Search for Articles:
Title / Keyword
Author / Affiliation / Email
Journal
Article Type
 
 
Advanced Search
 
Section
Special Issue
Volume
Issue
Number
Page
 
6.1
2.9
Journals
Applied Sciences
Special Issues
Approaches to Cyber Attacks and Malware Detection
applsci-logo
Submit to Special Issue Submit Abstract to Special Issue Review for Applied Sciences Propose a Special Issue

Journal Menu

► Journal Menu

Journal Browser

► Journal Browser
share announcement

Approaches to Cyber Attacks and Malware Detection

A Special Issue of Applied Sciences (ISSN 2076-3417) belonging to the section "Computing and Artificial Intelligence".

Deadline for manuscript submissions: 20 October 2026 | Viewed by 8823

Editors

Dr. Aldo Hernandez-Suarez

E-Mail Website
Guest Editor
Instituto Politecnico Nacional, ESIME Culhuacan, Mexico City 04440, Mexico
Interests: data mining; cybersecurity; malware detection; threat modeling; threat intelligence; network traffic analysis
Dr. Jose Portillo-Portillo

E-Mail Website
Guest Editor
Instituto Politecnico Nacional, ESIME Culhuacan, Mexico City 04440, Mexico
Interests: data mining; video processing; motion detection; biometrics; deep learning; computer vision
Prof. Dr. Gabriel Sanchez-Perez

E-Mail Website
Guest Editor
Instituto Politecnico Nacional, ESIME Culhuacan, Mexico City 04440, Mexico
Interests: data mining; cybersecurity; malware detection; threat modeling; threat intelligence; network traffic analysis

Special Issue Information

Dear Colleagues,

The detection of cyberattacks and malware has been a pressing topic in recent years. Although techniques and procedures have been developed to mitigate various threats, attack vectors, exploitation surfaces, and malicious anomalies in different information systems, malicious actors have refined their methods to evade detection and eradication. Therefore, in this ongoing race between detection and response, it is crucial to refine the scope of analysis, modeling, mitigation, and remediation across the vast array of attacks and malware strains by proposing innovative and effective solutions. This Special Issue focuses on the study of algorithms, tactics, procedures, workflows, tools, and technologies that can combat cyberattacks and malware. Topics of interest include, but are not limited to, the following:

AI and ML for cyberattack and malware detection:

  • Zero-day exploitation, detection, and remediation;
  • Behavioral analysis for threat modeling for cyberattack and malware strains;
  • Threat hunting for cyberattack and malware;
  • Adversarial simulation for cyberattack and malware;
  • Blockchain-based solutions for cyberattack and malware prevention;
  • Automated incident response for cyberattack and malware;
  • Malware and cyberattack countermeasures in cloud and IoT environments;
  • Advanced persistent threat recognition, analysis, and mitigation.

Dr. Aldo Hernandez-Suarez
Dr. Jose Portillo-Portillo
Prof. Dr. Gabriel Sanchez-Perez
Guest Editors

Manuscript Submission Information

Manuscripts should be submitted online at www.mdpi.com by registering and logging in to this website. Once you are registered, click here to go to the submission form. Manuscripts can be submitted until the deadline. All submissions that pass pre-check are peer-reviewed. Accepted papers will be published continuously in the journal (as soon as accepted) and will be listed together on the special issue website. Research articles, review articles as well as short communications are invited. For planned papers, a title and short abstract (about 250 words) can be sent to the Editorial Office for assessment.

Submitted manuscripts should not have been published previously, nor be under consideration for publication elsewhere (except conference proceedings papers). All manuscripts are thoroughly refereed through a single-anonymized peer-review process. A guide for authors and other relevant information for submission of manuscripts is available on the Instructions for Authors page. Applied Sciences is an international peer-reviewed open access semimonthly journal published by MDPI.

Please visit the Instructions for Authors page before submitting a manuscript. The Article Processing Charge (APC) for publication in this open access journal is 2400 CHF (Swiss Francs). Submitted papers should be well formatted and use good English. Authors may use MDPI's English editing service prior to publication or during author revisions.

Keywords

  • cybersecurity
  • malware detection
  • threat intelligence
  • network traffic analysis
  • behavioral analytics
  • advanced persistent threats
  • threat modeling
  • zero-day exploitation
  • automated incident response
  • cloud security

Benefits of Publishing in a Special Issue

  • Ease of navigation: Grouping papers by topic helps scholars navigate broad scope journals more efficiently.
  • Greater discoverability: Special Issues support the reach and impact of scientific research. Articles in Special Issues are more discoverable and cited more frequently.
  • Expansion of research network: Special Issues facilitate connections among authors, fostering scientific collaborations.
  • External promotion: Articles in Special Issues are often promoted through the journal's social media, increasing their visibility.
  • Reprint: MDPI Books provides the opportunity to republish successful Special Issues in book format, both online and in print.

