AegisSentinel: Secure Medical Image Transmission with HFQE-S Encryption and COA Optimized HAPCNN Attack Detection

3.1. System Overview

These three elements are integrated into AegisSentinel since they can each solve a specific problem which none of the other two can resolve. HFQE-S is employed for encrypting images, as it creates image-specific keys using SHA-256. Any alteration in the original image would cause a new key to be generated, which makes it impossible to decrypt the image. HAPCNN is utilized for detecting attacks since the polynomial convolution layers of the network are more sensitive to subtle pixel changes of encrypted (noisy) images compared to conventional CNN layers and therefore can detect attacks that cannot be detected visually. COA is applied to optimize the HAPCNN, since determining hyperparameters manually such as learning rate, dropout, and polynomial degree is unreliable, COA uses a simulation approach inspired by crayfish foraging.

The designed two-phase approach consists of two phases; namely, Training and Deployment. In the Training phase, the number of images from the TCGA-LUAD dataset used will be 475. These images will undergo preprocessing and encryption using the HFQE method. Afterward, we will conduct transmission attacks on these images with the help of five techniques, which give us a total number of 8,550 images. These images will then be optimized by the Crayfish Optimization Algorithm.

Figure 1 illustrates the sender-side HFQE-S encryption pipeline and the receiver-side HAPCNN-based attack detection and decryption workflow.

Figure 1.

In deployment phase, the medical image acts as input at the sender’s end while HFQE-S module is used for encrypting this image and generation of encrypted image along with SHA-256 key. This encrypted image is sent over the network. At the receiver’s end, the prediction regarding attack on image is done with help of the pre-trained HAPCNN model. If there is no attack detected then the image is decrypted by using SHA-256 key and the real image is returned. Otherwise, the image is discarded.

3.2. HFQE-S Encryption with SHA Key

HFQE-S is the encryption module of AegisSentinel and turns a plain CT image into ciphertext through two stages: a deterministic, image-specific key derivation stage based on SHA-256, followed by a multi-round confusion–diffusion stage based on Fibonacci Q-Matrices. Expressing both stages mathematically, rather than only procedurally, makes explicit why the resulting cipher is image-bound and resistant to statistical attack.

The image is first flattened, row by row, into a one-dimensional pixel vector, and this vector is hashed to obtain a 256-bit digest (Using Equation (1)):

The first sixteen bytes of the digest are then reinterpreted as an integer seed, which becomes the single source of randomness from which every structural parameter of the cipher is derived (Using Equation (2)):

The block size takes a value of 2, 3, or 4, and the round count takes the same range independently. Both therefore vary from one image to the next, so no two images are ever encrypted with the same round structure.

Two independent generators are then seeded from the same value - one to produce the permutation tables used for confusion, and one to produce the keystream used later for diffusion - and the resulting key is assembled from every parameter derived so far (Using Equation (5)):

Because the key is fully determined by the seed, and the seed is fully determined by the hash, it never has to be transmitted or stored separately - the receiver reconstructs it from the decrypted image's own hash once decryption succeeds. Encryption proceeds over the derived number of rounds, each combining a confusion step with a diffusion step.

Figure 2 depicts HFQE-S encryption engine showing the confusion and diffusion operations applied over R rounds with XOR keystream between rounds.

Figure 2.

In the confusion step, that round's permutation table reorders the pixel vector so that spatially adjacent pixels are scattered across the image (Using Equation (6)):

Permutation alone provides no statistical protection - it only relocates existing pixel values - which is why it is always paired with the diffusion step that follows.

Diffusion is carried out using a Fibonacci Q-Matrix whose order matches the block size chosen for that image [12]. For a general order N, the entries follow a simple placement rule: every entry in the first row is one, every other row has a single one placed directly below-left of the diagonal, and every remaining entry is zero (Using Equation (7)):

This is the direct generalization of the classical two-term Fibonacci recurrence to N terms: repeatedly multiplying by a matrix built this way advances an N-step Fibonacci-type sequence exactly the way repeated addition advances the ordinary sequence, which is what gives the diffusion step its mixing behaviour. For the block sizes used in HFQE-S, this rule produces the following three matrices (Using Equations (8–10)):

These three matrices are the only diffusion matrices HFQE-S ever uses, since the derived block size is always 2, 3, or 4; which one applies to a given image is decided entirely by that image's own hash value, not by any externally chosen setting.

