The rising frequency and sophistication of cyberattacks underscore the urgent need for adaptive Network Intrusion Detection Systems (NIDS). Traditional systems, though effective against known threats, struggle to adapt to evolving traffic patterns and novel attack vectors. A central challenge is catastrophic forgetting, whereby models overwrite prior knowledge when updated with new data, undermining their reliability in dynamic environments. Continual learning (CL) offers a promising paradigm for mitigating this challenge by enabling incremental adaptation without complete retraining. Yet, its systematic application and evaluation within NIDS remain limited. To address this gap, we introduce the Anomaly-Aware Class-Incremental Learning (ACIL), a framework designed to evaluate CL strategies under realistic network conditions. ACIL operationalizes anomaly-awareness by structuring task streams to reflect natural traffic imbalance: benign flows dominate early stages, while rare attack classes are introduced incrementally. This setup more faithfully represents the challenges of evolving intrusion detection by reflecting natural traffic imbalance, in contrast to uniform or artificially balanced learning. We assess ACIL on three widely recognized datasets CIC-IDS-2017, CIC-IDS-2018, and NSL-KDD using multiple state-of-the-art CL methods. Results show that CL strategies enhance adaptability and mitigate forgetting relative to static baselines, but notable trade-offs persist, especially for minority and late-emerging classes. These findings establish ACIL as a standardized evaluation framework for continual learning in cybersecurity and emphasize the need for anomaly-aware mechanisms to develop resilient NIDS in dynamic threat landscapes.

Modern network environments evolve rapidly, exposing intrusion detection systems (IDS) to continually emerging and previously unseen cyberattacks. Most existing IDS models cannot incorporate new attacks without full retraining, and they typically suffer from catastrophic forgetting, limited generalisation, and poor detection of zero-day or rare threats. We propose CLEAR (Continual Learning with Embedded Attack Replay), a lightweight framework that integrates continual learning, semantic representation, and hybrid detection. CLEAR learns new attack classes incrementally while preserving prior knowledge through an efficient replay strategy. A contrastively aligned language model produces semantic embeddings of network flows, enabling generalisation to unseen attacks, and a drift-aware module adjusts detection thresholds as traffic patterns evolve. The CLEAR unifies semantic-guided replay, supervised-unsupervised hybrid detection, and drift-sensitive adaptation within a single continual learning architecture. This design supports stable performance under limited data, shifting traffic distributions, and strict zero-day conditions. Experiments on four benchmark datasets (CIC-IDS-2017, CIC-IDS-2018, BoT-IoT 2018, and IoT-23) show that CLEAR achieves strong overall performance (F1 ≈ 0.89, average FPR ≈ 0.08), reduces catastrophic forgetting by up to 24%, and attains zero-day detection rates of 88%. CLEAR also performs well on rare attacks (F1 ≈ 0.83) and few-shot classes (F1 ≈ 0.85), demonstrating its suitability for adaptive and real-time intrusion detection in dynamic network environments.

Rapid urbanization and increasing vehicle ownership are intensifying traffic congestion, road safety risks, and environmental pressures in cities worldwide. Conventional rule-based traffic management systems are increasingly inadequate for handling the dynamic and nonlinear nature of modern transportation networks, motivating the adoption of artificial intelligence for congestion prediction, accident risk analysis, adaptive control, and sustainable mobility planning. This study presents a systematic survey, with a regional emphasis, of applications of artificial intelligence in transportation, focusing on traffic congestion, road safety, Intelligent Transportation Systems, and sustainable urban mobility. Following a systematic methodology aligned with PRISMA, 72 peer-reviewed studies published between 2020 and 2026 were analyzed, and a four-dimensional deployment-aware taxonomy is proposed across artificial intelligence paradigms, application domains, data sources, deployment contexts, and evaluation practices. The analysis shows that deep spatio-temporal models frequently report superior predictive accuracy on benchmark datasets, while ensemble and hybrid models offer improved robustness. Key challenges include region-specific infrastructure limitations, limited explainability, and weak integration with operational traffic management. Amman, Jordan, is examined as an emerging city case, highlighting deployment barriers in data-limited environments. The survey provides a comparative evidence base and a practical roadmap for minimizing artificial intelligence-enabled congestion, improving road safety, and sustainable urban mobility.

