Yevgen Kotukh

The paper addresses the problem of network traffic anomaly detection under class imbalance, which remains a critical challenge for modern intrusion detection systems due to the limited availability of labeled attack data and the inherent scarcity of anomalous traffic compared to normal traffic. Since supervised learning approaches require representative samples of malicious traffic for every attack type, which is practically infeasible given the constant emergence of new attacks, the study employs one-class learning methods trained exclusively on normal traffic. The authors perform a comparative analysis of three such methods — a multilayer-perceptron-based autoencoder, an isolation forest, and a one-class support vector machine (OCSVM) — on a subset of the widely used CICIDS2017 dataset, which combines records of normal traffic and traffic from a LOIC HTTP DDoS attack. The merged dataset contains 755,663 records with a class imbalance ratio of IR = 4.90, and the feature space consists of 76 numerical network-flow characteristics extracted with the CICFlowMeter tool. The key scientific contribution of the work is a new evaluation metric, the Detection Reliability Index (DRI), which, unlike conventional F1-score and ROC-AUC metrics, explicitly accounts for the operational burden of false positive alerts (FPR) by introducing a multiplicative penalty in the denominator of a weighted F-like score. The metric parameters were the recall weight beta = 0.8 and the penalty coefficient alpha = 0.5, which are justified by the asymmetry between the cost of a missed attack and the cost of a false alarm for security administrators. Experimental results show that the autoencoder achieves the highest precision (0.7245), ROC-AUC (0.9154), and proposed DRI value (0.6342) owing to its minimal false positive rate (FPR = 0.049). The isolation forest attains the highest recall (0.637) but generates substantially more false alarms (FPR = 0.169), which considerably reduces its practical applicability and results in the lowest DRI among the compared methods (0.5496). The one-class SVM, trained on a limited subsample due to the computational cost of the method on large datasets, occupies an intermediate position (DRI = 0.5835). The findings confirm that maximizing recall without accounting for the false alarm rate is a suboptimal strategy for operational intrusion detection systems, and that the proposed DRI metric reveals practical advantages of methods that remain hidden when using traditional classification quality measures. The work is of practical relevance for cybersecurity practitioners selecting anomaly detection methods for deployment in real network environments with limited administrator capacity for processing security alerts, and it calls for further validation on other attack types.

The development of quantum computing introduces fundamental risks to modern cryptographic systems used for protecting network infrastructure and software platforms. Following the publication of post-quantum cryptography standards by the National Institute of Standards and Technology (NIST) in 2024, including ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205), the need for efficient software implementation of post-quantum primitives in high-assurance programming environments has emerged. This paper proposes a multilayer architecture for post-quantum cryptographic algorithm implementation using the OCaml module system and functor-based parameterization of cryptographic primitives. The proposed architecture is based on separating the software stack into a type-safe OCaml API layer, an algebraic cryptographic logic layer, and a low-level constant-time primitive layer implemented via C interfaces. Special attention is given to the implementation of Number Theoretic Transform (NTT) operations, centered binomial distribution (CBD) sampling for ML-KEM and ML-DSA. To ensure implementation quality, NIST KAT vectors were integrated, along with side-channel statistical analysis tools including dudect, Valgrind, and TIMECOP. The proposed architecture aims to minimize the trusted computing base, isolate cryptographically sensitive arithmetic operations, and enable future formal verification via coq-of-ocaml. The approach establishes the foundation for an OCaml-oriented post-quantum cryptography ecosystem and can be used for developing high-assurance cryptographic software.

We propose a novel digital signature cryptosystem that exploits the concept of the brute-force problem. To ensure the security of the cryptosystem, we employed several mechanisms: sharing a common secret for factorable permutations, associating permutations with the message being signed, and confirming knowledge of the shared secret using a zero-knowledge proof. We developed a secret-sharing theory based on homomorphic matrix transformations for factorized permutations. The inverse matrix transformation for computing the shared secret is determined by secret parameters, which results in incompletely defined functionality and gives rise to a brute-force cryptanalysis problem. Randomization of session keys using a message hash and random parameters guarantees the uniqueness of each signature, even for identical messages. We employed a zero-knowledge authentication protocol to confirm knowledge of the shared secret, thereby protecting the verifier against unauthorized signature imposition. The LINEture cryptosystem is built on linear matrix algebra and does not rely on a computationally hard problem. High security is achieved through the appropriate selection of matrix transformation dimensions. Matrix computations potentially offer low operational costs for signature generation and verification.

