Applied Sciences

Research

Jump to: Review, Other

17 pages, 1121 KB

Open AccessArticle

CQLLM: A Framework for Generating CodeQL Security Vulnerability Detection Code Based on Large Language Model

by Le Wang, Chan Chen, Junyi Zhu, Rufeng Zhan and Weihong Han

Appl. Sci. 2026, 16(1), 517; https://doi.org/10.3390/app16010517 - 4 Jan 2026

Viewed by 1272

Abstract

With the increasing complexity of software systems, the number of security vulnerabilities contained within software has risen accordingly. The existing shift-left security concept aims to detect and fix vulnerabilities during the software development cycle. While CodeQL stands as the premier static code analysis [...] Read more.

With the increasing complexity of software systems, the number of security vulnerabilities contained within software has risen accordingly. The existing shift-left security concept aims to detect and fix vulnerabilities during the software development cycle. While CodeQL stands as the premier static code analysis tool currently available on the market, its high barrier to entry poses challenges for meeting the implementation requirements of shift-left security initiatives. While large language model (LLM) offers potential assistance in QL code development, the inherent complexity of code generation tasks often leads to persistent issues such as syntactic inaccuracies and references to non-existent modules, which consequently constrains their practical applicability in this domain. To address these challenges, this paper proposes CQLLM (CodeQL-enhanced Large Language Model), a novel framework for automating the generation of CodeQL security vulnerability detection code by leveraging LLM. This framework is designed to enhance both the efficiency and the accuracy of automated QL code generation, thereby advancing static code analysis for a more efficient and intelligent paradigm for vulnerability detection. First, retrieval-augmented generation (RAG) is employed to search the vector database for dependency libraries and code snippets that are highly similar to the user’s input, thereby constraining the model’s generation process and preventing the import of invalid modules. Then, the user input and the knowledge chunks retrieved by RAG are fed into a fine-tuned LLM to perform reasoning and generate QL code. By integrating external knowledge bases with the large model, the framework enhances the correctness and completeness of the generated code. Experimental results show that CQLLM significantly improves the executability of the generated QL code, with the execution success rate improving from 0.31% to 72.48%, outperforming the original model by a large margin. Meanwhile, CQLLM also enhances the effectiveness of the generated results, achieving a CWE (Common Weakness Enumeration) coverage rate of 57.4% in vulnerability detection tasks, demonstrating its practical applicability in real-world vulnerability detection. Full article

(This article belongs to the Special Issue Advanced Technologies in Data and Information Security, Fourth Edition)

► Show Figures

Figure 1

46 pages, 1279 KB

Open AccessArticle

Privacy-Preserving Machine Learning Techniques: Cryptographic Approaches, Challenges, and Future Directions

by Elif Nur Kucur, Tolga Buyuktanir, Muharrem Ugurelli and Kazim Yildiz

Appl. Sci. 2026, 16(1), 277; https://doi.org/10.3390/app16010277 - 26 Dec 2025

Viewed by 2153

Abstract

Privacy-preserving machine learning (PPML) constitutes a core element of responsible AI by supporting model training and inference without exposing sensitive information. This survey presents a comprehensive examination of the major cryptographic PPML techniques and introduces a unified taxonomy covering technical models, verification criteria, [...] Read more.

Privacy-preserving machine learning (PPML) constitutes a core element of responsible AI by supporting model training and inference without exposing sensitive information. This survey presents a comprehensive examination of the major cryptographic PPML techniques and introduces a unified taxonomy covering technical models, verification criteria, and evaluation dimensions. The study consolidates findings from both survey and experimental works using structured comparison tables and emphasizes that recent research increasingly adopts hybrid and verifiable PPML designs. In addition, we map PPML applications across domains such as healthcare, finance, Internet of Things (IoT), and edge systems, indicating that cryptographic approaches are progressively transitioning from theoretical constructs to deployable solutions. Finally, the survey outlines emerging trends—including the growth of zero-knowledge proofs (ZKPs)-based verification and domain-specific hybrid architectures—and identifies practical considerations that shape PPML adoption in real systems. Full article

(This article belongs to the Special Issue Advanced Technologies in Data and Information Security, Fourth Edition)

