Search Results (505)

Intrusion Detection Systems (IDSs) based on traditional machine learning treat network flows as independent tabular samples, ignoring the relational and topological structure that characterizes modern distributed attacks. Graph Neural Networks (GNNs) overcome this limitation by modeling network topology, which in turn raise the need to make their predictions transparent. This work develops and compares traditional classifiers against a GNN-based IDS on the UNSW-NB15 dataset, for both binary and multiclass classification. A novel graph construction is proposed in which each node is an individual flow and edges are defined by temporal proximity through three complementary strategies (conversation chains and temporal k-NN by source and destination IP). Three GNN backbones—GraphSAGE, Graph Convolutional Network (GCN) and Graph Attention Network (GAT)—are trained under an identical, matched pipeline and a chronological, inductive evaluation protocol, so that any difference is attributable to the backbone alone. A two-stage classifier then separates detection from attack-type categorisation, with GNNExplainer providing interpretability, and SHAP applied to the traditional models. In binary classification, GraphSAGE achieves an Accuracy of 0.9906, Precision of 0.9856, Recall of 0.9998, F1-Score of 0.9927 and ROC-AUC of 0.9965, exceeding the traditional baselines in their conventional evaluation setting, while GCN and GAT reach comparable detection (F1 ≈ 0.99), showing that the temporal graph rather than the specific backbone drives detection. The explainability analysis identifies TTL-related and connection-state variables as dominant predictors and reveals attack-specific structural patterns, confirming that temporally structured GNNs improve detection while providing interpretable predictions. Full article

Traditional rule-based intrusion detection systems generally fail in identifying unknown or evolving threats; thus, automated and adaptive kinds of methods are crucial. Deep learning models provide promising solutions, but many recent studies depend on hybrid architecture, which increase the computational cost and reduce deploying ability on real-time or resource-limited systems. In this paper, we present and test a standalone LSTM model for multiclass cyberattack detection based on a CIC_IoT_Dataset2023, a recent labeled dataset that mirrors the actual network environment containing 33 attack categories. The dataset was extremely imbalanced as benign traffic accounted for most of the classes. To detect such attacks, we used the Synthetic Minority Oversampling Technique (SMOTE) to increase the frequency of less common types of address. The pre-processed dataset was then employed to train four models (RNN, CNN, DNN and the proposed LSTM) for performance analysis with sequential data. The proposed LSTM model achieved an accuracy between 2% and 7%. LSTM had good detection for frequent attacks and slow-changing patterns, which shows its capacity in learning long-lasting dependencies. The results demonstrate that a simple, lightweight standalone LSTM model can be used for effective and realistic intrusion detection without the need for complex hybrid architecture. Full article

Modern intrusion detection systems (IDSs) are often evaluated under matched training and test conditions, whereas deployment environments involve changing traffic distributions, heterogeneous feature-generation pipelines, and shifting attack prevalence. This study investigates benchmark-shift-aware intrusion detection through harmonized cross-dataset evaluation of HIKARI-2021, CICIDS2017, and a CICIoT2023 sample subset. Two payload-free feature spaces are constructed: Rich-64 for detailed HIKARI-2021/CICIDS2017 analysis and Minimal-13 for three-way comparison. Using XGBoost, a supervised Transformer, and a masked-feature self-supervised Transformer, we evaluate discrimination, calibration, threshold transfer, alert-budget behavior, chronological robustness, and score-orientation stability. Across five in-domain XGBoost settings, observed false-positive rates were 4.94–5.40%, and F1-scores ranged from 0.507 to 0.995. Under strict Rich-64 HIKARI-2021-to-CICIDS2017 transfer, all models had zero recall at source-derived thresholds, with two showing inverted score orientation. In the reverse direction, XGBoost reached an 18.9% target false-positive rate, while a nominal 5% target-side alert budget yielded F1 = 0.112. Chronological evaluation further showed that improved ranking metrics did not guarantee stable validation-derived operating behavior. The study provides a reproducible diagnostic framework for evaluating IDS robustness under evolving benchmark conditions. Full article

