Jun 2026· Digital Technology Security· pp. 91-106· 0 citations
TL;DR
The developed solution enables independent, vendor-neutral comparative analysis of security measures, reduces testing costs, ensures test reproducibility, and enhances the soundness of security measure selection for critical infrastructure.
Abstract
This article discusses the development of a universal, comprehensive testing methodology for intrusion detection and prevention systems, designed to objectively evaluate their effectiveness in the face of increasingly complex network attacks. Existing approaches are often vendor-specific, which hinders independent comparative analysis. The methodology is based on a modular approach and is implemented on a test bench with the system directly integrated into the network traffic path. The study formulates requirements for the methodology, including universality, reproducibility, ease of use, and transparency of results analysis. Functional tests verify real-time attack blocking, logging accuracy, rule processing for various protocols, content filtering, and system behavior in failure mode. The article proposes an evaluation framework consistent with the recommendations of ISO/IEC 27034-1 and NIST SP 800-94. The developed solution enables independent, vendor-neutral comparative analysis of security measures, reduces testing costs, ensures test reproducibility, and enhances the soundness of security measure selection for critical infrastructure.
This review's results show that penetration testing is an important part of improving cybersecurity because it helps identify weaknesses before they become problems and reduces risk.
The rapid expansion of the life cycle for software deployment has required a move from traditional, manual security analysis to automated and integrated assurance frameworks. This study examines the effectiveness of integrating assurance, real-time threat detection, and automated certification gates right into the Continuous Integration and Continuous Deployment pipeline. The analysis is based on a synthetic dataset comprising values from 429 different builds, which is used to study the agreement between automated gating mechanisms and lower vulnerability escape rates. We used a standard tool chain consisting of Jenkins for orchestration, SonarQube for static analysis, and Splunk for log aggregation to emulate a high-velocity enterprise environment. The system seeks to reduce technical debt and potential security risks without impeding deployment velocity by enforcing stringent quality gates that prevent non-compliant artifacts from being promoted. The study highlights the quantitative effects of these controls on success build rates and on the exposure of hidden threats during staging. The results reveal that, despite an initial slowdown in delivery velocity, the incorporation of automated certification gates considerably reduces critical severity incident rates. Implications: The results indicate how to make system changes in response to data for those attempting to put DevSecOps into practice while maintaining the speed and integrity of their systems.
Sauhard Bhatt, Satyanarayana Gadiraju· 2026 6th International Confe...· 0 citations
The review begins with the network architecture, representative protocols such as IEC 104, IEC 61850, and Distributed Network Protocol 3 (DNP3), and their associated security risks, thereby clarifying the foundational role of protocol-level visibility in power monitoring scenarios.
Shan-Shan Bai, Pengyuan Wang, Tian-Le Gao et al.· Journal of Electronics and E...· 0 citations
The increasing complexity of modern network environments has heightened the need for practical and scalable intrusion detection solutions. This study presents the development of a real-time, flow-based Intrusion Detection and Security Management System (IDSMS) that integrates live traffic monitoring, machine learning-based intrusion analysis, centralized data storage, and web-based visualization. The system captures network traffic from a MikroTik-based gateway using a passive flow sniffer deployed on a Kali Linux monitoring node. Packets are aggregated into bidirectional flows and transformed into statistical feature vectors, which are analyzed by a machine learning inference service through an application programming interface. Detection results, including risk level and attack classification, are stored in a centralized database and presented through an interactive dashboard. The intrusion detection engine employs a two-stage ensemble approach: Stage A performs binary classification (benign vs. malicious) using a calibrated stacking ensemble of Random Forest, Gradient Boosting, and XGBoost classifiers with Logistic Regression as meta-classifier, achieving 99.92% accuracy and 0.99987 ROC-AUC. Stage B performs multi-class classification across 14 attack categories using a Random Forest classifier, achieving 99.83% accuracy with per-class F1-scores exceeding 99.6%. Development-stage testing using simulated attack traffic demonstrates the system’s ability to capture, analyze, and visualize network threats in real time, with average inference latency of 12.4 ms per flow and processing throughput of 3,842 flows per minute. The proposed system provides a practical foundation for deployment in shared-access networks, small enterprises, and IoT-enabled environments.
Jimson A. Olaybar, Patrick D. Cerna· 2026 International Conferenc...· 0 citations
The results of the threat assessment from software backdoors in embedded systems can be used to develop relevant countermeasures against threats, select optimal information protection means during the development and operation of embedded systems, and formulate technical specifications for the enhancement of existing or the creation of advanced information protection means in embedded systems.
A.I. Miroshnichenko, R. A. Dyachenko· Informatization and communic...· 0 citations
Research results indicate that pfSense, with properly configured IDS/IPS systems, can effectively detect and block a significant percentage of attacks, making it a reliable solution for network protection, particularly in resource-constrained environments.
Nemanja Jeličić, Marko Šarac· SINTEZA· 0 citations
