The intrusion detection system (IDS) that uses a machine learning (ML) algorithm recognizes attack flows from normal ones using supervised, semi-supervised, or unsupervised techniques. Supervised ML (SML) IDS achieved the best detection rate when historical data was available. Therefore, various SML-IDS techniques have been proposed, combining classification algorithms with preprocessing and normalization steps. This research has two aims (1) to review the components of the SML-IDS and (2) to evaluate the alternative techniques using a multi-criteria decision-making approach with reference to positive and negative ideal alternatives. The review focuses on the algorithms, datasets, and metrics used with the SML-IDS. On the other hand, the proposed evaluation framework uses the Technique for Order of Preference by Similarity to Ideal Solution (TOPSIS) and employs various evaluators’ preferences. Initially, the algorithms and the datasets are gathered, and then the evaluation criteria and their types are identified, e.g., cost vs. benefit. The weights for these criteria are initialized next, taking various preferences into account. The alternative algorithms are then evaluated, and their results are conveyed and ranked based on their distances to the ideal alternatives with references to the stored initialized weights. Three datasets are used in the evaluation process: KDD, NSL-KDD, and CICIDS2017. The results indicate that, within the experimental setup and the utilized datasets, tree-based methods (Random Tree, C4.5, and Random Forest) frequently achieved top rankings across multiple evaluator preferences. Naïve Bayes classifiers performed consistently worse across the experiments, likely reflecting their sensitivity to feature dependencies and high-dimensional distributions in the selected datasets.

In Wireless Sensor Networks (WSNs), survivability is a crucial issue that is greatly impacted by energy efficiency. Solutions that satisfy application objectives while extending network life are needed to address severe energy constraints in WSNs. This paper presents an Adaptive Enhanced Grey Wolf Optimizer (AEGWO) for energy-efficient cluster head (CH) selection that mitigates the exploration-exploitation imbalance, preserves population diversity, and avoids premature convergence inherent in baseline GWO. The AEGWO combines adaptive control of the parameter of the search pressure to accelerate convergence without stagnation, a hybrid velocity-momentum update based on the dynamics of PSO, and an intelligent mutation operator to maintain the diversity of the population. The search is guided by a multi-objective fitness, which aims at maximizing the residual energy, equal distribution of CH, minimizing the intra-cluster distance, desirable proximity to sinks, and enhancing the coverage. Simulations on 100 nodes homogeneous WSN Tested the proposed AEGWO under the same conditions with LEACH, GWO, IGWO, PSO, WOA, and GA, AEGWO significantly increases stability and lifetime compared to LEACH and other tested algorithms; it has the best first, half, and last node dead, and higher residual energy and smaller communication overhead. The findings prove that AEGWO provides sustainable energy management and better lifetime extension, which makes it a robust, flexible clustering protocol of large-scale WSNs.

The Address Resolution Protocol (ARP) spoofing is a common method used by adversaries to attack the security of Internet of Things (IoT) networks through Man-in-the-Middle (MITM) attacks. Lightweight, resource-constrained IoT devices are often vulnerable to these attacks; thus, traditional detection mechanisms are often insufficient to identify and counteract them in real time. In this study, we proposed a machine learning-based model to detect ARP spoofing MITM attacks using the IoTID20 dataset. The detection model is systematic and includes dataset extraction, preprocessing, train-test splitting, classifier training, and performance evaluation. We used accuracy, precision, recall, and F1-score to evaluate eleven machine learning classifiers, including tree-based ensembles, linear models, kernel-based methods, and optimization-driven algorithms. Results show that ensemble methods performed the best, with LightGBM achieving the highest score of 99.7% across all four metrics, followed by XGBoost and Random Forest. Simpler algorithms like logistic regression and ridge performed less well but still delivered competitive results, indicating their potential for deployment on resource-limited IoT devices. These findings demonstrate that machine learning can effectively detect ARP spoofing attacks with high accuracy and efficiency, offering a promising approach to securing IoT environments against MITM threats.

