arXiv subjects

Huy Kang Kim

Publications and source records attributed to Huy Kang Kim.

At least 19 recordsLinked to original sources

arXiv2026

Name2Pkg: Lightweight One-Class Android Malware Screening via Name-Package Correspondence Modeling

Deep learning-based malware detection has been widely adopted in security-critical services. Most detection methods rely on internal features extracted from APK files or runtime behavior. However, extracting these features is computationally expensive. This limits their use in large-scale, early-stage screening. Malicious apps may exhibit weak correspondence between their user-facing app names and package names, providing a low-cost screening signal. We present Name2Pkg, a lightweight one-class classification method. It leverages only the app name and the package name. We formulate malware screening as a sequence anomaly detection problem. A character-level sequence-to-sequence model estimates the conditional likelihood of a package name given the app name. The length-normalized negative log-likelihood serves as the anomaly score. We train the model and calibrate the threshold using only benign data. Using a dataset of 67,129 real-world applications, Name2Pkg achieves an area under the receiver operating characteristic curve (ROC-AUC) of 0.982 and malware recall of 0.885 at an achieved false-positive rate of 0.044 on held-out test data. It has a 3.57 MiB checkpoint and a CPU inference latency of 28.20 ms per sample. Name2Pkg provides an efficient and effective pre-filtering signal for large-scale security systems.

cs.CR↗

arXiv2026

You Are Not My Teammate: Behavioral Fingerprint-based Detection of Suspicious Account Misuse

Online games have been continuously affected by cyber threats such as game bots and gold farming. Game bots, which are automated programs that play on behalf of human users, significantly accelerate character progression and reduce the engagement of legitimate players, potentially leading to user churn. In addition, gold farming enables the monetization of in-game currency into real-world money, resulting in unfair profits. For these reasons, prior studies have primarily focused on detecting game bots and gold farming. However, in competitive Multiplayer Online Battle Arena (MOBA) games such as League of Legends, match outcomes and rankings are the primary objectives, where individual performance is more critical than in-game economic factors. Accordingly, account misuse such as account sharing and boosting has emerged as a major threat to fair competition. In this study, we propose a behavioral fingerprint-based detection method. Our approach analyzes and quantifies changes between a player's historical and recent in-game behaviors. Consequently, it enables the robust identification of suspicious account sharing and boosting, even in label-scarce environments. Experimental results show that behavioral fingerprints within the same account are distinguishable from those across different accounts, supporting rapid detection of suspicious account misuse even with limited labeled data.

cs.CR↗

arXiv2026

When to Trust the Map: Confidence-Aware LLM Routing for Automotive CVE-to-ATM Mapping

Public CVE descriptions report the technical conditions and impact of vulnerabilities, whereas the Auto-ISAC Automotive Threat Matrix (ATM) expresses an adversary's tactics and techniques. Because the two representations are not directly aligned, incorrect automated mappings in safety-critical environments may distort threat interpretation and mitigation prioritization, motivating a confidence-aware approach that distinguishes auto-confirmable mappings from uncertain cases. This paper reformulates automotive CVE-to-ATM mapping as a selective automation problem. The proposed framework generates candidate mappings via hierarchical in-context learning, then fuses self-consistency and LLM-based evidence verification signals into a calibrated meta-model. The resulting calibrated confidence score routes each candidate into AUTO, REVIEW, or HOLD. On the evaluation set, the proposed system substantially improved candidate-set precision at matched recall over a Flat zero-shot GPT-5.2 baseline. In the High-Confidence operating mode, the AUTO tier achieved a precision of 0.878, more than double the candidate-set base rate, and the calibrated confidence score achieved an AUROC of 0.868 in distinguishing correct from incorrect candidates. These results show that the framework can support selective automation by isolating auto-confirmable mappings from those requiring analyst review.

cs.CR↗

arXiv2026

GARAGE: Characterizing the Automation Boundary in LLM-based Attack Graph Generation

While modern vehicle security depends on effective Cyber Threat Intelligence (CTI) synthesis, current automated tools struggle with unstructured data and automotive-specific architectural nuances. To bridge this gap, we introduce GARAGE, a RAG-powered framework that converts fragmented CTI into an actionable, domain-specific knowledge base for automated attack graph generation. GARAGE synthesizes a dataset of 12,786 CVEs and 140 incident reports into a STIX 2.1 and Auto-ISAC ATM-compliant knowledge base. By formalizing tactical-pattern-level scenarios through granular kill chain analysis, GARAGE achieves threat generation capabilities. Our 320 Leave-One-Out experiments reveal that the framework can accurately transfer security knowledge to entirely unseen vehicle architectures. Furthermore, we position GARAGE as a scalable TARA support tool within human-in-the-loop workflows, offering a comprehensive cost-performance analysis to guide its deployment across various LLM tiers.

