Cybersecurity assessments in globally distributed enterprises are often fragmented. Organizational checks, threat modeling, and technical testing are frequently conducted in isolation, which reduces the completeness and traceability of the evidence available to decision makers. We present SyneSA, an integrated assessment framework that combines (i) security questionnaires to identify governance and process gaps, (ii) attack graphs for structured attack-path modeling, and (iii) vulnerability assessment and penetration testing to provide empirical exploitability evidence. SyneSA normalizes these heterogeneous outputs into a common evidence model and reconciles them into weakness-category/asset tuples that preserve source traces while enabling cross-method comparison.We apply SyneSA to two anonymized enterprise cases and evaluate the released executable evidence package through semantic reconciliation, severity-weighted coverage, leave-one-method-out ablation, Bayesian scenario analysis, and qualitative remediation interpretation. In the primary case (RED), 57 released normalized evidence rows yield 148 reconciled weakness-category/asset tuples after asset handling and reconciliation. In the secondary case (CS2), 55 released normalized evidence rows yield 66 reconciled tuples under the same protocol. Across both cases, the integrated tuple space reveals additional asset-specific evidence beyond that of the strongest standalone method, although the relative contribution of each assessment component remains case dependent.The results indicate that the main value of integration lies not in merely increasing the number of observations, but in reconciling scope-wide governance evidence, structured attack scenarios, and asset-specific technical findings into a comparable, remediation-oriented representation. Overall, SyneSA provides a reusable workflow for connecting governance, architectural, and exploitability evidence in enterprise cybersecurity assessment while making explicit the assumptions behind evidence integration, weighting, and remediation interpretation.
Process standards have long provided a foundation for software engineering, but equivalent guidance for machine learning projects remains limited. Existing frameworks, such as ISO/IEC 5338, outline artificial intelligence lifecycle processes at a high level but lack the detail needed to guide engineering teams in practice. This paper proposes a Process Reference Model for machine learning and artificial intelligence systems that extends existing standards by providing detailed descriptions of the technical processes that define their lifecycle. The process model was developed through a structured methodology aligned with ISO/IEC 33004 and ISO/IEC 24774 and designed following the principles of Design Science Research. It focuses exclusively on technical processes, specifying their purposes, outcomes, inputs, outputs, and base practices in a consistent format. The resulting process reference model provides a standard-aligned foundation for defining, comparing, and assessing machine learning development processes, and supports future efforts in lifecycle standardization and process capability assessment.
When machine learning (ML) applications are deployed in real-world settings, the dynamic nature of these environments often leads to a gradual degradation in model performance over time. This is called drift, which is one of the challenges the Machine Learning Operations (MLOps) paradigm tries to solve using drift detection techniques. At the same time, there is an ongoing trend of moving ML models onto edge devices, closer to the source of the data, avoiding latency issues of inference on the cloud. However, these devices have limited resources making it challenging to employ MLOps techniques like drift detection, which often require large amount of data and processing power. This paper introduces LSDD+ as a robust and efficient drift detection technique with an incorporated model adaptation strategy. This strategy makes it possible to implement new concepts whilst also recognizing previously known concepts. LSDD+ is evaluated against several other state-of-the-art drift detectors on three semi-synthetic datasets. It shows a significant increase in efficiency compared to the most accurate drift detectors whilst still being on par with these detectors in the ability to detect drift. This proves the method’s suitability for MLOps on the edge.
The rapid growth of Internet of Things (IoT) deployments has intensified the challenge of achieving reliable, secure, and energy-efficient operation under highly dynamic and non-stationary traffic conditions. In practical IoT networks, anomaly detection systems must simultaneously capture complex spatial–temporal dependencies while meeting strict constraints on inference latency and energy consumption at the edge. However, many existing approaches struggle to balance detection accuracy with operational efficiency, particularly when traffic patterns and attack behaviors evolve over time. In many real deployments, this evolution manifests as concept drift, where the statistical properties of network traffic gradually change, making fixed detection models and thresholds unreliable. To address these challenges, this paper presents a green and lightweight hybrid CNN–transformer architecture for adaptive anomaly detection in large-scale IoT networks. The proposed solution uses one-dimensional convolutional layers to explicitly capture localized cross-feature correlations and compress multivariate traffic representations before applying attention. This preliminary convolutional stage reduces noise, removes redundant temporal variations, and produces a compact representation, allowing the transformer to focus on meaningful temporal structure rather than raw high-dimensional inputs. Transformer encoders then model long-range temporal dependencies over these compact representations, enabling effective detection of both transient and persistent anomalies with reduced computational overhead. By combining convolutional compression with temporal attention, the model improves detection accuracy by jointly capturing short-range feature interactions and long-term behavioral evolution, while also reducing attention complexity and inference cost compared to transformer-only designs. To further enhance robustness under non-stationary conditions, an entropy-guided adaptive thresholding mechanism dynamically adjusts decision boundaries based on predictive uncertainty, allowing the system to maintain stable performance without retraining. Experiments on three representative IoT datasets and edge hardware show that the proposed approach achieves detection accuracy up to 97%, maintains average inference latency below 25 ms, and reduces energy consumption by about 27% compared to transformer-only baselines. Statistical analysis confirms that these improvements are significant (p<0.01) with large effect sizes (η2>0.15).
