In today’s interconnected world, protecting heterogeneous networks from emerging cybersecurity threats is increasingly critical, particularly during the integration of new networks, which often introduce unknown security postures and inconsistent measures. These uncertainties expand the attack surface and create vulnerabilities that attackers can exploit during the transition phase. To address these challenges, this research proposes a Collaborative Intrusion Detection System (CIDS) named Stacked Network Integration CIDS (SNI-CIDS), which Modified Ensemble Stacking Deep Neural Networks (MES-DNN) to enhance intrusion detection in heterogeneous networks. The model is built using diverse public Intrusion Detection System (IDS) datasets to represent heterogeneous environments, and the meta-model is fine-tuned with traffic samples from newly integrated networks for adaptability. Experimental results demonstrate that SNI-CIDS achieves robust detection performance with an average accuracy of 96.67 %, recall of 95.82 %, precision of 95.17 %, and F1-Score of 95.36 % when analyzing overall traffic. In the specific scenario of new network integration, SNI-CIDS maintains strong results with an accuracy of 89.23 %, recall of 86.55 %, precision of 71.52 %, and F1-Score of 71.09 %, showcasing its efficacy in securing both new and existing networks in heterogeneous environments.

Detecting coordinated attacks in cybersecurity is challenging due to their sophisticated and distributed nature, making traditional Intrusion Detection Systems often ineffective, especially in heterogeneous networks with diverse devices and systems. This research introduces a novel Collaborative Intrusion Detection System (CIDS) using a Weighted Ensemble Averaging Deep Neural Network (WEA-DNN) designed to detect such attacks. The WEA-DNN combines deep learning techniques and ensemble methods to enhance detection capabilities by integrating multiple Deep Neural Network (DNN) models, each trained on different data subsets with varying architectures. Differential Evolution optimizes the model’s contributions by calculating optimal weights, allowing the system to collaboratively analyze network traffic data from diverse sources. Extensive experiments on real-world datasets like CICIDS2017, CSE-CICIDS2018, CICToNIoT, and CICBotIoT show that the CIDS framework achieves an average accuracy of 93.8%, precision of 78.6%, recall of 60.4%, and an F1-score of 62.4%, surpassing traditional ensemble models and matching the performance of local DNN models. This demonstrates the practical benefits of WEA-DNN in improving detection capabilities in real-world heterogeneous network environments, offering superior adaptability and robustness in handling complex attack patterns.

The botnet attack is one of the coordinated attack types that can infect Internet of Things (IoT) devices and cause them to malfunction. Botnets can steal sensitive information from IoT devices and control them to launch another attack, such as a Distributed Denial-of-Service (DDoS) attack or email spam. This attack is commonly detected using a network-based Intrusion Detection System (NIDS) that monitors the network device’s activity. However, IoT network is dynamic and IoT devices have many types with different configurations and vendors in IoT environments. Therefore, this research proposes an Intrusion Detection System (IDS) by ensemble-ing traffic from heterogeneous IoT devices. This research proposes Deep Neural Network (DNN) to create a training model from each heterogeneous IoT device. After that, each training model from each heterogeneous IoT device is used to predict the traffic. The prediction results from each training model are averaged using the ensemble averaging method to determine the final result. This research used the N-BaIoT dataset to validate the proposed IDS model. Based on experimental results, ensemble averaging DNN can detect botnet attacks in heterogeneous IoT devices with an average accuracy of 97.21, precision of 91.41, recall of 87.31, and F1-score 88.48.

For many years, the mechanisms of transmitting audio streams have been gaining popularity. The SARS-COV-2 pandemic completely remodeled people's habits by completely preventing participation in concerts. The technical possibilities of the musicians' remote cooperation have not been fully used yet.The popularity of remote communication is unquestionable. However, so far this type of communication has been based on a one-to-many model. In the case of music events, or music production in general, a many-to-one or generally many-to-many model must be implemented. For this to be possible, it is necessary to solve the problem of synchornization of streams originating sequentially from many creators. In addition to the aspect of audio stream synchronization discussed in this article, one of the assumptions was also the ease of adapting the proposed solution as part of a web application.

This paper addresses the topic of database security, which is a critical component of many systems. The goal of the work is to investigate the effectiveness of methods for ensuring database security. The work introduces an innovative way of evaluating the effectiveness of the launched attacks. A literature review identifies current solutions in areas relevant to database security and identifies the state of the art and science. The final analysis introduced cost estimation and transformation of the results into a payoff matrix, which allowed the use of decision-making methods from the field of game theory. No party, defender or attacker, obtained a dominant strategy, but the application of the min-max criterion showed that the defenders' best strategy is to implement all means of protection, given the assumptions introduced. The presented evaluation method can be applied to decision making in cyber security and contribute to cost optimization in the organization.

With ever-increasing advancement of ICT (Information and Communications Technology) new challenges and requirements resulting from societal expectations emerge. Modern Cloud and Internet of Things feature functionalities that often involve not only data manipulation, but also mission critical tasks requiring ICT systems to strictly comply with defined nonfunctional requirements, especially in terms of web service execution time. These applications may range from solutions developed for e-Health, Industry 4.0, Smart Cities to applications related to fields like Smart Home or autonomous vehicles. Often, the QoS (Quality of Service) parameters are strongly correlated with user provided input and computational resources allocated to services that are handling the requests. To meet the needs of modern systems, new methods for QoS prediction are required, which can be later used by middleware responsible for resource allocation in service-based systems. This paper focuses on research related to QoS prediction methods. It discusses the general web service QoS parameters estimation problem and related challenges. Then a proposition of machine learning based approach for prediction of service QoS parameters based on the request data is presented, followed by experimentation aimed at evaluation of the proposed solution on real-word web services in a simulated environment.

