Search Results (202)

Security datasets are central to the evaluation of intrusion detection and prevention systems, but their suitability differs substantially across domains, data sources, attack scenarios, labeling practices, and reproducibility conditions. This study presents a structured evidence-mapping review of security datasets reported in intrusion detection and prevention research between 2018 and 2025. The final evidence map includes 42 primary dataset-use publication records, 82 dataset or evidence-source mentions, and 69 unique datasets, corpora, or evidence sources after duplicate, retracted, and irrelevant records were removed. The review organizes datasets across network-based IDS, IPS, firewall, VPN, WAF, endpoint, email filtering, IAM, DDoS, Windows, Linux-Apache, NetFlow, cloud, and IoT/IIoT security settings. In addition to adoption-frequency analysis, the study assesses representative dataset families in terms of documentation, labeling information, feature representation, class balance, public availability, reproducibility, and practical usability limitations. The findings show that established benchmarks remain widely reused, but recent studies increasingly rely on domain-specific datasets for IoT/IIoT, DDoS, cloud, edge, host, and cyber-physical environments. The review also proposes and illustrates a dataset-selection framework that links dataset choice to security objectives, operational context, telemetry requirements, attack coverage, and evaluation protocol. The results support more transparent, context-aware, and reproducible dataset selection for intrusion detection and prevention research. Full article

Within the scope of this article, security threats against web applications and the effects of Web Application Firewall (WAF) usage on security were examined. The aim of the study is to evaluate the effectiveness of the open-source ModSecurity-based WAF structure against application layer attacks and Denial of Service (DoS) attacks. For this purpose, a test environment with an Ubuntu and Apache2-based reverse proxy architecture was created, and HTTP traffic was analyzed using the OWASP Core Rule Set (CRS), custom security rules, and the mod_qos module. In the experimental studies, SQL Injection, Cross-Site Scripting (XSS), and DoS attack scenarios were applied, and custom ModSecurity rules operating on HTTP parameters, URI, and request body were also developed and tested. The obtained results were evaluated through log records and system performance metrics. When ModSecurity was disabled, it was observed that total CPU usage reached the level of 83% during the DoS attack. After ModSecurity and mod_qos configurations were enabled, CPU usage was determined to have decreased to the level of 25%. Log analyses showed that ModSecurity and OWASP CRS rules successfully analyzed attack traffic and detected abnormal request behaviors and protocol violations. In addition, it was verified that the developed custom rules successfully blocked requests with the HTTP 403 status code in tests performed on HTTP parameters, URI, and request body. It was observed that while the security mechanisms limited attack traffic, they did not block legitimate user access and normal client requests continued to be processed successfully. The experimental results show that the ModSecurity-based WAF architecture provides an effective security solution in terms of detecting attack traffic, protecting system resources, and ensuring service continuity. Full article

Marine pollution monitoring increasingly relies on Biological Early Warning Systems (BEWSs), which use living organisms as continuous, integrative sentinels of water quality. The moon jellyfish Aurelia aurita is a sensitive but under-exploited candidate for this role. We present a computer-vision BEWS pipeline that is unsupervised at inference time and operates without labelled pollution-response data, converting side-view aquarium video of single A. aurita medusae into a binary pollution alarm. Per-frame YOLO bounding-box detections are reduced to a continuous bell-area signal and a centroid trajectory, from which eleven pulsation, kinematic, and detection-quality features are extracted on 60 s sliding windows. A per-animal baseline is fitted on a clean-water baseline (recommended ≥15 min), and a two-layer detector—fast outlier detection on the mean absolute z-score with a k-of-N rule, plus one-sided CUSUM (cumulative sum) accumulation—flags any sustained deviation. Validation on six adult medusae exposed to diesel-WAF detected all six animals (95% CI 54–100%) and produced no false alarms in 203 clean-window opportunities (exact 95% upper bound 1.8%; rule-of-three estimate ≈1.5%). First-alarm latencies ranged from 1.0 to 23.7 min, and the observed responses were described as three descriptive patterns in this pilot dataset: sharp step-change, slow drift, and mixed. The deployed anomaly scoring step contains no neural-network weights, runs in under 300 lines of Python, and is designed for field-portable use in settings where a stationary side-view camera can be positioned alongside an aquarium, although field validation remains required. Per-animal anomaly detection accommodates the strong inter-individual variability of the diesel-WAF response that limits supervised clean-versus-polluted classification at this sample size. Full article

