Image similarity does not, by itself, establish repeated specimen identity or duplicate leakage. We reevaluate potato leaf classification using 240 completed runs spanning 4 architectures, 2 datasets, 2 holdout strategies, and 15 seeds. The laboratory dataset contains 2,152 PlantVillage images mapped to 538 published leaf identities; the field dataset contains 1,296 images from a single source, classified as Healthy, Fungi, or Phytophthora. The laboratory grouped holdout preserved leaf identities, whereas the field grouped holdout preserved DINOv2 visual clusters. Subset sizes and class allocations were constrained. Accuracy, balanced accuracy, macro F1, per-class metrics, and relative split gaps were calculated from saved predictions. Against published laboratory identities, DINOv2 clustering at a cosine-distance threshold of 0.10 yielded a pair precision of 3.89%, pair recall of 49.91%, and identity purity of 38.34%. The mean proportion of laboratory test image whose identities were also present in the training set was 97.13% under random holdout and zero under identity-grouped holdout. Random-minus-grouped balanced accuracy gaps range from 0.27 to 4.03% points in the laboratory dataset and from 5.31 to 9.54% points in the field. Seventeen of the 24 comparisons met the specified false discovery rate criterion, including all 12 field comparisons. No exploratory ViT vs.-mean-CNN interaction contrast survives its separate six-test adjustment. The results establish sensitivity to the evaluated partition protocols, not a causal decomposition of duplicate effects or a general difference between CNN and transformers. Validation of near-duplicate identity in the field dataset remains unavailable, limiting claims about leakage.
Android devices face an escalating threat from sophisticated phishing attacks exploiting URL manipulation, deceptive SMS messages, malicious application installations, and anomalous network traffic patterns. Existing single-layer detection systems suffer from elevated false positive rates and lack integrated user education components, limiting their real-world effectiveness. This paper presents a comprehensive Multilayered Machine Learning and User-Centric Security Framework that integrates four parallel detection engines—URL Lexical Analysis (Random Forest), Natural Language Processing Content Analysis (Logistic Regression), Static Behavioral Analysis (Support Vector Machine), and Dynamic Network Traffic Analysis (Random Forest)—into a weighted ensemble risk scoring system with fixed validation-derived triage thresholds. The framework further incorporates a Reinforcement Learning (RL)-based User Awareness Module delivering personalized, spaced-repetition phishing education. Evaluated on four publicly available benchmark datasets (PhiUSIIL: 235,795 URLs; SMS Spam Collection: 5,574 messages; Drebin-215: 15,036 applications; CIC-AndMal2017: 202,500 network flows), the proposed system achieves an overall detection accuracy of 94.7%, F1-score of 0.9800, AUC-ROC of 0.9913, false positive rate (FPR) of 3.2%, and false negative rate (FNR) of 2.1%. The integrated RL-based user-awareness module produced a descriptive 16.8% improvement in phishing-recognition score (32 score points absolute) within an average of 14.3 adaptive sessions, corresponding to a 35.3% reduction in sessions required to reach the expert threshold compared with static training. The deployed framework achieves a mean end-to-end inference latency of 42.71 ms (P95 = 51.83 ms) on physical Android hardware and approximately 5% additional battery consumption per day under the defined representative workload, demonstrating the feasibility of near-real-time on-device phishing prevention without cloud offloading.
Human insider threats continue to increase as digitalization grows, especially with the rise of remote work. Most studies of cybersecurity enhancements focus on technological solutions; however, the costliest cybersecurity events originate from human and insider threat risk factors. This novel, qualitative study identified drivers of human factor insider threats while addressing a need for in-depth, qualitative studies based on expert perceptions. This study conducted semi-structured interviews with 15 cybersecurity experts across government, healthcare, and cybersecurity sectors. A grounded theory methodology strengthened the analysis of codes and themes to generate dominant factors related to drivers and solutions of insider threats that led to developing a Human Insider Threat (HIT) framework. The HIT framework has practical implications for managers to assess insider threat vulnerabilities and for researchers to create scalable instruments to evaluate emerging insider threats. The HIT framework can support organizations in identifying human risk factors, improving security training programs, and aligning technology access controls with employee roles.
6G enabled cloud networks segregate traffic into service slices (eMBB, URLLC, mMTC) with very different latency, reliability, and density needs. For the ever evolving network environments like such, DDoS defense must not only detect attacks but respond to them per slice, without breaking each slice's service guarantees. Detection is well studied, but mitigation remains unexplored. The existing federated slice-aware frameworks report only aggregate performance, without showing which stage of the pipeline produced the given outcome. This research proposed a federated, slice aware framework for DDoS defense in 6G Cloud networks. A deep detector segregates each flow and passes its confidence and embedding to per slice mitigation policies. It is Trained by federated aggregation across heterogeneous cloud edge domains so that no raw traffic leaves its source. The interface is confidence gated, which means low-confidence flows are allowed before the slice policy is consulted. This makes every decision attributable to either the gate or the policy. This research introduces a stage attributable evaluation that traces each mitigation outcome to its source, and a SLA metric that separates policy quality from the attack density of the test data. Three dataset configurations are usd in this research : A synthetic 6G CTGAN-generated dataset, CICDDoS2019 dataset and a combined configuration. Across three dataset configurations the framework detects DDoS traffic with 0.96 to 0.9998 accuracy. It mitigates attacks at up to exact malicious block and benign allow rates and raises sustained SLA from as low as 0.13 to 0.81 against oracle ceilings of 0.97. All results come from a single reproducible run, and an honest ablation shows a shared policy matches the per slice design on accuracy. The result is a privacy preserving, slice aware, and interpretable approach to DDoS mitigation for 6G cloud networks.