cs.CR↗

arXiv2026

When to Switch, Not Just What: Transition Quality Prediction in Clash Royale

In competitive games, players frequently switch strategies after losing streaks, yet our analysis of 926,334 match records from 34,619 Clash Royale players reveals a counterintuitive pattern: switching frequency is inversely associated with the win rate, with effects that vary substantially across players and situational contexts. We attribute this to a limitation common in many prior recommendation systems, which evaluate strategies by expected quality while overlooking the behavioral cost of switching and individual differences in switching propensity. We refer to this implicit premise as the Zero Switching Cost Assumption. To address this, we reformulate strategy recommendation as a transition-level decision problem and instantiate it as TQP (Transition Quality Predictor), a three-stage pipeline structured as Who -> When -> What. PersonaGate suppresses recommendations for players whose strategic consistency is empirically associated with superior outcomes. TimingGate identifies moments when switching is likely to yield a net benefit over staying, using a subtype- and state-matched baseline to control for natural win-rate recovery. ScoreFusion ranks candidate strategies by combining an adoptability signal with predicted transition quality (delta WR). We further introduce SwitchGap, an evaluation metric that measures a policy's discriminative quality without treating observed player choices as optimal ground truth. This property is particularly important because the most frequent switchers record the lowest win rates. The full pipeline achieves a SwitchGap of +10.4 percentage points at a recommendation rate of 5.4%, and loss-triggered switchers, despite being the lowest-performing group, benefit the most from subtype-conditioned guidance.

cs.LG↗

arXiv2026

The Vehicle May Be Sick: Denial of Diagnostic Services by Exploiting the CAN Transport Protocol

Vehicle diagnostics has become essential for detecting in-vehicle errors and ensuring safety. While the Unified Diagnostic Services (UDS) protocol is widely adopted for diagnostic operations, it relies on the ISO 15765-2 standard as the transport protocol over the Controller Area Network (CAN), which was designed without inherent security considerations. In this paper, we identify eight novel attack scenarios that exploit specific transport layer mechanisms in the ISO 15765-2 standard, including Flow Control manipulation, Sequence Number violations, and error handling abuses. We evaluate these attacks on a real passenger vehicle using two distinct diagnostic tools to demonstrate their practical impact. Our results confirm that three of these attack scenarios successfully induce denial of diagnostic services, leading to abnormal diagnostic results such as concealed faults and manipulated sensor readings. These findings highlight critical vulnerabilities that can deceive technicians and drivers, potentially exposing vehicles to significant safety risks.

cs.CR↗

arXiv2025

Autoencoder-based Denoising Defense against Adversarial Attacks on Object Detection

Deep learning-based object detection models play a critical role in real-world applications such as autonomous driving and security surveillance systems, yet they remain vulnerable to adversarial examples. In this work, we propose an autoencoder-based denoising defense to recover object detection performance degraded by adversarial perturbations. We conduct adversarial attacks using Perlin noise on vehicle-related images from the COCO dataset, apply a single-layer convolutional autoencoder to remove the perturbations, and evaluate detection performance using YOLOv5. Our experiments demonstrate that adversarial attacks reduce bbox mAP from 0.2890 to 0.1640, representing a 43.3% performance degradation. After applying the proposed autoencoder defense, bbox mAP improves to 0.1700 (3.7% recovery) and bbox mAP@50 increases from 0.2780 to 0.3080 (10.8% improvement). These results indicate that autoencoder-based denoising can provide partial defense against adversarial attacks without requiring model retraining.

cs.CR↗

arXiv2025

Tracer: A Forensic Framework for Detecting Fraudulent Speedruns from Game Replays

Speedrun, a practice of completing a game as quickly as possible, has fostered vibrant communities driven by creativity, competition, and mastery of game mechanics and motor skills. However, this contest also attracts malicious actors as financial incentives come into play. As media and software manipulation techniques advance - such as spliced footage, modified game software and live stream with staged setups - forged speedruns have become increasingly difficult to detect. Volunteer-driven communities invest significant effort to verify submissions, yet the process remains slow, inconsistent, and reliant on informal expertise. In high-profile cases, fraudulent runs have gone undetected for years, allowing perpetrators to gain fame and financial benefits through monetised viewership, sponsorships, donations, and community bounties. To address this gap, we propose Tracer, Tamper Recognition via Analysis of Continuity and Events in game Runs, a modular framework for identifying artefacts of manipulation in speedrun submissions. Tracer provides structured guidelines across audiovisual, physical, and cyberspace dimensions, systematically documenting dispersed in-game knowledge and previously reported fraudulent cases to enhance verification efficiency.