The growing complexity of web attacks highlights the need for adaptive, intelligent defense systems that overcome the limitations of traditional rule-based web security. Thus, the architecture proposed in this paper integrates data-driven deep learning with deterministic rule-based logic to enhance real-time detection accuracy and adaptability in dynamic web threat environments. The practical integration of a deep learning-based Gated Recurrent Unit (GRU) model with ModSecurity, an open-source Web Application Firewall (WAF), is employed to improve the detection and classification of malicious HTTP requests. The model, pre-trained on a large labeled up-to-date dataset of web traffic and attack types collected post-2020, is designed to classify requests in real-time, identifying both whether a request is malicious and the corresponding attack category (e.g., SQL Injection, Cross-Site Scripting, Command Injection). We demonstrate how the trained model is incorporated into ModSecurity’s inspection pipeline, allowing it to analyze real-time web traffic alongside traditional rule-based inspection. This hybrid approach aims to significantly reduce false positives and improve adaptability to new attack patterns. Evaluation metrics such as accuracy, receiver operating characteristic (ROC), area under the curve (AUC), Principal Component Analysis (PCA), confusion matrix, and t-Distributed Stochastic Neighbor Embedding (t-SNE) visualization are discussed, along with performance considerations and implementation architecture. The integration presents a robust framework for ML-improved intelligent web security defense. Full article

Structured Query Language injection (SQLi) remains a persistent threat to web applications due to the obfuscation, diversity, and evolving structure of malicious payloads, which limit the effectiveness of conventional rule and signature-based Web Application Firewalls (WAFs). Although prior studies have reported high detection performance using individual feature extraction methods or offline classification models, limited work has addressed deployment-oriented SQLi prevention through an integrated real-time inspection framework. This paper proposes a Machine Learning (ML)-based SQLi detection and prevention framework that combines hybrid feature representation, supervised dimensionality reduction, Genetic Algorithm (GA)-based hyperparameter optimization, and real-time WAF validation. Multiple public SQLi datasets were merged, cleaned, and deduplicated to improve exposure to diverse query patterns. SQL queries were encoded using Term Frequency–Inverse Document Frequency (TF-IDF), Word2Vec, and FastText features, which were fused and transformed through a Supervised Autoencoder into a compact discriminative representation. GA was then employed to optimize multiple classifiers, including Random Forest (RF), Support Vector Machine (SVM), Decision Tree (DT), and Multi-Layer Perceptron (MLP). The MLP achieved the best overall performance, with an accuracy of 0.998681. The optimized model was deployed within a lightweight Flask-based WAF for real-time Hypertext Transfer Protocol (HTTP) request inspection and malicious input blocking. SQLMap v1.8.4-based robustness testing and runtime analysis demonstrate that the proposed framework provides effective SQLi prevention with practical deployment efficiency beyond conventional offline benchmark evaluation. Full article

Cutaneous Radiation Injuries (CRIs) and wounds within an area of radiation exposure (combined injury, CI) are a significant concern for nuclear accidents and radiation combat/terrorist events. CRIs and CI present unique clinical challenges, and effective countermeasures are urgently needed. Here we describe a murine model of CRI and CI in C57BL/6 mice using 16.9 Gy thoracic X-ray irradiation (5.3 Gy/min, 160 kV) ± experimental wound administered immediately. Wound repair and radiation-induced dermatitis were assessed after irradiation. Our previous studies showed that genistein (200 mg/kg, s.c.), administered 24 h prior to irradiation prevented radiation injuries in two murine models. We investigated the effects of genistein in the CI model. Macroscopic and histological analyses showed that radiation significantly delayed wound closure, although wounds did not significantly alter the progression of radiation dermatitis. Genistein improved the early rate of wound closure and significantly reduced dermatitis in mice. Histological analysis showed that genistein improved skin structure and reduced inflammation and fibrosis. Immunohistochemistry showed that genistein attenuated radiation-induced cyclin-dependent kinase inhibitor 1 (p21/waf1) and α-smooth muscle actin and preserved K15 positive skin adult stem cells. These findings suggest that genistein may be an effective prophylactic against CRIs and CI. Full article