► Show Figures

Figure 1

24 pages, 4967 KB

Open AccessArticle

Phish-Master: Leveraging Large Language Models for Advanced Phishing Email Generation and Detection

by Weihong Han, Junyi Zhu, Chenhui Zhang, Zhiqiang Zhang, Yangyang Mei and Le Wang

Appl. Sci. 2025, 15(22), 12203; https://doi.org/10.3390/app152212203 - 17 Nov 2025

Viewed by 2175

Abstract

Phishing emails present a significant and persistent cybersecurity threat to individuals and organizations globally due to the difficulty in detecting these malicious messages. Large Language Models (LLMs) have inadvertently intensified this challenge by facilitating the automated creation of high-quality, covert phishing emails that [...] Read more.

Phishing emails present a significant and persistent cybersecurity threat to individuals and organizations globally due to the difficulty in detecting these malicious messages. Large Language Models (LLMs) have inadvertently intensified this challenge by facilitating the automated creation of high-quality, covert phishing emails that can evade traditional rule-based detection systems. In this study, we examine the offensive capabilities of LLMs in generating phishing emails and introduce Phish-Master, a novel algorithm that integrates Chain-of-Thought (COT) reasoning, MetaPrompt techniques, and domain-specific insights to produce phishing emails designed to bypass enterprise-level filters. Our experiment, involving 100 malicious emails, validates Phish-Master’s real-world effectiveness, achieving a 99% evasion rate within authentic campus networks, successfully bypassing filters and targeting recipients, a testament to its capability in navigating complex network environments. To counteract the threat posed by Phish-Master and similar LLM-generated phishing emails, we have developed a multi-machine learning model integration framework trained on Kaggle’s phishing email dataset. This framework achieved an impressive detection rate of 99.87% on a rigorous test set of LLM-generated phishing emails, highlighting the critical role of our specialized dataset in enabling the detection tool to effectively recognize sophisticated patterns in LLM-crafted phishing emails. This study highlights the evolving threat of LLM-generated phishing emails and introduces an effective detection algorithm to mitigate this risk, emphasizing the importance of continued research in this domain. Full article

(This article belongs to the Special Issue Advanced Technologies in Data and Information Security, Fourth Edition)

► Show Figures

Figure 1

58 pages, 7248 KB

Open AccessArticle

Super Time-Cognitive Neural Networks (Phase 3 of Sophimatics): Temporal-Philosophical Reasoning for Security-Critical AI Applications

by Gerardo Iovane and Giovanni Iovane

Appl. Sci. 2025, 15(22), 11876; https://doi.org/10.3390/app152211876 - 7 Nov 2025

Cited by 2 | Viewed by 1079

Abstract

Current generative AI systems, despite extraordinary progress, face fundamental limitations in temporal reasoning, contextual understanding, and ethical decision-making. These systems process information statistically without authentic comprehension of experiential time or intentional context, limiting their applicability in security-critical domains where reasoning about past experiences, [...] Read more.

Current generative AI systems, despite extraordinary progress, face fundamental limitations in temporal reasoning, contextual understanding, and ethical decision-making. These systems process information statistically without authentic comprehension of experiential time or intentional context, limiting their applicability in security-critical domains where reasoning about past experiences, present situations, and future implications is essential. We present Phase 3 of the Sophimatics framework: Super Time-Cognitive Neural Networks (STCNNs), which address these limitations through complex-time representation T ∈ ℂ where chronological time (Re(T)) integrates with experiential dimensions of memory (Im(T) < 0), present awareness (Im(T) ≈ 0), and imagination (Im(T) > 0). The STCNN architecture implements philosophical constraints through geometric parameters α and β that bound memory accessibility and creative projection, enabling neural systems to perform temporal-philosophical reasoning while maintaining computational tractability. We demonstrate STCNN’s effectiveness across five security-critical applications: threat intelligence (AUC 0.94, 1.8 s anticipation), privacy-preserving AI (84% utility at ε = 1.0), intrusion detection (96.3% detection, 2.1% false positives), secure multi-party computation (ethical compliance 0.93), and blockchain anomaly detection (94% detection, 3.2% false positives). Empirical evaluation shows 23–45% improvement over baseline systems while maintaining temporal coherence > 0.9, demonstrating that integration of temporal-philosophical reasoning with neural architectures enables AI systems to reason about security threats through simultaneous processing of historical patterns, current contexts, and projected risks. Full article

