Machine Learning for Cyber Security and Privacy: Innovations, Challenges, and Future Directions

A special issue of Electronics (ISSN 2079-9292). This special issue belongs to the section "Computer Science & Engineering".

Deadline for manuscript submissions: 31 August 2026 | Viewed by 4902

Special Issue Editors

School of Cyber Science and Engineering, Xi’an Jiaotong University, Xi'an, China
Interests: AI security; cyber physical system security; physical layer security
School of Artificial Intelligence, Optics and Electronics (iOPEN), Northwestern Polytechnical University (NPU), Xi'an 710072, China
Interests: deep learning; artifical intelligent security; complex network; multi-modal data analysis
Special Issues, Collections and Topics in MDPI journals

E-Mail Website
Guest Editor

E-Mail
Guest Editor
Department of Computer Engineering, Air Force Engineering University, Xi'an, China
Interests: AI security; malicious code detection; intrusion detection; network security situation awareness

Special Issue Information

Dear Colleagues,

Machine Learning (ML) has revolutionized cyber security and privacy by enabling advanced threat detection, anomaly identification, and automated defense mechanisms. From intrusion detection systems to privacy-preserving data analytics, ML-driven solutions are increasingly embedded in critical infrastructures, IoT ecosystems, and cloud-based services. However, the rapid adoption of ML technologies has also exposed vulnerabilities that malicious actors exploit, such as adversarial attacks on ML models, data poisoning, membership inference attacks, and model inversion attacks. Furthermore, privacy concerns, especially in federated learning and generative AI, raise ethical and regulatory challenges that demand urgent attention.

This Special Issue will address the dual role of ML in cyber security and privacy as both a tool for defense and a vector for attack. We invite cutting-edge research that explores novel threats, develops robust mitigation strategies, and establishes ethical frameworks for deploying ML in sensitive domains. Submissions should emphasize interdisciplinary approaches, bridging ML theory, cryptographic techniques, policy design, and real-world applications.

We welcome original research articles, comprehensive reviews, and case studies focused on (but not limited to) the following themes:

1. ML-Driven Threat Detection and Mitigation

  • Novel ML methods for identifying zero-day exploits, ransomware, and APTs (Advanced Persistent Threats);
  • Adversarial robustness in malware classification, network intrusion detection, and phishing detection systems;
  • Explainable AI (XAI) for transparent threat analysis and incident response.

2. Privacy-Preserving ML in Sensitive Domains

  • Federated learning architectures for secure data collaboration in healthcare, finance, and smart cities;
  • Differential privacy guarantees in ML training and inference;
  • Mitigating model inversion and membership inference attacks in generative models (e.g., GANs, LLMs).

3. Attacks on ML Systems

  • Adversarial attacks targeting real-time decision systems (e.g., autonomous vehicles, critical infrastructure);
  • Data poisoning in federated learning and edge computing environments;
  • Privacy breaches via model extraction or side-channel attacks.

4. Ethical and Regulatory Challenges

  • Bias and fairness in ML-based security systems (e.g., facial recognition, predictive policing);
  • Compliance with GDPR, CCPA, and other privacy regulations in ML deployments;
  • Human-in-the-loop frameworks for accountable security automation.

5. Emerging Applications and Case Studies

  • ML for securing blockchain networks and decentralized applications;
  • Quantum-resistant ML algorithms for post-quantum cryptography;
  • Real-world deployments in industrial control systems (ICS), 5G networks, and IoT ecosystems.

Dr. Jiwei Tian
Dr. Peican Zhu
Prof. Dr. Beibei Li
Dr. Yafei Song
Guest Editors

Manuscript Submission Information

Manuscripts should be submitted online at www.mdpi.com by registering and logging in to this website. Once you are registered, click here to go to the submission form. Manuscripts can be submitted until the deadline. All submissions that pass pre-check are peer-reviewed. Accepted papers will be published continuously in the journal (as soon as accepted) and will be listed together on the special issue website. Research articles, review articles as well as short communications are invited. For planned papers, a title and short abstract (about 250 words) can be sent to the Editorial Office for assessment.

