31 October 2026, Volume 4 Issue 5
-
Select all|
-
Journal of Cybersecurity. 2026, 4(5): 2-17. https://doi.org/10.20172/j.issn.2097-3136.260622
Against the backdrop of great power strategic competition and digital sovereignty rivalries, cyber attack attribution has evolved from purely technical tracing into a composite decision problem that integrates forensic analysis, intelligence assessment, strategic intent judgment, and the allocation of state responsibility under international law. In current advanced persistent threat (APT) attribution paradigms, the micro-level technical paradigm faces challenges such as the failure of feature exclusivity, while the macro-level political paradigm faces insufficient evidence transparency. Meanwhile, intelligent paradigms like knowledge graphs and large language model (LLM) encounter bottlenecks in cross-domain integration. We conducted a critical review of five major research paradigms, encompassing technical tracing, political attribution, knowledge graphs, LLM and agents, and uncertainty quantification. The analysis reveals that the core dilemma in existing attribution research lies in a persistent triple fracture—representational, temporal, and causal—between micro-level technical evidence and macro-level strategic context. Based on this, this paper proposes a technogy-political fusion attribution framework. It advocates for entity extraction and semantic alignment through knowledge learning and analytical algorithms tailored for multi-source heterogeneous data, to populate and validate cross-domain technogy-political knowledge graphs, and integrates Dempster-Shafer evidence theory with Bayesian networks for conflict resolution and causal inference, ultimately generating confidence-scored attribution rankings and counterfactual explanations. Future research should construct a cross-domain ontology anchored by four dimensions—technology, organization, politics and events—and establish a "spatiotemporal-causal" alignment mechanism between micro-level technical indicators and macro-level political contexts. Furthermore, refining the serial reasoning pipeline of "probabilistic inference followed by counterfactual testing" will help transition cyber attack attribution from mere correlation matching toward a causal reasoning system that is auditable, interpretable, and capable of uncertainty quantification.
-
Journal of Cybersecurity. 2026, 4(5): 18-32. https://doi.org/10.20172/j.issn.2097-3136.260924
APT (advanced persistent threat) organization attribution aims to identify potential threat actors behind attack activities based on relevant attributes and open-source intelligence, representing a critical task in cyber threat analysis. However, APT organizations exhibit multidimensional, heterogeneous, sparse, and continuously evolving characteristics. Existing methods struggle to uniformly transform multisource features from organization profiles into computable attribution evidence, and the attribution process relies on expert experience, making threat attribution results difficult to unify and share. To address these issues, this paper proposes an APT organization attribution method based on a hierarchical quantification model. First, a hierarchical feature model for APT organizations is constructed from three dimensions—tool chain, business chain, and social chain—to establish attribution indicators with hierarchical relationships for threat organizations. Second, organization-specific decision conditions, quantification weights, and computation rules are generated according to the characteristics and statistical distributions of different indicators, thereby transforming the hierarchical model into hierarchical quantification attribution rules tailored to specific APT organizations. Finally, corresponding attribution features are extracted from the attack activity under analysis, and the quantification model calculates its matching degree with different APT organizations while outputting the contribution of indicators at each level to the attribution result, thereby producing quantifiable and explainable APT organization attribution conclusions. Experiments were conducted on the tool-chain and business-chain dimensions, for which structured data were available. The results show that the proposed method achieves a Top-1 attribution accuracy of 97.1% without labeled data, surpasses supervised baselines trained on 80% labeled data, and outperforms the LLM+RAG attribution approach in accuracy, consistency, and efficiency. Ablation experiments further confirm the contributions of rule learning and hierarchical structure to attribution performance.
-
Journal of Cybersecurity. 2026, 4(5): 33-45. https://doi.org/10.20172/j.issn.2097-3136.260921
The packet forwarding control protocol (PFCP) serves as the center of the N4 interface in the 5G core network, supporting dynamic scheduling and resource management of user plane data forwarding. Its security is directly related to the stable operation of user plane functions and the reliable delivery of data forwarding. With the ongoing exploration of 6G network architectures and the deepening deployment of 5G-Advanced technologies, the core network is expected to face emerging challenges such as multi-domain integration and computing-network collaboration, making the security and reliability of signaling data a critical concern. This study proposes a hybrid deep learning-based anomaly detection model that combines the capability of convolutional neural networks to capture local signaling patterns with the strength of Transformer architectures in modeling global temporal dependencies. The proposed approach enables high-precision detection of anomalous PFCP signaling behaviors, and its effectiveness is validated through experimental evaluations.
