This research paper explores the efficacy of two nature-inspired optimization algorithms, the whale optimization algorithm (WOA) and Harris Hawks optimization (HHO), for feature selection in the context of intrusion detection and prevention systems (IDPS). Leveraging the NSL-KDD dataset as a benchmark, our study employs Python for implementation and uses decision tree (DT) as the classification model. The objective is to assess the impact of the HHO and WOA optimization techniques on the performance of IDPS through feature selection. The WOA and HHO techniques were able to lessen the features from 40 to 16 and 13, respectively. Results indicate that DT integrated with HHO achieves an impressive accuracy of 97.59%, outperforming the WOA-enhanced model, which attains an accuracy of 97.5%. This study contributes valuable insights into the comparative effectiveness of WOA and HHO optimization algorithms in enhancing the accuracy of IDPSs, shedding light on their potential applications in the realm of cybersecurity.

The security and integrity of computer systems and networks highly depend on malware detection. In the realm of malware detection, the K-Nearest Neighbors (KNN) algorithm is a well-liked and successful machine learning algorithm. However, the choice of an acceptable distance metric parameter has a significant impact on the KNN algorithm's performance. This study tries to improve malware detection by adjusting the KNN algorithm's distance metric parameter. The distance metric greatly influences the similarity or dissimilarity between instances in the feature space. The KNN algorithm for malware detection can be more accurate and effective by carefully choosing or modifying the distance metric. This paper analyzes multiple distance metrics, including Minkowski distance, Manhattan distance, and Euclidean distance. These metrics account for the traits of malware samples while capturing various aspects of similarity. The effectiveness of the KNN algorithm is evaluated using the MalMem-2022 malware dataset, and the results are broken down into these three-distance metrics. The experimental findings show that, among the three distance metric parameters, the Euclidean and Minkowski distance metric parameters considerably produced the best outcomes with binary classification. While with multiclass classification, the KNN algorithm has achieved the highest outcomes using Manhattan distance.

Eliminating security threats on the Internet of Things (IoT) requires recognizing threat attacks. IoT and its implementations are currently the most common scientific field. When it comes to real-world implementations, IoT's attributes, on the one hand, make it simple to apply, but on the other hand, they expose it to cyber-attacks. Denial of Service (DoS) attack is a type of threat that is now widespread in the field of IoT. Its primary goal is to stop or damage service or capability on a target. Conventional Intrusion Detection Systems (IDS) are no longer sufficient for detecting these sophisticated attacks with unpredictable behaviors. Machine learning (ML)--based intrusion detection does not need a massive list of expected activities or a variety of threat signatures to create detection rules. This study aims to evaluate different ML classifiers for network intrusion detection that focus on DoS attacks in the IoT environment to determine the best ML classifier that can detect the DoS attack. The XGBoost, Decision Tree (DT), Gaussian Naive Bayes (NB), Random Forest (RF), Logistic Regression (LR), and Support Vector Machine (SVM) ML classifiers are used to evaluate the DoS attack. The UNSW-NB15 dataset was used for this study. The obtained accuracy rate for XGboost was 98.92%, SVM 98.62%, Gaussian NB 83.75%, LR 97.74%, RF 99.48%, and DT 99.16%. where the precision rate for XGboost, SVM, Gaussian NB, LR, RF, and DT was 98.40%, 98.29%, 77.50%, 97.14%, 99.21%, and 99.12%, respectively. The sensitivity rate for XGboost, SVM, Gaussian NB, LR, RF, and DT was 99.29%, 98.76%, 91.87%, 98.06%, 99.69%, and 99.08%, respectively. The results show that the RF classifier outperformed other classifiers in terms of Accuracy, Precision, and Sensitivity.

Cloud computing offers several advantages, including cost savings and easy access to resources, it is also could be vulnerable to serious security attacks such as cloud Trojan horse infection attacks. To address this issue, machine learning is a promising approach for detecting these threats. Thus, different machine learning tools and models have been employed to detect Trojan horse infection such as Weka and Python Colab. This study aims to compare the performance of Weka and Python Colab, as popular tools for building machine learning models. This study evaluates the recall, accuracy, and F1-score of machine learning models built with Weka and Python Colab and compares their computational resources required employing several machine learning algorithms. The dataset collected and analyzed using dynamic analysis of Trojan horse infection in control lab environment. The findings of this study can help determine the decision about which tool to use to detect Trojan horse infections and provide insights into the strengths and limitations of Weka and Python Colab for building machine-learning models in general.

