Phishing attacks are a class of cyberattacks in which adversaries deceive users to obtain sensitive credentials. Such attacks can spread quickly and dynamically through URL-based redirections, threatening network security and personal safety. In the proposed method, we build a stable modeling pipeline for URL-based phishing detection by leveraging the weighted fusion capabilities of an attention-based multi-feature fusion approach (AMFF) on boosting-based learning families. AMFF learns the relative importance of complementary features via an attention mechanism, balancing the fusion and reducing the impact of potential feature conflicts. In this study, the fusion approach is evaluated in the context of URL-based features and strong boosting classifiers (XGBoost and LightGBM); to mitigate the effects of class imbalance and data noise, a SMOTETomek-based balancing/cleaning strategy is applied. The approach is evaluated on different feature configurations of the UCI and Mendeley datasets using both 10-fold cross-validation and a 70/30 hold-out protocol. Experimental results show that the method achieves 97.94% accuracy and 99.76 AUC on UCI, 98.99% accuracy and 99.93 AUC on Mendeley-48, and 97.73% accuracy and 99.65 AUC on Mendeley-87. Additionally, the study provides a comparative analysis of different learning families and proposes a staged solution configuration for practical deployment (baseline model -> balancing/cleaning -> AMFF-based fusion). Overall, the findings indicate that the proposed AMFF-based configuration yields high discriminative power, low overfitting tendency, and strong generalization capability for URL-based phishing detection.

Internet of Medical Things (IoMT) devices are inherently vulnerable to cyberattacks, typically due to their limited processing power and memory capacity. Their widespread use in healthcare poses a significant security risk, threatening patient data privacy and the continuity of services. This study examines the effects of data imbalance correction and balancing strategies on the performance of machine and deep learning models using openly available IoMT datasets. In this context, four different balancing methods—RandomUnderSampler, SMOTE, Borderline-SMOTE, and ADASYN—were applied to three open-access IoMT datasets: ECU-IoHT, WUSTL, and CICIoMT2024. Performance analyses were conducted using five machine learning algorithms (AdaBoost, Logistic Regression, Random Forest, XGBoost, and K-Nearest Neighbor (KNN)) and two deep learning algorithms (Convolutional Neural Networks (CNN) and Deep Neural Networks (DNN)). In the highly imbalanced binary setting of the CICIoMT2024 dataset, the combination of RandomUnderSampler and SMOTE under the balanced-training/original-testing scenario produced the strongest improvement in the binary CICIoMT2024 setting, increasing the F1-Score from the unbalanced baseline to 99.87% for Random Forest and 99.86% for XGBoost across repeated runs. However, the benefit of balancing was not universal. In datasets with stronger class separability, such as ECU-IoHT, and in several multi-class settings, the effect of balancing was limited or, in some cases, inferior to the unbalanced baseline. These findings indicate that balancing is most effective under specific conditions, particularly in highly imbalanced binary tasks, and should be validated using class-sensitive metrics rather than overall performance alone.

The Internet of Medical Things (IoMT) has become integral to modern healthcare, yet its always-connected and resource-constrained nature enlarges the attack surface and complicates timely intrusion detection. This study presents a deployment-oriented, two-stage anomaly-detection pipeline. First, Principal Component Analysis (PCA) is employed to reduce the dimensionality of network traffic data, capturing the most significant variance. Subsequently, a One-Class Support Vector Machine (OC-SVM) is trained exclusively on these principal components of normal traffic. This approach prioritizes computational efficiency for resource-constrained IoMT devices while maintaining high model robustness. By modeling the principal components of normal behavior, our method achieves state-of-the-art performance across diverse attack families. We adopt a uniform protocol across four public IoMT corpora—BoT-IoT, CICIoMT2024, ECU-IoHT, and IoMT-TrafficData. The model’s hyperparameters, including the optimal number of principal components determined by explained variance, are tuned via randomized search. Despite using no attack labels during training, the proposed PCA-enhanced detector achieves state-of-the-art performance across diverse attack families: on BoT-IoT we obtain 99.92% F1-score (99.84% accuracy), on CICIoMT2024 we obtain 99.88% F1-score (99.77% accuracy), on ECU-IoHT 99.25% F1-score (98.58% accuracy), and on IoMT-TrafficData 99.19% F1-score (98.66% accuracy). The compact model size, enabled by PCA, makes the approach highly amenable to edge or gateway deployment in clinical networks, while the normal-only training paradigm improves robustness to zero-day threats. The results demonstrate that modeling the principal components of routine network behavior is a highly effective and efficient strategy for reliable, low-latency threat detection in realistic IoMT settings.