Recent progress in intelligent, adaptive, and security-aware Software-Defined Wireless Sensor Networks (SDWSNs) is driven by the integration of Machine Learning (ML) with Software-Defined Networking (SDN) and Wireless Sensor Networks (WSNs). This systematic survey analyzes 46 peer-reviewed articles published between 2024 and 2025, providing a problem-oriented synthesis of ML-SDWSN research. Emphasizing security, routing, and performance optimization, with a particular focus on deployment architectures, the survey identifies three major trends: increased adoption of ensemble and Reinforcement Learning (RL) methods for security and adaptive control; broader implementation of edge-based ML to minimize inference latency; and greater emphasis on privacy-preserving techniques, especially Federated Learning (FL). The survey presents a structured taxonomy encompassing seven thematic areas: Distributed Denial-of-Service (DDoS) mitigation, Intrusion Detection Systems (IDSs), routing optimization, Quality of Service (QoS) management, privacy preservation, data integrity, and network-efficiency optimization. Findings are synthesized from over 120 experimental configurations reported in the literature. Due to substantial differences among the reviewed studies in terms of datasets, network topologies, hardware platforms, measurement definitions, and validation methodologies, the reported values are presented as descriptive cross-study aggregates rather than direct comparative benchmarks or formal effect-size estimates. Within these constraints, the survey identifies recurring trade-offs among accuracy, latency, scalability, and privacy. It provides evidence-based design considerations for researchers and practitioners. The survey also highlights eight critical research gaps, including limited multi-dataset validation, a lack of real-world deployments, insufficient scalability analysis, and the need for rigorous evaluation of RL-based SDWSN control. Full article

Accurately assessing the fatigue levels of air traffic controllers is crucial for reducing human errors in ATC and ensuring the safe and orderly operation of the civil aviation transportation system. In remote tower scenarios, air traffic controllers’ work environments and task interaction modes differ significantly from those in traditional towers, and traditional fatigue detection approaches relying on physiological monitoring can cause intrusive disruptions to ATC operations. To overcome these limitations, this study proposes a scenario-based, non-invasive assessment framework for accurate and low-interference fatigue recognition. Taking three key scenario elements (traffic load, main operation screen brightness, and core work area illuminance) as the basis for measuring fatigue, the framework bridges the mapping from scenario elements to fatigue status, thereby enabling the transition of assessment inputs from physiological metrics to scenario features. In this mapping, fatigue labels are determined using a fusion strategy. Specifically, objective fatigue labels are derived from optimal wave features extracted from electroencephalogram data using one-way analysis of variance (OW-ANOVA), which are then fused with subjective labels based on the Karolinska Sleepiness Scale (KSS) self-reports through fuzzy C-means (FCM) clustering. Ultimately, a hybrid intelligent classification model integrating the Gannet optimization algorithm (GOA) and random forest (RF) is constructed to perform the primary assessment task. The experimental results indicate that the proposed framework achieves a recognition accuracy of 95.00%, outperforming six other commonly used classification or combination models. Ablation experiments and robustness tests validate the effectiveness of the fused labeling strategy and GOA modules, as well as the method’s excellent stability in resisting data noise. Furthermore, feature interpretability analysis reveals the quantitative influence of the three core fatigue drivers used. The research findings confirm the feasibility of non-invasive fatigue assessment for remote tower controllers leveraging scenario-based elements, which can offer intelligent decision support for controller shift scheduling, visual environment optimization, and targeted safety interventions. Full article