The malicious URLs have been a constant threat to cybersecurity because hackers are constantly creating phishing, malware, spam, and defacement links that resemble authentic Web layouts and bypass static security measures. Despite very promising results of machine learning (ML) and deep learning (DL) models in URL classification, the effectiveness of these models is usually limited by high dimensional spaces of features that have redundant and irrelevant qualities, which leads to increased computation costs and potentially less generalization ability. To cope with this, this study will present a wrapper-based Bat Algorithm (BA) feature selection model to determine small and discriminative subsets of features in detecting malicious URLs. The bio-inspired metaheuristic BA offers a good tradeoff of exploration and exploitation in high dimensional optimization issues and thus is useful in feature subset selection. The proposed BA model is tested on ensemble ML (XGBoost, AdaBoost, Gradient Boosting, CatBoost and LightGBM) and DL (CNN, RNN, LSTM and CNN-LSTM) architectures with two datasets the multi-class ISCX-URL-2016 dataset and the more recent URL Phishing (2026) dataset. Experiments results indicate that BA has a significant dimensionality reduction: It reduces original feature space on ISCX-URL-2016 by 51.90% in the case of Defacement, by 67.09% in the case of Malware, by 49.37% in the case of Phishing, by 59.49% in the case of Spam, and 45.91% in the case of Phishing on URL Phishing (2026). This reduction notwithstanding, BA shows consistent improvements in the classification of both datasets. BA-enhanced LightGBM had the best overall results of all the tested models, with an accuracy of 99.92% on ISCX-URL-2016 and 98.17% on URL Phishing (2026), and high values of ROC-AUC and good computational efficiency. A statistical analysis also supports the fact that the improvements noticed are significant. Altogether, the proposed BA-based feature selection model is an efficient, scalable, and reliable solution to malicious URL detection intelligent, with good possibilities of being implemented into real-world systems in terms of cybersecurity.

The fast proliferation of the Internet of Things (IoT) has facilitated the highest levels of connectivity, but also has created severe weaknesses, especially reconnaissance attacks, including host and operating system (OS) port scanning. Such attacks provide gateway to even more sophisticated attacks, and therefore it is crucial to detect them early to ensure IoT infrastructures are secured. This paper suggests a framework that could be used to detect port scanning based on the IoTID20 dataset and implemented with machine learning. Eight classifiers, including, XGBoost, Random Forest, Bagging, AdaBoost, Gradient Boosting, CatBoost, LightGBM and Support Vector Machine (SVM) have been used in comparative analysis in terms of Accuracy, Precision, Recall, and F1-score. It is demonstrated that the boosting and ensemble models are much better than the traditional classifiers, with LightGBM demonstrating the best accuracy of 99.90%, precision of 99.91%, recall of 99.87% and F1-score of 99.89%. Near-perfect detection was also observed with bagging (99.87% accuracy) and CatBoost (99.84% accuracy) and the lowest accuracy was observed with SVM (98.37%). These results highlight the power of sophisticated ensemble learning models to identify complex attack patterns in high-dimensional IoT traffic. The combination of these strategies can offer a very strong backbone to the next generation intrusion detection systems that will be able to overcome reconnaissance threat in the IoT networks

The rapid growth of sophisticated Android malware (AM) threats is significant, as Android devices often store private and sensitive personal and financial information. These threats allow stealing of data, interference with device functioning, and network compromise. One of the greatest difficulties in efficient interception systems is ensuring a high level of detection accuracy for distinguishable AM variants. This study focuses on developing a robust Android malware detection model via machine learning (ML) and deep learning (DL) techniques. The model combines ML classifiers, which consist of logistic regression (LR) and decision trees (DTs), and a DL classifier, an artificial neural network (ANN). The model was implemented via an open-source data mining program called Orange. The NATICUSdroid dataset was used to train and test the model, which was measured in terms of accuracy, precision, recall, F-measure and AUC. The experimental findings revealed that the ANN performed the best (accuracy: 98.0%, precision/recall/F-measure: 98.0%, AUC: 0.997) and was better than the LR (accuracy: 96.1%, AUC: 0.989) and DT (accuracy: 96.0%, AUC: 0.971) methods. The results highlight the high potential of DL-based approaches, especially ANNs, to detect Android malware and reinforce their suitability for enhancing mobile security systems.