With the advancement of audio editing tools, manipulation of audio recordings has become more prevalent, posing a threat to their credibility. This study focuses on detecting audio splicing forgeries, which are created by combining segments from different parts of speech recordings. Such forgeries can make it appear as though a person said something they did not, leading to serious consequences when used as digital evidence. The RawNet2 architecture was used in the study. The model was trained and evaluated directly using the TIMIT dataset. Experiments were conducted on 2-second and 3-second spliced audio samples, and performance was evaluated using accuracy, precision, recall, F1-score, AUC, and EER metrics. The results demonstrate that the proposed system provides an effective and accurate approach for detecting audio splicing forgeries.

The rapid advancement of digital environments has led to an increase in multimedia forgery, particularly in the realm of audio, which leads to significant threats to the reliability of digital evidence. This paper presents a novel method to detect audio copy-move forgery, a type of manipulation where segments of an audio file are duplicated and moved to different locations within the same file. The proposed method consists of two main stages. In the first stage, the frequency range containing the forged segments is identified by extracting high-resolution spectrograms from the audio and matching keypoints within the spectrogram images to detect duplicated segments. The frequency range of the sub-spectrogram images with the highest match density is considered the location of the repeated segments. A swarm-based optimization approach is used to adaptively determine this dense region. The audio is then a bandpass filtered using the identified frequency range, and the second stage begins. In this stage, the filtered audio is represented as a graph using the proposed spiral pattern information extraction method. Graph coloring algorithms are applied to convert the graph into a visual representation, which is then input into a specially designed Convolutional Neural Network (CNN) model for classification. The trained model was evaluated using five different datasets, demonstrating that this approach generally outperforms existing methods in terms of detection accuracy. It provides a robust solution for verifying audio authenticity, even under various additional attack scenarios, and shows potential for generalization.

Federated learning is a distributed machine learning approach where end users train local models with their own data and combine model updates on a reliable server to create a global model. Despite its advantages, this distributed structure is vulnerable to attacks as end users keep their data and training process private. Current defense mechanisms often fail when facing different attack types or high percentages of malicious participants. This paper proposes a new defense algorithm called Neuron-Centric Federated Learning Defense (NC-FLD), a novel approach that dynamically identifies and analyzes the most significant neurons across model layers rather than examining entire gradient spaces. Unlike existing methods that analyze all parameters equally, NC-FLD creates feature vectors from specifically selected neurons that show the highest training impact, then applies dimensionality reduction to enhance their discriminative features. We conduct experiments with various attack scenarios and different malicious participant rates across multiple datasets (CIFAR-10, F-MNIST, and MNIST). Additionally, we perform simulations on the GTSR dataset as a real-world application. Experimental results demonstrate that NC-FLD successfully defends against diverse attack scenarios in both IID and non-IID dataset distributions, maintaining accuracy above 70% with 40% malicious participation, a 5–15% improvement over the state-of-the-art method, showing enhanced robustness across diverse data distributions while effectively mitigating the impacts of both data and model poisoning attacks.

Audio splicing forgery involves cutting specific parts of an audio recording and inserting or combining them into another audio recording. This manipulation technique is often used to create misleading or fake audio content, particularly in digital media environments. The detection of audio splicing forgery is of great importance, especially in forensic analysis, security applications and media verification processes. In this paper, we present a novel noise robust method for detecting audio splicing forgery. The proposed method converts audio signals into cochleagram images, which are then input into SWIN transformer model for training. Following the training process, the model classifies and labels test audio files as either original or fake. In the experiments, the method is tested on data sets of varying durations. The results demonstrate high performance across different datasets, both without and with Gaussian noise, as well as under real-world environmental noise attacks with varying audio durations. For example, under 30 dB noise condition on 2-second data segments, the model achieved an accuracy of 94.33%, precision of 96.46%, recall of 92.90%, and an F1-score of 94.65%. For rain noise condition, the proposed method achieves the highest accuracy of 93.26%, precision of 99.83%, and F1-score of 95.48% .