cs.HC↗

arXiv2025

GUARD-CAN: Graph-Understanding and Recurrent Architecture for CAN Anomaly Detection

Modern in-vehicle networks face various cyber threats due to the lack of encryption and authentication in the Controller Area Network (CAN). To address this security issue, this paper presents GUARD-CAN, an anomaly detection framework that combines graph-based representation learning with time-series modeling. GUARD-CAN splits CAN messages into fixed-length windows and converts each window into a graph that preserves message order. To detect anomalies in the timeaware and structure-aware context at the same window, GUARD-CAN takes advantage of the overcomplete Autoencoder (AE) and Graph Convolutional Network (GCN) to generate graph embedding vectors. The model groups these vectors into sequences and feeds them into the Gated Recurrent Unit (GRU) to detect temporal anomaly patterns across the graphs. GUARD-CAN performs anomaly detection at both the sequence level and the window level, and this allows multi-perspective performance evaluation. The model also verifies the importance of window size selection through an analysis based on Shannon entropy. As a result, GUARD-CAN shows that the proposed model detects four types of CAN attacks (flooding, fuzzing, replay and spoofing attacks) effectively without relying on complex feature engineering.

cs.CR↗

arXiv2024

Who ruins the game?: unveiling cheating players in the "Battlefield" game

The "Battlefield" online game is well-known for its large-scale multiplayer capabilities and unique gaming features, including various vehicle controls. However, these features make the game a major target for cheating, significantly detracting from the gaming experience. This study analyzes user behavior in cheating play in the popular online game, the "Battlefield", using statistical methods. We aim to provide comprehensive insights into cheating players through an extensive analysis of over 44,000 reported cheating incidents collected via the "Game-tools API". Our methodology includes detailed statistical analyses such as calculating basic statistics of key variables, correlation analysis, and visualizations using histograms, box plots, and scatter plots. Our findings emphasize the importance of adaptive, data-driven approaches to prevent cheating plays in online games.

cs.HC↗

arXiv2024

Field Testing and Detection of Camera Interference for Autonomous Driving

In recent advancements in connected and autonomous vehicles (CAVs), automotive ethernet has emerged as a critical technology for in-vehicle networks (IVNs), superseding traditional protocols like the CAN due to its superior bandwidth and data transmission capabilities. This study explores the detection of camera interference attacks (CIA) within an automotive ethernet-driven environment using a novel GRU-based IDS. Leveraging a sliding-window data preprocessing technique, our IDS effectively analyzes packet length sequences to differentiate between normal and anomalous data transmissions. Experimental evaluations conducted on a commercial car equipped with H.264 encoding and fragmentation unit-A (FU-A) demonstrated high detection accuracy, achieving an AUC of 0.9982 and a true positive rate of 0.99 with a window size of 255.

cs.CR↗

arXiv2024

Expanding the Attack Scenarios of SAE J1939: A Comprehensive Analysis of Established and Novel Vulnerabilities in Transport Protocol

Following the enactment of the UN Regulation, substantial efforts have been directed toward implementing intrusion detection and prevention systems (IDPSs) and vulnerability analysis in Controller Area Network (CAN). However, Society of Automotive Engineers (SAE) J1939 protocol, despite its extensive application in camping cars and commercial vehicles, has seen limited vulnerability identification, which raises significant safety concerns in the event of security breaches. In this research, we explore and demonstrate attack techniques specific to SAE J1939 communication protocol. We introduce 14 attack scenarios, enhancing the discourse with seven scenarios recognized in the previous research and unveiling seven novel scenarios through our elaborate study. To verify the feasibility of these scenarios, we leverage a sophisticated testbed that facilitates real-time communication and the simulation of attacks. Our testing confirms the successful execution of 11 scenarios, underscoring their imminent threat to commercial vehicle operations. Some attacks will be difficult to detect because they only inject a single message. These results highlight unique vulnerabilities within SAE J1939 protocol, indicating the automotive cybersecurity community needs to address the identified risks.

cs.CR↗

arXiv2024

UAVCAN Dataset Description

We collected attack data from unmanned vehicles using the UAVCAN protocol, and public and described technical documents. A testbed was built with a drone using PX4, and a total of three attacks, Flooding, Fuzzy, and Replay, were performed. The attack was carried out in a total of 10 scenarios. We expect that the attack data will help develop technologies such as anomaly detection to solve the security threat problem of drones.

