As Open Radio Access Network (O-RAN) deployments expand and adversaries adopt “store-now, decrypt-later” strategies, operators need empirical data on the cost of migrating critical control interfaces to post-quantum cryptography (PQC). This paper experimentally evaluates the impact of integrating a NIST-aligned Module-Lattice Key-Encapsulation Mechanism (ML-KEM) into IKEv2/IPsec, protecting the E2 interface between the 5G Node B (gNB) and the Near-Real-Time RAN Intelligent Controller (Near-RT RIC). Using an open-source testbed built from srsRAN, Open5GS, FlexRIC and strongSwan (with liboqs), we compare three configurations: no IPsec, classical Elliptic Curve Diffie–Hellman (ECDH)-based IPsec, and ML-KEM-based IPsec. This study focuses on IPsec tunnel-setup latency and the runtime behaviour of Near-RT RIC xApps under realistic signalling workloads. Results from repeated, automated runs show that ML-KEM integration adds a small overhead to tunnel establishment, which is approximately 2.7~4.7 ms in comparison to classical IPsec, while xApp operation and RIC control loops remain stable in our experiments. These findings, produced from an open, reproducible testbed, indicate that ML-KEM-based IPsec on the E2 interface is practically feasible and inform quantum-safe migration strategies for O-RAN deployments.

Intrusion Detection Systems (IDSs) are integral to safeguarding networks by detecting and responding to threats from malicious traffic or compromised devices. However, standalone IDS deployments often fall short when addressing the increasing complexity and scale of modern cyberattacks. This paper proposes a Collaborative Intrusion Detection System (CIDS) that leverages Snort, an open-source network intrusion detection system, to enhance detection accuracy and reduce false positives. The proposed architecture connects multiple Snort IDS nodes to a centralised node and integrates with a Security Information and Event Management (SIEM) platform to facilitate real-time data sharing, correlation, and analysis. The CIDS design includes a scalable configuration of Snort sensors, a centralised database for log storage, and LogScale SIEM for advanced analytics and visualisation. By aggregating and analysing intrusion data from multiple nodes, the system enables improved detection of distributed and sophisticated attack patterns that standalone IDSs may miss. Performance evaluation against simulated attacks, including Nmap port scans and ICMP flood attacks, demonstrates our CIDS's ability to efficiently process large-scale network traffic, detect threats with higher accuracy, and reduce alert fatigue. This paper highlights the potential of CIDS in modern network environments and explores future enhancements, such as integrating machine learning for advanced threat detection and creating public datasets to support collaborative research. The proposed CIDS framework provides a promising foundation for building more resilient and adaptive network security systems.

In the field of cybersecurity, effective malware detection remains a pivotal challenge, especially when malware is generated by AI. This paper introduces the LeqLiv-25 dataset, a comprehensive collection of labeled malware and benign representations, including raw samples and their representation such as grey images, n-grams (2-gram and 3-gram), behaviour reports and assembly code. This paper examines the fundamental principles of malware detection, with a focus on the Portable Executable (PE) file format, static analysis, dynamic analysis and the application of supervised machine learning models. Additionally, the diverse presentations of malware - grey images, n-grams, behavior reports, and assembly code - offer unique perspectives for representing and understanding malicious behavior. LeqLiv-25 stands as a valuable resource, fostering advancements in malware detection methodologies and contributing to the ongoing efforts to improve cyber defence against evolving cyber threats.

Deep learning models like Convolutional Neural Networks (CNNs) are widely used in Intrusion Detection Systems (IDSs), but their high energy demands and complexity limit deployment in resource-constrained environments. This paper presents a feasibility study of a lightweight yet deep Spiking Neural Network (SNN) based on Leaky Integrate-and-Fire (LIF) dynamics for sustainable IDS applications. Evaluated on the NSL-KDD dataset, the proposed SNN achieved comparable overall accuracy to a CNN, trained similar to 3x faster (similar to 2.14 s/epoch), and consumed up to 5x less energy. Despite a slightly lower macro Fl score (0.58 vs. 0.62), it outperformed the CNN on rare attacks (e.g., U2R Fl: 0.82 vs. 0.42) and exhibited lower test loss, indicating better calibration. Local deployment estimates showed similar to 65% lower CO2 emissions than cloud execution, challenging assumptions that offloading is inherently greener. Its low energy footprint, compact architecture, and fast inference latency (similar to 0.014 ms/sample) make it well-suited for real-time traffic first line analysis in edge or IoT environments. These findings highlight SNNs as viable, sustainable alternatives for IDS and underscore the importance of evaluating carbon emissions, not just energy use, when designing AI systems for cyber security.