Through the rapid evolution of deepfake audio generation, and more importantly, its quite simplified access through easy-to-use tools, synthetic speech generation and its abuse have become a considerable threat over the years. It becomes clear that the detection of the spoofed audio will be a growing concern in the future. So, building robust and reliable methods to achieve the highest detection rates is needed. To address this issue, we proposed a method to detect the spoofed audio from genuine audio effectively. We utilized the cochleagram images for feature extraction, which is the closest to the human ear's biology, and used ViT and XCiT architectures for classification purposes. At the end, to eliminate deficiencies of one architecture to another, we adapted Late Score Fusing, achieving 6.94 % EER and 0.11 $\min$ t-DCF score on the ASVspoof2019 LA benchmark dataset, surpassing the state-of-the-art methods.

Federated learning (FL) is a type of distributed learning that can perform model training without exposing end users' data from end-user devices to increase security. Although it is one step ahead of other learning approaches thanks to this feature, studies have also proven that malicious users can reduce the success of the FL model. In this study, it is proven that the accuracy of the FL model is deteriorated by applying poisoning attack. We propose a defence strategy that can help identify harmful participants in FL using size reduction algorithms. Then, we create the Low Dimensional Secure Federated Learning (LD-SFL) framework with the OC-SVM method to eliminate the identified malicious users. The superiority of our proposed method has been proven against state-of-the-art methods by experimental results on three different datasets that the proposed framework is a robust defence mechanism.

Artificial intelligence training in a single center requires sharing personal data with third parties. In methods such as federated learning, where training is provided without collecting data from the participants, the security of personal data is ensured. However, in Federated learning, since no information is received from the participants about their data, imbalanced data sets may occur and become a target for attacks. Many methods in the literature that defend against security problems in federated learning work on the assumption that participants’ data is distributed homogeneously and malicious users attack independently. The Federated Learning Resistant to Byzantine Attacks with Statistical Distribution Around Quantiles (QBARFL) method proposed in this study offers a Federated learning method that is resistant to Byzantine attacks without making any assumptions about the data sets and in all cases where the attacks are organized or independent.The proposed method calculates the Euclidean distances between the current model from the participants and the main model. Using the found Euclidean matrix, it finds the ideal distance with the mean absolute deviation measure (QMAD) based on percentiles. It detects outliers by examining the spread around the ideal distance on the coordinate plane. The results of two different experiments show that QBARFL achieves higher results than similar methods that use quarter gap as a statistical spread measure, even in scenarios with heterogeneous data distribution, organized attacks and a high rate of malicious participants.

Federated learning is a distributed machine learning approach in which end-user devices update the learning model by training on their local data, rather than on a central server. Each device trains on its own data and the updated model parameters are aggregated on a central server to create a global model. Although this distributed learning structure has its advantages, it is still vulnerable to attacks by malicious actors. Current defenses against such attacks are limited to assumptions about end-user data distribution, and most work in the literature is not feasible to apply on large deep learning networks. Therefore, this article examines attacks and security vulnerabilities against Federated learning. Model poisoning scenarios, which are among the attack types that significantly affect model success, are applied to the learning network. Our proposed method, the Weight Pruning algorithm is used to select impactful neurons in the deep learning network. Then, the feature vectors created with the selected neurons are brought to a size suitable for classification by Principal Component Analysis. Finally, the Isolated Forest unsupervised learning algorithm was used for classification. Our results in defense success have been proven to exceed other approved defense algorithms in the literature.

Attacks on multimedia files by malicious users have become quite common, especially with the increase in the number of editing tools and their ease of use. Considering that such files can now be used both as evidence and for social visibility in all kinds of environments, it has become important to prove their authenticity. With the proposed method, the detection of merging forgeries in audio files has been carried out. For this purpose, the audio files received from the input are converted into cochleagram images. The PVTv2 based deep network architecture is trained with the generated cochleagram images. As a result of the training, the suspicious audio file given as input is labelled as original/fake. The proposed method gives 96.11% accuracy for 2s database, 94.63% accuracy for 3s database and 95.19% accuracy for 2s-3s database.

