Table of Content

12 December 2025, Volume 11 Issue 12

Previous Issue   

Research on Critical Information Infrastructure Security Protection

2025, 11(12):  1074. 

Asbtract ( )   PDF (334KB) ( )  

Related Articles | Metrics

Research on Frontier Technologies for Critical Information  Infrastructure Security Protection

2025, 11(12):  1075. 

Asbtract ( )   PDF (994KB) ( )  

References | Related Articles | Metrics

Currently, China’s critical information infrastructure (CII) faces significant threats, including statesponsored cyber attacks and supply chain disruptions. This research aims to systematically analyze the key technological frameworks and development trends in CII security protection, assess China’s current technological capabilities and core bottlenecks in this domain, and propose development strategies and implementation pathways aligned with national conditions. Focusing on key technology clusters such as dynamic active defense, intelligent analysis and response, and resilience architectures, the study explores their synergistic application mechanisms and integration points with existing policies. The study seeks to provide critical technical support and policy recommendations for enhancing the security resilience and compliance of CII.

Research on Talent Cultivation for Critical Information Infrastructure  Security Protection

2025, 11(12):  1081. 

Asbtract ( )   PDF (922KB) ( )  

References | Related Articles | Metrics

As the digital wave sweeps across the globe, the security of critical information infrastructure has become central to national cybersecurity strategies. Cultivating a highcaliber talent pool capable of protecting these core facilities from cyber attacks has therefore become particularly crucial. By examining international practical experience in training professionals for the security protection of critical information infrastructure systems, and considering the current status and challenges of talent development in this field in China, this paper proposes recommendations to strengthen the foundation, address existing challenges, and optimize talent development. These suggestions aim to support and guide the development and training of professionals responsible for securing China’s critical information infrastructure.

Research on Security Challenges and Countermeasures for Critical  Information Infrastructure in the Artificial Intelligence Era

2025, 11(12):  1087. 

Asbtract ( )   PDF (944KB) ( )  

References | Related Articles | Metrics

With the rapid advancement of artificial intelligence (AI) technologies, critical information infrastructure is confronting unprecedented security challenges. This paper employs systematic analysis and comparative research methods to examine the security threats faced by critical information infrastructure in the AI era, specifically focusing on structural vulnerabilities, governance lag, and dual technical risks. Drawing on the strategic practices of major economies such as the United States, the European Union, and Japan, it proposes that China should enhance AI security policy standards, establish a security risk governance framework, and strengthen security technology innovation. Through these pathways, China can build a selfreliant, secure, and reliable AIenabled critical information infrastructure system, thereby enhancing national digital security capabilities and global competitiveness.

Research on Data Space Security Under Critical Information  Infrastructure Security

2025, 11(12):  1093. 

Asbtract ( )   PDF (968KB) ( )  

References | Related Articles | Metrics

Against the backdrop of the deepening development of the digital economy, researching the security of trustworthy data spaces is of great significance for enhancing the data protection level of critical information infrastructure and promoting the highquality development of the datafactor market. This study systematically analyzes the development status of data spaces in the United States, the European Union and Japan. Building on international experience, it focuses on industrial sectors, examining the development landscape and existing challenges of data space security in each field. The study proposes policy recommendations, including strengthening the legal and regulatory framework for data spaces, advancing breakthroughs in core technologies, fostering diverse application scenarios and market ecosystems, optimizing the supply structure, and enhancing international cooperation. These proposals aim to ensure the secure circulation of data as a production factor and to promote the highquality development of the data factor market.

Private Set Intersection Cardinality Protocol for Supporting Set  Dynamic Updating

2025, 11(12):  1099. 

Asbtract ( )   PDF (1322KB) ( )  

References | Related Articles | Metrics

The private set intersection cardinality (PSICA) enables each participant to obtain only the intersection size while keeping other information private. For instance, when it comes to measuring the ad conversion rates, the number of ad viewers on the ad platform is much smaller than the number of service subscribers of the service provider, and the set owned by the service provider is constantly changing. However, the majority of the existing PSICA protocols do not suppport the dynamic updating of sets. To this end, this paper proposes a PSICA protocol based on switched encryption and dynamic Bloom filters for nonequilibrium scenarios and supports dynamic updating of ensembles. The security proof shows that the protocol can be proven to be secure under the random oracle model. The performance analysis and simulation experimental results indicate that the protocol is able to achieve the intersection base computation with acceptable overhead and the misclassification rate of the dynamic Bloom filter is maintained at a low level. 

Insider Threat Detection Model Based on SSIMGAN and  Time Series Transformer

2025, 11(12):  1108. 

Asbtract ( )   PDF (2431KB) ( )  

References | Related Articles | Metrics

Insider threat detection is a critical component of information security, aiming to protect enterprise networks and data security by preventing damage caused by insider misconduct. This paper proposes a novel insider threat detection framework based on the CERT4.2 dataset. First, we construct multivariate timeseries data and design a structural similarity indexdriven auxiliary classifier generative adversarial network (SSIMACGAN) to augment threat data across different scenarios. This approach addresses the class imbalance issue in the CERT4.2 dataset by generating synthetic samples that closely match the original data distribution. Subsequently, a time series Transformer model with Focal Loss is adopted for classification tasks, enabling the model to prioritize hardtoclassify and minorityclass samples. Precision, recall, and F1score are used as evaluation metrics. Experimental results show that our method achieves a recall of 96.22% and F1score of 94.22% on the CERT4.2 dataset, outperforming baseline models. These results validate its effectiveness in mitigating data imbalance and reducing false negative rates.