Many Internet of Things devices have weak security by default, which is often exploited by malware to recruit such devices into Thingbots (a botnet comprised of Internet of Things devices). The concerning capabilities of Thingbots have been demonstrated by Mirai, which powered the largest Distributed Denial of Service (DDoS) attack ever recorded. Thingbots rely upon the number of devices, rather than their computational capacity. Hence, as more devices become Internet-enabled, the severity of this problem will only increase. However, the coordination of such a large and distributed system poses a challenge. One commonly utilised mechanism is Domain Generation Algorithms (DGAs), which can help attackers communicate with compromised devices whilst evading detection. Current detection systems are unsuitable for analysing high volumes of network traffic as they struggle to balance accuracy with the expected levels of privacy-preservation and performance. Many effective yet complex techniques such as reverse engineering, are considered too costly in terms of time, resources and privacy. Other existing techniques tend to focus on post-event analysis such as aggregation of non-existent domains or analysis of basic characteristics but these often yield unacceptable delays or high false detection rates. As a solution to this problem, we present our novel technique for detecting DGA-managed Thingbots. We propose a solution that hybridises deep learning, shallow learning and morphological observations, to monitor Domain Name System (DNS) traffic. Using real-world data, we demonstrate that the proposed approach can accurately identify DNS traffic symptomatic of DGA-based Thingbots, with low false detection rates.

Detecting attacks on websites is crucial for maintaining their security and availability, particularly against common OWASP threats. Conventional detection systems typically depend on rule-based approaches and signature matching, restricting their ability to detect new or emerging threats. Recently, various models have been developed using machine learning (ML) models to detect these attacks. However, these models still face significant challenges, including low accuracy, high false positive rates, and an inability to generalize to new attack types. In this paper, we propose a novel model that combines the Deep Auto-Encoder (DAE) architecture with the concept of Magnet Loss in the latent space. The DAE transforms input data into a lower-dimensional representation, capturing complex and nonlinear relationships between features. By incorporating Magnet Loss, the model maximizes the margin between normal and attack regions in latent space. This separation allows for more precise identification of attacks, even previously unseen or involving subtle variations of known techniques. Experiments conducted on the datasets, such as CIC-IDS-2017 and CSE-CIC-IDS-2018, show that the proposed model achieves higher Accuracy, Precision, Recall, and F1-Score than previous approaches while notably decreasing computation time during the testing phase.

With their growing use of digital technologies, the critical infrastructures are facing an increasingly sophisticated cyber-threat vector from a broadening landscape, evident in the many high-profile examples now appearing more prominently in the mainstream media (e.g., Stuxnet, WannaCry, Whispergate, etc.). This trend has the potential to affect society's health, safety, security and economic wellbeing. Furthermore, the connections between critical infrastructures are interdependent relations, meaning attacks have the potential to propagate and cause a cascading effect between differing infrastructure types and across national borders. This growing digital threat is discussed by means of a focus on different attack types using case study examples. Research demonstrates that legacy systems and weakening segmentation remain vulnerabilities for the adoption of holistic artificial intelligence-driven security solutions. Therefore, this chapter also focuses on the barriers facing the development of higher-quality (e.g., AI-driven) security solutions for critical infrastructures.