Recently, the development of technology and access to this technology facilitates the possibility of easier access to data in the digitalized world and making effortless changes to the data reached. In this study, a new approach was proposed to copy a part of the audio to the same audio and to determine the forgery obtained by applying various attacks. In the proposed method, the speech recording is divided into syllables by using the Pitch Tracking method, and the Instantaneous frequency feature is extracted from these parts. Before comparing similarity, the Pitch sequences of syllable segment pairs are examined. The equal number of amplitude m value of the first Pitch series determined by experimental studies is obtained and these values are sought in the second Pitch series. If the n element from the first series is found in the second series, the similarity between syllable segment pairs is examined. The minimum Dynamic Time Warping score calculated between syllable regions gives an idea about the location of the copied and pasted areas. The proposed method showed 0.89 precision, 0.87 recall, and 0.87 F-score metrics despite noise, compression, and median filter attacks.

Gerçek kişilerin konuşmalarını içeren dijital ses dosyalarının kullanılması ile gerçekleştirilen derin sahte ses manipülasyonu, sesi taklit edilecek kişinin sesini klonlayarak kişinin söylemediği bir şeyi söylemiş gibi içerikte ses dosyalarını oluşturan bir sahtecilik türüdür. Konuşmacının kimliğini doğrulamak için güvenlik adımı olarak kabul edilen Otomatik Konuşmacı Doğrulama Sistemlerinin derin sahte ses sahtecilikleri saldırılarına karşı savunmasızlığı söz konusudur. Ayrıca mahkemelerde karar merciini etkileyecek delil olarak sunulan ses dosyalarının orijinal olup olmadığı kontrolü önemli bir ihtiyaç haline gelmiştir. Bu tür sahteciliklerin uzman sistemler tarafından tespit edilebilmesi günümüz çağı için oldukça önem arz etmektedir. Bu sahtecilik türündeki saldırıların tespit edilebilmesi için literatürde çeşitli yöntemler önerilmiştir. Literatürdeki çalışmalarda performans değerlendirmesinde kullanılan ücretsiz erişimli veri setleri de mevcut olup sonuç kıyaslamasında kullanabilmesi mümkündür. Bu çalışmada literatürdeki yöntemler ve verisetleri incelenmiş, yöntemlerin bu verisetleri üzerindeki performans değerlendirmeleri, avantaj ve dezavantajları vurgulanmıştır.

Automatic Speaker Verification systems are prone to various voice spoofing attacks such as replays, voice conversion (VC) and speech synthesis. Malicious users can perform specific tasks such as controlling the bank account of someone, taking control of a smart home, and similar activities, by using advanced audio manipulation techniques. This study presents a Multi-Pattern Features Based Spoofing detection mechanism using the modified ResNet architecture and OC-Softmax layer to detect various LA and PA spoofing attacks. We proposed a novel Pattern features-based audio spoof detection scheme. The scheme contains three branches to evaluate different patterns on a Mel spectrogram of the audio file. This is the first work for the audio spoofing detection task using three different pattern representations of Mel spectrogram with modified ResNet architecture and OC-Softmax layer. Through the proposed network, we can extract pattern images from the Mel spectrogram and gives each of them into modified ResNet architecture. At the last step of each network, we use OC-Softmax to obtain a score for the current pattern image and then the method fuses three scores to label the input audio. Experimental results on the ASVspoof 2019 and ASVspoof 2021 corpuses show that the proposed method achieves better results in the challenges of ASVspoof 2019 than state-of-the-art methods. For example, in the logical access scenario, our model improves the tandem decision cost function and equal error rate scores by 0.06% and 2.14%, respectively, compared with state-of-the-art methods. Additionally, experiments illustrate that the proposed fused decision improved the performance of the system.

As technological equipment continues to improve; recording has become possible anywhere and anytime. Audio files, which we commonly encounter in cyberspace, can be used to entertain, inform our daily lives or sometimes to provide evidence in court. In this case, there is the problem of verifying the sound files produced and used. The method of audio copy moving forgery is a type of forgery that has been widely used by attackers in recent years. This situation has become particularly noticeable with the increase in the availability of easy-to-use audio editing software. Studies on detecting audio copy-move forgery are increasing day by day in the literature. However, the main problem with existing studies is the lack of a large, open-source dataset. In this study, original sounds were recorded from 50 women and 50 men in three different environments (quiet room, canteen and office). A total of 200 texts produced by the Department of Turkish Language and Literature were read by the people in the three different environments. In this paper, details of the data set and some experimental results will be given.