Submitted manuscripts should not have been published previously, nor be under consideration for publication elsewhere (except conference proceedings papers). All manuscripts are thoroughly refereed through a single-blind peer-review process. A guide for authors and other relevant information for submission of manuscripts is available on the Instructions for Authors page. Electronics is an international peer-reviewed open access semimonthly journal published by MDPI.

Please visit the Instructions for Authors page before submitting a manuscript. The Article Processing Charge (APC) for publication in this open access journal is 2400 CHF (Swiss Francs). Submitted papers should be well formatted and use good English. Authors may use MDPI's English editing service prior to publication or during author revisions.

Keywords

  • machine learning
  • cyber security and privacy
  • AI security

Benefits of Publishing in a Special Issue

  • Ease of navigation: Grouping papers by topic helps scholars navigate broad scope journals more efficiently.
  • Greater discoverability: Special Issues support the reach and impact of scientific research. Articles in Special Issues are more discoverable and cited more frequently.
  • Expansion of research network: Special Issues facilitate connections among authors, fostering scientific collaborations.
  • External promotion: Articles in Special Issues are often promoted through the journal's social media, increasing their visibility.
  • Reprint: MDPI Books provides the opportunity to republish successful Special Issues in book format, both online and in print.

Further information on MDPI's Special Issue policies can be found here.

Published Papers (3 papers)

Order results
Result details
Select all
Export citation of selected articles as:

Research

Jump to: Review

16 pages, 1425 KB  
Article
Unlocking Few-Shot Encrypted Traffic Classification: A Contrastive-Driven Meta-Learning Approach
by Zheng Li, Jian Wang, Ya-Fei Song and Shao-Hua Yue
Electronics 2025, 14(21), 4245; https://doi.org/10.3390/electronics14214245 - 30 Oct 2025
Viewed by 994
Abstract
The classification of encrypted traffic is critical for network security, yet it faces a significant “few-shot” challenge as novel applications with scarce labeled data continuously emerge. This complexity arises from the high-dimensional, noisy nature of traffic data, making it difficult for models to [...] Read more.
The classification of encrypted traffic is critical for network security, yet it faces a significant “few-shot” challenge as novel applications with scarce labeled data continuously emerge. This complexity arises from the high-dimensional, noisy nature of traffic data, making it difficult for models to generalize from few examples. Existing paradigms, such as meta-learning from scratch or standard pre-train/fine-tune methods, often fail in this scenario. To address this gap, we propose Contrastive Learning Meta-Flow (CL-MetaFlow), a novel two-stage learning framework that uniquely synergizes the strengths of contrastive representation learning and meta-learning adaptation. In the first stage, a robust feature encoder is pre-trained using supervised contrastive learning on known traffic classes, shaping a highly discriminative and metric-friendly embedding space. In the second stage, this pre-trained encoder initializes a Prototypical Network, enabling rapid and effective adaptation to new, unseen classes from only a few samples. Extensive experiments on a benchmark dataset (ISCX-VPN-2016 & ISCX-Tor-2017) demonstrate the superiority of our approach. Notably, in a five-way five-shot setting, CL-MetaFlow achieves a Macro F1-Score of 0.620, significantly outperforming from-scratch ProtoNet (0.384), a standard fine-tuning baseline (0.160), and strong pre-training counterparts like SimCLR+ProtoNet (0.545) and a re-implemented T-Sanitation (0.591). Our work validates that a high-quality, domain-adapted feature prior is the key to unlocking high-performance few-shot learning in complex network environments, providing a practical and powerful solution for real-world traffic analysis. Full article
Show Figures