Diffusion itself is applied by multiplying each block of the permuted image by the matrix matching the chosen block size, under modulo-256 arithmetic so that every result remains a valid pixel intensity (Using Equation(11)):

Because each of these matrices is invertible under modulo-256 arithmetic, this step can be undone exactly during decryption using the corresponding inverse matrix.

Finally, a keystream drawn from the second generator is combined with the diffused block using bitwise XOR, adding a layer of randomization that does not depend on the Fibonacci structure at all (Using Equation (12)):

Because this mask changes for every pixel and every round, two images that differ by only a single pixel produce ciphertexts that look completely unrelated once all rounds are complete.

Together, Equations (1)–(12) show how a single hash of the input image determines every downstream choice made by HFQE-S - the key, the block size, the round count, the permutation, and the diffusion matrix - which is what gives the scheme its image-binding property without requiring any key to be stored or transmitted separately.

The immutability of the SHA-256 algorithm ensures that a particular image would always generate the same key. The slightest alteration of the picture results in an entirely new hash value.

Diffusion step is carried out using the use of the Fibonacci Q-Matrices in the sizes 2×2, 3×3 and 4×4. Encryption round involves two processes that occur alternately. Confusion process is where permutations take place. Permutations are done in a process involving multiplication of pixels by the Q-Matrix in modulo 256. Furthering the security of the process, application of XOR-based key-streams is done between rounds thus adding a new level of randomization. The combined effect of diffusion and confusion with XOR across multiple rounds ensures that even a single-pixel change in the image propagates unpredictably thus ensuring avalanche characteristics essential for robust security.

One of the main advantages of this method is the fact that the hash created with the help of the SHA-256 algorithm is created based on the initial picture. Therefore, any changes made to the picture will create a different hash and make decryption of the changed file impossible. Decryption is the reverse process of encryption.

3.3. Dataset Preparation and Attack Simulation

Pre-processing of data is performed before it is used for training and testing of the model. The process begins with extraction of images from the TCGA-LUAD dataset, which contains 475 sets of images, each set comprising DICOM images extracted from CT scans. Pre-processing of the images includes extraction of the middle slice, conversion of the image to PNG format, scaling of the image to 256×256, and graying of the image.

These images are encrypted using the HFQE-S encryption algorithm. After encryption, the images are classified as “clean” and assigned a label value of 0. Other forms of attacks considered are the Gaussian Noise Attack, Salt & Pepper Noise Attack, Intensity Shift Attack, Occlusion Attack, and FGSM Attack.

Because an adversary intercepting the channel only ever has access to ciphertext, all five attacks used to stress-test HAPCNN are simulated directly on the encrypted image I_c(x, y) rather than on the original plaintext. Pixel intensities are normalized to the range [0, 1] before a perturbation is applied and clipped back to a valid range afterward. The five attack models are defined below, with each attack first defining its underlying random or structural variable and then using that variable in the equation that produces the attacked image.

The Gaussian Noise Attack models additive channel or sensor noise picked up during transmission. A noise field η(x, y) is first drawn independently at every pixel from a zero-mean Gaussian distribution with standard deviation σ, resampled for each image as σ ∈ [0.05, 0.15] (Using Equation(13)):

This noise field is then added to the encrypted image and clipped to a valid range to obtain the attacked image (Using Equation(14)):

Table 2 depicts the clean and attacked image variations.The Salt & Pepper Noise Attack models impulsive bit-level corruption, in which a random subset of pixels is forced to the extreme intensity values. A binary corruption mask M(x, y) is first drawn from a Bernoulli distribution with density p ∈ [0.03, 0.08] (Using Equation(15)):

Table 2.

Clean and Attacked Image Variations.