(This article belongs to the Special Issue Advanced Technologies in Data and Information Security, Fourth Edition)

► Show Figures

Figure 1

18 pages, 24399 KB

Open AccessArticle

Legacy Code, Live Risk: Empirical Evidence of Malware Detection Gaps

by Gang-Cheng Huang and Tai-Hung Lai

Appl. Sci. 2025, 15(22), 11862; https://doi.org/10.3390/app152211862 - 7 Nov 2025

Viewed by 1314

Abstract

Consistent detection of malicious loaders across varied programming languages and build tools remains a significant cybersecurity challenge. This study empirically measures how compiler and language choices affect the detectability of standard in-memory Windows loaders. We implement functionally equivalent loaders (allocate, copy, protect, execute) [...] Read more.

Consistent detection of malicious loaders across varied programming languages and build tools remains a significant cybersecurity challenge. This study empirically measures how compiler and language choices affect the detectability of standard in-memory Windows loaders. We implement functionally equivalent loaders (allocate, copy, protect, execute) in C, C#, Fortran, and COBOL, embedding an identical x64 test payload to isolate behavior. Our results reveal significant detection gaps: loaders compiled in legacy languages (Fortran, COBOL) consistently evade static and dynamic antivirus engines that easily flag their C and C# counterparts. We demonstrate this evasion is not due to behavioral differences, but to compiler-specific static artifacts. These artifacts, such as interleaved zero-bytes in Fortran and fragmented payload-construction logic in COBOL, effectively break common signature matching. These findings indicate that many detection tools are overly sensitive to the static build surface rather than true semantic behavior. We provide actionable guidance favoring behavior-focused analysis, such as tracking API call order and memory protection changes, to address this critical legacy code blind spot. Full article

(This article belongs to the Special Issue Advanced Technologies in Data and Information Security, Fourth Edition)

► Show Figures

Figure 1

22 pages, 588 KB

Open AccessArticle

Hybrid AI-Based Framework for Generating Realistic Attack-Related Network Flow Data for Cybersecurity Digital Twins

by Eider Iturbe, Javier Arcas, Gabriel Gaminde, Erkuden Rios and Nerea Toledo

Appl. Sci. 2025, 15(21), 11574; https://doi.org/10.3390/app152111574 - 29 Oct 2025

Viewed by 1084

Abstract

In the context of cybersecurity digital twin environments, the ability to simulate realistic network traffic is critical for validating and training intrusion detection systems. However, generating synthetic data that accurately reflects the complex, time-dependent nature of network flows remains a significant challenge. This [...] Read more.

In the context of cybersecurity digital twin environments, the ability to simulate realistic network traffic is critical for validating and training intrusion detection systems. However, generating synthetic data that accurately reflects the complex, time-dependent nature of network flows remains a significant challenge. This paper presents an AI-based data generation approach designed to generate multivariate temporal network flow data that accurately reflects adversarial scenarios. The proposed method integrates a Long Short-Term Memory (LSTM) architecture trained to capture the temporal dynamics of both normal and attack traffic, ensuring the synthetic data preserves realistic, sequence-aware behavioral patterns. To further enhance data fidelity, a combination of deep learning-based generative models and statistical techniques is employed to synthesize both numerical and categorical features while maintaining the correct proportions and temporal relationships between attack and normal traffic. A key contribution of the framework is its ability to generate high-fidelity synthetic data that supports the simulation of realistic, production-like cybersecurity scenarios. Experimental results demonstrate the effectiveness of the approach in generating data that supports robust machine learning-based detection systems, making it a valuable tool for cybersecurity validation and training in digital twin environments. Full article

(This article belongs to the Special Issue Advanced Technologies in Data and Information Security, Fourth Edition)

► Show Figures

Figure 1

22 pages, 3582 KB

Open AccessArticle

Novel Synthetic Dataset Generation Method with Privacy-Preserving for Intrusion Detection System

by JaeCheol Kim, Seungun Park, Jaesik Cha, Eunyeong Son and Yunsik Son

Appl. Sci. 2025, 15(19), 10609; https://doi.org/10.3390/app151910609 - 30 Sep 2025

Cited by 1 | Viewed by 2385

Abstract

The expansion of Internet of Things (IoT) networks has enabled real-time data collection and automation across smart cities, healthcare, and agriculture, delivering greater convenience and efficiency; however, exposure to diverse threats has also increased. Machine learning-based Intrusion Detection Systems (IDSs) provide an effective [...] Read more.