With the increasing prevalence of network intrusions, the development of effective network intrusion detection systems (NIDS) has become crucial. In this study, we propose a novel NIDS approach that combines the power of long short-term memory (LSTM) and attention mechanisms to analyze the spatial and temporal features of network traffic data. We utilize the benchmark UNSW-NB15 dataset, which exhibits a diverse distribution of patterns, including a significant disparity in the size of the training and testing sets. Unlike traditional machine learning techniques like support vector machines (SVM) and k-nearest neighbors (KNN) that often struggle with limited feature sets and lower accuracy, our proposed model overcomes these limitations. Notably, existing models applied to this dataset typically require manual feature selection and extraction, which can be time-consuming and less precise. In contrast, our model achieves superior results in binary classification by leveraging the advantages of LSTM and attention mechanisms. Through extensive experiments and evaluations with state-of-the-art ML/DL models, we demonstrate the effectiveness and superiority of our proposed approach. Our findings highlight the potential of combining LSTM and attention mechanisms for enhanced network intrusion detection.

The class imbalance problem occurs when the number of samples in a given dataset is not balanced according to the class labels. In a binary classification problem of two classes, one class contains a minority of samples while the other has a majority. The commonly utilized SMOTE technique generates synthetic samples in the middle of a pair of original samples in the feature space to oversample the minority class. The midlines and randomness characteristics of this technique and its extensions capture the local characteristics of the minority class. Besides, these techniques do not significantly improve the classification problem’s performance. Accordingly, this paper proposes a new technique for oversampling using a single-layer perceptron that captures the general characteristics of the data with low resource consumption. The proposed technique uses the weights trained for the network as input to other networks to generate new samples within the min-max range. The results showed that the proposed technique overperformed the SMOTE techniques, as reported using several machine learning techniques, including decision tree, random forest, support vector machine, and K-nearest neighbors. The experiments are conducted using the highly imbalanced credit card transaction dataset, which contains 492 fraudulent transactions out of 284,807 total transactions. The random forest reported the best results, in which the proposed technique improves the recall and the f-measure while maintaining full precision, similar to SMOTE.

Low Power Networks are spreading worldwide, seeking to enable small devices to join wireless networks. This requires a routing mechanism that makes it possible and seamless. This research aims to create a Low Power and Lossy Networks (RPL) routing protocol that balances power usage and node dependability. The main emphasis of the algorithm presented here is the choice made by network nodes (Zigbees) regarding which path to deliver the message along. Results for this routing technique seem promising. Utilizing it increased packet transfer reliability while enforcing power conservation. Furthermore, a 10% reduction in the network's overall power consumption was made.

Phishing websites are characterized by distinguished visual, address, domain, and embedded features, which identify and defend such threats. Yet, phishing website detection is challenged by overlapping these features with legitimate websites’ features. As the inter-class variance between legitimate and phishing websites becomes low, commonly utilized machine learning algorithms suffer from low performance in overlapping feature cases. Alternatively, ensemble learning that combines multiple predictions intending to address low inter-class variations in the classified data improves the performance in such cases. Ensemble learning utilizes multiple classifiers of similar or different types with multiple deviations of the training data. This paper develops a framework based on random forest ensemble techniques. The limitations of the random forest are the inability to capture the high correlation between features and their join dependency on the label. The random forest is combined with k-means clustering to capture the feature correlation. The framework is evaluated for phishing detection with a dataset of 5000 samples. The results showed the proposed framework over-performed the random forest classifier, all other ensemble classifiers, and the conventional classification algorithms. The proposed framework achieved an accuracy of 98.64%, precision of 0.986, recall of 0.987, and F-measure of 0.986.

Active Queue Management (AQM) methods significantly impact the network performance, as they manage the router queue and facilitate the traffic flow through the network. This paper presents a novel fuzzy-based AQM method developed with a computationally efficient precise fuzzy modeling optimized using the Genetic Algorithm. The proposed method focuses on the concept of symmetry as a means to achieve a more balanced and equitable distribution of the resources and avoid bandwidth wasting resulting from unnecessary packet dropping. The proposed method calculates the dropping probability of each packet using a precise fuzzy model that was created and tuned in advance and based on the previous dropping probability value and the queue length. The tuning process is implemented as an optimization problem formulated for the b0, b1, and b2 variables of the precise rules with an objective function that maximizes the performance results in terms of loss, dropping, and delay. To prove the efficiency of the developed method, the simulation was not limited to the common Bernoulli process simulation; instead, the Markov-modulated Bernoulli process was used to mimic the burstiness nature of the traffic. The simulation is conducted on a machine operated with 64-bit Windows 10 with an Intel Core i7 2.0 GHz processor and 16 GB of RAM. The simulation used Java programming language in Apache NetBeans Integrated Development Environment (IDE) 11.2. The results showed that the proposed method outperformed the existing methods in terms of computational complexity, packet loss, dropping, and delay. As such, in low congested networks, the proposed method maintained no packet loss and dropped 22% of the packets with an average delay of 7.57, compared to the best method, LRED, which dropped 21% of the packets with a delay of 10.74, and FCRED, which dropped 21% of the packets with a delay of 16.54. In highly congested networks, the proposed method also maintained no packet loss and dropped 48% of the packets, with an average delay of 16.23, compared to the best method LRED, which dropped 47% of the packets with a delay of 28.04, and FCRED, which dropped 46% of the packets with a delay of 40.23.