Medical Image	0: Clean	1: Gaussian	2: Salt&Pepper	3: Intensity	4: Occlusion	5: FGSM

Each corrupted pixel is then assigned to 1 (salt) or 0 (pepper) with equal probability through V(x, y). Using this mask, the attacked image is composed as (Using Equation(16)):

The Intensity Shift Attack models a uniform gain or exposure drift applied to the whole image. A single scalar offset Δ is first drawn once per image from a uniform distribution over [-0.30, 0.30] (Using Equation(17)):

This offset is then applied identically to every pixel of the encrypted image and clipped to a valid range (Using Equation(18)):

The Occlusion Attack models a physical obstruction or packet-loss blackout covering part of the image. An indicator mask R(x, y) is first defined, equal to 1 inside a randomly positioned rectangular region covering 10–25% of the image area and 0 elsewhere (Using Equation(19)):

A randomly chosen fill value c ∈ {0, 1} is then substituted into the masked region to obtain the attacked image (Using Equation(20)):

The FGSM-style Perturbation Attack applies a bounded, sign-based perturbation modeled on the Fast Gradient Sign Method, to stress-test HAPCNN against adversarial-style inputs. A per-pixel sign field g(x, y) is first drawn from {−1, +1} (Using Equation(21)):

Because this perturbation is generated at the dataset-construction stage, before any classifier exists to differentiate against, g(x, y) is instantiated as a random sign field rather than the gradient of a trained model’s loss; this preserves FGSM’s characteristic bounded, high-frequency perturbation pattern while keeping the attack classifier-agnostic. Using a perturbation budget ε ∈ [0.02, 0.10], the attacked image is then obtained by (Using Equation(22)):

Equations (13)–(22) generate the five attacked image classes (labels 1–5), which are used alongside the unperturbed clean class (label 0) for training and evaluation of the proposed model.

Figure 3 illustrates the DICOM CT scan series from the TCGA-LUAD dataset are processed by extracting the center slice, converting to PNG, resizing to 256×256, and converting to grayscale.

Figure 3.

3.4. HAPCNN: Hierarchical Auto-Associative Polynomial CNN

The attack detection stage of AegisSentinel is carried out by the Hierarchical Auto-Associative Polynomial CNN (HAPCNN). Its input is a 256×256 encrypted grayscale image, and its output is a six way classification of that same image into one of six categories: clean ciphertext or one of five attack types (Gaussian noise, salt-and-pepper noise, intensity shift, occlusion, or FGSM perturbation). The network architecture is organized hierarchically, consisting of three stacked polynomial convolution layers, an auto-associative bottleneck layer, and a fully connected output layer.

Instead of the conventional ReLU activation, each convolutional stage applies a polynomial expansion of the filtered response. This design choice is central to the model, because random-looking ciphertext pixels carry information not in their raw magnitude but in the higher-order statistical relationships between neighbouring pixels. A first-order (linear) filter is blind to these relationships, whereas a polynomial filter can retain quadratic and higher cross-terms that change measurably when noise, occlusion, or an adversarial perturbation is injected into the ciphertext. The response produced by the 1-th polynomial convolution layer is given by (Using Equation(23)):

where x is the feature map received from the previous layer, wi is the i-th learnable polynomial coefficient (kernel) of the layer, n is the polynomial order, and b is the layer bias. Raising the convolutional response to successive powers before summation allows the layer to learn feature interactions of order greater than one, which is what lets HAPCNN pick up the faint, structured distortions that an attack leaves behind in an otherwise noise-like encrypted image.