The Internet of Medical Things (IoMT) is transforming healthcare through continuous patient monitoring, telemedicine, cloud–edge services, and Healthcare 5.0. However, the rapid growth of interconnected medical devices has expanded the healthcare cyberattack surface, making intelligent intrusion detection essential for protecting sensitive medical data and ensuring resilient clinical operations. Existing reviews examine specific aspects of AI-powered intrusion detection but rarely provide a deployment-oriented synthesis linking technical performance with operational and clinical requirements. This review critically examines Artificial Intelligence (AI)-powered Intrusion Detection Systems (IDSs) for IoMT across six analytical dimensions: detection performance, explainability, privacy preservation, computational efficiency, benchmarking practices, and cross-dataset generalization. This structured narrative review adopted the PRISMA 2020 framework to ensure transparent record identification, screening, and reporting, with evidence synthesized qualitatively rather than through quantitative meta-analysis. A total of 5127 records published between 2021 and 2026 were screened, resulting in 24 primary studies supported by 115 complementary studies. The findings show that machine learning, deep learning, hybrid AI, Explainable Artificial Intelligence (XAI), Federated Learning (FL), blockchain-assisted security, and edge intelligence have significantly advanced IoMT intrusion detection. However, despite benchmark accuracies often exceeding 95%, deployment remains constrained by dataset dependency, weak cross-dataset generalization, computational overhead, limited explainability, fragmented benchmarking, and insufficient operational validation. This review identifies deployment readiness, rather than predictive accuracy alone, as the principal challenge for next-generation healthcare cybersecurity and provides a practical framework for developing trustworthy, interoperable, privacy-preserving, and deployment-ready IoMT cybersecurity architectures supported by standardized evaluation protocols. Full article

Currently, in high-density indoor environments such as businesses and factories, managing human presence and access control remains a significant challenge. Traditional access control systems based on facial recognition or card scanning typically only record authentication events at the point of entry. Therefore, continuous monitoring, presence detection, or restricted area surveillance are limited. This paper proposes an integrated indoor person detection and management framework based on centralized multi-camera processing for deployment-oriented identification surveillance. The proposed framework combines SCRFD and ArcFace to perform enrollment-based face recognition and distinguish between enrolled and unknown identities. During the experimental evaluation, the facial recognition module using the SCRFD 2.5G configuration achieved a recognition accuracy of approximately 88.2%. YOLOv11n is integrated with DeepSORT to detect and continuously track individuals within the monitored area. Experimental results showed the system achieving an average processing performance of 10.6 FPS, demonstrating the feasibility of the proposed architecture for small- to medium-scale indoor surveillance applications. Additionally, this system framework integrates event-driven spatial analysis using virtual boundaries and surveillance zones to support entry/exit counting, presence monitoring, and intrusion detection in restricted areas. Experimental results demonstrate that the proposed system framework provides consistent identification monitoring performance, stable multi-object tracking capabilities, and an efficient event management mechanism for typical indoor surveillance scenarios. This work offers a centralized, deployment-oriented surveillance architecture suitable for practical indoor security management and access control applications utilizing multiple cameras. Full article

This study proposes a zero-shot cross-domain intrusion detection framework for industrial control systems (ICS) using a canonical feature representation and domain-adversarial learning. While prior approaches relied on labeled target data, the proposed method generalizes across heterogeneous SCADA datasets without target supervision. Our experimental results across SWaT, BATADAL, Mississippi, and HAI datasets show that our proposed approach outperforms traditional unsupervised baselines. Specifically, PCA-based detection achieves a ROC-AUC of 0.84 on SWaT and 0.63 on Mississippi, compared to near-random performance (0.50 ROC-AUC, 0 F1-score) for Isolation Forest and One-Class SVM due to threshold calibration limitations. A two category negative transfer taxonomy is introduced to explain performance degradation under domain divergence, and domain-adversarial analysis confirms domain-invariant representations with accuracy converging to chance level. These findings highlight the robustness of the proposed framework for real-world cross-domain ICS anomaly detection and its potential for deployment in environments with limited labeled data. Full article

The increasing adoption of machine learning and deep learning techniques in intrusion detection systems (IDSs) has substantially increased the computational complexity of model development due to large-scale datasets, sophisticated model architectures, extensive hyperparameter optimization, and repeated experimentation. Despite these demands, existing IDS research primarily emphasizes detection performance while providing limited support for estimating the computational effort required during model development and evaluation. This study proposes the Adaptive Project Complexity Index (APCI), a complexity-aware framework for estimating Computational Software Effort (CSE), a computational resource-based effort metric derived from model training and execution characteristics to support planning and resource estimation in machine learning-based IDS development. To support this objective, a complexity- and effort-oriented benchmark comprising 1040 IDS project instances was constructed using diverse datasets, model architectures, feature configurations, and hyperparameter settings. Statistical analysis demonstrated a strong positive relationship between APCI and CSE, with a Pearson correlation coefficient of 0.834. Building upon this benchmark, multiple machine learning models were evaluated to predict CSE from project characteristics available before implementation, with LightGBM achieving the best predictive performance (R² = 0.963). Furthermore, explainability analysis identified the dominant computational effort drivers and enabled the development of APCI-Adaptive, improving the APCI–CSE correlation from 0.834 to 0.904 (8.4%). By integrating dataset complexity, model complexity, and computational resource requirements within a unified framework, APCI enables computational software effort estimation prior to IDS implementation, supporting resource planning, experimental design, and complexity-aware project management for machine learning-based IDS development. Consequently, APCI provides a practical decision-support framework for resource planning, experimental design, and complexity-aware project management in modern machine learning-based cybersecurity applications. Full article