-
Journal of Cybersecurity. 2026, 4(5): 46-58. https://doi.org/10.20172/j.issn.2097-3136.260925
With the exhaustion of IPv4 addresses, IPv6 has been widely deployed. Its enormous address space renders traditional brute-force scanning ineffective. Existing seedless IPv6 probing methods suffer from limited generalization capability, and most of them only focus on discovering live addresses, failing to automatically identify diverse unknown security risks. This paper proposes an integrated active mapping framework for unknown IPv6 cyberspace. Targeting high-value Lowbyte1 addresses, we design the 6SeqGen autoregressive model, which learns nibble-wise address distributions from seeded prefixes and transfers the learned patterns to seedless network segments. An online closed-loop feedback mechanism is introduced to iteratively optimize the model based on real-world probing results. Combining deep mapping with large-model-driven analysis, the framework enables intelligent judgment of unstructured security risks and forms a complete working loop via risk fingerprint accumulation. Real-world experiments conducted on five autonomous systems demonstrate that 6SeqGen outperforms random scanning by 2~4 orders of magnitude in probing efficiency. It achieves a hit rate of 2.66% for general seedless prefixes, with the highest average hit rate reaching 91.46% for highly regular prefixes. The measurement also uncovers widespread issues including information leakage on gateway devices and exposure of outdated high-risk services. The results verify the feasibility of cross-segment address pattern transfer, providing technical references for IPv6 network asset mapping and pre-emptive threat perception.
-
Journal of Cybersecurity. 2026, 4(5): 59-74. https://doi.org/10.20172/j.issn.2097-3136.260535
As networked information systems are increasingly deployed in critical infrastructures, network defense systems face pervasive challenges of massive alerts, high noise, and weak correlation, which undermines the timely identification and response to real attacks. Cyber threat intelligence (CTI) can assist in reducing the mean time to detect (MTTD) and the mean time to respond (MTTR) by providing threat indicators and contextual information, thereby supporting alert triage and decision-making. However, in practice, CTI is heterogeneous in origin and uneven in quality, and its opaque production and delivery processes make its trustworthiness and usability difficult to guarantee. This paper systematically combs representative academic research results and industry practices on CTI quality evaluation in recent years. We organize existing work along two primary dimensions—source evaluation and content evaluation—and summarize the evaluation objectives into three core facets: correctness, timeliness, and utility. Based on this synthesis, we summarize the implications of existing evaluation methods for industrial-level intelligence selection, integration, and operation, identify the limitations of current evaluation work in verifiability, applicability, and operability, and outline future research directions oriented to real-world defense needs. Our review provides a structured reference for constructing scientific and practical CTI quality assessment systems, so as to support network defense systems in improving their alert handling and risk response capabilities.
-
Journal of Cybersecurity. 2026, 4(5): 75-89. https://doi.org/10.20172/j.issn.2097-3136.260705
Underwater systems are typical resource-constrained local area networks that rely on data distribution service (DDS) for intra-domain communication. The security threats faced by underwater systems tend to spread inside the system via the publish/subscribe mechanism of intra-domain communication, which are defined as domain threat propagation threats. Among them, attack paths refer to the sequences of asset nodes that have been or may be affected during threat propagation, and attack path evolution denotes the dynamic process where domain threat propagation threats form attack paths with distinct temporal progression characteristics in the system. Traditional security assessment methods ignore the evolution rules of attack paths corresponding to domain threat propagation threats, and have high resource consumption and poor dynamic adaptability, which limits their application in the special underwater environment. Therefore, this paper proposes an attack path evolution-based dynamic adaptive security assessment method for underwater systems. Firstly, the proposed method adopts the hidden Markov model (HMM) to acquire threat propagation paths, states and probabilities, so as to verify the attack path evolution, screen key nodes and determine node weights. Secondly, according to different system security states, it designs a dynamic switching mechanism of evaluation indicators to extract core evaluation indicators. Finally, it adopts the combined weighting method to realize the quantitative scoring of system threats. An underwater system simulation platform is built based on OpenDDS. The experimental results show that the proposed method outperforms traditional industry standards and static models in evaluation performance, reducing the scale of participating evaluation nodes by approximately 54.5% and the scale of evaluation indicators by 76%. This method provides an efficient and lightweight dynamic security assessment approach for domain threats of underwater systems.
