International Journal of Information and Computer Security (9 papers in press)

Regular Issues

• An interpretable ensemble learning approach with multi-feature behavioural intelligence for Lumma malware detection  
  by Romil Rawat, Shraddha Gupta, Swati Sharma, Shilpa Jaiswal, Kamal Kant Trivedi, T.M. Thiyagu 
  Abstract: To counter Lumma stealer malware threats bypassing traditional static and deep learning methods, this study proposes a Bayesian-optimised gradient boosting framework with in-fold selection (BAE-GBF). Evaluated on a balanced 2,000-sample dataset comprising 1,000 authentic Lumma variants and 1,000 benign executables across a 15-attribute feature space (PE headers, execution traces, network telemetry), the model applies strict in-fold synthetic Gaussian jitter and mutual information feature selection with correlation pruning (> 0.85) within an 80:20 stratified protocol (n = 400 holdout). BAE-GBF achieves 97.8% accuracy, a 97.2% F1-score, 98.1% precision, 96.3% recall, an AUC-ROC of 0.992, and a 2.9% false positive rate. It maintains a 4.2 ms inference time and 18.7 ms total processing time per sample. Additionally, it demonstrates high stability across ten random seeds (p < 0.01) and an 8.4% attack success rate under multi-domain perturbations.
  Keywords: Lumma malware; gradient boosting; behavioural analysis; network features; malware detection; adversarial robustness; cybersecurity analytics.
  DOI: 10.1504/IJICS.2026.10081537
   
  
• An adaptive deep learning intrusion detection system for control and data plane security in software defined network  
  by P. Mohana Priya 
  Abstract: Software defined network (SDN) introduces programmability to enhance network flexibility, which might result in attack surfaces across both control plane and data plane. This research work presents an adaptive intrusion detection system (A-IDS) to secure both the control and data planes of SDN. The core of A-IDS proposed is an adaptive model selection framework that dynamically evaluates and selects appropriate deep learning models such as convolutional neural network (CNN), deep belief network (DBN) and restricted Boltzmann machine (RBM) architectures based on traffic characteristics and performance feedback. The A-IDS is implemented using Mininet emulation software, and experimental results prove that CNN outperforms other deep learning models with intrusion detection accuracy, precision, recall and F1-score. Comparative results show that the adaptive deep learning approach of adaptive IDS outperforms traditional classifiers, validating its effectiveness for accurate, robust, and scalable intrusion detection in SDN environments.
  Keywords: deep learning; intrusion detection system; IDS; open flow protocol; security attacks; software defined network; SDN.
  DOI: 10.1504/IJICS.2026.10082144
   
  
• Privacy preserving stream-based intrusion detection against model inversion attacks: a differential privacy framework  
  by Mohammad M. Rasheed 
  Abstract: An intrusion detector releases a probability vector with every decision, and an adversary with auxiliary traffic can use it to estimate flow attributes the operator never published. This study asks which features such a detector should consume, and answers by attacking each candidate through the detectors own outputs to obtain a recoverability score. Features scoring above the threshold are withheld under a declared utility budget, and the surviving vector receives bounded Laplace noise cached so identical queries return one release. No formal differential-privacy guarantee is claimed for the composed mechanism, which is characterised empirically. On CICIDS2017 the rule withholds 35 of 77 features, removes 96.67% of measured leakage and leaves frozen-test macro-F1 higher. Reconstruction and shadow-model membership attacks both approach chance under perturbation, with under 3% throughput overhead. NSL-KDD and UNSW-NB15 behave similarly, while CSE-CIC-IDS2018 yields no defensible isolation and adaptive allocation proves no better than uniform noise.
  Keywords: intrusion detection; model inversion; attribute inference; feature isolation; bounded output perturbation; membership inference; probability calibration; CICIDS2017; UNSW-NB15; streaming security.
  DOI: 10.1504/IJICS.2027.10082145
   
