Jul 2026· International Journal for Research in Applied Science and Engineering Technology· Vol 14, pp. 787-794· 0 citations
TL;DR
This work proposes a graphstructured detection framework underpinned by a Graph Convolutional Network (GCN), enabling the model to capture interaction-driven threat indicators that scalar feature vectors cannot represent.
Abstract
Among the most consequential vulnerabilities in contemporary IoT-based systems is the insider threat — a class of
attack in which authorised users deliberately or inadvertently misuse their privileges, often evading detection for prolonged
intervals. Mainstream detection approaches continue to be undermined by three unresolved obstacles: severe class imbalance
between benign and malicious records, the curse of dimensionality arising from rich feature sets, and the non-stationary nature
of user behavioural profiles. To address these co-occurring challenges within a unified architecture, this work proposes a graphstructured detection framework underpinned by a Graph Convolutional Network (GCN). Relational dependencies among users,
devices, and system resources are encoded as graph topology, enabling the model to capture interaction-driven threat indicators
that scalar feature vectors cannot represent. Improved Principal Component Analysis (IPCA) performs dimensionality reduction
while maximising the retention of discriminative variance. An Outlier-Resistant K-Means algorithm segments the activity space
into semantically coherent clusters, and the Enhanced Bidirectional Generative Adversarial Network (EBiGAN) synthesises
statistically faithful malicious samples to redress class skew. Hyperparameter optimisation is conducted via Bayesian search
guided by the Probability of Improvement (PI) acquisition function. On the CMU CERT benchmark, the proposed system
achieves a detection accuracy of 96.8%, a detection rate of 96.7%, and a false alarm rate of only 3%, outperforming all
compared baselines and demonstrating readiness for deployment in production IoT security environments.
Cloud platforms are the targets of highly advanced attacks that are designed to circumvent traditional rule based IDSs, such as: credential misuse, insider threats, privilege escalation, lateral movements, etc. To protect against user attacks, this paper introduces an interpretable deep learning defence framework in the context of user anomaly detection for both IaaS and PaaS cloud service layers and SaaS application layer. Multi-source authentication logs/records, APIs, networks logs are combined into integrated behavioural tensors and classified as anomalies by processing with the recurrent neural network with attention-based temporal weights. The mathematical model for access probability distribution, the model for anomaly scoring and temporal sequence modeling, as well as the model for Mahalanobis-distance-based deviation analysis further enhance the analysis's rigor and interpretability. Experimental results show that the detection accuracy achieved is 97.4%, followed by 96.8% precision, 97.9% recall and 97.3% F1-score, which are much higher than those of the conventional rule-based and black-box deep learning IDSs.
Madhavi Kapre, P. Sahu, Raman Verma et al.· Journal of Intelligent Decis...· 0 citations
The widespread adoption of end-to-end encryption in 5G networks limits the effectiveness of traditional intrusion detection systems that rely on payload inspection. This challenge is particularly critical for detecting Advanced Persistent Threats (APTs), which employ low-rate, long-duration, and stealthy communication strategies to evade conventional defenses. This study presents a privacy-preserving intrusion detection framework that operates exclusively on flow-level traffic metadata without deep packet inspection. Network packets are aggregated into bidirectional flows, from which temporal, statistical, and directional features are extracted to characterize behavioral patterns. A Transformer-based model with self-attention is employed to capture long-range dependencies across encrypted traffic sequences and identify subtle, temporally dispersed attack indicators. The framework is evaluated on a large-scale 5G-relevant dataset containing over one million flow records and compared against classical machine learning, ensemble, CNN, and LSTM models. Results demonstrate high recall and strong F1-score in distinguishing APT from benign traffic. Attention-based and feature-level explanations further reveal that prolonged communication, irregular timing gaps, and directional asymmetry significantly influence detection decisions. The findings support the practicality of explainable Transformer models for secure and scalable APT detection in encrypted 5G environments.
By integrating temporal graph construction, adversarial augmentation, and GCN classification, GraphGAN effectively models coordinated attack behaviors and mitigates class imbalance, providing a robust and topology-aware solution for intrusion detection in data-constrained environments.