During COVID-19, universities started to use mobile learning applications as one of the solutions to support distance learning. The readiness of universities to apply new systems, such as mobile learning applications, is considered one of the critical issues to ensure the system’s success. Determining the most important aspects of readiness to use mobile learning is a key step to adopt mobile learning in an effective way. To address this issue, this research aims to determine the most important determinants influencing mobile learning readiness by employing the Technology Acceptance Model (TAM). The Structural Equation Modelling (SEM) method was used to test the hypotheses in the proposed model. The results showed that the relationship between mobile learning readiness and awareness, IT infrastructure and top management support was positively significant. In conclusion, the findings will be of value to decision makers and mobile learning developers in universities to enhance the development of mobile learning applications. In addition, it may help facilitate and promote the usage of mobile learning applications among users.

The growing number of security threats has prompted the use of a variety of security techniques. The most common security tools for identifying and tracking intruders across diverse network domains are intrusion detection systems. Machine Learning classifiers have begun to be used in the detection of threats, thus increasing the intrusion detection systems’ performance. In this paper, the investigation model for an intrusion detection systems model based on the Principal Component Analysis feature selection technique and a different Support Vector Machine kernels classifier is present. The impact of various kernel functions used in Support Vector Machines, namely linear, polynomial, Gaussian radial basis function, and Sigmoid, is investigated. The performance of the investigation model is measured in terms of detection accuracy, True Positive, True Negative, Precision, Sensitivity, and F-measure to choose an appropriate kernel function for the Support Vector Machine. The investigation model was examined and evaluated using the KDD Cup’99 and UNSW-NB15 datasets. The obtained results prove that the Gaussian radial basis function kernel is superior to the linear, polynomial, and sigmoid kernels in both used datasets. Obtained accuracy, Sensitivity, and, F-measure of the Gaussian radial basis function kernel for KDD CUP’99 were 99.11%, 98.97%, and 99.03%. for UNSW-NB15 datasets were 93.94%, 93.23%, and 94.44%.

Network security risks are increasing at an exponential rate as Internet technology advances. Keeping the network protected is one of the most challenging of network security. Many security mechanisms were implemented to detect and identify any malicious activity on the network. Intrusion Detection System (IDS) one of the most used mechanisms to reduce the effects of these risks. Machine Learning (ML) classifiers are widely begin used to classify the network traffic as normal or abnormal. In this paper a comparative evaluation of the following ML classifiers: LogisticRegression, Multinomial Naive Bayesian, Gaussian Naive Bayesian, Bernoulli Naive Bayesian, k-Nearest Neighbors, Decision Tree, Adaptive Boosting, Random Forest, Multilayer Perceptron, and GradientBoosting is performed to specify the best classifier in identifying intrusion detection. The used evaluation metrics are accuracy, precision, and F-measure. The UNSW-NB15 dataset is used to assess ML classifiers. The experimental results show that the RandomForest classifier outperforms the other classifiers in terms of accuracy at 87%, precision 98%, and F-measure 84%.

Despite the fact that several studies have been conducted to study the adoption of smart-government services, little consideration has been paid to exploring the main factors that influence the adoption of smart-government services at the three main stages of smart-government services (the static, interaction, and transaction stages). Based on the results of this study, each of these three stages has different requirements in terms of system compatibility, security, information quality, awareness, perceived functional benefit, self-efficacy, perceived image, perceived uncertainty, availability of resources, and perceived trust. In addition, the results demonstrate that the requirements and perceptions of users towards the adoption and use of smart-government services in the three stages significantly differ. This study makes a unique contribution to the existing research by examining the perceptions and needs of consumers, in terms of adoption throughout the three stages.