The expansion of Internet of Things (IoT) networks has enabled real-time data collection and automation across smart cities, healthcare, and agriculture, delivering greater convenience and efficiency; however, exposure to diverse threats has also increased. Machine learning-based Intrusion Detection Systems (IDSs) provide an effective means of defense, yet they require large volumes of data, and the use of raw IoT network data containing sensitive information introduces new privacy risks. This study proposes a novel privacy-preserving synthetic data generation model based on a tabular diffusion framework that incorporates Differential Privacy (DP). Among the three diffusion models (TabDDPM, TabSyn, and TabDiff), TabDiff with Utility-Preserving DP (UP-DP) achieved the best Synthetic Data Vault (SDV) Fidelity (0.98) and higher values on multiple statistical metrics, indicating improved utility. Furthermore, by employing the DisclosureProtection and attribute inference to infer and compare sensitive attributes on both real and synthetic datasets, we show that the proposed approach reduces privacy risk of the synthetic data. Additionally, a Membership Inference Attack (MIA) was also used for demonstration on models trained with both real and synthetic data. This approach decreases the risk of leaking patterns related to sensitive information, thereby enabling secure dataset sharing and analysis. Full article

(This article belongs to the Special Issue Advanced Technologies in Data and Information Security, Fourth Edition)

► Show Figures

Figure 1

16 pages, 955 KB

Open AccessArticle

Minimizing Redundant Hash and Witness Operations in Merkle Hash Trees

by DaeYoub Kim

Appl. Sci. 2025, 15(17), 9611; https://doi.org/10.3390/app15179611 - 31 Aug 2025

Viewed by 1119

Abstract

Reusing cached data is a widely adopted technique for improving network and system performance. Future Internet architectures such as Named Data Networking (NDN) leverage intermediate nodes—such as proxy servers and routers—to cache and deliver data, reducing latency and alleviating load on original data [...] Read more.

Reusing cached data is a widely adopted technique for improving network and system performance. Future Internet architectures such as Named Data Networking (NDN) leverage intermediate nodes—such as proxy servers and routers—to cache and deliver data, reducing latency and alleviating load on original data sources. However, a fundamental challenge of this approach is the lack of trust in intermediate nodes, as users cannot reliably identify and verify them. To address this issue, many systems adopt data-oriented verification rather than sender authentication, using Merkle Hash Trees (MHTs) to enable users to verify both the integrity and authenticity of received data. Despite its advantages, MHT-based authentication incurs significant redundancy: identical hash values are often recomputed, and witness data are repeatedly transmitted for each segment. These redundancies lead to increased computational and communication overhead, particularly in large-scale data publishing scenarios. This paper proposes a novel scheme to reduce such inefficiencies by enabling the reuse of previously verified node values, especially transmitted witnesses. The proposed scheme improves both computational and transmission efficiency by eliminating redundant computation arising from repeated calculation of identical node values. To achieve this, it stores and reuses received witness values. As a result, when verifying 2ⁿ segments (n > 8), the proposed method achieves more than an 80% reduction in total hash operations compared to the standard MHT. Moreover, our method preserves the security guarantees of the MHT while significantly optimizing its performance in terms of both computation and transmission costs. Full article

(This article belongs to the Special Issue Advanced Technologies in Data and Information Security, Fourth Edition)

► Show Figures

Figure 1

16 pages, 3129 KB

Open AccessArticle

Research on the Credulity of Spear-Phishing Attacks for Lithuanian Education Institutions’ Employees

by Justinas Rastenis, Simona Ramanauskaitė, Antanas Čenys, Pavel Stefanovič and Asta Radzevičienė

Appl. Sci. 2025, 15(7), 3431; https://doi.org/10.3390/app15073431 - 21 Mar 2025

Viewed by 1491

Abstract

Organizational security assurance is a complex and multi-dimensional task. One of the biggest threats to an organization is the credulity of phishing attacks for its employees. To prevent attacks, employees must maintain cyber security hygiene and increase their awareness of the cyberattack landscape. [...] Read more.