Federated learning (FL) has emerged as an effective paradigm for collaborative model training in Industrial Internet of Things (IIoT) environments by enabling distributed devices to learn shared models without exchanging raw data. However, existing FL defence mechanisms predominantly rely on either behavioural analysis of client updates or semantic validation of model performance, limiting their ability to detect sophisticated poisoning and stealthy backdoor attacks that evade single-dimensional trust assessment. This paper proposes DBST-FL, a dynamic behavioural and semantic trust framework for robust federated learning in the Industrial IoT. The proposed framework evaluates each client through two complementary trust dimensions: a behavioural trust layer that measures gradient alignment, historical consistency, and collective deviation and a semantic trust layer that assesses benign utility and template-free semantic stress validation using server-side data. The two trust scores are integrated through a non-compensatory multiplicative trust fusion mechanism, ensuring that weaknesses in one trust dimension cannot be masked by strengths in the other. The resulting trust score guides a trust-aware aggregation strategy that reduces the influence of malicious participants while preserving the contributions of reliable clients. Extensive experiments are conducted on the Edge-IIoTset and UNSW-NB15 datasets using ANN, 1D-CNN, and LSTM models under multiple poisoning and backdoor attack scenarios. The proposed framework achieves overall classification performance competitive with the strongest robust aggregation baselines while consistently delivering stronger resilience against adversarial attacks and lower backdoor attack success rates than representative trust-based and Byzantine-robust aggregation methods, all while maintaining linear per-round computational complexity suitable for large-scale IIoT deployments. The results demonstrate that integrating behavioural and semantic trust within a unified aggregation framework provides an effective and scalable defence against advanced adversarial threats in federated learning.

In today’s dynamic financial environment, bank loan approval systems are crucial for determining credit accessibility and maintaining economic stability. Efficient and accurate mechanisms help financial institutions minimize risks, enhance customer satisfaction, and make informed lending decisions. Traditional evaluation methods, however, often struggle with complex applicant data, underscoring the need for advanced, data-driven approaches. This study proposes an enhanced loan approval prediction framework that integrates SHAP-guided feature selection and LIME-based interpretability within a robust multiclassifier architecture. The methodology includes extensive data preprocessing, handling missing values, and encoding categorical variables, followed by SHAP to identify the most influential features. Using two Kaggle datasets, logistic regression achieved the highest performance, with 86.17% accuracy and 81% AUC on Dataset 1 and 99.06% accuracy on Dataset 2. LIME provided intuitive, visual explanations of model predictions, fostering transparency and trust. In addition, a user-friendly, real-time web application was developed for practical deployment. Overall, the study advances intelligent, interpretable, and efficient loan approval systems for modern banking.

The rapid growth of the Internet of Things (IoT) has significantly increased the complexity of device interactions, making IoT networks more vulnerable to sophisticated cyber threats. Effective intrusion detection is therefore crucial to ensuring the security and resilience of these systems. This paper presents federated learning with feature reduction (Fed-FeRe), a novel approach that enhances decentralized intrusion detection by integrating χ ^2 -based feature selection with a gated recurrent unit model. Fed-FeRe introduces an adaptive initialization of the performance threshold α and a data-driven estimation of key hyperparameters ( θ _0 , η ), enabling robust performance across diverse IoT conditions. By dynamically optimizing feature selection, the framework reduces computational overhead and communication costs, achieving approximately 2

Distributed Denial of Service (DDoS) attack occurs when an attacker attempts to disrupt the normal operation of a network, service, or website by overwhelming it with a high volume of internet traffic. The goal of detecting DDoS attacks is to identify and respond to them promptly, thereby minimizing their impact on the targeted system. Effective detection is essential for individuals, organizations, and network administrators to safeguard infrastructure, ensure service availability, and protect online systems and services. DDoS detection is widely applicable in areas such as network security, web service protection, cloud computing, and online infrastructure resilience. To address this need, we propose a framework consisting of six main steps. First, data collection involves gathering network traffic information, system activity logs, and known instances of DDoS attacks. Second, relevant features are identified from the dataset, including traffic patterns, packet sizes, IP addresses, and protocol types. In the third step, feature selection is performed using metaheuristic algorithms such as the Salp Swarm Algorithm (SSA), Gray Wolf Optimization (GWO), and Particle Swarm Optimization (PSO) to isolate the most informative features for distinguishing between normal and malicious traffic. Fourth, the dataset is divided into training and testing subsets for model development and evaluation. Fifth, classification models are built using machine learning algorithms such as Support Vector Machine (SVM) and K-Nearest Neighbors (KNN) to classify traffic patterns effectively. Finally, the performance of the models is evaluated using metrics including accuracy, precision, recall, and F1-score. The results of the proposed framework demonstrate outstanding performance, with classification accuracy reaching up to 99.9%. In summary, detecting DDoS attacks is vital for protecting networked systems and ensuring the continuity of online services, and the use of feature selection and machine learning techniques significantly enhances detection accuracy and efficiency.