  
• FedPah: accuracy-based dynamic weighting with homomorphic encryption in federated learning  
  by Huimin Zheng, Shengwei Xu 
  Abstract: Federated learning under non-independent and identically distributed (Non-IID) data can yield uneven client performance and expose transmitted updates. To address these, this study proposes FedPah, which combines FedProx local regularisation, an accuracy-derived self-information weighting rule and CKKS-compatible encrypted aggregation. Across four synthetic distributions, four seeded repetitions under a fixed per-round client-selection schedule show that FedPah improves final accuracy by 2.153.62 percentage points and reduces client-accuracy variance by 45.0%62.5% relative to FedProx in three Non-IID settings. In the seed-0, 10,000-round FEMNIST experiment, FedPah reaches 0.7968 accuracy versus 0.7516 for FedProx and lowers final client-accuracy variance from 0.0354 to 0.0260. Worst-client, best-client and Jain metrics clarify performance-distribution fairness, while CKKS measurements quantify numerical fidelity and overhead. These results demonstrate the value of transparent accuracy-based weighting for improving effectiveness and performance balance under the evaluated Non-IID settings.
  Keywords: federated learning; FL; accuracy; fairness; homomorphic encryption; HE; privacy protection.
  DOI: 10.1504/IJICS.2026.10082274
   
  
• Secure colour image encryption using improved ECC with KOAWOA algorithm and OTP generation  
  by Nilesh N. Thorat, Amit Singla, Tanaji Anandrao Dhaigude, Sumit Arun Hirve 
  Abstract: This research proposes a novel hybrid cryptographic framework that integrates improved elliptic curve cryptography (ImECC) with modified HMAC-based one-time password (MHOTP) generation, optimised through the newly introduced kookaburra merged walrus optimisation (KOAWOA) algorithm. The proposed method consists of two primary phases: embedding (encryption) and extraction (decryption). During the encryption process, three original images and two secret images undergo multi-layered encryption using random grid-based secret image sharing, extended visual cryptography scheme (EVCS), and kronecker product-based encryption, ensuring a highly secure and robust encryption mechanism. The KOAWOA algorithm is introduced as an advanced hybrid optimisation technique to generate optimal encryption keys, significantly enhancing security and reducing computational overhead. KOAWOA employs an adaptive metaheuristic strategy to improve randomness, making it highly resistant to attacks. Additionally, in the ImECC-based encryption stage, the MHOTP generation technique is utilised, where dynamically generated OTPs serve as encryption keys.
  Keywords: kookaburra merged walrus optimisation algorithm; improved elliptic curve cryptography; ImECC; visual cryptography; Baker's map; MHOTP generation.
  DOI: 10.1504/IJICS.2026.10081171
   
  
• Malicious transaction detection in Bitcoin blockchain using ensemble learning approaches  
  by Abhiram Vaitla, Devidas S 
  Abstract: The growing adoption of cryptocurrencies has increased concerns about malicious activities on blockchain networks. Due to their pseudonymous nature and rapid transaction processing, identifying fraudulent Bitcoin transactions remains challenging. This study presents a practical and reproducible machine learning pipeline for detecting malicious Bitcoin transactions using the enriched Elliptic++ dataset. The proposed workflow involves data preprocessing, integration of transaction features with class labels, missing-value handling, and temporal data splitting to simulate real-world prediction scenarios. Pearson correlation analysis was conducted to assess the relevance of individual features to the target variable. Since the features exhibited weak correlations and none satisfied the predefined threshold for exclusion, all available features were retained for model training. We evaluated several machine learning models, including logistic regression, decision trees, random forests, XGBoost, SVM, and ensemble approaches. The results show that voting and stacking ensembles performed comparably to the best individual classifiers, highlighting their potential for blockchain security and financial forensics.
  Keywords: blockchain; financial forensics; ensemble learning; anomaly detection.
  DOI: 10.1504/IJICS.2026.10081588
   