Distributed Denial of Service (DDoS) attack is an attack that causes the shutting down of a network. It is usually directed at a service, and disruption of that service can be detected through methods such as penetration. This paper aims to evaluate diverse machine learning (ML) classifiers concerning their performance when classified DDoS attacks using CICDDoS2019 dataset, which is a complete benchmark dataset for the study of DDoS attacks. The paper investigates effectiveness using nine different ML classifiers: XGBoost, Random Forest, AdaBoost, Gradient Boosting, Decision Tree, Stochastic Gradient Descent (SGD), CatBoost, LightGBM, and Support Vector Machine (SVM). Evaluation of each classifier conducted on exhaustive performance indicators accuracy, precision, recall, F-measure. The results conclude that XG Boost and Light GBM are superior on all ML classifiers of detection accuracy, precision, sensitivity, and F-measure. The findings will assist this research to indicate the best possible ML classifiers to enhance the network security of a region and mitigate DDoS impacts. The study adds to the increasing body of knowledge in leveraging ML for cybersecurity applications.

The rapid growth of digital communication has intensified spam-related threats, including phishing and malware, which employ advanced evasion tactics. Traditional filtering methods struggle to keep pace, driving the need for sophisticated machine learning (ML) solutions. The effectiveness of ML models hinges on selecting high-quality input features, especially in high-dimensional datasets where irrelevant or redundant attributes impair performance and computational efficiency. Guided by principles of symmetry to achieve an optimal balance between model accuracy, complexity, and interpretability, this study proposes an Enhanced Hybrid Quantum-Inspired Firefly and Artificial Bee Colony (EHQ-FABC) algorithm for feature selection in spam detection. EHQ-FABC leverages the Firefly Algorithm’s local exploitation and the Artificial Bee Colony’s global exploration, augmented with quantum-inspired principles to maintain search space diversity and a symmetrical balance between exploration and exploitation. It eliminates redundant attributes while preserving predictive power. For interpretability, Shapley Additive Explanations (SHAPs) are employed to ensure symmetry in explanation, meaning features with equal contributions are assigned equal importance, providing a fair and consistent interpretation of the model’s decisions. Evaluated on the ISCX-URL2016 dataset, EHQ-FABC reduces features by over 76%, retaining only 17 of 72 features, while matching or outperforming filter, wrapper, embedded, and metaheuristic methods. Tested across ML classifiers like CatBoost, XGBoost, Random Forest, Extra Trees, Decision Tree, K-Nearest Neighbors, Logistic Regression, and Multi-Layer Perceptron, EHQ-FABC achieves a peak accuracy of 99.97% with CatBoost and robust results across tree ensembles, neural, and linear models. SHAP analysis highlights features like domain_token_count and NumberOfDotsinURL as key for spam detection, offering actionable insights for practitioners. EHQ-FABC provides a reliable, transparent, and efficient symmetry-aware solution, advancing both accuracy and explainability in spam detection.

Cyberattacks try to compromise the security objectives (i.e., confidentiality, integrity, and availability) and stop the services that everyone uses. An Intrusion Detection System (IDS) monitors and reveals cyberattack patterns in network flows. Network packets contain several features that can be used in the detection of cyberattacks. These features comprise several irrelevant or redundant ones that lessen the efficiency of detecting cyberattacks and increase false alarms. This paper inspects the features of the UNSW-NB15 dataset. We employ the Bat Algorithm (BA) as a feature selection to identify the strongest features from the UNSW-NB15 dataset that contribute detect cyberattack patterns. The Adaboost and Logistic Regression (LR) classifiers are employed to assess the complexity in terms of accuracy, precision, and recall. The experimental results show that the Adaboost achieved 100% accuracy, precision, and recall. Meanwhile, the LR achieved 99.2% accuracy, 99.9% precision, and 99.91% recall.