Network intrusion detection aims to identify anomalous activities in network traffic, while continual learning (CL) methods strive to preserve past knowledge and adapt to evolving threats. Memory replay-based CL approaches have been widely used and proven effective at mitigating catastrophic forgetting. However, previous research has primarily focused on addressing class imbalance and has largely relied on augmented and random memory replay strategies, which introduce significant computational overhead and limit practicality in real-time applications. To overcome these challenges, we propose Task-Aware Memory Replay (TAMR), a novel framework that prioritizes past experiences based on their relevance to the current task. By dynamically adjusting the importance of replayed samples, TAMR balances the integration of new attack patterns with the retention of critical historical knowledge, ensuring resilience against evolving threats and variations in normal traffic. Unlike traditional methods that employ random selection or augmented replays, TAMR selectively replays high-impact experiences, thereby optimizing memory usage and improving adaptability. Our experiments demonstrate that TAMR achieves real-time adaptability across five distinct NIDS datasets, ultimately delivering superior performance and computational efficiency in detecting even unknown attacks in dynamic network environments. In general, we highlight the potential of memory-based replay strategies for continual learning in detecting unknown attacks using a task-aware approach.

Skin cancer is a potentially life-threatening disease resulting from DNA damage, where early detection is critical to improving survival rates. This study introduces an advanced hybrid deep learning framework designed to enhance the accuracy of skin cancer classification, distinguishing between benign and malignant lesions. Our approach begins with data pre-processing to improve input quality, followed by training two high-performing pre-trained deep learning models, InceptionV3 and DenseNet121. We then apply a weighted sum rule for fusion of the model predictions, leading to high accuracy and generalizability across datasets. On the primary dataset, our hybrid model achieved 92.27

Cardiovascular disease (CVD) is the leading global cause of death, highlighting the urgent need for early, accurate, and interpretable diagnostic tools. However, many AI-based heart disease prediction models lack transparency, hindering their acceptance in clinical settings. This study proposes XAI-HD, a hybrid framework integrating machine learning (ML), deep learning (DL), and explainable AI (XAI) techniques for heart disease detection. The framework systematically addresses key challenges, including class imbalance, missing data, and feature inconsistency, through advanced preprocessing and class-balancing methods such as OSS, NCR, SMOTEN, ADASYN, SMOTETomek, and SMOTEENN. Comparative performance evaluations across multiple datasets (CHD, FHD, SHD) demonstrate that XAI-HD reduces classification error rates by 20–25

Objective To address the limitations of traditional approaches in diagnosing eye diseases, we propose five state-of-the-art, transfer-learning-based deep convolutional neural network (DCNN) models and an ensemble model. These models are trained on thousands of retinal images to achieve robust classification of diseases such as glaucoma, cataracts, and diabetic retinopathy. Methods Our dataset consists of 3744 raw retinal images. We implemented and fine-tuned five individual DCNN models: VGG16, ResNet152, DenseNet169, EfficientNetB3, and NASNetMobile. We also developed an ensemble model that combines ResNet152, DenseNet169, and EfficientNetB3. Additionally, a single-shot multibox detector (SSD) was used for the detection of central and branch retinal vein occlusions (CRVO and BRVO). Results Among the individual models, DenseNet169 demonstrated superior performance, with 96% accuracy and 22% loss. The NASNetMobile model achieves the lowest accuracy at 87%. The proposed ensemble model outperforms all the individual networks, reaching a peak accuracy of 97%. These results highlight the effectiveness of transfer learning in improving classification accuracy. Conclusion The proposed AI-driven approaches provide a reliable solution for the early and precise detection of common eye diseases. By leveraging advanced deep learning techniques, our work contributes to the medical field by assisting healthcare professionals in diagnosis and paving the way for improved diagnostic tools and enhanced patient care.

Ensuring the security and integrity of Federated Learning (FL) models against adversarial attacks is critical. Among these threats, targeted data poisoning attacks, particularly label flipping, pose a significant challenge by undermining model accuracy and reliability. This paper investigates targeted data poisoning attacks in FL systems, where a small fraction of malicious participants corrupt the global model through mislabeled data updates. Our findings demonstrate that even a minor presence of malicious participants can substantially decrease classification accuracy and recall, especially when attacks focus on specific classes. We also examine the longevity and timing of these attacks during early and late training rounds, highlighting the impact of malicious participant availability on attack effectiveness. To mitigate these threats, we propose a defense strategy that identifies malicious participants by analyzing parameter updates across vulnerable training rounds. Utilizing Principal Component Analysis (PCA) for dimensionality reduction and anomaly detection, our approach effectively isolates malicious updates. Extensive simulations on standard datasets validate the effectiveness of our algorithm in accurately identifying and excluding malicious participants, thereby enhancing the integrity of the FL model. These results offer a robust defense against sophisticated poisoning strategies, significantly improving FL security.