Resource limited networks have various applications in our daily life. However, a challenging issue associated with these networks is a uniform load balancing strategy to prolong their lifespan. In literature, various schemes try to improve the scalability and reliability of the networks, but majority of these approaches assume homogeneous networks. Moreover, most of the technique uses distance, residual energy and hop count values to balance the energy consumption of participating nodes and prolong the network lifetime. Therefore, an energy efficient load balancing scheme for heterogeneous wireless sensor networks (WSNs) need to be developed. In this article, an energy gauge node (EGN) based communication infrastructure is presented to develop a uniform load balancing strategy for resource-limited networks. EGN measures the residual energy of the participating nodes i.e., Ci ∈ Network. Moreover, EGN nodes advertise hop selection information in the network which is used by ordinary nodes to update their routing tables. Likewise, ordinary nodes use this information to uni-cast its collected data to the destination. EGN nodes work on built-in configuration to categorize their neighboring nodes such as powerful, normal and critical energy categories. EGN uses the strength of packet reply (SPR) and round trip time (RTT) values to measure the neighboring node's residual energy (Er) and those node(s) which have a maximum Er values are advertised as reliable paths for communication. Furthermore, EGN transmits a route request (RREQ) in the network and receives route reply (RREP) from every node reside in its closed proximity which is used to compute the Er energy values of the neighboring node(s). If Er value of a neighboring node is less than the defined category threshold value then this node is advertised as non-available for communication as a relaying node. The simulation results show that our proposed scheme surpasses the existing schemes in terms of lifespan of individual nodes, throughput, packet loss ratio (PLR), latency, communication costs and computation costs, etc,. Moreover, our proposed scheme prolongs the lifespan of WSNs and as well as an individual node against exiting schemes in the operational environment.

Jamming attack is one of the most common threats on wireless networks through sending a high-power signal to the network in order to corrupt legitimate packets. To address Jamming attacks problem, the Particle Swarm Optimization (PSO) algorithm is used to describe and simulate the behavior of a large group of entities, with similar characteristics or attributes, as they progress to achieve an optimal group, or swarm. Therefore, in this study enhanced version of PSO is proposed called the Improved PSO algorithm aims to enhance the detection of jamming attack sources over randomized mobile networks. The simulation result shows that Improved PSO algorithm in this study is faster at obtaining the location of the given mobile network at which coverage area is minimal and hence central compared to other algorithms. The Improved PSO as well was applied to a mobile network. The Improved PSO algorithm was evaluated with two experiments. In the First experiment, The Improved PSO was compared with PSO, GWO and MFO, obtained results shown the Improved PSO is the best algorithm among others to fine obtain the location for jamming attack. In Second experiment, Improved PSO was compared with PSO in mobile network environment. The obtain results prove that Improved PSO is better than PSO for obtaining the location in mobile network where coverage area is minimal and hence central.

Data exchange has been rapidly increased recently by increasing the use of mobile networks. Sharing information (text, image, audio and video) over unsecured mobile network channels is liable for attacking and stealing. Encryption techniques are the most suitable methods to protect information from hackers. Hill cipher algorithm is one of symmetric techniques, it has a simple structure and fast computations, but weak security because sender and receiver need to use and share the same private key within a non-secure channel. Therefore, a novel hybrid encryption approach between elliptic curve cryptosystem and hill cipher (ECCHC) is proposed in this paper to convert Hill Cipher from symmetric technique (private key) to asymmetric one (public key) and increase its security and efficiency and resist the hackers. Thus, no need to share the secret key between sender and receiver and both can generate it from the private and public keys. Therefore, the proposed approach presents a new contribution by its ability to encrypt every character in the 128 ASCII table by using its ASCII value direct without needing to assign a numerical value for each character. The main advantages of the proposed method are represented in the computation simplicity, security efficiency and faster computation.

This paper presents a performance study for Gentle BLUE (GB) under the bursty and correlated properties of aggregated network traffic. The Bernoulli Process (BP) fails to represent the properties of aggregated correlated and bursty traffic, so instead of that, MMBP has been used. MMBP is A 2D discrete-time Markov chain modeling for GB algorithm with two traffic classes, each with its own parameters. The proposed model is compared with the GB that uses the BP as a source model (GB-BP) and original BLUE that uses the BP (BLUE-BP) and MMBP (BLUE-MMBP-2) as source model. The evaluation is conducted in term of queuing waiting time, mean queue length, throughput, packet loss and dropping probability. When congestion (e.g., heavy congestion) occurs, the results show that GB-MMBP-2 provides the bestmean queue length, queuing time and packet loss among the compared methods.