This paper presents a comprehensive cryptographic analysis of the security parameters of the LINEture post-quantum digital signature scheme, which is constructed using matrix algebra over elementary abelian 2-groups. We investigate the influence of three principal parameters. First, the word size m (exhibiting quadratic impact), the second is a vector dimension l, and the third is a number of submatrices in the session key q (exhibiting linear impact) on cryptographic strength. Our analysis reveals a dualistic nature of the parameter l. According to the previous analysis, it does not affect resistance to guessing attacks. A deeper examination of the verification mechanism demonstrates that l establishes a kind of verification barrier of l times m bits. We establish the threshold relationship l less q minus 1 times m, below which parameter l becomes security-critical. The optimal selection rule l near q minus 1 times m is proposed for maximum cryptographic efficiency. Comparative analysis with NIST PQC standards and practical parameter recommendations are provided.

Introduction. The institutional adoption of distributed ledger technologies is driving the transformation of real-world asset (RWA) tokenization from experimental solutions toward fullscale financial infrastructure. Leading global financial institutions view RWA tokenization as an instrument of long-term capital market modernization, the effectiveness of which is determined primarily by the quality and suitability of underlying platforms. At the same time, the contemporary tokenization landscape is characterized by fragmentation in terms of architecture, regulatory compliance, and institutional readiness, which complicates informed platform selection. The absence of a unified multicriteria framework for comparative platform assessment creates a methodological gap, particularly relevant for Ukraine amid the formation of a national virtual asset regulatory framework and its alignment with international standards. The purpose of the article is to develop a comprehensive methodology for evaluating tokenization platforms and to conduct a comparative analysis based on a multicriteria indicator system in order to formulate practical recommendations for implementation in the Ukrainian context. Results. This study presents a comprehensive comparative analysis of leading tokenization platforms, covering more than 32 platforms, including BlackRock BUIDL, Securitize, Ondo Finance, and Figure Technologies, with a combined transaction portfolio exceeding USD 60 billion. A multicriteria evaluation methodology based on an integrated Fuzzy AHP–TOPSIS model is developed, incorporating technical architecture, regulatory compliance, economic efficiency, and institutional adoption. Particular attention is given to Ethereum’s Layer 2 ecosystem, which enables scalability for institutional use cases. The results show that Ethereum dominates with a 58% share of the RWA market, while specialized networks such as Canton Network and Provenance provide stronger institutional compliance. The regulatory landscape analysis covers SEC/FINRA (USA), MiCA (EU), the DLT Act (Switzerland), MAS (Singapore), and Draft Law of Ukraine No. 10225-d “On Amendments to the Tax Code of Ukraine and Certain Other Legislative Acts of Ukraine Regarding the Regulation of Virtual Asset Circulation in Ukraine,” identifying critical gaps and opportunities for the Ukrainian market. Conclusions. The study confirms that the real-world asset tokenization market has reached the stage of institutional adoption and is rapidly evolving into a component of the global financial infrastructure. Ethereum’s dominance is complemented by the growth of specialized regulated networks and scaling through the Layer 2 ecosystem, ensuring the institutional viability of RWA tokenization. The proposed multicriteria platform evaluation model based on Fuzzy AHP–TOPSIS integrates technical, regulatory, and economic parameters into a unified methodological framework. Regulatory convergence across leading jurisdictions creates a window of opportunity for Ukraine to develop a MiCA-aligned tokenization implementation model. The findings have practical relevance for regulators, institutional investors, and market participants and provide a foundation for further research on integrating tokenized assets into the national financial system.