Cybersecurity has emerged as one of the most prevalent and significant challenges in recent years due to the advancement of technology. Among the most frequent and hazardous cybersecurity threats are spam URLs (Uniform Resource Locators), which are also one of the most popular methods for user fraud. Users are the victims of this attack, which also steals their data and infects their devices with harmful software. The detection of spam URLs has become very important in protecting the user. Therefore, this study aims to investigate the efficiency of machine learning classifiers in detecting spam URLs. The following machine learning classifiers were chosen: Random Forest, Decision Tree, and SVM. The evaluation was based on the ISCXURL2016 dataset, which is divided into three groups: All Features, BestFirst Features, and Infogain Features and evaluation matrices were the Accuracy, Precision, Sensitivity, and F-measure. The results obtained showed that Random Forest with All Features is superior to others with an accuracy of 99.75%, Precision of 99.74%, and Sensitivity of 99. 79%, and F-measure 99.76 %.

Uniform resource locator (URL) defacement attack can be defined as any cyberattack in which the attacker replaces the appearance or content of the targeted webpage with their own that is intended to disgrace, mislead, or malign the website. Detecting URL defacement attacks is significant to avoid breaching the security of the website content or its configuration files, modifying the file locations, templates, or attacks on the website environment and applications. A machine learning (ML) technique can be used to detect the defacement attack on any website with complex content and structure, as opposed to the classical techniques for detection, such as Diff comparison, Document Object model tree analysis, and checksum, which can only be applied to static websites. This article proposes a feature selection model based on particle swarm optimization with support vector machine, decision tree, random forest, Naive Bayes, and k-nearest neighbor ML classification algorithms. The proposed model aims to improve the URL defacement attack detection by selecting the best features from the ISCX-URL-2016 dataset. Then, the reduced set of features produced by the proposed model step is used as input to evaluate and compare the results of the used ML classifiers. The results showed that the proposed model has significantly reduced the features, regarding the classification's feature reduction, the random forest classifier outperformed other classifiers in terms of true positive rates, accuracy, precision, sensitivity, and F-measure, whereas the proposed model with random forest classifier has 99.21% True positive rates, 99.29% accuracy rate, 99.38% precision rate, 99.21% sensitivity rate, and 99.29% F-measure rate. In the future directions of this article, more research should be done on a variety of things, including varying and sophisticated techniques of altering the URL defacement since it would better calibrate the model for application in real-life situations. Received: 28 October 2024 | Revised: 16 December 2024 | Accepted: 1 January 2025 Conflicts of Interest The authors declare that they have no conflicts of interest to this work. Data Availability Statement The data that support the findings of this study are openly available in URL dataset (ISCX-URL2016) at: https://www.unb.ca/cic/datasets/url-2016.html. Author Contribution Statement Omar Almomani: Conceptualization, Methodology, Software, Investigation, Writing – original draft, Supervision, Project administration. Adeeb Alsaaidah: Conceptualization, Formal analysis, Writing – original draft. Ahmad Adel Abu-Shareha: Methodology, Formal analysis, Investigation, Data curation, Writing – review & editing, Visualization. Abdullah Alzaqebah: Software, Resources, Data curation, Writing–review & editing, Visualization. Mohammed Amin Almaiah: Validation, Resources, Writing – original draft. Qusai Shambour: Resources, Writing – original draft

Cloud computing has become a hot research topic due to the robust development and migration of many services to this cloud environment. The main problem that appears is regarded with both management's efficiency and the large amount of resources utilization. These resources are managed by data centers as well as distributed to internet users dynamically depending on their availability, request and quality parameters that are in request to be usable. Thus, task scheduling is a major concern that can affect system performance. This study presents a survey of employing genetic algorithm for task scheduling in cloud environments. This survey provides a comprehensive overview of task scheduling approaches in cloud environments, with a particular focus on the application of genetic algorithms. It discusses fundamental cloud computing concepts, scheduling criteria, and classification of scheduling methods. Furthermore, it analyses a wide range of GA-based scheduling algorithms, comparing their performance, task characteristics, and simulation tools.