Thanks to advanced audio editing software, speech recordings can be tampered with very quickly. If the speech recordings are used as forensic evidence, adding the audio recordings together, cutting them, and changing their content are legally unacceptable and constitute a crime. Audio copy-move forgery is the most common forgery to change the content of the speech. Audio copy-move forgery is performed by copying a segment in the audio and pasting it anywhere in the same audio. This study proposes a robust and new method based on cochleagram images to detect audio copy-move forgery. The proposed method uses cochleagram images of the voiced parts of the audio to detect forgery clues in the input audio file. For this purpose, the audio file is first split into voiced parts using a pitch-based Voice Activity Detection (VAD) method. Each audio part is then converted into a cochleagram image. Structural similarity index measure (SSIM) is used to calculate the similarity between cochleagram images. After calculating the SSIM values between the cochleagram images, the proposed forgery localization algorithm is performed. In this algorithm, the SSIM values among the cochleagram images are first sorted in descending order. The length ratio between these pairs of segments is calculated to determine which values in this descending order are duplicated segment pairs. If this ratio exceeds the specified percentage rate, these segment pairs are marked as forged segments. Finally, the proposed audio copy-move forgery detection method is evaluated against the state-of-the-art approaches with two Copy-Move Forgery Detection (CMFD) database and forged databases created from TIMIT and the Arabic Speech Corpus database. For Copy-Move Forged Datasets, 95% Precision, 98% Recall and 97% F-score were obtained. The experimental results show that the proposed method is significantly more robust against post-processing operations than other studies.

Complex forgeries such as deepfakes, which are very popular today, as well as very simple but effective manipulation techniques, the production of which does not require the use of deep networks such as GAN, are still practiced. Audio splicing forgery, which combines multiple speech segments from different recordings of a person to alter the content of a speech recording, is one of these manipulation techniques and presents a great challenge to audio forgery. In this paper, a novel audio splicing detection method based on ArCapsNet architecture is proposed. The proposed method consists of two stages. In the first stage, the audio file given as input is converted into a cochleagram image. In the second stage, features are extracted from the cochleagram images with EfficientNet and the ArCapsNet is trained with these features. As a result of the training, the audio files given as a test are labelled as forged/original. The proposed method is tested on the database created by us using the TIMIT database. Our model gives the baseline metrics precision, recall and F1 metrics by 98.59%, 97.99%, and 98.29% on the dataset, respectively.

In recent years, with the massive development of new deep learning tools, the production of fake video content has become widespread. This fake content has the potential to cause serious social problems. Therefore, detecting fake content is of great importance. For this purpose, we present a new method for deepfake video detection. In most of the studies, which image frames of the videos are selected to be used in the detection models is determined randomly. This randomness can cause important image frames to be missed which can improve detection performance. The proposed method differs from other studies in the literature by determining which image frames to select from the videos with the help of the golden ratio information on the face. The method was developed using three different feature extraction methods, VGG19, EfficientNet B0, EfficientNet B4, and two different capsule network models, CapsuleNet and ArCapsNet. Performance evaluations were performed on Celeb-DF and DFDC-P, two of the currently challenging deepfake video datasets. The results were improved by fusing the best performing models. For Celeb-DF dataset, 93.63% ACC, 99.14% AUC and for DFDC-P dataset, 82.84% ACC, 89.08% AUC were obtained.

Since there are the advanced voice editing tools provided, the forgery of digital content such as video or voice could be performed and fake video or modified voice can be generated easly. Many methods have been proposed in the literature to detect audio forgery. In this study, for the first time in the literature, the RASTA-PLP method was used to detect audio copy-paste forgery. In the proposed study, first the voiced parts in the audio signal were detected using the pitch method. Afterward, feature vectors were extracted with RASTA-PLP from the detected voice segments. The correlation value was calculated between the feature vectors obtained for the detects of the forgery segments. Segments that correlation value is above a certain threshold value are marked as forgery segments. The proposed method has been tested on two different data sets. Obtained experimental results show that the proposed method is highly robust to attacks and superior to other methods in the literature.