Autoencoder-based unsupervised intrusion detection systems (IDS) offer a promising approach for identifying zero-day attacks without requiring labeled malicious data. However, residual autoencoder (RAE) frameworks remain limited by static decision thresholds, susceptibility to concept drift (CD), limited adversarial robustness, and restricted adaptability to emerging attack patterns. To address these limitations, we propose the Attention-Boosted Streaming Residual Autoencoder (ASRAE), a unified framework that integrates attention-enhanced representation learning, online CD detection with adaptive thresholding, benign-only adversarial training, post-identification few-shot meta-learning, and explainability through integrated gradients (IG). Experiments on UNSW-NB15, CIC-IDS2017, and CSE-CIC-IDS2018 show that ASRAE outperforms the evaluated unsupervised baselines, achieving ROC-AUC values of 0.952, 0.940, and 0.931, respectively. Under the controlled simulated concept-drift setting, ASRAE maintains a ROC-AUC above 0.91, while adversarial evaluation using Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) demonstrates improved robustness to feature-space perturbations. The few-shot adaptation stage further enables adaptation to held-out attack families using only a small number of labeled samples while largely preserving benign reconstruction performance. ASRAE requires an average inference time of 9.2 ms per sample in the evaluated experimental environment. Overall, the results demonstrate the effectiveness of ASRAE across the benchmark, simulated-drift, adversarial, and few-shot adaptation settings.
This study proposes an expert-based multi-criteria decision analysis framework for prioritizing selected ISO/IEC 27001 implementation investment items. The framework evaluates eleven practical implementation items, including ten major investment areas and the Statement of Applicability, which are relevant to early-stage ISO/IEC 27001 implementation planning. Judgments obtained from ten information security and IT professionals were first aggregated using RANCOM, a ranking-based subjective weighting method that allows ties and accommodates expert hesitation. The resulting priority structure was then compared with Copeland and PageRank rankings, and its stability was examined through a leave-one-expert-out sensitivity analysis. The findings indicate strong convergence across methods for the upper-priority items, with C1 (Server Room Setup), C3 (System Redundancy/Backup), and C2 (Disaster Recovery Center) consistently emerging as the highest-priority implementation investments. Smaller numerical differences among mid- and lower-ranked items indicate that these results should be interpreted with attention to numerical proximity and organizational context. Overall, the study provides a practical decision-support framework for early-stage ISO/IEC 27001 implementation planning.
Industrial internet of things (IIoT) environments connect devices, gateways, hosts, and services in ways that increase both operational visibility and cyber-attack exposure. Conventional intrusion-detection systems commonly produce flat attack labels and may underuse relational information between communicating assets. We investigate an ATT CK-inspired stage-aware intrusion-detection framework that maps observed behaviour into four operational classes: Benign, Initial Access Discovery (IAD), Lateral Movement, Execution Persistence (LMEP), and Impact (IMP). Network-flow observations are represented using leakage-aware feature processing and an asset–time interaction graph, enabling comparison of feature-based, graph-based, temporal, and fusion models. To reduce dependence on a single benchmark, we evaluate the stage-aware formulation on both ToN-IoT and Edge-IIoTset. Following correction of the temporal-windowing pipeline, ToN-IoT contains 34,435 asset–window instances. GAT achieves the strongest ToN-IoT stage-detection performance with Macro-F1 0.687± 0.041 , followed by GraphSAGE ( 0.671± 0.015 ) and GCN ( 0.660± 0.039 ). The logistic-regression RF–GCN stack reaches 0.395± 0.067 and does not outperform the strongest graph learners. A controlled meta-learner ablation increases stacked Macro-F1 to 0.468 with gradient boosting, suggesting that meta-learner choice contributes substantially to the fusion shortfall. On Edge-IIoTset, the feature-based Random Forest performs best with Macro-F1 0.615. We additionally evaluate stage-mapping sensitivity, graph construction, window-size sensitivity, alternative stacking meta-learners, baseline tuning, bootstrap uncertainty, and inference latency. We formulate a strict leakage-controlled pre-impact forecasting protocol; however, although the corrected ToN-IoT representation yields 21,313 candidate forecasting instances, only five are positive and all occur in the training partition, with zero positives in validation and test. We therefore do not report held-out forecasting-performance estimates and limit our empirical claims to stage-aware intrusion detection.
Cybersecurity maturity models are widely used to assess and improve organizational security posture. However, many existing frameworks remain control-centric, static, and insufficiently adaptive to organizational scale and sector-specific constraints. These limitations are particularly evident in small and medium-sized enterprises and public-sector environments, where resource and governance challenges hinder effective implementation. The Cyber-Resistivity Maturity and Scoring Framework (CRMSF) is developed as a modular, scalable, and business-aligned framework that integrates maturity progression with explicit weighting, complexity, criticality, and benchmarking mechanisms. It combines technical and organizational practices within a unified self-assessment and scoring architecture designed to support risk-informed and actionable decision-making. This paper presents an initial empirical evaluation of CRMSF through a mixed-methods pilot study involving 26 cybersecurity professionals from multiple industry sectors. Data were collected through structured self-assessments across seven domains and twenty-four security categories, supplemented by surveys and expert interviews. Both quantitative and qualitative data were collected to evaluate usability, completeness, and contextual relevance. Based on structured practitioner evaluations, the results indicate meaningful perceived relationships between cybersecurity and cyber-resilience domains and suggest that practitioners regarded the framework as supportive for prioritizing initiatives and informing strategic investment decisions, while complementing established standards such as ISO/IEC 27001 and the NIST Cybersecurity Framework. The findings suggest strong perceived coherence and practical applicability of the framework, while identifying opportunities for refinement and further evaluation of scalability. The results provide initial, exploratory evidence that CRMSF is perceived as supporting adaptive, context-aware cybersecurity maturity assessment aligned with strategic governance and operational realities.
Cyber resilience measurement remains conceptually fragmented across technical, organizational, and human-oriented research traditions. Existing approaches differ in terminology, level of analysis, form of operationalization, and evidence basis, while indicators are often not clearly distinguished from the metrics used to assess them. This study conducts a structured, theory-informed conceptual synthesis of 33 publications issued between 2011 and 2024 to examine how cyber resilience indicators have been conceptualized, operationalized, demonstrated, and validated. Using the a priori theory-informed structure described in the methodology, the analysis organizes the reviewed indicator families into three interdependent domains: technical, organizational, and socio-psychological and relational. Within the corpus, technical contributions typically use mathematical, temporal, structural, or probabilistic metrics. Organizational contributions rely mainly on maturity criteria, questionnaires, expert judgment, mission-oriented models, or hybrid approaches. Socio-psychological and relational constructs generally appear within broader cognitive, social, workforce, or organizational assessment structures rather than as standalone cyber resilience measures. Based on this synthesis, the study proposes the Integrated Cyber Resilience Indicators Model (ICRIM), a non-hierarchical conceptual structure for organizing heterogeneous indicator families, distinguishing indicators from operational metrics, and clarifying cross-domain relationships. ICRIM is not presented as a validated assessment instrument and does not prescribe universal metrics, weights, thresholds, or scoring procedures. Its contribution is to provide a transparent analytical basis for the future development and empirical testing of context-appropriate cyber resilience measures.
