity, homophily, development diversity, and turnover rates among developers across various software releases. The in-depth insights from this research enhance our understanding of collaborative patterns in OSS communities within open software ecosystems, particularly in the security context.

Implementasi Next.Js, Typescript, Dan Tailwind Css Untuk Pengembangan Aplikasi Frontend Sistem Inventory Perusahaan Apar (Studi Kasus: CV Indoka Surya Jaya)

This research succeeded in developing an internal management system using Next.js for the integration of key features such as customer, supplier, category, unit, product, purchase and invoice management. The use of TypeScript increases code security and clarity, and ensures the system is verified through Black Box Testing. Implementing Tailwind CSS in creating company landing pages strengthens online representation with a responsive and modern design. It is hoped that this system can significantly increase operational efficiency and be adaptive to changes in company needs in the future.

Stegocrypt: A robust tri‐stage spatial steganography algorithm using TLM encryption and DNA coding for securing digital images

AbstractThis research work presents a novel secured spatial steganography algorithm consisting of three stages. In the first stage, a secret message is divided into three parts, each is encrypted using a tan logistic map encryption key with a unique seed value. In the second stage, the encrypted parts are transformed into quick response codes, serving as a layer of channel coding. Subsequently, the quick response codes are decoded back into bit‐streams. To enhance security, a uniquely‐seeded Mersenne Twister key is generated and employed to apply DNA coding onto each bit‐stream. The resulting bit‐streams are then embedded in the least significant bits of the RGB channels of a cover image. Finally, the RGB channels are merged to form a single stego image. A comprehensive set of experimental analyses is conducted to evaluate the performance of the proposed secure steganography algorithm. The experimental results demonstrate the algorithm's robustness against various attacks and its ability to achieve high embedding capacity while maintaining imperceptibility. The proposed algorithm offers a promising solution for secure information hiding in the spatial domain, with potential applications in areas such as data transmission, digital forensics, and covert communication.

May the Source Be with You: On ChatGPT, Cybersecurity, and Secure Coding

Software security is an important topic that is gaining more and more attention due to the rising number of publicly known cybersecurity incidents. Previous research has shown that one way to address software security is by means of a serious game, the CyberSecurity Challenges, which are designed to raise awareness of software developers of secure coding guidelines. This game, proven to be very successful in the industry, makes use of an artificial intelligence technique (laddering technique) to implement a chatbot for human–machine interaction. Recent advances in machine learning have led to a breakthrough, with the implementation and release of large language models, now freely available to the public. Such models are trained on a large amount of data and are capable of analyzing and interpreting not only natural language but also source code in different programming languages. With the advent of ChatGPT, and previous state-of-the-art research in secure software development, a natural question arises: to what extent can ChatGPT aid software developers in writing secure software? In this work, we draw on our experience in the industry, and also on extensive previous work to analyze and reflect on how to use ChatGPT to aid secure software development. Towards this, we conduct two experiments with large language models. Our engagements with ChatGPT and our experience in the field allow us to draw conclusions on the advantages, disadvantages, and limitations of the usage of this new technology.

Evaluating and validating the Serious Slow Game Jam methodology as a mechanism for co-designing serious games to improve understanding of cybersecurity for different demographics

We present an evaluation of a Serious Slow Game Jam (SSGJ) methodology as a mechanism for co-designing serious games in the application domain of cybersecurity, to evaluate how the SSGJ methodology contributed to improving the understanding of cybersecurity for different demographics. The aim of this study was to evaluate how the SSGJ contributed to improving the understanding of cybersecurity for young persons between the ages of 11 and 16 years old who had no formal training or education in cybersecurity, and to validate and compare these results to previous work where the same SSGJ methodology was used with a different target demographic (i.e.,M.Sc. students with no formal training or education in secure coding). To this end, we engaged 23 participants between the ages of 11 and 16 years old for 5 consecutive days over a one-week period, in a multidisciplinary SSGJ involving domain-specific, pedagogical, and game design knowledge, and encouraged engagement in-between scheduled events of the SSGJ. Findings show improved confidence of participants in their knowledge of cybersecurity, for both demographics, after undertaking the Serious Slow Game Jam (from 41.2% to 76.5% for young persons, and from 12.5% to 62.5% for M.Sc. students). Free-text answers specifically indicate an improved understanding of cybersecurity in general, and one specific security vulnerability, attack or defence for a quarter of young persons, and the trichotomy of security vulnerabilities, attacks, and defences for three quarters of the M.Sc. students. Also, confidence in knowledge of game design improved for both demographics (from 47.1% to 82.4% for young persons and from 12.5% to 75% for M.Sc. students). The SSGJ methodology also successfully engaged both demographics of participants in-between scheduled days. Finally, two serious games in the application domain of cybersecurity are presented that were co-designed during the SSGJ with participants and produced as an output of the SSGJs.

The Pitfalls of the Certificate-Based User Authentication Scheme on Korean Public Websites

The Korean government has employed a certificate-based user authentication scheme powered by Internet Explorer and ActiveX plug-ins for the past two decades. Users must obtain accredited digital certificates, install all required plug-ins on their machines, and undergo all user authentication procedures. Most clients mistakenly take a series of authentication procedures for granted and unwittingly make copies of security code cards, store accredited digital certificates on hard disks, and mechanically click “Yes” or “OK”. Public websites lack cross-platform and cross-browser compatibility and discriminate against those who do not use Windows. The government should require public organizations to provide at least a password-based n-factor authentication scheme over SSL/TLS and should reform institutional arrangements so that service providers take primary responsibility for online transactions. This “Galapagos e-government” case illustrates the importance of global technology standards and web accessibility.

