Justinas Janulevičius

Hybrid finality-gadget consensus protocols expose many tunable parameters, that are usually fixed by convention. We present a three-stage verify-then-optimize method. Stage 1, a machine-checked consistency check of the quorum-intersection bound, covers 325 committee and quorum settings by counter abstraction, cross-validated by three independent models; the verdicts reduce to the two-thirds quorum rule, fix the quorum at 2f + 1, and show that the gadget stops finalizing at 75% participation. Stage 2 certifies that confirmed but unfinalized blocks resist reorganization. For a latest-message fork choice with proposer boost under random network delays, attacked by an adversary that splits its votes and times their release per validator, we compute exactly, as a Markov decision process, the worst-case probability that a block is confirmed and then reorganized within 256 slots of its proposal, and check it against an identity-level model. With 13 and 25 validators and an adversary at the gadget’s fault bound, the balancing attack succeeds almost surely unless the boost lies in a narrow window, and a risk of 10⁻⁶ requires 38 to 90 slots of confirmation, 1.5 to 3.5 times the depth a proof-of-work estimate prescribes. Stage 3 reports operating points: against such an adversary every slot length trades confirmation latency against message load.

Financial information systems remain vulnerable to process flow integrity breaches when manual overrides circumvent security controls. These breaches exploit the gap between authentication and workflow enforcement. This paper presents the Zero-Override Architecture (ZOA), a framework that structurally prevents the bypassing of verification mechanisms. It analyzes existing architectural weaknesses through formal threat modeling, identifies regulatory compliance gaps, and derives design requirements for tamper-resistant payment processing. The proposed architecture implements a cryptographically attested verification chain in which each processing component must present proof of all preceding control executions before advancing a transaction. The state-transition model, including the exception-handling workflow, is formalized in TLA+ and its completeness, non-bypassability, replay-resistance, and fail-secure properties are verified with the TLC model checker against an explicit adversary capable of component circumvention and attestation replay. Two deliberately weakened baselines, one with a manual override capability and one in which exception approval substitutes for control execution, are refuted by mechanically derived bypass counterexamples. A component ablation identifies which components’ verification the properties depend on. This research contributes to the field by distinguishing process flow integrity from software-level control-flow integrity and establishing it as a discrete security property, providing a reference architecture with formal state-transition specifications, establishing regulatory requirement traceability through explicit control-to-requirement mapping, and creating an evaluation framework applicable across diverse financial information systems.

Managing the lifecycle of cybersecurity policies from high-level governance documents to low-level technical implementation remains prone to human error and operational inefficiency. With the rapid evolution of Infrastructure as Code (IaC) and the increasing volume of regulatory standards, there is a critical need for automated methods to bridge the gap between "what is written" (Policy) and "what is executed" (Practice). This systematic literature review examines the state of the art in Artificial Intelligence (AI) and Natural Language Processing (NLP) techniques for automating cybersecurity knowledge management. This study was conducted in accordance with the PRISMA 2020 statement for reporting systematic reviews. We systematically identified and analyzed 55 peer-reviewed studies published between 2020 and 2025, selected from an initial corpus of 230 papers sourced from IEEE, ACM Digital Library, Scopus, ScienceDirect, and Springer Journals. Our analysis reveals a transition from discriminative information extraction to hybrid architectures integrating deep learning-driven extraction with symbolic logic formalisms for verified knowledge graph construction. We categorize existing approaches into four key themes: (1) Automated Policy Extraction, (2) Knowledge Graph Construction, (3) Policy-as-Code Compliance, and (4) Dynamic Threat Translation. The review identifies a significant gap in "neuro-symbolic" verification methods capable of mitigating stochastic failure modes and hallucination risks inherent in probabilistic LLM-driven compliance pipelines, outlining a roadmap for future research in automated security governance. Beyond a descriptive summary, this review provides a critical comparative analysis of extraction accuracy, reasoning scalability, and the risks inherent in Large Language Model (LLM) approaches.