Organizational security assurance is a complex and multi-dimensional task. One of the biggest threats to an organization is the credulity of phishing attacks for its employees. To prevent attacks, employees must maintain cyber security hygiene and increase their awareness of the cyberattack landscape. In this paper, we investigate how selected Lithuanian education system employees are vulnerable to spear-phishing attacks. In various education organizations, spear-phishing attacks were imitated, and user responses to received emails were monitored and analyzed. Each organization needs a different attention because employee behavior varies. Employees’ reaction time dimension is explored in the research. Based on these results, it appears that the organization has no time for delayed responses. Employees in the education system are highly affected by spear-phishing attacks and need less than one minute to provide attacker-requested data. This illustrates that automated e-mail filtering systems are a key element in the fight against these kinds of attacks. Full article

(This article belongs to the Special Issue Advanced Technologies in Data and Information Security, Fourth Edition)

► Show Figures

Figure 1

18 pages, 2639 KB

Open AccessArticle

Privacy-Preserved Visual Simultaneous Localization and Mapping Based on a Dual-Component Approach

by Mingxu Yang, Chuhua Huang, Xin Huang and Shengjin Hou

Appl. Sci. 2025, 15(5), 2583; https://doi.org/10.3390/app15052583 - 27 Feb 2025

Cited by 1 | Viewed by 1664

Abstract

Edge-assisted visual simultaneous localization and mapping (SLAM) is widely used in autonomous driving, robot navigation, and augmented reality for environmental perception, map construction, and real-time positioning. However, it poses significant privacy risks, as input images may contain sensitive information, and generated 3D point [...] Read more.

Edge-assisted visual simultaneous localization and mapping (SLAM) is widely used in autonomous driving, robot navigation, and augmented reality for environmental perception, map construction, and real-time positioning. However, it poses significant privacy risks, as input images may contain sensitive information, and generated 3D point clouds can reconstruct original scenes. To address these concerns, this paper proposes a dual-component privacy-preserving approach for visual SLAM. First, a privacy protection method for images is proposed, which combines object detection and image inpainting to protect privacy-sensitive information in images. Second, an encryption algorithm is introduced to convert 3D point cloud data into a 3D line cloud through dimensionality enhancement. Integrated with ORB-SLAM3, the proposed method is evaluated on the Oxford Robotcar and KITTI datasets. Results demonstrate that it effectively safeguards privacy-sensitive information while ORB-SLAM3 maintains accurate pose estimation in dynamic outdoor scenes. Furthermore, the encrypted line cloud prevents unauthorized attacks on recovering the original point cloud. This approach enhances privacy protection in visual SLAM and is expected to expand its potential applications. Full article

(This article belongs to the Special Issue Advanced Technologies in Data and Information Security, Fourth Edition)

► Show Figures

Figure 1

28 pages, 432 KB

Open AccessArticle

A Dynamic Risk Assessment and Mitigation Model

by Pavlos Cheimonidis and Konstantinos Rantos

Appl. Sci. 2025, 15(4), 2171; https://doi.org/10.3390/app15042171 - 18 Feb 2025

Cited by 7 | Viewed by 5276

Abstract

In the current operational landscape, organizations face a growing and diverse array of cybersecurity challenges, necessitating the development and implementation of innovative and effective security solutions. This paper presents a novel methodology for dynamic risk assessment and mitigation suggestions aimed at assessing and [...] Read more.