Mohammad Arif Hossain, Yeahia Sarker, Md Jafrin Hossain et al.· 0 citations
Advanced Persistent Threats (APTs) remain among the most damaging risks to enterprise networks: they evade signature-based defenses, persist inside compromised environments, and cause substantial harm. Most machine learning approaches to intrusion detection treat the problem as binary classification and therefore offer little support for the risk prioritisation that Security Operations Centre (SOC) analysts actually require. This paper presents an Intrusion Detection System (IDS)-contextual ensemble learning framework that assigns network traffic to three operationally meaningful risk tiers: High, Medium and Low. Sixteen domain-knowledge engineered features are combined with IDS-generated contextual annotations, raw behavioural flow measurements and temporal components to form a 36-dimensional input representation. A one-way analysis of variance (ANOVA) with eta-squared effect sizing, performed before any model is trained, shows that none of the nine raw behavioural features carries meaningful discriminating power for risk-tier assignment, which establishes the need for IDS context. Five classifiers are evaluated on a balanced dataset of 125,000 APT flow records. Extra Trees performs best, reaching 89.35% accuracy, a Macro F1 of 0.8941, a Matthews Correlation Coefficient of 0.8404 and a macro Area Under the Curve (AUC) of 0.9829, at an inference cost of approximately 42 microseconds per record. A six-configuration ablation study shows that removing the IDS annotation alone reduces Macro F1 from 0.8941 to 0.3341, the chance level for three balanced classes. Robustness is confirmed by five-fold stratified cross-validation and by a fairness audit across the four network protocol types present in the data.
Reeta Mishra, Neelu Chaudhary· Journal of Trends in Compute...· 0 citations
Cloud computing has emerged as an important core to the contemporary digital services, facilitating scalable, on demand provisioning of resources across a variety of application fields. Nevertheless, this multi-tenant and dynamic environment of clouds and the amplified attack surface make the detection of intrusions through reliable methods a consistent issue that cloud security systems struggle with. The proposed work is a Generative Adversarial Network (GAN)-based hardening framework of cloud intrusion detection systems, targeting better resilience to changing and low-rate cyberattacks. The methodology combines a conditional generator which is used to generate realistic cloud-specific attack traffic, a discriminator used to refine the adversarial traffic, as well as a co-trained intrusion classifier trained on both clean and synthetic data in a closed-loop way. The feature-aware regularization is introduced to maintain the statistical consistency of network traffic, and optimize the attack diversity. The proposed approach is proved to yield better results in comparison with signature-based, machine learning, deep learning, and adversarial ML-based IDS models by experimental assessment. Significant gains in the accuracy of identifying, the ability to recall, stability, and minimizing errors are also noticed with quantifiable increases observed in all evaluation measures. These findings represent the usefulness of adversarial data-driven learning to develop robust, adaptive, and future-ready cloud intrusion detection systems.
T. Divya, Sheik Saidhbi, S. Umarani et al.· 2026 International Conferenc...· 0 citations
The rapid advancement of digital communication and networking technologies has resulted in a significant increase in the frequency and sophistication of cyber threats, creating new challenges for securing modern computer networks. Traditional intrusion detection approaches mainly depend on signature-based techniques and predefined security rules, making them less effective against newly emerging and continuously evolving cyber attacks. To address these limitations, this study presents an Explainable Artificial Intelligence (XAI)-based cyber threat detection framework that combines Long Short-Term Memory (LSTM) and Autoencoder models for accurate and transparent threat detection. The LSTM model captures sequential network traffic patterns to identify temporal attack behaviours, whereas the Autoencoder detects anomalous activities by learning the characteristics of normal network traffic. The integration of Explainable AI enables users to understand prediction outcomes by highlighting the factors influencing each detection decision. Furthermore, the framework performs quantitative risk assessment, categorizes threats into multiple severity levels, and generates suitable mitigation recommendations through an interactive web-based dashboard. Experimental results demonstrate that the proposed framework provides reliable, interpretable, and effective cyber threat detection, thereby supporting security professionals in making timely and well-informed decisions.
Indu Asitha, Manjunatha B. N.· International Journal of Com...· 0 citations