Download This Paper Open PDF in Browser Add Paper to My Library Share: Permalink Using these links will ensure access to this page indefinitely Copy URL Copy DOI

In the field of anomaly detection, well-known techniques and state-of-the-art models often face challenges when interpreting the latent space, which hinders their behavioral classification accuracy. Firstly, the sub-optimal distribution of data points within the latent space makes normal behavioral regions verbose and indistinguishable from abnormal regions. Secondly, within the latent space, it can be difficult to identify meaningful, separable, and indicative features. Finally, the processing time at the inference stage is still relatively slow.This paper aims to improve the accuracy of network anomaly detection mechanisms by proposing two novel deep hierarchical representation learning models: Deep Nested Clustering Auto-Encoder (DNCAE) and Deep Clustering Hierarchical Auto-Encoder (DCHAE). Both models adopt a nested branch structure, utilizing dual deep auto-encoders to establish hierarchical latent spaces; in each, clustering algorithms are used to spatially optimize and refine the data points. This approach results in improved separation between normal and abnormal data points, and easier identification of notable and/or indicative features.To ascertain the effectiveness of the approach and the quality of resulting features, both models were used in conjunction with ten different one-class anomaly detectors. Each of these ten anomaly detectors was evaluated on popular network intrusion datasets, notably: NSL-KDD, UNSW-NB15, CIC-IDS-2017, CSE-CIC-IDS-2018, and CTU13. Experimental results have confirmed that both of the proposed models produced higher levels of accuracy than existing baselines and current state-of-the-art models. Additionally, the processing time at the inference stage shows a significant reduction.

Detecting zero-day malware in Windows PE files using dynamic analysis techniques has proven to be far more effective than traditional signature-based methods. One specific approach that has emerged in recent years is the use of graphs to represent executable behavior, which can be subsequently used to learn patterns. However, many current graph representations omit key parameter information, meaning that the behavioral impact of variable changes cannot be reliably understood. To combat these shortcomings, we present a new method for malware detection by applying a graph attention network on multi-edge directional heterogeneous graphs constructed from API calls. The experiments show the TPR and FPR scores demonstrated by our model, achieve better performance than those from other related works.

Anomaly-based intrusion detection system (AIDS) plays an increasingly important role in detecting complex, multi-stage network attacks, especially zero-day attacks. Although there have been improvements both in practical applications and the research environment, there are still many unresolved accuracy-related concerns. The two fundamental limitations that contribute to these concerns are: i) the succinct, concise, latent representation learning of the normal network data, and ii) the optimization volume of normal regions in latent space. Recent studies have suggested many ways to learn the latent representation of normal network data in a semi-supervised manner to construct AIDS. However, these approaches are still affected by the above limitations, mainly due to the inability to process high data dimensionality or ineffectively explore the underlying architecture of the data. In this paper, we propose a novel Deep Nested Clustering Auto-Encoder (DNCAE) model to thoroughly overcome the aforementioned difficulties and improve the performance of network attack detection. The proposed model consists of two nested Deep Auto-Encoders (DAE) to learn the informative and tighter data representation space. In addition, the DNCAE model integrates the clustering technique into the latent layer of the outer DAE to learn the optimal arrangement of data points in the latent space. This harmonious combination allows us to effectively deal with the limitations outlined. The performance of the proposed model is evaluated using standard datasets including NSL-KDD, UNSW-NB15, and six scenarios of CIC-IDS2017 (Tuesday, Wednesday, Thursday-Morning, Friday-Morning, Friday-Afternoon-PortScan, Friday-Afternoon DDoS). The experimental results strongly confirm that the proposed model clearly outperforms the baselines and the existing methods for network anomaly detection.

The role of semi-supervised network intrusion detection systems is becoming increasingly important in the ever-changing digital landscape. Despite the boom in commercial and research interest, there are still many concerns over accuracy yet to be addressed. Two of the major limitations contributing to this concern are reliably learning the underlying probability distribution of normal network data and the identification of the boundary between the normal and anomalous data regions in the latent space. Recent research has proposed many different ways to learn the latent representation of normal data in a semi-supervised manner, such as using Clustering-based Autoencoder (CAE) and hybridized approaches of Principal Component Analysis (PCA) and CAE. However, such approaches are still affected by these limitations, predominantly due to an overreliance on feature engineering, or the inability to handle the large data dimensionality. In this paper, we propose a novel Cluster Variational Autoencoder (CVAE) deep learning model to overcome the aforementioned limitations and increase the efficiency of network intrusion detection. This enables a more concise and dominant representation of the latent space to be learnt. The probability distribution learning capabilities of the VAE are fully exploited to learn the underlying probability distribution of the normal network data. This combination enables us to address the limitations discussed. The performance of the proposed model is evaluated using eight benchmark network intrusion datasets: NSL-KDD, UNSW-NB15, CICIDS2017 and five scenarios from CTU13 (CTU13-08, CTU-13-09, CTU13-10, CTU13-12 and CTU13-13). The experimental results achieved clearly demonstrate that the proposed method outperforms semi-supervised approaches from existing works.