In the current operational landscape, organizations face a growing and diverse array of cybersecurity challenges, necessitating the development and implementation of innovative and effective security solutions. This paper presents a novel methodology for dynamic risk assessment and mitigation suggestions aimed at assessing and reducing cyber risks. The proposed approach gathers information from publicly available cybersecurity-related open sources and integrates it with environment-specific data to generate a comprehensive understanding of potential risks. It creates multiple distinct risk scenarios based on the identification of vulnerabilities, network topology, and the attacker’s perspective. The methodology employs Bayesian networks to proactively and dynamically estimate the probability of threats and Fuzzy Cognitive Maps to dynamically update vulnerability severity values for each risk scenario. These elements are combined with impact estimations to provide dynamic risk assessments. Furthermore, the methodology offers mitigation suggestions for each identified vulnerability across all risk scenarios, enabling organizations to effectively address the assessed cybersecurity risks. To validate the effectiveness of the proposed methodology, a case study is presented, demonstrating its practical application and efficacy. Full article

(This article belongs to the Special Issue Advanced Technologies in Data and Information Security, Fourth Edition)

► Show Figures

Figure 1

14 pages, 3053 KB

Open AccessArticle

Cyber Environment Test Framework for Simulating Command and Control Attack Methods with Reinforcement Learning

by Minki Jeong, Jongyoul Park and Sang Ho Oh

Appl. Sci. 2025, 15(4), 2120; https://doi.org/10.3390/app15042120 - 17 Feb 2025

Cited by 4 | Viewed by 3626

Abstract

Recently, the IT industry has become larger, and cloud service has rapidly increased; thus cybersecurity to protect sensitive data from attacks has become an important factor. However, cloud services have become larger, making the surface area larger, and a complex cyber environment leads [...] Read more.

Recently, the IT industry has become larger, and cloud service has rapidly increased; thus cybersecurity to protect sensitive data from attacks has become an important factor. However, cloud services have become larger, making the surface area larger, and a complex cyber environment leads to difficulty managing and defending. With the rise of artificial intelligence, applying artificial intelligence to a cyber environment to automatically detect and respond to cyberattacks has begun to get attention. In order to apply artificial intelligence in cyber environments, a simulation framework that is easily applicable and can represent real situations well is needed. In this study, we introduce the framework Cyber Environment (CYE) that provides useful components that abstract complex and large cloud environments. Additionally, we use CYE to reproduce real-world situations into the scenario and apply reinforcement learning for training automated intelligence defense agents. Full article

(This article belongs to the Special Issue Advanced Technologies in Data and Information Security, Fourth Edition)

► Show Figures

Figure 1

Review

Jump to: Research, Other

34 pages, 3772 KB

Open AccessReview

Challenges and Potential Improvements for Passkey Adoption—A Literature Review with a User-Centric Perspective

by Alexander Matzen, Artur Rüffer, Marcus Byllemos, Oliver Heine, Maria Papaioannou, Gaurav Choudhary and Nicola Dragoni

Appl. Sci. 2025, 15(8), 4414; https://doi.org/10.3390/app15084414 - 17 Apr 2025

Cited by 6 | Viewed by 9814

Abstract

This paper provides a comprehensive review of the recent literature on passkeys, a more secure and phishing-resistant authentication method compared to traditional passwords. Despite their clear advantages, passkeys have not yet replaced the de facto standard of password authentication. This literature survey aims [...] Read more.

This paper provides a comprehensive review of the recent literature on passkeys, a more secure and phishing-resistant authentication method compared to traditional passwords. Despite their clear advantages, passkeys have not yet replaced the de facto standard of password authentication. This literature survey aims to outline a holistic picture of the related research, focusing on technical aspects as well as user-centric perspectives on usability and perception. The main challenges hindering passkey adoption are misaligned user perception and technical issues regarding account recovery, sharing, and delegation. Research suggests that improved user education and awareness could address these challenges. Existing studies have also analyzed and contributed to enhancing the usability of passkeys. However, the current literature highlights a clear gap for more academic research focusing on effective strategies to improve the user perception of passkeys, as the existing work primarily concentrates on technical and usability aspects. Addressing this research gap may lead to increased passkey adoption among end users, ultimately improving the overall security of authentication systems. Full article

(This article belongs to the Special Issue Advanced Technologies in Data and Information Security, Fourth Edition)

► Show Figures

Figure 1

24 pages, 424 KB

Open AccessReview

Understanding the Role of Demographic and Psychological Factors in Users’ Susceptibility to Phishing Emails: A Review

by Alexandros Kavvadias and Theodore Kotsilieris

Appl. Sci. 2025, 15(4), 2236; https://doi.org/10.3390/app15042236 - 19 Feb 2025

Cited by 6 | Viewed by 7849

Abstract

Phishing emails are malicious email messages that aim to deceive users into revealing sensitive information by imitating legitimate emails. These emails are usually among the first steps in most cyberattacks, often appearing as an urgent message, seemingly from reputable sources, in order to [...] Read more.