The bottleneck stage that follows the three polynomial convolution layers performs an auto-associative mapping: it compresses the polynomial feature maps to a lower-dimensional code and then reconstructs the original feature map from that code, in the same manner as an autoencoder. Because this reconstruction can only succeed if the compressed code preserves the fine-grained structure of the ciphertext, the bottleneck acts as an internal consistency check - a clean ciphertext reconstructs with low error, while an attacked ciphertext, whose local statistics have been disturbed, reconstructs with a measurably larger error. This reconstruction signal is combined with the ordinary classification signal, and the two are optimized jointly through a composite loss (Using Equation (24)):

where Lcls is the classification loss, Lrec is the reconstruction loss produced by the auto-association layer, and λ is a weighting coefficient that balances the two terms during training. The classification term is a standard categorical cross-entropy over the six output classes (Using Equation (25)):

where yc is the one-hot ground-truth label for class c and ŷ_c is the probability that HAPCNN assigns to class c. The reconstruction term is the mean squared error between the original encrypted image and the image reconstructed from the bottleneck code (Using Equation (26)):

where xi is the i-th pixel of the original encrypted image, ${\widehat{\text{x}}}_{\text{i}}$ is the corresponding reconstructed pixel produced by the bottleneck decoder, and N is the total number of pixels. Minimizing L_rec alongside L_cls forces the network to keep enough ciphertext detail through the bottleneck that any attack-induced deviation remains detectable, rather than being smoothed away as the network learns to classify.

Training proceeds for a maximum of 80 epochs with a batch size of 16, using the hyperparameter set Θ* returned by the Crayfish Optimization Algorithm described in the next subsection. At inference time, an output of class 0 signals a clean ciphertext and triggers decryption, while any output in the range 1–5 signals a detected attack and raises an alarm instead of proceeding to decryption.

3.5. Crayfish Optimization Algorithm (COA)

The Crayfish Optimization Algorithm (COA) is a nature-inspired meta-heuristic that models the feeding and competing behaviour of crayfish as they respond to changes in water temperature [13]. In AegisSentinel, COA is used as a pre-training search procedure to determine the optimal values of the hyperparameters that most strongly affect HAPCNN accuracy - namely the learning rate η, the regularization coefficient λ, the dropout rate d, and the polynomial/filter parameter p. Rather than hand-tuning these values, COA treats each candidate hyperparameter set as an individual “crayfish” and lets a population of such individuals compete and forage until the best-performing configuration emerges.

Each candidate Ci is scored by briefly training HAPCNN with that configuration and measuring how well it performs on the validation set. Because COA is framed as a minimization procedure, the validation accuracy is converted into a fitness value where a smaller number is better (Using Equation (27)):

where Acc_val(Ci) is the validation accuracy obtained by HAPCNN after a short training run using the hyperparameter values encoded in candidate C_i. A candidate that yields higher validation accuracy therefore receives a lower (better) fitness value, and the candidate with the smallest f(C_i) across the whole population is retained as the current best solution C.

COA's distinguishing feature is that its search behaviour is not fixed but is instead driven by a temperature value T, resampled uniformly from the interval [20, 35] at every iteration. This temperature acts as a switch between two complementary search behaviours. When the temperature is high (T > 30), the crayfish behave competitively: each individual is pulled toward the current best solution, narrowing the search around the most promising region found so far, which is an exploitation move (Using Equation (28)):

where C_i^t is candidate i's position (hyperparameter values) at iteration t, C is the current best candidate, and r1 is a random number drawn from [0, 1] that controls the step size of the move toward C. When the temperature drops (T ≤ 30), the crayfish instead disperse to forage, which is an exploration move that widens the search away from the current best and helps the algorithm avoid settling into a local optimum (Using Equation(29)):

where r₂ is a second random scalar in [0, 1] and ε is a small random perturbation vector applied around the current best solution C. Alternating between Equation (28) and Equation (29) according to the sampled temperature is what keeps COA from converging prematurely - a known weakness of gradient-free optimizers such as PSO and WOA - while still concentrating most of the search effort near the strongest candidates found so far.

In practice, the search space is defined first, and an initial population of five candidate crayfish is drawn at random. Each candidate is trained for five epochs to obtain an initial fitness score, and the best scoring candidate becomes C*. The population then undergoes ten rounds of temperature-driven updates alternating between Equations (28) and (29) as dictated by the freshly sampled temperature each round with every candidate retrained for five epochs and rescored after each update.

4.1. Encryption Module Performance

The performance of the proposed HFQE-S algorithm is measured using the standard cryptographically defined performance criteria for the CT scan images of the TCGA-LUAD dataset, which includes entropy, PSNR, and encryption/decryption times [14].