Microscopy image acquisition is frequently limited by a shallow depth of field (DoF), restricted dynamic range (DR), uneven illumination, and noise, particularly when imaging transparent or weakly textured biological specimens. This work presents MFusionJ (MFJ), an open-source ImageJ/Fiji plugin for microscopic multi-focus image fusion (MFIF) and multi-exposure image fusion (MEIF). The proposed method combines two-scale decomposition (TSD), edge-preserving filtering (EPF), and weighted average fusion (WAF) to fuse base and detail layers separately using refined weight maps. MFJ was evaluated on heterogeneous microscopy datasets, including nine diatom MFIF datasets, 100 cyanobacteria stacks, 93 cervical cytology stacks, and ten diatom MEIF datasets. The comparison includes publicly or commercially available tools and methods that can be directly applied to microscopy image stacks, namely EDF, Zerene Stacker, Helicon Focus, Photomatix Pro, BLT-TM, and a CNN-based fusion baseline. In the diatom MFIF experiments, MFJ achieved the best average $Q^{AB/F}$ and $N^{AB/F}$ scores, with values of 0.821 and 0.010, respectively. For cyanobacteria, MFJ obtained the best average $Q^{AB/F}$, $N^{AB/F}$, and PIQE scores, with values of 0.543, 0.005, and 9.984, respectively. For cervical cytology, MFJ achieved the best average $Q^{AB/F}$, $L^{AB/F}$, $N^{AB/F}$, and BRISQUE scores, with values of 0.935, 0.065, 0.000, and 30.472, respectively. For MEIF, MFJ achieved the best PIQE score and average performance comparable to that of the leading methods in reference-based metrics. These results show that MFJ provides a reproducible, training-free, and user-accessible solution for enhancing DoF, preserving fine details, and reducing fusion artifacts in heterogeneous microscopy imaging scenarios. Full article

Background: Oil spills have dramatically increased, causing significant damage and pollution to marine ecosystems. The entry of petroleum hydrocarbons into the ocean may lead to the occurrence of harmful algal blooms (HABs). The amino acid changes in harmful algae after oil spills remain unclear. Methods: In order to study the effect of oil spills on the amino acid mechanism of typical causative species, the composition and relative abundance of amino acids in Heterosigma akashiwo were investigated under different water accommodated fractions (WAFs) of 180# fuel oil. Results: Random forest prediction of polycyclic aromatic hydrocarbon toxicity to microalgae identified pyrene, benzo[k]fluoranthene, and fluoranthene as significant contributors. A total of 16 species of amino acids were detected in Heterosigma akashiwo, among which alanine, proline, aspartic acid, cysteine, lysine, and histidine were the predominant ones. As the concentration of the WAF increased, alanine abundance decreased significantly, indicating that the WAF disrupted the metabolic balance of alanine, with the degree of interference being positively correlated with exposure concentration. With the increase in culture time, the abundance of cysteine increased at 1%, 3%, and 5% WAFs, whereas the cysteine increased and then decreased at 7% and 10% WAFs. The abundance of aspartic acid and lysine showed no obvious pattern with culture time under WAF stress. Significant increases in the abundance of proline and histidine were observed in the WAF treatments. Conclusions: This study investigated the impact of oil spill pressure on the amino acid content of harmful algae, providing a scientific basis for understanding the potential impact of oil spills on the occurrence of HABs. Full article

Geometric distortion remains a major obstacle to achieving high dimensional accuracy in laser powder bed fusion (LPBF), especially for complex thin-walled components with heterogeneous structural constraint. In this study, a finite element simulation-driven geometric compensation strategy was applied and validated for an LPBF-fabricated winged annular funnel structure (WAFS). A transient thermo-mechanically coupled finite element model was established to predict the distortion behavior during fabrication and validated by 3D scanning measurements, showing good agreement in both global deformation trend and local distribution characteristics. The simulation results indicated that the distortion of the WAFS was dominated by the combined constraint effect of the wing-like features and the baseplate, resulting in a non-uniform and symmetric deformation pattern. Based on the validated displacement field, an inverse-mapping method was used to construct a compensated geometry for re-fabrication. The compensated WAFS exhibited a substantially reduced deformation level, and the overall geometric distortion was reduced by more than 85% after a single compensation iteration. The present results demonstrate that finite element simulation-driven geometric compensation provides an efficient and practical route for improving the dimensional accuracy of the investigated WAFS, while reducing dependence on repeated trial-and-error optimization. Full article