This article focuses on insider-threat detection within healthcare infrastructures. There are inherent dangers to digitising patient records and considering the sensitive nature of the data, EHR is equally at risk of both external threats and insider attacks, but security applications are predominantly facing the outer boundary of the network. In this work, the focus is on insider data misuse detection. The approach involves the use of supervised classification (decision tree, random forest and support vector machine) based off pre-labelled real world data collated from a UK-based hospital for the detection of EHR data misuse. The results demonstrate that by employing a machine learning approach to analyse EHR data access, anomaly detection can be achieved with a 0.9896 accuracy from a test set and 0.9908 from the validation set using a support vector machine classifier. The emphasis of this research is on the detection of EHR data misuse, through the detection of anomalous behavioural patterns. Based on the results, the recommendation is to adopt an SVM for data misuse/insider threat detection

Patch testing is a core component of patch management and is used to verify that modified software modules (i.e. an update or patch) work as expected (functional testing) and do not contain any known vulnerabilities (security testing). Security patch testing requires a lot of time and a professional security knowledge from the tester. In recent years, chopped symbolic execution has been successfully applied in automatic or semiautomatic program testing, to reduce the amount of testing work. Chopped symbolic execution (Chopper) allows users to specify “uninteresting” functions to ignore during analysis, therefore allowing the testing of software modules without running all functions of the program. It is an effective solution for path explosion (one of the main problems of symbolic execution). The effectiveness of the chopped symbolic execution method in patch testing depends on how well the ignored functions are initially chosen. In this paper, we propose a novel method to automatically exclude functions for chopped symbolic execution in patch testing, using a control flow graph. Moreover, we use cyclomatic complexity to optimize the speed of the testing process. Experimental results show that our method can automatically choose the ignored functions and reduce the required testing time, in comparison to typical Chopper techniques.

Detecting malware using dynamic analysis techniques is an efficient method. Those familiar techniques such as signature-based detection perform poorly when attempting to identify zero-day malware, and it is also a challenging and time-consuming task to manually engineer malicious behaviors. Several studies have tried to detect unknown behaviors automatically. One of effective approaches introduced in recent years is to use graphs to represent the behavior of an executable, and learn from these graphs. However, current graph representations have ignored much important information such as parameters, variables changes… In this paper, we present a new method for malware detection by applying a graph attention network on multi-edge directional heterogeneous graphs constructed from Windows API calls collected after a file being executed in cuckoo sandbox… The experiments show that our model achieves better performance than other baseline models at both TPR and FAR scores.

Energy poverty has a negative impact on the health and well-being of individuals within a household; affecting not only comfort levels but also results in increased levels of seasonal mortality. Energy poverty issues are receiving increasing attention and particular interest has focused on identifying how the needs of people in vulnerable situations can be improved by suppliers and public institutions. As such, in this paper, the focus of the research is towards a prediction of whether an individual household is in a poverty situation through the analysis of their gas smart meter data. To achieve this prediction, decision trees and cloud analytics are employed to detect and individual's socio-economic standing and whether they receive government assistance in paying for their bills. The results demonstrated a 74.2% AUC classification using a Two-Class Decision Forest to detect social class and an 88.1% AUC classification using a two-class decision forest to detect whether the household is in receipt of government funding.

Hospital critical infrastructures have a distinct threat vector, due to i) a dependence on legacy software; ii) the vast levels of interconnected medical devices; iii) the use of multiple bespoke software and that iv) electronic devices (e.g., laptops and PCs) are often shared by multiple users. In the UK, hospitals are currently upgrading towards the use of electronic patient record (EPR) systems. EPR systems and their data are replacing traditional paper records, providing access to patients’ test results and details of their overall care more efficiently. Paper records are no-longer stored at patients’ bedsides, but instead are accessible via electronic devices for the direct insertion of data. With over 83% of hospitals in the UK moving towards EPRs, access to this healthcare data needs to be monitored proactively for malicious activity. It is paramount that hospitals maintain patient trust and ensure that the information security principles of integrity, availability and confidentiality are upheld when deploying EPR systems. In this paper, an investigation methodology is presented towards the identification of anomalous behaviours within EPR datasets. Many security solutions focus on a perimeter-based approach; however, this approach alone is not enough to guarantee security, as can be seen from the many examples of breaches. Our proposed system can be complementary to existing security perimeter solutions. The system outlined in this research employs an internal-focused methodology for anomaly detection by using the Local Outlier Factor (LOF) and Density-Based Spatial Clustering of Applications with Noise (DBSCAN) algorithms for benchmarking behaviour, for assisting healthcare data analysts. Out of 90,385 unique IDs, DBSCAN finds 102 anomalies, whereas 358 are detected using LOF.