Entropy measures the randomness of the pixel values of the encrypted image. An ideal encrypted image has pixel intensities uniformly distributed over all 256 gray levels, giving a theoretical maximum entropy of 8 bits per pixel. It is calculated as (Using Equation (30)):

where p(i) is the probability of pixel intensity value i occurring in the image. The entropy of the image encrypted using the HFQE-S scheme is 7.9973 bits per pixel, which differs from the ideal value by only 0.0027 bits per pixel. This implies that the encrypted output image is statistically indistinguishable from random noise. This high entropy is obtained through the combination of multiple rounds of Fibonacci Q-Matrix diffusion and key-stream application via the XOR operator, which removes correlation among neighbouring pixels in all directions. A high entropy corresponds to strong resistance against statistical attacks.

HFQE-S scrambling and diffusion analysis was performed on images with different derived block sizes and round counts. For all cases tested, the entropy values remain closely clustered, ranging from 7.9969 to 7.9974 bits per pixel, which shows that the level of security offered by HFQE-S is consistent irrespective of the block size and round count derived from the SHA-256 key-generation parameters.

To quantify the visual dissimilarity between two images, the Peak Signal-to-Noise Ratio (PSNR) is used. It is defined as (Using Equation(31)):

where MAX is the maximum pixel intensity value (255 for 8-bit images) and MSE is the Mean Squared Error between the two images being compared. MSE is defined as (Using Equation(32)):

where dl is the actual pixel value, $\widehat{\text{d}}\text{l}$ is the corresponding reconstructed/compared pixel value, and k is the total number of pixels. Between the original and the encrypted images, the PSNR values obtained range between 5.38 dB and 9.15 dB across the tested block-size and round configurations, which is sufficiently low to confirm that no visual information about the underlying CT image leaks into the ciphertext. The variation in PSNR across configurations is expected, since different block sizes cause different degrees of pixel alteration per round, even though the resulting entropy remains uniformly high in every case.

In the HFQE-S algorithm, the only role of SHA-256 is deterministic key generation from the image pixels [15]. SHA-256 does not take part in the encryption process itself; its task is to generate a 256-bit message digest of the original image pixel vector, which is then used to determine the block size b, the number of rounds R, and the seeds of the two random number generators. This design allows different encryption keys to be obtained for different images without relying on any additional key -management system. One SHA-256 hash computation takes very little time relative to the overall encryption process — execution of a single SHA-256 hash over a 256×256 pixel image takes less than 0.1 ms out of the total encryption time of 2.87 ms, remaining well below the real-time threshold of 5 ms. Using SHA-256 for key binding rather than for encryption itself eliminates computational bottlenecks while still ensuring plaintext sensitivity.

From the above results, the PSNR between the source image and the encrypted image is very low, confirming that the encrypted image bears no resemblance to the source image and that no diagnostic information can be extracted from it without the key. However, using the key generated through SHA-256, decryption recovers the original image exactly, so that the PSNR between the decrypted image and the source image becomes infinite (i.e., MSE = 0 in Eq. 31). This confirms perfect, lossless decryption, a property that is critical for medical-imaging applications, where any pixel-level distortion could obscure a diagnostic finding. Encryption performance across images is shown in Table 3. HFQE-S Encryption Module Performance Metrics is shown in Table 4.

Table 3.

Encryption Performance Across Images.

Image	Block Size	Rounds	PSNR (dB)	Entropy (bits)
	4×4	4	6.52	7.9973
	2×2	4	9.15	7.9972
	3×3	3	8.00	7.9971
	3×3	3	6.68	7.9974
	4×4	2	5.38	7.9969

4.2. Attack Detection Performance

The attack-detection capability of HAPCNN is evaluated on 1,293 test images spanning six classes (clean and five attack types), using accuracy, precision, recall and F1 score [16]. Accuracy is calculated as (Using Equation(33)):

Precision, recall and F1 score together characterize the trade-off between false alarms and missed detections and are calculated as (Using Equations (34,35, and 36)):

where TP, FP and FN denote the number of true positives, false positives and false negatives, respectively.