Phishing emails are malicious email messages that aim to deceive users into revealing sensitive information by imitating legitimate emails. These emails are usually among the first steps in most cyberattacks, often appearing as an urgent message, seemingly from reputable sources, in order to provoke an immediate action from the recipient. Their manipulative nature leverages social engineering techniques to exploit human psychological weaknesses, personality traits, and a range of cognitive, behavioral, and technical vulnerabilities. In this review, the factors that contribute to users’ susceptibility to phishing attacks were investigated. The study focuses on exploring how demographic and psychological factors influence individuals’ vulnerability to phishing emails, with the goal of identifying and categorizing the key factors that increase susceptibility. Twenty-seven studies were examined, revealing that demographic factors, behavioral tendencies, psychological traits and contextual elements play a key role on the users’ susceptibility in phishing emails. The results vary according to the type of methodology that has been used, indicating a need for further investigation and refinement in each respective procedure. Significant investigation has been conducted in identifying the factors contributing to users’ susceptibility to phishing emails, and existing studies do not fully cover the complexity of the topic. There is more to be studied regarding these factors, especially in understanding their complex interactions and impacts across different contexts. Further research is essential so that we may be able to more accurately predict users’ characteristics and the factors that make someone more susceptible to phishing and thus more vulnerable to phishing email attacks. Full article

(This article belongs to the Special Issue Advanced Technologies in Data and Information Security, Fourth Edition)

► Show Figures

Figure 1

Other

Jump to: Research, Review

28 pages, 7241 KB

Open AccessSystematic Review

Anomaly Detection in Blockchain: A Systematic Review of Trends, Challenges, and Future Directions

by Ruslan Shevchuk, Vasyl Martsenyuk, Bogdan Adamyk, Vladlena Benson and Andriy Melnyk

Appl. Sci. 2025, 15(15), 8330; https://doi.org/10.3390/app15158330 - 26 Jul 2025

Cited by 4 | Viewed by 8145

Abstract

Blockchain technology’s increasing adoption across diverse sectors necessitates robust security measures to mitigate rising fraudulent activities. This paper presents a comprehensive bibliometric analysis of anomaly detection research in blockchain networks from 2017 to 2024, conducted under the PRISMA paradigm. Using CiteSpace 6.4.R1, we [...] Read more.

Blockchain technology’s increasing adoption across diverse sectors necessitates robust security measures to mitigate rising fraudulent activities. This paper presents a comprehensive bibliometric analysis of anomaly detection research in blockchain networks from 2017 to 2024, conducted under the PRISMA paradigm. Using CiteSpace 6.4.R1, we systematically map the knowledge domain based on 363 WoSCC-indexed articles. The analysis encompasses collaboration networks, co-citation patterns, citation bursts, and keyword trends to identify emerging research directions, influential contributors, and persistent challenges. The study reveals geographical concentrations of research activity, key institutional players, the evolution of theoretical frameworks, and shifts from basic security mechanisms to sophisticated machine learning and graph neural network approaches. This research summarizes the state of the field and highlights future directions essential for blockchain security. Full article

(This article belongs to the Special Issue Advanced Technologies in Data and Information Security, Fourth Edition)

► Show Figures

Figure 1

Journal Menu

Journal Browser

Advanced Technologies in Data and Information Security, Fourth Edition

Share This Special Issue

Special Issue Editors

Special Issue Information

Keywords

Benefits of Publishing in a Special Issue

Related Special Issues

Published Papers (15 papers)

Research

Review

Other

Further Information

Guidelines

MDPI Initiatives

Follow MDPI