  
• An efficient block cipher identification technique based on distance measurement and ensemble learning  
  by Xiaonian Wu, Bingyin Song, Runlian Zhang, Hailong Zhang 
  Abstract: Improving the accuracy of block cipher identification remains a significant challenge. To address this issue, we propose an efficient identification technique based on distance measurement and ensemble learning. First, plaintexts and their corresponding ciphertexts are generated and treated as vectors. The distance between each plaintext-ciphertext pair is then computed. These computed distances, together with the entropy of the ciphertexts, constitute a feature set. Using this feature set, the stacking technique is employed to construct an ensemble learning based classification model that integrates multiple machine learning algorithms, with five-fold cross-validation applied for both training and testing. Experimental results demonstrate that, compared with existing methods, the proposed model attains a highest five-class classification accuracy of 0.80 under the ECB mode and 0.61 under the CBC mode. Overall, this work contributes a hybrid feature set and a stacking ensemble model that achieve superior identification accuracy over existing approaches.
  Keywords: block cipher identification; distance measurement; entropy; ensemble learning; stacking.
  DOI: 10.1504/IJICS.2026.10081479
   
  
• A novel AI-based cloud healthcare security framework using optimised fire hawk XOR encryption and probabilistic super learning  
  by A.R. Arunarani, G. Sudhakaran, G. Logeswari, T.M. Thiyagu 
  Abstract: Modern society cannot do without healthcare, which demands secure data storage and transmission including prescriptions, medical history, and patient information. However, even though cloud computing offers flexible healthcare services; it raises serious privacy and security concerns. Thus, this research suggests a novel intelligent approach for healthcare data transmission using optimised fire hawks XOR (OFHXOR) and probabilistic super learning (PSL). In the proposed OFHXOR algorithm, the FHO is responsible for selecting the best encryption key for improving data security. Next, the PSL is used to detect attacks, select features, and change attack-related properties in order to boost learning performance. The suggested intelligent approach is helpful for real-time healthcare cloud computing, providing secure communication, efficient detection, robust access control, and computational efficiency. As can be seen from experiments, the OFHXOR-PSL model is superior to other techniques because it ensures 95.68% detection accuracy, 98.56% security level, and 4% attack rate.
  Keywords: cloud computing; fire hawk optimiser; FHO; probabilistic super learning; Matthews correlation coefficient.
  DOI: 10.1504/IJICS.2026.10081694
   
  
• Security assessment of TWINE cipher under linked and statistical ineffective fault analysis  
  by Vahid Soleimani Hesari, Hadi Soleimany, Iman Mirzaali Mazandarani, Fatemeh Hossein-khani 
  Abstract: Linked ineffective fault analysis (LIFA) exploits deterministic relations between internal variables associated with ineffective faults, enabling key-dependent leakage even when faulty ciphertexts are unavailable. We investigate LIFA on TWINE, a lightweight block cipher based on a 16-branch generalised feistel network, and compare it with statistical ineffective fault analysis (SIFA). For single-link LIFA, one ineffective ciphertext reduces the candidate space for two four-bit last-round subkey nibbles from 2⁸ to 2⁸. We further introduce multiple linked ineffective fault analysis (MLIFA), which applies two linked S-box relations simultaneously and reduces the candidate space for four 4-bit last-round subkey nibbles from 2¹⁶ to 2⁸ per ineffective ciphertext. We validate both attacks through simulations and clock-glitch experiments on an ATmega328P microcontroller. The results show that LIFA and MLIFA require substantially fewer ineffective ciphertexts and provide greater robustness to fault-injection noise than SIFA.
  Keywords: generalised Feistel network; GFN; linked ineffective fault analysis; LIFA; lightweight block cipher; multiple linked ineffective fault analysis; MLIFA; statistical ineffective fault analysis; SIFA; TWINE.
  DOI: 10.1504/IJICS.2026.10081649