Further information on MDPI's Special Issue policies can be found here.

Published Papers (4 papers)

Download All Papers
Order results
Result details
Show export options expand_more Show export options expand_less
Select all
Export citation of selected articles as:

Research

39 pages, 1921 KB  
Article
FocalVulNORM: Focal Attention for Normatively Conditioned Vulnerability Repair with Multi-Task Verification
by Aldo Hernandez-Suarez, Gabriel Sanchez-Perez, Linda Karina Toscano-Medina, Hector Perez-Meana, Jose Portillo-Portillo and Jesus Olivares Mercado
Appl. Sci. 2026, 16(13), 6752; https://doi.org/10.3390/app16136752 - 6 Jul 2026
Viewed by 476
Abstract
Vulnerable-code auditing is critical within the Software Development Life Cycle (SDLC) as timely remediation reduces exploitation risks from sensitive-data exposure to full system compromise. Although Automatic Program Repair (APR) has advanced through Machine Learning (ML), Deep Learning (DL), and Transformer-based generative models, current [...] Read more.
Vulnerable-code auditing is critical within the Software Development Life Cycle (SDLC) as timely remediation reduces exploitation risks from sensitive-data exposure to full system compromise. Although Automatic Program Repair (APR) has advanced through Machine Learning (ML), Deep Learning (DL), and Transformer-based generative models, current approaches remain limited by reduced language coverage, weak grounding in documented vulnerabilities, incomplete patch validation, and lack of explicit normative guidance for secure-coding compliance. This study introduces FocalVulNORM, a normatively conditioned Multi-Task repair model that generates a secure patch from vulnerable code while simultaneously verifying whether the vulnerable pattern is removed, the patch preserves observable behavior, and the repair aligns with the applicable security control. FocalVulNORM uses a shared Transformer encoder, a Focal Attention Layer, and four jointly optimized objectives: Repair, Detection, Normative Compliance, and Semantic Equivalence. The normative text is derived from CWE descriptions and SDLC secure-coding guides and standards, providing the security condition used to guide and evaluate each repair. Using this normative input, FocalVulNORM is trained on 11,503 vulnerability–patch pairs across seven programming languages and eight Common Weakness Enumeration (CWE) types. The model achieves CodeBLEU =0.8247 and Token-Level Accuracy (TLA) =0.8976 for Repair, F1=0.9926 for Detection, F1=0.9820 for Normative Compliance, and F1=0.9921 for Semantic Equivalence. The results indicate that FocalVulNORM extends APR beyond patch generation by attaching each repair to explicit evidence of vulnerability removal, behavioral preservation, and security-control alignment. Full article
(This article belongs to the Special Issue Approaches to Cyber Attacks and Malware Detection)
►▼ Show Figures

Figure 1

28 pages, 812 KB  
Article
Wavelet-Based and MAML-Driven Framework for Enhanced Few-Shot Malware Classification
by Abdullah Almuqrin, Ibrahim Mutambik and Majed Abusharhah
Appl. Sci. 2026, 16(8), 3921; https://doi.org/10.3390/app16083921 - 17 Apr 2026
Viewed by 579
Abstract
Traditional malware classification approaches primarily address fixed sets of well-studied malware types and therefore struggle to accommodate the continual emergence of novel or previously unseen malware strains. While visualization-based strategies have shown promise in few-shot malware classification, existing methods often produce representations with [...] Read more.
Traditional malware classification approaches primarily address fixed sets of well-studied malware types and therefore struggle to accommodate the continual emergence of novel or previously unseen malware strains. While visualization-based strategies have shown promise in few-shot malware classification, existing methods often produce representations with limited semantic richness. In parallel, few-shot learning models frequently converge with suboptimal solutions, limiting their ability to generalize effectively to new classes. To address these challenges, we propose MetaWave, a unified framework that jointly optimizes both data representation and model learning for few-shot malware classification. Rather than treating feature representation and learning strategy as largely independent stages, MetaWave is formulated as an explicit representation–adaptation integration framework that combines multi-view malware encoding with meta-learning-based optimization. At the data level, we propose a Wavelet Transform-based Malware Representation method that leverages multi-scale frequency analysis and complementary views to generate semantically enriched representations. At the model level, we adopt Model-Agnostic Meta-Learning (MAML) to optimize model initialization for rapid adaptation to unseen tasks under limited data conditions. Extensive experiments are conducted on two benchmark datasets, EMBER and Malicia, under a 5-way 5-shot protocol with disjoint class splits to ensure evaluation on previously unseen malware families. The proposed framework achieves superior performance, reaching 97.8% accuracy on EMBER and 96.2% on Malicia, consistently outperforming state-of-the-art methods. These results indicate that jointly enhancing representation quality and model adaptability can improve classification accuracy and unseen-family performance under the evaluated 5-way 5-shot protocol. Overall, MetaWave provides an effective framework for few-shot malware classification and offers a promising basis for detecting emerging malware under limited-data conditions, while robustness to adversarial perturbation, obfuscation, and polymorphism remains to be validated through dedicated future evaluation. Full article
(This article belongs to the Special Issue Approaches to Cyber Attacks and Malware Detection)
►▼ Show Figures