Intrusion Detection Systems (IDS) are essential for securing computer networks by identifying and mitigating potential threats. However, traditional IDS systems face challenges related to scalability, privacy, and computational demands as network data complexity increases. Federated Learning (FL) has emerged as a promising solution, enabling collaborative model training on decentralized data sources while preserving data privacy. Each participant retains local data repositories, ensuring data sovereignty and precluding data sharing. Leveraging the FL framework, participants locally train machine learning models on their respective datasets, subsequently transmitting model updates to a central server for aggregation. The central server then disseminates the aggregated model updates to individual participants, collectively striving to bolster intrusion detection capabilities. This paper presents a comprehensive survey of FL applications in IDS, covering core concepts, architectural approaches, and aggregation strategies. We evaluate the strengths and limitations of various FL methodologies for IDS, addressing privacy and security concerns and exploring privacy-preserving techniques and security protocols. Our examination of aggregation strategies within the FL framework for IDS aims to highlight their effectiveness, limitations, and potential enhancements.

Wireless Sensor Networks (WSNs) play a pivotal role in modern applications, ranging from smart cities to environmental monitoring. However, their inherent vulnerability to security threats, such as denial-of-service attacks and unauthorized access, necessitates the implementation of robust intrusion detection systems (IDS). Traditional IDS frameworks are predominantly centralized, raising significant concerns about data privacy, leakage, and scalability. In this paper, we propose a novel federated learning-based Random Forest architecture (RF-FedAvg) for intrusion detection in WSNs that addresses these limitations. Our method enables decentralized model training across multiple clients without sharing raw data, thereby enhancing privacy and mitigating data leakage. Random Forest models are trained locally on each client and aggregated using a weighted FedAvg strategy at the central server. To reflect real-world deployment scenarios, we evaluate the model under varying client configurations (2 to 5 nodes) and incorporate data balancing techniques such as Random Under Sampling (RUS) and SMOTE to address class imbalance issues common in WSN datasets. Extensive experiments on WSN-DS and UNSW-NB15 datasets demonstrate that the RF-FedAvg model maintains high performance even with fewer clients and imbalanced data. The highest accuracy achieved was 99.67% on WSN-DS with SMOTE and 98.45% on UNSW-NB15, showcasing strong robustness and scalability. These results confirm the effectiveness of our federated learning-based IDS in providing a scalable, privacy-preserving, and reliable solution for intrusion detection in resource-constrained WSNs environments.

The rapid expansion of IoT devices has introduced significant cybersecurity risks, as attackers increasingly exploit these networks’ vulnerabilities. To counter this threat, this paper presents the Privacy-Enhanced IoT Defence System (PEIoT-DS), a novel solution that emphasises data privacy while delivering high-performance intrusion detection. PEIoT-DS use federated learning to create a comprehensive intrusion detection model without necessitating the transmission of raw data to a central server. IoT devices only contribute model updates, which are then combined to improve the global model. While allowing devices to benefit from the network’s collective insights, this decentralised learning methodology safeguards data privacy. Using a real-world IoT dataset and two popular federated learning algorithms—Federated Average and Federated Average with Momentum—the study assesses the effectiveness of PEIoT-DS. The findings show that, in comparison to Federated Average, Federated Average with Momentum produces faster convergence and better intrusion detection accuracy. Our PEIoT-DS approach offers a reliable intrusion detection system for IoT networks while maintaining privacy.

The Industrial Internet of Things (IIoT) is transforming industrial operations through connected devices and real-time automation but also introduces significant cybersecurity risks. Cyber threat intelligence (CTI) is critical for detecting and mitigating such threats, yet traditional centralized CTI approaches face limitations in latency, scalability, and data privacy. Federated learning (FL) offers a privacy-preserving alternative by enabling decentralized model training without sharing raw data. This survey explores how FL can enhance CTI in IIoT environments. It reviews FL architectures, orchestration strategies, and aggregation methods, and maps their applications to domains such as intrusion detection, malware analysis, botnet mitigation, anomaly detection, and trust management. Among its contributions is an empirical synthesis comparing FL aggregation strategies—including FedAvg, FedProx, Krum, ClippedAvg, and Multi-Krum—across accuracy, robustness, and efficiency under IIoT constraints. The paper also presents a taxonomy of FL-based CTI approaches and outlines future research directions to support the development of secure, scalable, and decentralized threat intelligence systems for industrial ecosystems.