Deep learning has been widely deployed in critical scenarios such as the Internet of Things (IoT), industrial sensing, network intrusion detection, and cyber-physical system monitoring, where model inference directly affects system security, operational reliability, and service continuity. However, existing adversarial example detection studies remain insufficient for practical IoT deployment, as their validation often overlooks endpoint resource constraints, heterogeneous data modalities, physical environmental interference, communication protocol specifications, adaptive attacks, and adversary capability models. Moreover, detection outcomes are rarely connected with deployment locations, computational overhead, formal security assurance, and subsequent response strategies, which limits their engineering applicability. To address these limitations, this review systematically synthesizes recent representative studies in adversarial example detection and constructs a unified analytical framework integrating detection evidence, IoT deployment feasibility, and adaptive-attack evaluation. Based on the source of detection evidence, existing methods are categorized into input-consistency-based, feature-statistics-based, predictive-uncertainty-based, model-reconstruction-based, runtime-context-aware, and multi-strategy fusion detection, while formal certification is discussed as an independent security-assurance dimension. The review further analyzes the principles, applicable conditions, limitations, compatibility conflicts with IoT deployment constraints, and typical failure modes of these methods. The analysis identifies four key challenges: the lack of IoT-native adaptive evaluation, limited anomaly-boundary identification and cross-modal generalization, insufficient deployment-time security assurance, and weak coordination between detection decisions and security responses. Future research should therefore emphasize feasible attack paradigms, hierarchical lightweight detection, reliable multimodal fusion, certifiable operational boundaries, and auditable end-to-end response mechanisms, thereby supporting the evaluation and deployment of adversarial example detection in IoT scenarios. Full article

Mobile Ad Hoc Networks (MANETs) or Wireless Sensor Networks (WSNs) have a “decentralized” architecture and are very susceptible to sophisticated attacks, such as identity forgery attacks using deep learning (DL) methods. Secure routing and intrusion detection systems have been developed but they are usually not scalable, consume too much power, introduce too much communication overhead and do not provide enough privacy protection, or are not resilient to changes in adversarial behavior. This paper introduces a Federated Pyramid Swin Vision Transformer (FPSViT) framework that enhances the routing optimization and energy-efficient communication for MANET–WSN networks with the support of Generative AI (GAI), addressing these challenges. The proposed framework incorporates three modules: federated averaging for privacy-preserving distributed learning, Pyramid Swin Vision Transformer (PSViT) for extracting Sybil attack characteristics at multiple scales, and a GAI-based adversarial pattern generation module to boost the robustness of the detection process in the presence of evolving attack patterns. Energy-aware routing optimization: It takes into account the energy level of the nodes, power consumption of the links, link reliability and trust values to optimize the routing for minimum power consumption with secure communication. Results of experimental evaluations on various Sybil attack scenarios show that the proposed FPSViT is able to achieve 98.84%, 98.52%, 98.21%, and 98.36% detection accuracy, precision, recall, and F1-score, respectively, and consume 0.381 J/node on average and increase the lifetime of the network to 2876 rounds. The power consumption analysis demonstrates that FPSViT consumes 12–21% less energy than other methods such as Federated CNN, FL-LSTM, Lightweight Standalone Swin Detector, and RL-based Secure Routing, thanks to optimized routing decisions and avoiding unnecessary transmissions, as well as adaptive trust-based communication. Moreover, the proposed framework achieves an improvement in the packet delivery ratio to 98.24%, decreases communication overhead by 9–17% and increases network lifetime by 10–19%. The results have also validated that FPSViT is a scalable, privacy-preserving, and power-saving security solution for dynamic MANET–WSN environments and is able to successfully resist advanced DL-driven Sybil attacks. Full article