cs.CR↗

arXiv2024

RTPS Attack Dataset Description

This paper explains all about our RTPS datasets. We collect malicious/benign packet data by injecting attack data in an Unmanned Ground Vehicle (UGV) in the normal state. We assembled the testbed, consisting of UGV, Controller, PC, and Router. We collect this dataset in the UGV part of our testbed. We conducted two types of attack "Command Injection" and "Command Injection with ARP Spoofing" on our testbed. The data collection time is 180, 300, 600, and 1200. The scenario has 30 each on collection time, 240 total. We expect this dataset to contribute to the development of defense technologies like anomaly detection to address security threat issues in ROS2 networks and Fast-DDS implements.

cs.CR↗

arXiv2024

X-CANIDS: Signal-Aware Explainable Intrusion Detection System for Controller Area Network-Based In-Vehicle Network

Controller Area Network (CAN) is an essential networking protocol that connects multiple electronic control units (ECUs) in a vehicle. However, CAN-based in-vehicle networks (IVNs) face security risks owing to the CAN mechanisms. An adversary can sabotage a vehicle by leveraging the security risks if they can access the CAN bus. Thus, recent actions and cybersecurity regulations (e.g., UNR 155) require carmakers to implement intrusion detection systems (IDSs) in their vehicles. The IDS should detect cyberattacks and provide additional information to analyze conducted attacks. Although many IDSs have been proposed, considerations regarding their feasibility and explainability remain lacking. This study proposes X-CANIDS, which is a novel IDS for CAN-based IVNs. X-CANIDS dissects the payloads in CAN messages into human-understandable signals using a CAN database. The signals improve the intrusion detection performance compared with the use of bit representations of raw payloads. These signals also enable an understanding of which signal or ECU is under attack. X-CANIDS can detect zero-day attacks because it does not require any labeled dataset in the training phase. We confirmed the feasibility of the proposed method through a benchmark test on an automotive-grade embedded device with a GPU. The results of this work will be valuable to carmakers and researchers considering the installation of in-vehicle IDSs for their vehicles.

cs.CR↗

arXiv2023

C-ITS Environment Modeling and Attack Modeling

As technology advances, cities are evolving into smart cities, with the ability to process large amounts of data and the increasing complexity and diversification of various elements within urban areas. Among the core systems of a smart city is the Cooperative-Intelligent Transport Systems (C-ITS). C-ITS is a system where vehicles provide real-time information to drivers about surrounding traffic conditions, sudden stops, falling objects, and other accident risks through roadside base stations. It consists of road infrastructure, C-ITS centers, and vehicle terminals. However, as smart cities integrate many elements through networks and electronic control, they are susceptible to cybersecurity issues. In the case of cybersecurity problems in C-ITS, there is a significant risk of safety issues arising. This technical document aims to model the C-ITS environment and the services it provides, with the purpose of identifying the attack surface where security incidents could occur in a smart city environment. Subsequently, based on the identified attack surface, the document aims to construct attack scenarios and their respective stages. The document provides a description of the concept of C-ITS, followed by the description of the C-ITS environment model, service model, and attack scenario model defined by us.

cs.CR↗

arXiv2023

AI-based Attack Graph Generation

With the advancement of IoT technology, many electronic devices are interconnected through networks, communicating with each other and performing specific roles. However, as numerous devices join networks, the threat of cyberattacks also escalates. Preventing and detecting cyber threats are crucial, and one method of preventing such threats involves using attack graphs. Attack graphs are widely used to assess security threats within networks. However, a drawback emerges as the network scales, as generating attack graphs becomes time-consuming. To overcome this limitation, artificial intelligence models can be employed. By utilizing AI models, attack graphs can be created within a short period, approximating optimal outcomes. AI models designed for attack graph generation consist of encoders and decoders, trained using reinforcement learning algorithms. After training the AI models, we confirmed the model's learning effectiveness by observing changes in loss and reward values. Additionally, we compared attack graphs generated by the AI model with those created through conventional methods.

cs.CR↗

arXiv2022

Defining C-ITS Environment and Attack Scenarios

As technology advances, it is possible to process a lot of data, and as various elements in the city become diverse and complex, cities are becoming smart cities. One of the core systems of smart cities is Cooperative-Intelligent Transport Systems (C-ITS). C-ITS is a system that provides drivers with real-time accident risk information such as surrounding traffic conditions, sudden stops, and falling objects while a vehicle is driving, and consists of road infrastructure, C-ITS center, and vehicle terminals. Meanwhile, smart cities can have cybersecurity problems because many elements of the city are networked and electronically controlled. If cybersecurity problems occur in C-ITS, there is a high risk of safety problems. The purpose of this technical document is to describe C-ITS environment modeling and C-ITS attack scenarios for C-ITS security. After describing the concept of C-ITS and MITRE ATT&CK, we describe the C-ITS environment model and the attack scenario model that we define.

cs.CR↗