Figure 1

38 pages, 9358 KB  
Article
Generation of a Multi-Class IoT Malware Dataset for Cybersecurity
by Mazdak Maghanaki, Soraya Keramati, F. Frank Chen and Mohammad Shahin
Electronics 2025, 14(21), 4196; https://doi.org/10.3390/electronics14214196 - 27 Oct 2025
Viewed by 886
Abstract
This study introduces a modular, behaviorally curated malware dataset suite consisting of eight independent sets, each specifically designed to represent a single malware class: Trojan, Mirai (botnet), ransomware, rootkit, worm, spyware, keylogger, and virus. In contrast to earlier approaches that aggregate all malware [...] Read more.
This study introduces a modular, behaviorally curated malware dataset suite consisting of eight independent sets, each specifically designed to represent a single malware class: Trojan, Mirai (botnet), ransomware, rootkit, worm, spyware, keylogger, and virus. In contrast to earlier approaches that aggregate all malware into large, monolithic collections, this work emphasizes the selection of features unique to each malware type. Feature selection was guided by established domain knowledge and detailed behavioral telemetry obtained through sandbox execution and a subsequent report analysis on the AnyRun platform. The datasets were compiled from two primary sources: (i) the AnyRun platform, which hosts more than two million samples and provides controlled, instrumented sandbox execution for malware, and (ii) publicly available GitHub repositories. To ensure data integrity and prevent cross-contamination of behavioral logs, each sample was executed in complete isolation, allowing for the precise capture of both static attributes and dynamic runtime behavior. Feature construction was informed by operational signatures characteristic of each malware category, ensuring that the datasets accurately represent the tactics, techniques, and procedures distinguishing one class from another. This targeted design enabled the identification of subtle but significant behavioral markers that are frequently overlooked in aggregated datasets. Each dataset was balanced to include benign, suspicious, and malicious samples, thereby supporting the training and evaluation of machine learning models while minimizing bias from disproportionate class representation. Across the full suite, 10,000 samples and 171 carefully curated features were included. This constitutes one of the first dataset collections intentionally developed to capture the behavioral diversity of multiple malware categories within the context of Internet of Things (IoT) security, representing a deliberate effort to bridge the gap between generalized malware corpora and class-specific behavioral modeling. Full article
Show Figures

Graphical abstract

Review

Jump to: Research

33 pages, 1134 KB  
Review
A Comprehensive Review of DDoS Detection and Mitigation in SDN Environments: Machine Learning, Deep Learning, and Federated Learning Perspectives
by Sidra Batool, Muhammad Aslam, Edore Akpokodje and Syeda Fizzah Jilani
Electronics 2025, 14(21), 4222; https://doi.org/10.3390/electronics14214222 - 29 Oct 2025
Viewed by 2198
Abstract
Software-defined networking (SDN) has reformed the traditional approach to managing and configuring networks by isolating the data plane from control plane. This isolation helps enable centralized control over network resources, enhanced programmability, and the ability to dynamically apply and enforce security and traffic [...] Read more.
Software-defined networking (SDN) has reformed the traditional approach to managing and configuring networks by isolating the data plane from control plane. This isolation helps enable centralized control over network resources, enhanced programmability, and the ability to dynamically apply and enforce security and traffic policies. The shift in architecture offers numerous advantages such as increased flexibility, scalability, and improved network management but also introduces new and notable security challenges such as Distributed Denial-of-Service (DDoS) attacks. Such attacks focus on affecting the target with malicious traffic and even short-lived DDoS incidents can drastically impact the entire network’s stability, performance and availability. This comprehensive review paper provides a detailed investigation of SDN principles, the nature of DDoS threats in such environments and the strategies used to detect/mitigate these attacks. It provides novelty by offering an in-depth categorization of state-of-the-art detection techniques, utilizing machine learning, deep learning, and federated learning in domain-specific and general-purpose SDN scenarios. Each method is analyzed for its effectiveness. The paper further evaluates the strengths and weaknesses of these techniques, highlighting their applicability in different SDN contexts. In addition, the paper outlines the key performance metrics used in evaluating these detection mechanisms. Moreover, the novelty of the study is classifying the datasets commonly used for training and validating DDoS detection models into two major categories: legacy-compatible datasets that are adapted from traditional network environments, and SDN-contextual datasets that are specifically generated to reflect the characteristics of modern SDN systems. Finally, the paper suggests a few directions for future research. These include enhancing the robustness of detection models, integrating privacy-preserving techniques in collaborative learning, and developing more comprehensive and realistic SDN-specific datasets to improve the strength of SDN infrastructures against DDoS threats. Full article
Show Figures

Figure 1

Back to TopTop