Recently, the exponential growth of Internet of Things (IoT) network-connected devices has resulted in the exchange of large amounts of data via a smart grid. This extensive connection between IoT devices results in numerous security breaches and violations. Due to the increasing prevalence of IoT-related cybercrimes, forensic investigators and researchers face numerous obstacles when attempting to recover evidence from a variety of different types of IoT smart devices. The primary challenge in performing forensic analysis on the IoT is the heterogeneity of IoT devices. Additionally, the bulk of IoT devices has flash memory or limited memory, which makes generating and converting evidence for presenting forensic data in court problematic. This review paper presents several forensic methodologies, techniques, and challenges in IoT device forensics, a comprehensive review of prominent recent works, with an overview of tools that are frequently used for performing digital forensics investigations. Additionally, a comparative analysis of three popular digital forensic tools is also conducted.

The widespread dissemination of misinformation and the diverse public sentiment observed during the COVID-19 pandemic highlight the necessity for accurate sentiment analysis of social media discourse. This study proposes a hybrid deep learning (DL) model that integrates Bidirectional Encoder Representations from Transformers (BERT) for contextual feature extraction with Long Short-Term Memory (LSTM) networks for sequential learning to classify COVID-19-related sentiments. To enhance data quality, advanced text preprocessing techniques, including Unicode normalization, contraction expansion, and emoji conversion, are applied. Additionally, to mitigate class imbalance, Random OverSampling (ROS) is employed, leading to significant improvements in model performance. Before applying ROS, the model exhibited lower accuracy and inconsistent performance across sentiment categories. After balancing the dataset, accuracy for binary classification increased to 92.10%, with corresponding precision, sensitivity, and specificity of 92.10%, 92.10%, and 91.50%, respectively. For three-class sentiment classification, accuracy improved to 89.47%, with precision, sensitivity, and specificity of 89.80%, 89.47%, and 94.10%, respectively. In five-class sentiment classification, accuracy reached 81.78%, with precision, sensitivity, and specificity of 82.19%, 81.78%, and 95.28%, respectively. These findings demonstrate the efficacy of combining deep learning-based sentiment analysis with advanced text preprocessing and class balancing techniques for accurately classifying public sentiment related to COVID-19 across multiple sentiment categories.

Car accidents remain a leading cause of unintentional fatalities, with many incidents stemming from driver behaviors that impact vehicle control, such as steering, braking, accelerating, and gear shifting. Activities like searching for items, using mobile devices, or listening to the radio can distract drivers visually, audibly, and physically, posing significant risks to road safety. While various methods have been developed to detect such distractions, their effectiveness often falls short in real-world applications. This paper introduces a novel approach that combines machine learning (ML) and deep learning (DL) techniques to identify both safe and risky driving behaviors. Six ML classifiers were evaluated on real-world data to distinguish between driving behaviors such as aggressive, fatigued, and normal driving, with the Random Forest classifier demonstrating superior performance. Additionally, a specialized deep-learning baseline model was developed using ResNet50 and EfficientNetB6 to classify driving-related images into distinct categories. The hybrid model integrates ML for analyzing tabular data and DL for image recognition, achieving a classification accuracy of 99.3

The rapid growth of internet users and social networking sites presents significant challenges for entrepreneurs and marketers. Understanding the evolving behavioral and psychological patterns across consumer demographics is crucial for adapting business models effectively. Particularly, the emergence of new firms targeting adolescents and future generations underscores the importance of comprehending online consumer behavior and communication dynamics. To tackle these challenges, we introduce a Machine Learning-based Digital Native Market Segmentation designed to cater specifically to the interests of digital natives. Leveraging an open-access prototype dataset from social networking sites (SNS), our study employs a variety of clustering techniques, including Kmeans, MiniBatch Kmeans, AGNES, and Fuzzy C-means, to uncover hidden interests of teenage consumers from SNS data. Through rigorous evaluation of these clustering approaches by default parameters, we identify the optimal number of clusters and group consumers with similar tastes effectively. Our findings provide actionable insights into business impact and critical patterns driving future marketing growth. In our experiment, we systematically evaluate various clustering techniques, and notably, the Kmeans cluster outperforms others, demonstrating strong segmentation ability in the digital market. Specifically, it achieves silhouette scores of 63.90% and 58.06% for 2 and 3 clusters, respectively, highlighting its effectiveness in segmenting the digital market.