An Efficient Detection Method of Phishing Email Based on  Language Model and LoRA

2025, 11(12):  1117. 

Asbtract ( )   PDF (2705KB) ( )  

References | Related Articles | Metrics

Phishing email detection is critical in cybersecurity, as it faces significant challenges due to the diverse and complex nature of phishing emails. This paper proposes a phishing email detection method integrating the pretrained language model DistilBERT with LowRank Adaptation (LoRA). DistilBERT is used to extract deep semantic features from email text, while LoRA finetunes a small number of parameters, thereby reducing the dependence on largescale labeled data and enhancing the model generalization. Experimental results show that compared to traditional machine learning methods and deep learning models (such as RNN, LSTM, and Bidirectional LSTM), DistilBERT+LoRA outperforms them in key metrics including accuracy, precision, recall, and F1score, achieving 96% accuracy and 97% F1score, which significantly surpassing comparative models. Additionally, it demonstrates better balance between precision and recall than other deep learning models, particularly demonstrating robustness and adaptability in detecting complex phishing emails. Experiments further reveal that the model’s performance improves with the increase in LoRA’s rank parameters. By leveraging the powerful feature extraction capabilities of pretrained language models and the efficient finetuning advantages of LoRA, this method provides an innovative and effective solution for accurate and efficient phishing email detection.

Fileless Obfuscation Attack Recognition Based on Semantic Recovery and  Large Language Model

2025, 11(12):  1125. 

Asbtract ( )   PDF (1478KB) ( )  

References | Related Articles | Metrics

With the continuous advancement of fileless attack techniques and strategies, research on identifying fileless malicious attack has garnered significant attention. Among these, fileless obfuscation attack, as a new type of covert, dynamic, and complex attack, can rapidly bypass existing attack engines and rulebased frameworks. To address this problem, this paper proposes an attack script restoration method guided by dynamic partial execution and semantic analysis tree guidance, enabling the restoration of obfuscated code. Furthermore, leveraging the efficiency of large models in attack understanding and semantic recognition, we integrate large models to achieve efficient identification and classification of fileless code. To further alleviate the limitations of large models in handling large code files and long passages, we also provide a semantic code compression strategy to retain critical attack semantics. Experimental results demonstrate that our proposed semantic restoration and large model identification methods can enhance effectiveness by around 10% compared to existing models and methods, while maintaining efficient attack identification efficiency.

A Lightweight PUFbased Anonymous Authentication Protocol for  Wireless Medical Sensor Networks

2025, 11(12):  1134. 

Asbtract ( )   PDF (2231KB) ( )  

References | Related Articles | Metrics

In response to the current challenges of resource constraints and the vulnerability of wireless medical sensor nodes, this paper proposes a lightweight anonymous authentication protocol specifically designed for wireless medical sensor networks. The protocol utilizes a physical unclonable function (PUF), deployed by the gateway, to facilitate secure authentication and key negotiation between medical experts and wireless medical sensor nodes via the gateway. The Proverif protocol analysis tool, the ROR Oracle model and nonformal analysis demonstrate that this protocol achieves mutual authentication and session key negotiation between medical specialists and wireless medical sensors, and is resistant to common attacks with good security properties. A comparison of the proposed protocol with other authentication protocols from recent years reveals that it has the lowest computational costs, with the total computational costs outperforming other protocols by more than 22.7% when the number of authentication times reaches 3500. Furthermore, experiments demonstrate that the protocol has good security attributes and lightweight characteristics, making it suitable for resourceconstrained wireless medical sensor networks.

USB Device Access Control Policy Based on Attributebased  RBAC Mixed Extension

2025, 11(12):  1146. 

Asbtract ( )   PDF (2108KB) ( )  

References | Related Articles | Metrics

Aiming at the hot issue of USB (universal serial bus) device security defense, this paper explores access control methodologies. It proposes a mixed extention access control model of Attributebased RBAC (rolebased access control). Then based on the model, this paper designs and implements an access control system for USB device by combining authentication and control. This experiment verifies the feasibility of the model and its access control system. The results show that this system could solve the problems of coarsegrained and static allocation in traditional USB device access control.

A DiForest Algorithm for Detecting Abnormal Docker Container

2025, 11(12):  1156. 

Asbtract ( )   PDF (2458KB) ( )  

References | Related Articles | Metrics

With the problems of anomaly detection for poor accuracy, high resource consumption, and high time complexity of the isolation forest (iForest) algorithm, this paper proposed a novel DiForest algorithm which applies the featureweighted selection and the standard deviation of the isolation tree path lengths for anomaly detection of Docker container. The experiment simulates four types, CPU, memory, disk IO, and URL access overruns. The experimental results show that DiForest algorithm performs anomaly detection. The average running memory in the container is 30.6 MB, which is about 6.67% smaller than the average running memory of iForest algorithm for anomaly detection. The network throughput for DiForest algorithm is 110Mbps, which is about 13.3% higher than the network throughput for iForest algorithm. Meanwhile, the log anomaly detection experiments for URL access overruns show that the DiForest algorithm accesses requests with a success rate of 82.9%. It is 31.8% higher than the success rate of the iForest algorithm in the state of handling URL access overruns. Therefore, DiForest algorithm not only reduces the resource consumption when the container is abnormal, but also improves the accuracy of abnormality log detection.