In spite of ever-increasing volume of network traffic, unsupervised intrusion detection methods are one of most widely researched solutions in the field of network security. One of the key challenges related to development of such solutions is the proper assessment of methods utilized in the process of anomaly detection. Real life cases show that in many situations labeled network data is not available, which effectively excludes possibility to utilized standard criteria for evaluation of anomaly detection algorithms like Receiver Operating Characteristic or Precision-Recall curves. In this paper, an alternative criteria based on Excess-Mass and Mass-Volume curves are analyzed, which can enable anomaly detection algorithms quality assessments without need for labeled datasets. This paper focuses on the assessment of effectiveness of Excess-Mass and Mass-Volume curves-based criteria in relation to intrusion detection system’s data dimensionality. The article discusses these criteria and presents the intrusion detection algorithms and datasets that will be utilized in the analysis of data dimensionality influence on their effectiveness. This discussion is followed by experimental verification of these criteria on various real-life datasets differing in dimensionality and statistical analysis of the results indicating relation between effectiveness of analyzed criteria and dimensionality of data processed in intrusion detection systems.

This paper presents the results achieved so far on the anomaly detection module designed for Regional Center of Cybersecurity. The conducted research focused on determining the relationship between the values of the anomaly detection algorithms used and the results obtained with the goal of reducing the number of configurations needed to be tested during the module deployment phase. The research was conducted using traffic coming from a real computer network using an established attack generation scenario.

In recent years the development of complex Internet of Things (IoT) systems and their increased use has resulted in the growing importance of communication services, which task has been to provide uninterrupted and undisturbed communication between nodes with different interfaces. This paper presents the capabilities of communication between Internet of Things nodes including application of various communication protocols as well as software and architectural solutions ensuring adequate quality of connections. It also discusses the differences in various types of networks and quality assurance methods.

Unsupervised intrusion detection methods are an important component of modern, network based, ICT systems. One of key challenges in the development of such methods is the assessment of anomaly detection algorithms utilized for intrusion detection. In many real-life scenarios labeled network data is not available, hence typical criteria for evaluation of anomaly detection based on Receiver Operating Characteristic or Precision-Recall curves cannot be utilized. In this paper, an alternative approach utilizing Excess-Mass and Mass-Volume curves is presented, which can enable anomaly detection algorithms quality assessments without need for labeled datasets. The article discusses these criteria and presents the test intrusion detection algorithms that will be assessed with them. This discussion is followed by experimental evaluation of this approach, which is conducted with utilization of real-life network traffic datasets in order to provide a strong indication if this approach is viable in production environments.

Popularity of Internet of Things (IoT) systems are growing and becoming important role in everyday life. Development of hardware, network infrastructure and software solutions provide an opportunity to take on more responsibility and perform more complex tasks by these systems. Performing complex operations requires developing more advanced systems, which leads to natural requirement to use an architecture that allows easy extension and maintenance. Additionally, systems of this type must contain may different nodes, such as databases, communication services, user interfaces, etc., which requires easy system modularization. This document presents the possibilities of using service-oriented architecture to build Internet of Things system as a complex service, which ensures that the requirements for modern IoT systems are fulfilled.

The goal of the work is to present a preliminary result of research about trade-off between privacy and utility in network traces. The study is considered in context of anomaly detection module with using neural network. The paper presents work in progress and the preliminary results of the evaluation of a anonymization algorithms of anomaly detection module. The anonymization algorithm has been briefly described and the results of the implemented neural network detection method using anonymized flow has been discussed.

The paper presents the preliminary results of the research undertaken within RegSOC project. The goal of the project is initiate a prototype instance of the model Regional Center for Cybersecurity (RegSOC) and to facilitate to the public entities. The outcomes of this project will allow to raise levels of security protection and to present procedures, which can reduce the probability of unwanted events and methods of lowering their consequences. The project aims at developing a comprehensive cybersecurity monitoring platform which will be the software and organizational solution (management models and organizational procedures). The software part of the platform will constitute several modules specialized in various types of security level evaluation. The paper focuses on the module integrated with the RegSOC platform which will support security-related events detection by detecting anomalies. The architecture of the anomaly detection module has been introduced and the functional and non-functional requirements related to this module have been discussed. Also, the role and the way of integrating the module with the general RegSOC architecture has been demonstrate.

Intrusion detection systems define an important and dynamic research area for cybersecurity. The role of Intrusion Detection System within security architecture is to improve a security level by identification of all malicious and also suspicious events that could be observed in computer or network system. One of the more specific research areas related to intrusion detection is anomaly detection. Anomaly-based intrusion detection in networks refers to the problem of finding untypical events in the observed network traffic that do not conform to the expected normal patterns. It is assumed that everything that is untypical/anomalous could be dangerous and related to some security events. To detect anomalies many security systems implements a classification or clustering algorithms. However, recent research proved that machine learning models might misclassify adversarial events, e.g. observations which were created by applying intentionally non-random perturbations to the dataset. Such weakness could increase of false negative rate which implies undetected attacks. This fact can lead to one of the most dangerous vulnerabilities of intrusion detection systems. The goal of the research performed was verification of the anomaly detection systems ability to resist this type of attack. This paper presents the preliminary results of tests taken to investigate existence of attack vector, which can use adversarial examples to conceal a real attack from being detected by intrusion detection systems.