Traditional Web Application Firewalls (WAFs) rely on static thresholds to detect automated threats. While effective against simple scripts, these deterministic rules struggle with “Ambiguous Traffic”—sophisticated bots that mimic human behavior and “Efficient Humans” (Power Users) who exhibit bot-like speed. In this paper, we introduce H2-MAS, a hierarchical security framework that combines a high-speed Random Forest classifier (Tier 1) with a Multi-Agent Cognitive Council (Tier 2) powered by Large Language Models (LLMs). Unlike standard “Black Box” LLM deployments, H2-MAS utilizes an adversarial “Prosecutor vs. Defender” protocol to resolve semantic paradoxes in real-time. We evaluated the system on a stratified dataset of 1000 high-uncertainty sessions ($0.2\le p\le 0.8$). Through simulated evaluation on a stratified semantic test set, the results demonstrate that the proposed architecture has the theoretical capacity to achieve up to 97.6% accuracy on specific edge cases where traditional heuristics fail. Notably, the Cognitive Council demonstrated the theoretical capacity to reduce the False Positive Rate to 0.00% within this constrained evaluated set, validating that the “Defender” agent can successfully protect legitimate power users from erroneous blocking. This architecture offers a cost-effective paradigm for Semantic Security, prioritizing user experience without compromising threat detection. Full article

Web Application Firewalls (WAFs) based on the OWASP Core Rule Set (CRS) are widely utilized to protect web applications; however, higher CRS paranoia levels, while improving attack coverage, often lead to a significant increase in false positives, thus creating substantial operational challenges. To address this issue, this article proposes AutoEx, a systematic framework for the automated generation of secure exclusion rules in CRS-based, rule-driven WAFs. The framework analyzes WAF audit logs and traces of legitimate traffic to identify recurring false-positive patterns and derive exception rules without disabling core detection mechanisms. AutoEx is evaluated across multiple CRS paranoia levels using controlled traffic scenarios, enabling a comparative assessment of its impact on false-positive reduction and detection effectiveness. The results demonstrate that false-positive rates decrease from 100% to mean residual values between 32% and 46% under scenarios involving simple input datasets and to below 2% when sufficiently representative datasets are utilized for exception generation. Additionally, the detection effectiveness remains at 100% when all intentionally introduced attack payloads are correctly identified and blocked, regardless of input dataset complexity or configured paranoia level. Furthermore, the processing latency before and after applying AutoEx is discussed. These findings show that log-driven automated exception rule generation can substantially improve the operational usability of CRS-based WAFs. The proposed framework provides a practical and scalable solution to support secure WAF tuning in complex web applications, reducing manual effort, and minimizing the risk of security degradation caused by overly permissive configurations. Full article

Web application firewalls (WAFs) are critical defenses against persistent threats to web applications, yet their security evaluation remains challenging. Traditional manual testing methods are often inefficient and resource-intensive, while existing reinforcement learning (RL)-based automated approaches face two key limitations: (1) attackers cannot perceive opaque WAF rule logic; (2) boolean feedback from WAFs results in sparse/delayed rewards—sparse rewards trap agents in blind exploration, and delayed rewards hinder the association between early actions and final outcomes, adversely affecting learning efficiency. To address those challenges, we propose Ouroboros—a framework integrating genetic algorithm-based symbolic rule reconstruction (translating WAF rules into interpretable RNNs for fine-grained confidence scoring), timing side-channel analysis (evaluating rule-matching depth), and a multi-tiered reward mechanism to enable self-evolving RL testing. Experiments show that the framework reaches 89.2% bypass success rate on signature-based WAFs. This paper presents an efficient solution for automated WAF testing and delivers insights for optimizing rule logic and anomaly detection mechanisms. Full article

