Purpose The existing Granular-Ball (GB) generation methods construct granular-balls for clustering tasks by determining their center locations and sizes according to the local distribution characteristics of the data, making it difficult to accurately characterize clusters with arbitrary shapes. Consequently, the clustering performance is constrained by the quality of the generated granular-balls. To address the above issue, this paper proposes a Stable Natural Neighborhood-based Granular Ball (SNGB) generation model. Design/methodology/approach This paper develops an adaptive granular-ball generation method for clustering. The proposed method automatically identifies neighbor core vertex from natural neighborhood relationships, constructs the structure through a core domain member assignment mechanism, and introduces an outlier identification and assignment strategy to balance coverage and compactness. The proposed method is integrated with clustering algorithms, and experiments are conducted on various datasets to evaluate its performance. Findings Experimental results demonstrate that SNGB is effective, efficient, and robust in generating high-quality granular-balls. Compared with existing granular-ball generation methods, SNGB more accurately fits complex cluster shapes and adapts to diverse data distributions, thereby improving clustering performance. Originality/value This paper proposes a granular-ball generation model based on the natural neighborhood structure. Building on natural neighborhood density and representative-point construction methods, the model transforms natural neighborhood representative structures into granular-ball representations and incorporates an outlier assignment strategy, thereby enhancing the capability of granular-balls to characterize data distribution structures. The model exhibits strong stability and robustness in scenarios involving complex structures and noise interference, providing a reliable initialization scheme for granular-ball-based clustering methods.
Purpose This review examines intelligent denoising methods for multi-source security logs in industrial cybersecurity operations. It focuses on discrete logs, audit events and security alerts ingested into log management platforms. The study aims to analyse how to reduce the burden of log and alert processing while preserving critical security evidence, anomalous information and event correlations, and to identify the applicability boundaries and research gaps of existing methods. Design/methodology/approach This study constructs a two-tier evidence scope and employs systematic mapping and narrative synthesis to synthesise 64 verified publications. It further compares the capabilities, deployment conditions and applicability of different technical approaches. Findings Existing approaches have expanded from sequence prediction and semantic representation to include parsing assisted by large language models knowledge augmentation, and collaboration between lightweight models and LLMs. The evidence reviewed suggests that lightweight models are generally better suited to low-latency preliminary screening, whereas LLMs are used primarily for semantically ambiguous and context-intensive tasks. Selective routing provides one means of coordinating the two model types while controlling the frequency and cost of large language model invocation. Originality/value This study reviews and compares existing research by focussing on semantic representation, knowledge augmentation, the division of responsibilities between lightweight models and large language models, and selective routing. It clarifies the functional boundaries and applicable conditions of different methods.
Purpose Machine learning-based intrusion detection systems (IDS) for Internet of Things (IoT) environments are vulnerable to adversarial perturbations that can cause malicious traffic to be misclassified as benign. Existing defences, such as adversarial training and feature squeezing, are typically applied independently and are not specifically designed for the heterogeneous combination of continuous and discrete features in IoT network traffic. This study proposes a robust and efficient defence framework for securing IoT IDSs against adversarial attacks. Design/methodology/approach This study proposes CoLD-IDS (Coordinated Latent Defence for Intrusion Detection Systems), a two-phase defence framework that is evaluated on the Edge-IIoTset dataset, which contains more than 2.2 million samples spanning 14 attack categories from a physical IoT testbed. Phase 1 combines an IoT-adapted feature squeezing mechanism that quantizes only continuous features with multi-attack adversarial training using clean, Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) samples. Phase 2 introduces a latent-space defence pipeline in which a denoising autoencoder compresses the original 52-dimensional feature space into a 32-dimensional representation, where feature squeezing and adversarial training are jointly applied. Robustness is further validated through ablation studies and Backward Pass Differentiable Approximation (BPDA) attacks. Findings The adversarially trained multi-layer perceptron in Phase 1 achieved an accuracy of 99.58\% on clean data and 99.49% under a PGD attack. The latent-space framework in Phase 2 achieved 98.90% accuracy on clean data and 98.88% under a PGD attack, corresponding to a degradation of only 0.02 percentage points. Ablation studies revealed that applying feature squeezing without training-time adaptation significantly degrades robustness, reducing PGD accuracy to 78.23% for the undefended baseline and 31.47% for latent squeezing without adversarial adaptation. BPDA evaluation confirmed that the observed robustness is not a consequence of gradient masking. Both proposed systems satisfy the latency and storage constraints of edge-based IoT deployments, achieving inference times below 4 µs per sample on CPU. Originality/value This study presents CoLD-IDS, a novel two-phase adversarial defence framework that integrates IoT-specific feature squeezing with multi-attack adversarial training and extends this concept to a latent representation learned through a denoising autoencoder. Unlike existing approaches that employ these defences independently, the proposed framework jointly optimises feature transformation and adversarial adaptation, resulting in highly robust and computationally efficient intrusion detection suitable for resource-constrained IoT edge devices.
Purpose Mobile robot path planning is a fundamental task in autonomous navigation. Conventional ant colony optimization (ACO) and some of its variants may exhibit weak search guidance, slow convergence, and redundant initial paths in complex grid environments. This study proposes a hybrid heuristic ant colony optimization algorithm, termed HHACO, for improving path quality and search efficiency in known static grid environments. Design/methodology/approach HHACO integrates weighted Euclidean distance, Manhattan distance and historical global-best path proximity into heuristic information. A dynamic balance factor and selection threshold regulate node-selection behavior across iterations. A dual-path pheromone update jointly reinforces the current iteration-best and historical global-best paths under pheromone bounds. After a complete path is generated, local line-of-sight optimization removes redundant nodes subject to collision checking. Findings Parameter, ablation and comparative experiments on several static grid maps show that HHACO obtains shorter feasible paths and favorable performance in convergence iterations, turning points, and result stability in the tested scenarios. Comparisons with recent representative multi-strategy ACO methods further indicate faster convergence or improved path quality in the corresponding environments. Originality/value This study improves conventional ACO from the perspectives of heuristic information, state transition, pheromone updating and path post-processing for path planning in known static grid environments. The proposed method combines hybrid geometric guidance, historical high-quality path guidance, dynamic search control, dual-path pheromone updating and local line-of-sight optimization, providing an improvement approach for enhancing path quality and search efficiency when a certain amount of additional computational cost is acceptable.
Purpose Online learning environments provide rich digital traces of learner activity, yet they offer limited access to the non-verbal affective cues that instructors naturally observe in face-to-face classrooms. This study investigates facial expression analysis as an affective sensing component for emotion-aware online learning. Design/methodology/approach Facial data were collected from 26 students during online learning sessions, and self-reported emotion labels were mapped into three affective categories: positive, neutral and negative. The visual stream was transformed into standardized face-centered representations and evaluated using a lightweight CNN implementation together with representative pretrained CNN architectures. Findings The results show that facial expressions are perceived by participants as meaningful non-verbal cues in online learning. In the classification experiments, VGG19 achieved the highest accuracy (0.79), while the lightweight CNN achieved a comparable accuracy (0.78) with the lowest loss value. Originality/value These findings suggest that facial-expression-based affective cues can be extracted from online learning data and may complement conventional learning analytics in future emotion-aware educational systems. Highlights