Four configurations were compared: HAPCNN without an optimizer, HAPCNN tuned with PSO, HAPCNN tuned with WOA, and the proposed HAPCNN tuned with COA.

HAPCNN without any optimizer achieves an accuracy of 83.94%, with a precision of 84.13%, a recall of 83.92%, and an F1 score of 83.80%. This establishes a strong baseline and demonstrates the effectiveness of the polynomial convolution layers and the auto-association mechanism in detecting attacks on encrypted images. The closeness of precision and recall at this stage indicates that the base architecture carries little inherent class bias, even before hyperparameter tuning.

When PSO is used to tune HAPCNN, accuracy improves to 89.94% and F1 score to 89.80%, confirming that systematic hyperparameter search yields substantial gains over manual or default configurations. A further improvement is observed with WOA, which raises accuracy to 92.51% and F1 score to 92.71%, reflecting the improved exploration–exploitation balance of WOA relative to PSO. The best performance is obtained with the proposed COA-tuned HAPCNN, which achieves 96.52% accuracy, 96.60% precision, 96.48% recall, and 96.49% F1 score. The high and closely matched precision and recall achieved by COA-tuned HAPCNN indicate that the model maintains both high sensitivity and high specificity simultaneously — a property that is essential in medical-image security, where either a missed attack or a false alarm can have serious downstream consequences. Comparative analysis of detection performance is shown in table 5.

In addition to detection accuracy, the practical feasibility of HAPCNN for IoT-healthcare deployment was evaluated in terms of model size and inference speed. HAPCNN contains 243,654 trainable parameters and requires approximately 1.276 GFLOPs per forward pass on a single 256×256 input image, resulting in an average inference time of 68.71 ms per image on CPU. This lightweight computational footprint confirms that HAPCNN is well suited for deployment on resource-constrained IoT-healthcare edge devices without requiring specialized hardware acceleration.

To visualize the class-wise behaviour of the proposed HAPCNN + COA detector after retraining on the corrected dataset, the confusion matrix over the 1,293 test images is shown in Figure 4. The corresponding per-class precision, recall and F1 score are macro-averaged across all six classes (Using Equation(37)),

Figure 4.

4.3. Comparative Analysis

The following analysis of the encryption quality is presented to justify the reasonability of the proposed framework against recent benchmarks. The HFQE-S encryption performance is compared with four recently reported encryption schemes in terms of entropy, encryption time, attack-detection capability and classification accuracy. The selected methods for comparison span different encryption paradigms, namely hyperchaotic, memristor chaos, ghost imaging via quaternion transforms, and pixel-adaptive diffusion.

The entropy provided by the HFQE-S scheme is 7.9973 bits/pixel, which is marginally lower than the entropy offered by Hu et al. [6] (7.9984 bits/pixel) and Zhang et al. [5] (7.9986 bits/pixel), within a margin of 0.0011–0.0013 bits/pixel, while HFQE-S performs light-weight block-wise processing on grayscale CT images without requiring quaternion transformation or hardware-based chaotic-circuit realization. Importantly, none of the compared techniques provide a multi-class attack-detection mechanism: Lin et al. [1] and Zhang et al. [5] offer encryption only, with no detection capability, and although Hu et al. [6] and Gong et al. [7] respectively provide authentication and source -verification schemes, neither classifies the type of attack. The comparison also includes the base Hyperchaotic Fibonacci Q-Matrix + HAPCNN-COA framework of Veerasekharreddy et al. [8], which reports an entropy of 7.9971 bits/pixel and an encryption time of 2.58 ms, together with a binary (tamper-vs-clean) detection accuracy of 91.7%, but does not report a per-class classification accuracy for the six-class attack-type setting used in this work. In contrast, the proposed HFQE-S with COA-tuned HAPCNN achieves 7.9973 bits/pixel entropy, 2.87 ms encryption time, and 96.52% six-class attack-classification accuracy, combining competitive encryption randomness with a substantially richer, multi-class detection capability. Table 7 indicates the comparative analysis of proposed work.