This paper addresses the critical challenge of deploying effective intrusion detection on resource-constrained edge devices within IoT ecosystems. We propose and evaluate a lightweight security framework that integrates AI-driven be-havioural analysis with interactive honeypot technology to enable real-time threat detection at the network edge. To overcome the scarcity of representative attack data, our methodology combines the emulation of adversary interactions via Cowrie honeypots deployed on Raspberry Pi hardware with the curated MedBIoT dataset, using LightGBM for efficient anomaly classification. Experimental results demonstrate very high detection performance (F1-score ≈ 1.00, ROC-AUC ≈ 1.0) on the evaluated dataset of 64,193 samples, reflecting strong separability under controlled conditions. It also maintains minimal resource consumption (<2% RAM, <1% CPU during peak operations). The system achieves sub-second inference (0.128 seconds) and demonstrates sustained operational stability under edge constraints. These findings validate the practical viability of decentralised, AI-enhanced honeypots for scalable edge security, providing a blueprint for implementing adaptive, behaviour-based defence mechanisms in constrained environments.

This research presents an empirical evaluation of CPython and Mojo with respect to two key dimensions: execution performance and qualitative software quality attributes, most notably code readability. While CPython is renowned for its expressive syntax and Mojo for its explicit memory control, the impact of code readability on performance and overall code quality remains unclear. To investigate this, we conduct a systematic empirical comparison using a dual benchmarking methodology that integrates macro-benchmarking (wall time, CPU time) with micro-benchmarking at the function level. Six representative algorithmic workloads are evaluated: random integer generation, Fibonacci computation, matrix multiplication, quick sort, A* pathfinding, and Conway's Game of Life. The study evaluates performance through a combination of quantitative complexity metrics and a two-stage code review process. In terms of performance, Mojo significantly outperforms CPython in numerically intensive and compute-bound tasks, achieving speed-ups of up to 77× in matrix multiplication and notable performance improvements in sorting benchmarks. In contrast, CPython consistently ranks higher in readability and developer experience, offering clearer error messages and more concise implementations. The result confirms Mojo as a promising option for performance-critical components, particularly in scientific and data-intensive computing such as machine learning. Furthermore , a hybrid approach integrating Mojo for computational hotspots within Python-based systems can emerge as the most practical development strategy. The research contributes to a reproducible benchmarking and evaluation framework to support future research as Mojo evolves.

Data recovery for forensic analysis of both hard drives and solid state media presents its own unique set of challenges. Hard drives face mechanical failures and data fragmentation, but their sequential storage and higher success rates make recovery more feasible. Solid State Drives (SSDs), with no moving parts and no data fragmentation, provide faster access to data but may pose challenges due to wear levelling and data retention issues. This project examines the challenges of data recovery between hard drives and solid-state media and compares them against each other. This was achieved by running several tests on four types of storage media, one of which is a hard drive, and the others are different types of solid-state media. The tests indicated that most SSDs perform as expected; however, the Intel Optane drive retained a much higher percentage of deleted data than the other drives. Despite this, all of the evaluated SSDs retained less deleted data than the hard drive. It can therefore be argued that traditional forensic processes are incapable of recovering as much deleted data from solid-state media and that these processes must be re-examined.

Internet of Things (IoT) is fast growing. Non-personal computer devices under the umbrella of IoT have been increasingly applied in various fields and will soon account for a significant share of total Internet traffic. However, the security and privacy of IoT and its devices have been challenged by malware, particularly polymorphic worms that rapidly self-propagate once being launched and vary their appearance over each infection to escape from the detection of signature-based intrusion detection systems. It is well recognized that polymorphic worms are one of the most intrusive threats to IoT security. To build an effective, strong defense for IoT networks against polymorphic worms, this study proposes a machine intelligent system, termed Gram-Restricted Boltzmann Machine (Gram-RBM), which automatically generates generic fingerprints/signatures for the polymorphic worm. Two augmented N-gram-based methods are designed and applied in the derivation of polymorphic worm sequences, also known as fingerprints/signatures. These derived sequences are then optimized using the Gaussian–Bernoulli RBM dimension-reduction algorithm. The results, gained from the experiments involved three different types of polymorphic worms, show that the system generates accurate fingerprints/signatures even under “noisy” conditions and outperforms related methods in terms of accuracy and efficiency.

Detecting metamorphic malware provides a challenge to machine-learning models as trained models might not generalise to future mutant variants of the malware. To address this, we explore whether machine-learning models can be improved by augmenting training data-sets with samples of potential variants. These variants are generated using an evolutionary algorithm that evolves a behaviourally diverse set of mutants, optimised to avoid detection by a large set of existing detection-engines. Using features calculated from the behavioural trace of a sample as input, we evaluate the ability of five machine-learning methods to detect the new variants, show that the detection rate is considerably improved by including the new samples as training data, and that the classifiers still generalise over a range of malware. We then repeat this experiment using a sequence-based deep-learning method as the classifier, which is shown to out-perform the feature-based classifiers.