The demand for medical sensors in the Smart Healthcare System (SHS) creates an intelligent Internet of Medical Things (IoMT) system. This system plays an important role in detecting the vital parameters of the human body. However, security and privacy issues in terms of network vulnerability have arisen due to the transmission of data and lack of control over the data. The Intrusion Detection System (IDS) is one of the security solutions to identify various threats and vulnerabilities in the consumable edge-centric IoMT industry. Several IDS techniques have been developed in previous years. However, a real-time and highly accurate attack detection system in the edge-centric IoMT industry is needed. This paper proposes a blended deep learning framework that leverages the strengths and capabilities of different deep learning architectures. The proposed model combined Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) to recognize the latest intruders accurately and defend the healthcare data. The major outcome of the proposed framework is to detect different attacks during data transmission at the edge of the network with high accuracy and efficiency. The proposed model was analyzed on the CSE-CIC-IDS 2018 systematic dataset containing two distinct classes of profiles. The experimental results demonstrate that the proposed framework’s accuracy is higher than the existing approach.

Eliminating security threats on the Internet of Things (IoT) requires recognizing threat attacks. IoT and its implementations are currently the most common scientific field. When it comes to real-world implementations, IoT's attributes, on the one hand, make it simple to apply, but on the other hand, they expose it to cyber-attacks. Denial of Service (DoS) attack is a type of threat that is now widespread in the field of IoT. Its primary goal is to stop or damage service or capability on a target. Conventional Intrusion Detection Systems (IDS) are no longer sufficient for detecting these sophisticated attacks with unpredictable behaviors. Machine learning (ML)--based intrusion detection does not need a massive list of expected activities or a variety of threat signatures to create detection rules. This study aims to evaluate different ML classifiers for network intrusion detection that focus on DoS attacks in the IoT environment to determine the best ML classifier that can detect the DoS attack. The XGBoost, Decision Tree (DT), Gaussian Naive Bayes (NB), Random Forest (RF), Logistic Regression (LR), and Support Vector Machine (SVM) ML classifiers are used to evaluate the DoS attack. The UNSW-NB15 dataset was used for this study. The obtained accuracy rate for XGboost was 98.92%, SVM 98.62%, Gaussian NB 83.75%, LR 97.74%, RF 99.48%, and DT 99.16%. where the precision rate for XGboost, SVM, Gaussian NB, LR, RF, and DT was 98.40%, 98.29%, 77.50%, 97.14%, 99.21%, and 99.12%, respectively. The sensitivity rate for XGboost, SVM, Gaussian NB, LR, RF, and DT was 99.29%, 98.76%, 91.87%, 98.06%, 99.69%, and 99.08%, respectively. The results show that the RF classifier outperformed other classifiers in terms of Accuracy, Precision, and Sensitivity.