-
Journal of Cybersecurity. 2026, 4(5): 90-100. https://doi.org/10.20172/j.issn.2097-3136.260851
Side-channel analysis, which recovers secret keys by exploiting physical leakage from cryptographic devices, has become a significant threat to embedded system security. Existing non-profiling methods, such as correlation power analysis (CPA), are sensitive to noise and suffer from low information utilization. To address this problem, this paper proposes a novel side-channel analysis framework named SPARSE. This framework transforms the key recovery problem into a multi-response row-sparse reconstruction problem based on an enumerated dictionary of key hypotheses. Specifically, the method first constructs an enumerated dictionary for all candidate keys based on the Hamming weight leakage model. Then, it introduces L2,1-norm regularization to establish a convex optimization model and leverages the uniqueness of the secret key to enforce the row-sparsity of the solution matrix. Finally, a sliding-window strategy is adopted to adaptively locate leakage intervals, and a coefficient-of-determination based criterion is used to enhance noise robustness. In systematic experimental evaluations conducted on a self-collected AES power dataset (AES50000) and the public AES power dataset (Panda2018), SPARSE exhibits excellent performance in low-trace scenarios. Specifically, compared with traditional CPA, SPARSE improves the success rate by 20% on the AES50000 dataset and by 10% on the Panda2018 dataset.
-
Journal of Cybersecurity. 2026, 4(5): 101-117. https://doi.org/10.20172/j.issn.2097-3136.260922
Aiming at the problem that large language model (LLM) based penetration agents can utilize the blocking feedback signals of traditional Web application firewalls (WAF) to accelerate attack iteration and optimization, this paper proposes a cognitive adversarial WAF (AIWAF) by investigating existing Web application defense mechanisms. The proposed method activates the safety alignment mechanism of LLMs through a cognitive injection engine to terminate automated penetration tasks. Meanwhile, a pseudo-vulnerability engine is adopted to construct deceptive attack surfaces and mislead the reasoning and decision-making processes of LLM penetration agents. Experimental results on 5 agent frameworks and 6 LLMs show that, under the experimental settings of this work, AIWAF reduces the penetration success rate from 72.8% to 7.3% in the XBOW benchmark. In the evaluation of 20 real-world production websites, the number of discovered real vulnerabilities decreases from 176 to 45 with a vulnerability hit rate of 7.50%, and the agent false positive rate reaches 95.4%. The experimental results demonstrate that the proposed framework can effectively consume the reasoning resources of adversarial agents and block automated penetration behaviors, which realizes effective Web application protection without perception by legitimate browser users.
-
Journal of Cybersecurity. 2026, 4(5): 118-130. https://doi.org/10.20172/j.issn.2097-3136.260923
To address the limitations of existing privacy protection mechanisms, which lack the ability to perceive individual differences of users and find it difficult to make dynamic security decisions, a personalized privacy risk assessment method based on personality traits is proposed. In this method, firstly, a prediction model for the big five personality traits scores is constructed based on Word2Vec and Stacking learning methods to achieve precise quantification of users' personality traits. Subsequently, a privacy risk assessment model is built based on the personality trait scores and the users' real privacy preference data to complete the personalized quantitative assessment of users' privacy risks. Furthermore, for different privacy objects, the privacy protection intensity is adaptively adjusted based on the privacy risk values, providing intelligent decision support for personalized privacy protection. Finally, a data collection strategy is autonomously constructed, and the proposed method is verified and analyzed based on the collected real user data sets. The results show that the proposed method can accurately predict users' personality traits, effectively assess privacy risks, achieve dynamic optimization of privacy protection strategies, and provide an effective approach for data-driven personalized privacy protection and intelligent security decision-making.
Volume 4 Issue 4
Bimonthly
Sponsored by China Aerospace Academy of Systems Science and Engineering
ISSN 2097-3136
CN 10-1901/TP
-
Total visitors
Visitors of today
Now online