Background: Malva sylvestris (the common mallow) is an herbaceous species widely used in ethnobotanical practices to treat gastrointestinal, hepatic and urinary inflammation. Objectives: Despite these beneficial effects on human health, the antineoplastic potential of this plant has not yet been fully explored. Thus, in the present study, two human colon cancer cell lines (i.e., HCT-116 and Caco-2) were treated with an extract obtained from M. sylvestris flowers (MFE), whose composition in terms of phytochemicals and microRNAs has been recently published by our research group, to explore its potential bioactivity. Methods/Results: MTT and Trypan blue assays demonstrated that MFE reduced tumour cell growth without causing significant cytotoxicity or apoptosis. Following the diphenylboric acid 2-aminoethyl ester-induced fluorescence of some plant metabolites, microscopy analysis proved that MFE components crossed the cell membranes, accumulating into nuclei. Wound assay and transwell tests documented that MFE was also able to reduce cell motility and invasiveness. In both cell lines qPCR experiments demonstrated that MFE caused the over-expression of factors, like VIMENTIN and E-CADHERIN, which negatively influence epithelial–mesenchymal transition in colon cancers. However, the effects of MFE appeared to be time-, dose- and cell type-dependent. In fact, the treatment induced senescence in P53-null Caco-2 cells (i.e., ROS, β-galactosidase and P21^WAF1/Cip1) and a premise of differentiation (i.e., P27^Kip1) in P53-wild-type HCT-116 cells, also via the CDK2/c-MYC/AKT axis, justifying its antiproliferative property. In parallel, the transfection of tumour cells with pure synthetic miR160b-5p—a microRNA identified in M. sylvestris flowers and predicted to target the human CDK2 transcript—resulted in gene silencing, thereby suggesting its central role in mediating the cross-kingdom effects of MFE on the investigated cancer models. Conclusions: Overall, these findings open new perspectives on the common mallow as a source of potential antimetastatic compounds and on the possible use of its plant microRNAs in the development of gene therapies. Full article

Background/Objectives: Renal cell carcinoma (RCC) is a common and often asymptomatic malignancy with limited treatment options for advanced stages. Chronic inflammation and cellular senescence—collectively termed “inflammaging”—are emerging as key contributors to tumor progression. This study aimed to investigate the expression of inflammaging-related markers in RCC tissues, focusing on the role of PTX3, IL-6, and senescence-associated proteins in the tumor microenvironment. Methods: A retrospective cohort of 57 patients with clear cell RCC who underwent nephrectomy was analyzed. Formalin-fixed paraffin-embedded samples from tumor, peritumoral, and normal renal tissues were examined using confocal immunofluorescence microscopy to assess PTX3, IL-6, p21, and p16 expression. Senescence-associated β-galactosidase staining was performed to identify senescent cells. Serum IL-6 levels were measured by ELISA, and survival analysis was conducted using Kaplan–Meier curves and Cox regression analysis. Results: PTX3 and IL-6 were significantly upregulated in both peritumoral and tumor tissues compared to normal kidney samples (p < 0.001). Expression of senescence markers p21 and p16 were elevated in peritumoral areas (p < 0.001) as compared to normal renal tissues, but their expression was reduced or absent in the tumor core. High-grade and high-stage tumors exhibited stronger PTX3 and IL-6 expression and lower levels of cell cycle inhibitors (p < 0.001). Patients with elevated serum IL-6 levels had significantly lower 5-year cancer-specific survival (p < 0.005) and shorter progression-free survival (p < 0.001). Conclusions: Our findings suggest that peritumoral tissue in RCC exhibits a senescent and proinflammatory phenotype that may support tumor progression. PTX3 and IL-6 are potential biomarkers of disease severity and prognosis. Targeting inflammaging pathways could offer new therapeutic strategies for RCC, particularly in aggressive disease forms. Full article

Write amplification factor (WAF) is a critical performance and endurance bottleneck in flash-based solid-state drives (SSDs). Multi-streamed SSDs mitigate WAF by enabling logical data streams to be written separately, thereby improving the efficiency of garbage collection. However, despite the architectural potential of multi-streaming, prior research has largely overlooked the design of write buffer management schemes tailored to this model. In this paper, we propose a stream-aware block-level write buffer management technique that leverages both spatial and temporal locality to further reduce WAF. Although the write buffer operates at the granularity of pages, eviction is performed at the block level, where each block is composed exclusively of pages from the same stream. All pages and blocks are tracked using least recently used (LRU) lists at both global and per-stream levels. To avoid mixing data with disparate hotness and update frequencies, pages from the same stream are dynamically grouped into logical blocks based on their recency order. When space is exhausted, eviction is triggered by selecting a full block of pages from the cold region of the global LRU list. This strategy prevents premature eviction of hot pages and aligns physical block composition with logical stream boundaries. The proposed approach enhances WAF and garbage collection efficiency without requiring hardware modification or device-specific extensions. Experimental results confirm that our design delivers consistent performance and endurance improvements across diverse multi-streamed I/O workloads. Full article