Database systems have consistently been prime targets for cyber-attacks and threats due to the critical nature of the data they store. Despite the increasing reliance on database management systems, this field continues to face numerous cyber-attacks. Database management systems serve as the foundation of any information system or application. Any cyber-attack can result in significant damage to the database system and loss of sensitive data. Consequently, cyber risk classifications and assessments play a crucial role in risk management and establish an essential framework for identifying and responding to cyber threats. Risk assessment aids in understanding the impact of cyber threats and developing appropriate security controls to mitigate risks. The primary objective of this study is to conduct a comprehensive analysis of cyber risks in database management systems, including classifying threats, vulnerabilities, impacts, and countermeasures. This classification helps to identify suitable security controls to mitigate cyber risks for each type of threat. Additionally, this research aims to explore technical countermeasures to protect database systems from cyber threats. This study employs the content analysis method to collect, analyze, and classify data in terms of types of threats, vulnerabilities, and countermeasures. The results indicate that SQL injection attacks and Denial of Service (DoS) attacks were the most prevalent technical threats in database systems, each accounting for 9% of incidents. Vulnerable audit trails, intrusion attempts, and ransomware attacks were classified as the second level of technical threats in database systems, comprising 7% and 5% of incidents, respectively. Furthermore, the findings reveal that insider threats were the most common non-technical threats in database systems, accounting for 5% of incidents. Moreover, the results indicate that weak authentication, unpatched databases, weak audit trails, and multiple usage of an account were the most common technical vulnerabilities in database systems, each accounting for 9% of vulnerabilities. Additionally, software bugs, insecure coding practices, weak security controls, insecure networks, password misuse, weak encryption practices, and weak data masking were classified as the second level of security vulnerabilities in database systems, each accounting for 4% of vulnerabilities. The findings from this work can assist organizations in understanding the types of cyber threats and developing robust strategies against cyber-attacks.

ABSTRACTThe Internet of Things has emerged as a significant and influential technology in modern times. IoT presents solutions to reduce the need for human intervention and emphasizes task automation. According to a Cisco report, there were over 14.7 billion IoT devices in 2023. However, as the number of devices and users utilizing this technology grows, so does the potential for security breaches and intrusions. For instance, insecure IoT devices, such as smart home appliances or industrial sensors, can be vulnerable to hacking attempts. Hackers might exploit these vulnerabilities to gain unauthorized access to sensitive data or even control the devices remotely. To address and prevent this issue, this work proposes integrating intrusion detection systems (IDSs) with an artificial neural network (ANN) and a salp swarm algorithm (SSA) to enhance intrusion detection in an IoT environment. The SSA functions as an optimization algorithm that selects optimal networks for the multilayer perceptron (MLP). The proposed approach has been evaluated using three novel benchmarks: Edge‐IIoTset, WUSTL‐IIOT‐2021, and IoTID20. Additionally, various experiments have been conducted to assess the effectiveness of the proposed approach. Additionally, a comparison is made between the proposed approach and several approaches from the literature, particularly SVM combined with various metaheuristic algorithms. Then, identify the most crucial features for each dataset to improve detection performance. The SSA‐MLP outperforms the other algorithms with 88.241%, 93.610%, and 97.698% for Edge‐IIoTset, IoTID20, and WUSTL, respectively.

Low Power Networks are spreading worldwide, seeking to enable small devices to join wireless networks. This requires a routing mechanism that makes it possible and seamless. This research aims to create a Low Power and Lossy Networks (RPL) routing protocol that balances power usage and node dependability. The main emphasis of the algorithm presented here is the choice made by network nodes (Zigbees) regarding which path to deliver the message along. Results for this routing technique seem promising. Utilizing it increased packet transfer reliability while enforcing power conservation. Furthermore, a 10% reduction in the network's overall power consumption was made.

The exponential growth of Internet and network usage has necessitated heightened security measures to protect against data and network breaches. Intrusions, executed through network packets, pose a significant challenge for firewalls to detect and prevent due to the similarity between legitimate and intrusion traffic. The vast network traffic volume also complicates most network monitoring systems and algorithms. Several intrusion detection methods have been proposed, with machine learning techniques regarded as promising for dealing with these incidents. This study presents an Intrusion Detection System Based on Stacking Ensemble Learning base (Random Forest, Decision Tree, and k-Nearest-Neighbors). The proposed system employs pre-processing techniques to enhance classification efficiency and integrates seven machine learning algorithms. The stacking ensemble technique increases performance by incorporating three base models (Random Forest, Decision Tree, and k-Nearest-Neighbors) and a meta-model represented by the Logistic Regression algorithm. Evaluated using the UNSW-NB15 dataset, the pro-posed IDS gained an accuracy of 96.16% in the training phase and 97.95% in the testing phase, with precision of 97.78%, and 98.40% for taring and testing, respectively. The obtained results demonstrate improvements in other measurement criteria.