Expert systems (ESs) can be seen as a perspective method for risk analysis process automation, especially in the case of small- and medium-sized enterprises that lack internal security resources. Expert system practical applicability is limited by the fact that the creation of an expert system knowledge base requires a lot of manual work. External knowledge sources, such as attack trees, web pages, and ontologies, are already proven to be valuable sources for the automated creation of knowledge base rules, thus leading to more effective creation of specialized expert systems. This research proposes a new method of automated conversion of CVE data from the National Vulnerability Database (version CVSS 2) into the knowledge base of an expert system and flags CVE records that have higher risk due to already existing exploit tools. This manuscript also contains a description of the method for implementing software and a practical evaluation of conversion results. The uniqueness of the proposed method is incorporation of the records included in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities Catalog.

Investigation and detection of cybercrimes has been in the spotlight of cybersecurity research for as long as the topic has existed. Modern methods are required to keep up with the pace of the technology and toolset used to facilitate these crimes. Keystroke-injection attacks have been an issue due to the limitations of hardware and software up until recently. This paper presents comprehensive research on keystroke-injection payload generation that proposes the use of deep learning to bypass the security of keystroke-based authentication systems focusing on both fixed-text and free-text scenarios. In addition, it specifies the potential risks associated with keystroke-injection attacks. To ensure the legitimacy of the investigation, a model is proposed and implemented within this context. The results of the implemented implant model inside the keyboard indicate that deep learning can significantly improve the accuracy of keystroke dynamics recognition as well as help to generate effective payload from a locally collected dataset. The results demonstrate favorable accuracy rates, with reported performance of 93–96% for fixed-text scenarios and 75–92% for free-text. Accuracy across different text scenarios was achieved using a small dataset collected with the proposed implant model. This dataset enabled the generation of synthetic keystrokes directly within a low-computation-power device. This approach offers efficient and almost real-time keystroke replication. The results obtained show that the proposed model is sufficient not only to bypass the fixed-text keystroke dynamics system, but also to remotely control the victim’s device at the appropriate time. However, such a method poses high security risks when deploying adaptive keystroke injection with impersonated payload in real-world scenarios.

The increase in flying time of unmanned aerial vehicles (UAV) is a relevant and difficult task for UAV designers. It is especially important in such tasks as monitoring, mapping, or signal retranslation. While the majority of research is concentrated on increasing the battery capacity, it is also important to utilize natural renewable energy sources, such as solar energy, thermals, etc. This article proposed a method for the automatic recognition of cumuliform clouds. Practical application of this method allows diverting of an unmanned aerial vehicle towards the identified cumuliform cloud and improving its probability of flying into a thermal flow, thus increasing the flight time of the UAV, as is performed by glider and paraglider pilots. The proposed method is based on the application of Hough transform and Canny edge detector methods, which have not been used for such a task before. For testing the proposed method a dataset of different clouds was generated and marked by experts. The achieved average accuracy of 87% on the unbalanced dataset demonstrates the practical applicability of the proposed method for detecting thermals related to cumuliform clouds. The article also provides the concept of VilniusTech developed UAV, implementing the proposed method.

Spamming and phishing are two types of emailing that are annoying and unwanted, differing by the potential threat and impact to the user. Automated classification of these categories can increase the users’ awareness as well as to be used for incident investigation prioritization or automated fact gathering. However, currently there are no scientific papers focusing on email classification concerning these two categories of spam and phishing emails. Therefore this paper presents a solution, based on email message body text automated classification into spam and phishing emails. We apply the proposed solution for email classification, written in three languages: English, Russian, and Lithuanian. As most public email datasets almost exclusively collect English emails, we investigate the suitability of automated dataset translation to adapt it to email classification, written in other languages. Experiments on public dataset usage limitations for a specific organization are executed in this paper to evaluate the need of dataset updates for more accurate classification results.