Figure 1

39 pages, 4701 KB  
Article
DCmal-2025: A Novel Routing-Based DisConnectivity Malware—Development, Impact, and Countermeasures
by Mai Abu-Jazoh, Iman Almomani and Khair Eddin Sabri
Appl. Sci. 2025, 15(18), 10219; https://doi.org/10.3390/app151810219 - 19 Sep 2025
Cited by 2 | Viewed by 4712
Abstract
Operating systems such as Windows, Linux, and macOS include built-in commands that enable administrators to perform essential tasks. These same commands can be exploited by attackers for malicious purposes that may go undetected by traditional security solutions. This research identifies an unmitigated risk [...] Read more.
Operating systems such as Windows, Linux, and macOS include built-in commands that enable administrators to perform essential tasks. These same commands can be exploited by attackers for malicious purposes that may go undetected by traditional security solutions. This research identifies an unmitigated risk of misuse of a standard command to disconnect network services on victim devices. Thus, we developed a novel Proof-of-Concept (PoC) malware named DCmal-2025 and documented every step of its lifecycle, including the core idea of the malware, its development, impact, analysis, and possible countermeasures. The proposed DCmal-2025 malware can cause a Denial-of-Service (DoS) condition without exploiting any software vulnerabilities; instead, it misuses legitimate standard commands and manipulates the routing table to achieve this. We developed two types of DCmal-2025: one that triggers a DoS immediately and another that initiates it after a predefined delay before restoring connectivity. This study evaluated 72 antivirus detection rates of two malware types (DCmal-2025 Type 1 and Type 2) written in C and Rust using VirusTotal. The source code for both types was undetected by any of the antivirus engines. However, after compiling the source code into executable files, only some Windows executables were flagged by general keywords unrelated to DCmal-2024 behaviour; Linux executables remained undetected. Rust significantly reduced detection rates compared to C—from 7.04% to 1.39% for Type 1 and from 9.72% to 4.17% for Type 2. An educational institution was chosen as a case study. The institution’s network topology was simulated using the GNS3 simulator. The result of the case study reveals that both malware types could cause a successful DoS attack by disconnecting targeted devices from all network-based services. The findings underscore the need for enhanced detection methods and heightened awareness that unexplained network disconnections may be caused by undetected malware, such as DCmal-2025. Full article
(This article belongs to the Special Issue Approaches to Cyber Attacks and Malware Detection)
►▼ Show Figures

Figure 1

14 pages, 1019 KB  
Article
Enhanced Blockchain-Based Data Poisoning Defense Mechanism
by Song-Kyoo Kim
Appl. Sci. 2025, 15(7), 4069; https://doi.org/10.3390/app15074069 - 7 Apr 2025
Cited by 5 | Viewed by 1996
Abstract
This paper deals with a new secured execution environment which adapts blockchain technology to defend artificial intelligence (AI) models against data poisoning (DP) attacks. The Blockchain Governance Game (BGG) is a theoretical framework for analyzing the network to provide the decision-making moment for [...] Read more.
This paper deals with a new secured execution environment which adapts blockchain technology to defend artificial intelligence (AI) models against data poisoning (DP) attacks. The Blockchain Governance Game (BGG) is a theoretical framework for analyzing the network to provide the decision-making moment for taking preliminary cybersecurity actions before DP attacks. This innovative method for conventional decentralized network securities is adapted into a DP defense for AI models in this paper. The core components in the DP defense network, including the Predictor and the BGG engine, are fully implemented. This research concerns the first blockchain-based DP defense mechanism which establishes an innovative framework for DP defense based on the BGG. The simulation in the paper demonstrates realistic DP attack situations targeting AI models. This new controller is newly designed to provide sufficient cybersecurity performance measures even with minimal data collection and limited computing power. Additionally, this research will be helpful for those considering using blockchain to implement a DP defense mechanism. Full article
(This article belongs to the Special Issue Approaches to Cyber Attacks and Malware Detection)
►▼ Show Figures

Figure 1

Show export options expand_more Show export options expand_less
Select all
Export citation of selected articles as:
 
Displaying articles 1-4
Back to TopTop