The article is devoted to the study of institutional prerequisites and mechanisms for implementing the tokenisation of real-world assets (RWA) as an innovative tool for sustainable financing of local hromadas in Ukraine. In the context of the digital transformation of the global financial system and the need to diversify funding sources for territorial development – especially in the post-war reconstruction period – there is a growing demand for alternative mechanisms to attract investment at the local self-government level. The authors analyse the current state of the institutional environment for implementing RWA-tokenisation in Ukraine, identifying key obstacles and opportunities for the development of digital financial instruments in municipal governance. A conceptual model of the institutional-functional architecture of the RWA-tokenisation ecosystem is developed, incorporating regulatory, organisational-institutional, technological, financial-economic, compliance, and informational-educational components. A comprehensive SWOT analysis of the potential for real asset tokenisation in Ukrainian local hromadas reveals significant opportunities to create innovative financing mechanisms for infrastructure projects and to enhance the investment attractiveness of territories. Four scenarios for the development of the institutional environment are proposed: “institutional stagnation,” “experimental phase,” “integrated RWA ecosystem,” and “technological transformation”. Based on empirical research into the readiness of territorial hromadas to implement blockchain technologies, practical recommendations are formulated for creating an effective institutional foundation for RWA tokenisation. The study results can inform public policy on the digitalisation of municipal finance and support the implementation of pilot projects to tokenise public assets.

The advent of quantum computing poses significant threats to current cryptographic infrastructure protecting 5G and emerging 6G networks. In August 2024, the National Institute of Standards and Technology (NIST) published the first post-quantum cryptography (PQC) standards: ML-KEM (FIPS 203) for key encapsulation and ML-DSA (FIPS 204) for digital signatures. Real-world security protocols such as TLS 1.3 and IPsec require both operations simultaneously, necessitating efficient unified hardware implementations. This paper presents a novel unified cryptographic coprocessor architecture (UniPQC) supporting both ML-KEM and ML-DSA algorithms for deployment in 6G network equipment. The proposed architecture leverages the shared mathematical foundation of both algorithms, specifically the Number Theoretic Transform (NTT), to achieve significant resource optimization. We implement a configurable NTT engine with shared butterfly units capable of processing both 256-coefficient polynomials for ML-KEM and ML-DSA with different moduli (q=3329 and q=8380417). The architecture includes: Unified Polynomial Arithmetic Module (UniPAM), Hash and Sampling Unit (HSU) with Keccak-f[1600] core, Memory Management Unit (MMU) with conflict-free addressing, and Control Configuration Logic (CCL). The architecture is implemented on Xilinx Zynq UltraScale+ FPGA, achieving 285 MHz operating frequency with 4,512 LUTs, 3,245 FFs, 24 DSPs, and 8 BRAMs. Performance evaluation demonstrates that the unified design reduces area-time product by 34% compared to separate implementations while meeting the latency requirements for 6G Ultra-Reliable Low-Latency Communication (URLLC) applications. Complete TLS 1.3 handshake is achieved in under 300 μs, with power consumption of 245 mW for ML-KEM and 312 mW for ML-DSA operations.

The rapid deployment of fifth-generation (5G) networks has dramatically transformed telecommunications by enabling ultra-low latency, high bandwidth, and dynamic spectrum allocation. However, these innovations have also expanded the attack surface, introducing unprecedented security vulnerabilities. Among them, Man-in-the-Middle (MITM) attacks have evolved into complex, AI-driven, and persistent threats capable of exploiting 5G’s Service-Based Architecture (SBA), virtualized functions, and heterogeneous interoperability with LTE and Wi-Fi. A particularly critical evolution is the rise of Digital Twin attacks, where adversaries replicate devices or network elements with high fidelity, bypassing traditional authentication and maintaining long-term undetectable intrusions. This paper provides a comprehensive analysis of MITM evolution in 5G systems, including vulnerabilities across the OSI model layers, exploitation of NGAP, Diameter, and DSS signaling, and the persistent risks posed by distributed architectures. Special attention is given to quantum-era threats, such as store-now-decrypt-later scenarios and quantum-enhanced MITM attacks undermining 5G-AKA protocols reliant on non-quantum-resistant cryptography. The study emphasizes the need for cryptographic agility, post-quantum authentication, and continuous behavioral validation mechanisms to mitigate persistent and quantum-enhanced MITM exploits. The findings highlight urgent requirements for international standardization and proactive implementation of post-quantum secure protocols in 5G infrastructures.