The Internet of Things (IoT) is the novel paradigm of connectivity and the driving force behind state-of-the-art applications and services. However, the exponential growth of the number of IoT devices and services, their distributed nature, and scarcity of resources has increased the number of security and privacy concerns ranging from the risks of unauthorized data alterations to the potential discrimination enabled by data analytics over sensitive information. Thus, a blockchain based IoT-platform is introduced to address these issues. Built upon the tamper-proof architecture, the proposed access management mechanisms ensure the authenticity and integrity of data. Moreover, a novel approach called Block Analytics Tool (BAT), integrated with the platform is proposed to analyze and make predictions on data stored on the blockchain. BAT enables the data-analysis applications to be developed using the data stored in the platform in an optimized manner acting as an interface to off-chain processing. A pharmaceutical supply chain is used as the use case scenario to show the functionality of the proposed platform. Furthermore, a model to forecast the demand of the pharmaceutical drugs is investigated using a real-world data set to demonstrate the functionality of BAT. Finally, the performance of BAT integrated with the platform is evaluated.

Smart meters have become a core part of the Internet of Things, and its sensory network is increasing globally. For example, in the UK there are over 15 million smart meters operating across homes and businesses. One of the main advantages of the smart meter installation is the link to a reduction in carbon emissions. Research shows that, when provided with accurate and real-time energy usage readings, consumers are more likely to turn off unneeded appliances and change other behavioural patterns around the home (e.g., lighting, thermostat adjustments). In addition, the smart meter rollout results in a lessening in the number of vehicle callouts for the collection of consumption readings from analogue meters and a general promotion of renewable sources of energy supply. Capturing and mining the data from this fully maintained (and highly accurate) sensing network, provides a wealth of information for utility companies and data scientists to promote applications that can further support a reduction in energy usage. This research focuses on modelling trends in domestic energy consumption using density-based classifiers. The technique estimates the volume of outliers (e.g., high periods of anomalous energy consumption) within a social class grouping. To achieve this, Density-Based Spatial Clustering of Applications with Noise (DBSCAN), Ordering Points to Identify the Clustering Structure (OPTICS) and Local Outlier Factor (LOF) demonstrate the detection of unusual energy consumption within naturally occurring groups with similar characteristics. Using DBSCAN and OPTICS, 53 and 208 outliers were detected respectively; with 218 using LOF, on a dataset comprised of 1,058,534 readings from 1026 homes.

In Western Europe, the number of Internet connected devices is expected to increase from the 2.3 billion devices in 2017, to 4 billion in 2022. Dealing with this growth is an increasing problem for administrators attempting to ensure that Quality of Service levels are maintained. Software Defined Networking (SDN) has been proposed as one of the solutions to some of the problems caused by this increasing volume of data, such as the time it takes to manually reconfigure switches in response to changing network conditions. SDN moves the distributed networking paradigm to a centralised solution, which is easier to manage, but comes with other issues for security focused administrators. SDN can lead to a reduction in the amount of information available for Intrusion Detection Systems (IDSs). This is because IDSs still rely on direct packet sampling techniques, which can provide more information than the aggregated view of networks SDN flow tables provide. As deep learning and other artificial intelligence techniques look likely to become more commonplace in IDSs, this reduction in information becomes an increasing problem. Many of these methods require large training sets with many features. In this paper, we propose a method to correct this imbalance through the creation of a novel framework, which will allow upwards of 90% precision on the state of the art UNSW-NB15 dataset while only using a small fraction of the features available, matching those available within a SDN environment.