With the rapid expansion of the Internet of Medical Things (IoMT), the risks of cybersecurity have increased exponentially in healthcare settings, exposing patients’ safety. Three fundamental issues that existing intrusion detection systems (IDS) are challenged by are: (1) limited cross-domain generalization, (2) high computation requirements not suitable for edge deployment, and (3) absence of systematic comparison between classical machine learning (ML) and deep learning (DL) approaches on IoMT-specific data. In this paper, we propose a multi-dataset evaluation framework that covers six models (Random Forest, XGBoost, DNN, CNN, LSTM, and CNN-LSTM) across three different datasets: WUSTL-EHMS-2020, Edge-IIoTset, and UNSW-NB15. We show that there is a scale-dependent pattern: classical ensemble methods work best when the data is small (F1 = 0.914 ± 0.013 on WUSTL-EHMS-2020); the proposed hybrid CNN–Ensemble framework performs best when the data is large (F1 = 0.968 ± 0.002 on UNSW-NB15 with 62.8% fewer features). The proposed framework achieves a total model size of 2.11 MB and an inference latency of 111.6 ms, with seven out of the top 15 discriminative features being patient vital signs, giving the first quantitative evidence that physiological data systematically contributes to IoMT attack detection, which is demonstrated through an explainability analysis using the SHAP approach. Cross-dataset generalization experiments across six transfer scenarios expose fundamental limitations in domain transfer, establishing an important baseline for future research. Full article

Due to the explosive growth in cloud-native infrastructures, the attack surface has dramatically increased in modern enterprise identity systems, where privilege escalation has become a major security risk. Conventional rule-based intrusion detection systems fall short in identifying multi-hop privilege inheritance paths and lateral movements over heterogeneous and dynamic identity graphs. This study introduces PEGraphSec-Net, a graph-theoretical framework for detecting privilege-escalation-relevant identity behavior, modeling cloud identity interactions as dynamic heterogeneous graphs of users, services, roles, tokens, and workloads. The core contribution of this framework is a graph-based detection pipeline—an Identity Relationship Graph Constructor, a Privilege-Escalation Path Encoder, and a Temporal Graph Attention Detection layer—evaluated on privilege-escalation-relevant attack categories using a documented proxy identity-graph construction derived from the UNSW-NB15 network-traffic benchmark, and benchmarked against six non-graph tabular classifiers (CNN, LightGBM, XGBoost, Random Forest, SVM, and MLP) trained under identical preprocessing; this pipeline achieves 98.78% accuracy, a weighted F1-score of 0.98692 (macro F1-score of 0.91828), and an AUC of 1.000 on the held-out test partition. PEGraphSec-Net is further benchmarked against three graph neural network baselines (GCN, GAT, and GraphSAGE) trained on the identical identity-graph topology and node attributes; all three substantially underperform PEGraphSec-Net (best case, GraphSAGE: 63.66% accuracy, 0.239 macro F1-score), indicating that a large share of PEGraphSec-Net’s performance derives from its explicit privilege-path encoding and temporal attention mechanisms rather than from the graph topology alone. An Adaptive Containment and Isolation Engine and a Mitigation Policy Reinforcement Optimizer are further proposed as risk-scoring and reward-driven policy-learning components, whose contribution is validated through module-wise ablation on classification performance; live containment action and reinforcement-learning-specific evaluation are left for future validation. The term “privilege escalation” is used throughout to denote the evaluated proxy attack categories (Exploits, Backdoor/Backdoors, and Reconnaissance) under a documented, decade-old (2015) network-intrusion benchmark, rather than production cloud-native IAM behavior, for which native-dataset validation remains an open direction. SHAP-based interpretability analysis links the model’s top-ranked traffic-level features back to the identity-graph risk, role, and trust-transition attributes they populate, evidencing that the learned representation captures semantically meaningful identity-behavior patterns within this proxy setting. Full article