Enhanced automated code vulnerability repair using large language models

This research addresses the complex challenge of automated repair of code vulnerabilities, vital for enhancing digital security in an increasingly technology-driven world. The study introduces a novel and efficient format for the representation of code modification, using advanced Large Language Models (LLMs) such as Code Llama and Mistral. These models, fine-tuned on datasets featuring C/C++ code vulnerabilities, significantly improve the accuracy and adaptability of automated code repair techniques. A key finding is the enhanced repair accuracy of these models when compared to previous methods such as VulRepair, which underscores their practical utility and efficiency. The research also offers a critical assessment of current evaluation metrics, such as “Perfect Predictions”, and their limitations in reflecting the true capabilities of automated repair models in real-world scenarios. Following this, it underscores the importance of using test datasets devoid of train samples, emphasizing the need for dataset integrity to enhance the effectiveness of LLMs in code repair tasks. The significance of this work is its contribution to digital security, setting new standards for automated code vulnerability repair and paving the way for future advancements in the fields of cybersecurity and artificial intelligence. The study does not only highlight the potential of LLMs in enhancing code security but also fosters further exploration and research in these crucial areas.

Implementation of ISPS Code Security Level 2 at the Time the Ship Entered the Pontianak Navy Line to Prevent Security Threats Load at KM. Meratus Benoa

This research aims to implement ISPS Code Security Level 2 when the ship enters the Pontianak shipping channel to prevent cargo security threats on KM. Meratus Benoa. The time used by researchers to conduct research for 11 months and 13 days, starting from March 11, 2023-24 February 2024. KM. Meratus Benoa is one type of container deck ship managed by PT Meratus Line. This research method uses qualitative methods using Phenomenological research strategies. This data source collection technique is obtained from direct observation, interviews with ship crews and several journals related to this research. The results of this study indicate that the implementation of ISPS Code Security Level 2 when the ship enters the Pontianak shipping channel to prevent cargo security threats on KM.Meratus Benoa, namely by, a) Involving various efforts and activities such as patrols, security drills and additional supervision. Crew awareness and external support are also factors that influence the effectiveness of ISPS Code Security Level 2 implementation. b) There are coordination and training efforts carried out by ship officers to improve crew preparedness in dealing with security threats. As for the efforts made to prevent cargo security threats on KM Meratus Benoa by a) Restricting access to the ship and inside the ship to prevent unauthorized access, adding bulkheads to the pilot ladder door to increase security, adding guard officers and optimal division of guard duties when the ship enters a high-risk port area. b) conducting annual security exercise trials on a regular basis.

Preventing Security Code Vulnerabilities in the Age of AI (Artificial Intelligence) Code Assistants

Preventing Security Code Vulnerabilities in the Age of AI (Artificial Intelligence) Code Assistants

One time pad for enhanced steganographic security using least significant bit with spiral pattern

Data is an important commodity in today’s digital era. Therefore, data needs to get adequate security to prevent misuse. A common data security practice in the transmission of information is cryptography. Another approach is steganography, which hides secret messages in other media that are not confidential and can be accessed by the public. In this study, the spiral pattern is used for data placement using the least significant bit (LSB) method. Modifications were made to the 2-bits LSB to increase the data capacity that can be hidden. In order to increase security, the data is first converted into a datastream using random numbers as one time pad (OTP). exclusive-OR (XOR) operation is performed on datastream and OTP to get encrypted data to be hidden. The results showed that the image quality of the steganography results at a capacity close to 100% was still fairly good, as indicated by a peak signal-to-noise ratio (PSNR) value greater than 46 dB. Visually, the steganographic image does not look different from the original one. Likewise, the use of random numbers as OTP succeeded in changing the hidden data significantly, as indicated by the avalanche effect value above 50%.

Adaptive 3D Mesh Steganography Based on Feature-Preserving Distortion.

Current 3D mesh steganography algorithms relying on geometric modification are prone to detection by steganalyzers. In traditional steganography, adaptive steganography has proven to be an efficient means of enhancing steganography security. Taking inspiration from this, we propose a highly adaptive embedding algorithm, guided by the principle of minimizing a carefully crafted distortion through efficient steganography codes. Specifically, we tailor a payload-limited embedding optimization problem for 3D settings and devise a feature-preserving distortion (FPD) to measure the impact of message embedding. The distortion takes on an additive form and is defined as a weighted difference of the effective steganalytic subfeatures utilized by the current 3D steganalyzers. With practicality in mind, we refine the distortion to enhance robustness and computational efficiency. By minimizing the FPD, our algorithm can preserve mesh features to a considerable extent, including steganalytic and geometric features, while achieving a high embedding capacity. During the practical embedding phase, we employ the Q-layered syndrome trellis code (STC). However, calculating the bit modification probability (BMP) for each layer of the Q-layered STC, given the variation of Q, can be cumbersome. To address this issue, we design a universal and automatic approach for the BMP calculation. The experimental results demonstrate that our algorithm achieves state-of-the-art performance in countering 3D steganalysis.