Severe electrochemical corrosion and leaching degradation of underground structures are induced by coupled stray current and groundwater in rail transit systems like subways. The microstructural evolution of fly ash geopolymer (FAG) during accelerated leaching was systematically investigated by simulating a coupled direct current (DC) stray current and soft water environment. Pore solution alkalinity and electrolytic cell OH⁻ concentration were utilized as evaluation indicators, combined with X-ray diffraction (XRD), Fourier transform infrared spectroscopy (FTIR), scanning electron microscopy (SEM), and mercury intrusion porosimetry (MIP). Results indicate that substantial OH⁻ leaching occurs under the coupled stray-current and soft-water exposure, leading to reduced pore-solution alkalinity and changes consistent with the degradation of the N–A–S–H binding network. Consequently, porosity, most probable pore diameter, and the quantity of harmful pores are increased. However, no obvious changes in the major diffraction peaks associated with quartz and mullite were detected within the resolution of the qualitative XRD analysis. Furthermore, a linearly decreasing trend over time is observed for the coupled leaching rate. Mix proportion analysis demonstrates that FAG leaching resistance is improved by reducing the water-to-binder ratio; specifically, superior gel phase content and pore structure are maintained at a ratio of 0.30. Additionally, cumulative OH⁻ leaching is effectively reduced by decreasing the sodium silicate modulus, with optimal resistance exhibited between 1.0 and 1.2. Concurrently, pore solution alkalinity before and after leaching is significantly elevated by increasing the alkali dosage. This exerts a pronounced inhibitory effect on OH⁻ leaching, thereby substantially enhancing the overall leaching resistance. Full article

Unmanned aerial vehicles (UAVs) have become essential cyber-physical platforms for applications such as surveillance, infrastructure inspection, emergency response, and intelligent transportation. However, their tight coupling among sensing, communication, control, actuation, and swarm coordination also exposes them to sophisticated cyber-physical attacks that are difficult to detect using conventional intrusion detection systems. Existing machine learning, deep learning, graph-based, and federated intrusion detection approaches generally rely on statistical feature representations or temporal patterns, providing limited capability to model causal dependencies among interacting UAV subsystems and to generalize across heterogeneous operating environments. To address these limitations, this paper proposes Fed-CGIDS-UAV, a federated causal graph learning framework for cross-domain intrusion detection in cyber-physical UAV networks. The proposed framework models each telemetry window as a typed causal graph in which nodes represent navigation, sensing, communication, control, actuation, and swarm states, while directed edges capture stable operational dependencies. Intrusions are detected by identifying violations of these learned causal relationships, and the framework provides interpretable node-edge explanations to support root-cause analysis. Furthermore, federated learning enables collaborative model training across distributed UAV clients without sharing raw telemetry, thereby preserving data privacy while improving robustness under heterogeneous operating conditions. The proposed framework was implemented and experimentally evaluated in a controlled simulation environment covering four UAV operating domains and six representative attack classes. All experiments were repeated over five independent runs using different random seeds, and the reported results correspond to the measured average performance. The proposed framework was implemented using Python 3.12 (Python Software Foundation, Wilmington, DE, USA) and PyTorch 2.3 (Meta Platforms, Menlo Park, CA, USA). UAV flight data were generated using Microsoft AirSim 1.9.1 (Microsoft Corporation, Redmond, WA, USA), integrated with PX4 Autopilot v1.14 (Dronecode Foundation, San Francisco, CA, USA) and Gazebo Sim 11 (Open Source Robotics Foundation, Mountain View, CA, USA). Within this simulation-based evaluation, Fed-CGIDS-UAV achieved an accuracy of 0.968, an F1-score of 0.956, and an internal–external stability gap (IESG) of 0.028, outperforming conventional machine learning, deep learning, graph-based, and centralized causal baselines while maintaining competitive computational latency. Although these results demonstrate the effectiveness of the proposed framework under controlled simulation conditions, validation using real-flight UAV telemetry remains an important direction for future research. These results demonstrate that integrating causal graph learning with federated optimization provides an effective and interpretable solution for privacy-preserving intrusion detection in heterogeneous cyber-physical UAV environments. Full article