Abstract Internet of Things (IoT) networks are increasingly targeted by advanced botnet attacks, posing serious risks to security and system stability. However, many existing intrusion detection systems (IDS) struggle to balance detection accuracy, real-time efficiency, and interpretability—especially in resource-constrained environments. In this paper, we introduce GELAX, a novel detection framework that combines Graph Neural Networks (GNNs), Dynamic Graph Pruning, and Anchored Explainable AI to address these challenges. GELAX dynamically simplifies graph structures to reduce computational load, while still capturing meaningful device interactions. Its integrated explainability component highlights key features driving detection decisions with minimal overhead, supporting analyst trust and model transparency. Evaluations on two benchmark datasets—N-BaIoT and UNSW Bot-IoT—demonstrate that GELAX achieves high detection accuracy (95.9% and 96.9%), reduces CPU and memory usage by over 45%, and improves explanation alignment (faithfulness) by 22.5%. These results highlight GELAX as a robust, efficient, and interpretable solution for securing modern IoT systems.

Abstract Intrusion Detection Systems (IDSs) with a Machine Learning (ML) technique have shown efficacy in securing Internet of Things (IoT) networks in recent years. As cyber threats continue to evolve, IDS have become increasingly reliant on advanced ML and deep learning (DL) techniques to improve detection accuracy. However, the growing complexity of these models often makes it challenging for security analysts to interpret the reasoning behind specific alerts. While extensive research has been conducted on IDS using ML and DL methods, the issue of interpretability remains largely unaddressed. One of the interpretable methods in machine learning is to use model-agnostic interpretation tools that can be applied to any supervised machine learning model. To address this issue, a new hybrid model composed of a lightweight one-dimensional convolutional Neural Network (1D-CNN) is proposed with the interpretation ability of the results in which, resource-constrained IoT devices can execute the proposed model. In the first phase, the SHapley Additive exPlanations (SHAP) technique is used for feature selection to detect the most important features. These features can be considered for redesigning the model by using a smaller set of features and reducing the computation and complexity of the model, leading to the creation of a lighter deep network. After the prediction of the proposed model, to interpret and explain the results and analyze the influential factors in predictions, Agnostic methods are employed both globally(SHAP) and locally(SHAP, LIME) to clarify the reasons for the predictions. Experimental results using the TON-IoT dataset showed accuracy, precision, recall, and F1-score criteria to 0.995, 0.9949, 0.9947, and 0.9947, respectively. Therefore, besides accurately predicting attacks in the area of IoT with high precision and lightweight models, the proposed method increases transparency to assist cybersecurity personnel in gaining a better understanding of IDS judgments.

Abstract Deploying the Internet of Things (IoT) in integrated edge‐cloud environments exposes the IoT traffic data to performance issues such as delay, bandwidth limitation etc. Recently, Software‐Defined Wide Area Network (SD‐WAN) has emerged as an architecture that originates from the Software‐Defined Network (SDN) paradigm and provides solutions for networking multiple data centers by allowing network administrators to manage and control network layers. In this article, an SDWAN‐based policy for traffic management in IoT is introduced in which the Quality of Service (QoS) metrics such as end‐to‐end delay and bandwidth utilization are optimized. The proposed method implements the traffic management policy in the SDWAN controller. When the IoT traffic flows reach the SDWAN infrastructure network, graph search algorithms are performed to find the near‐optimal paths that affect the end‐to‐end delay of traffic flows. Because of the ability of deep learning to process complex data, a deep RNN model is used to predict the network state information, such as link latency and available bandwidth, before the traffic flows reach the infrastructure network. The proposed method consists of four key modules to predict the routes for future time intervals: (a) an SD‐WAN topology updater unit that checks the link changes and availability, (b) the network state information collector, which collects the network state information to create a dataset, (c) the learning unit, which trains a deep RNN model using the created dataset, and (d) the route predictor unit, which uses the trained model to predict the network state information using a heuristic algorithm to determine the routes. The simulation results showed that the deep RNN model can achieve high accuracy and low Mean Absolute Error (MAE), and the proposed method outperforms shortest‐path algorithms in terms of latency. At the same time, the available bandwidth is almost fairly distributed among all network links.

Internet of Things (IoT), as a remarkable paradigm, establishes a wide range of applications in various industries like healthcare, smart homes, smart cities, agriculture, transportation, and military domains. This widespread technology provides a general platform for heterogeneous objects to connect, exchange, and process gathered information. Beside significant efficiency and productivity impacts of IoT technology, security and privacy concerns have emerged more than ever. The routing protocol for low power and lossy networks (RPL) which is standardized for IoT environment, suffers from the basic security considerations, which makes it vulnerable to many well‐known attacks. Several security solutions have been proposed to address routing attacks detection in RPL–based IoT, most of which are based on machine learning techniques, intrusion detection systems and trust‐based approaches. Securing RPL–based IoT networks is challenging because resource constraint IoT devices are connected to untrusted Internet, the communication links are lossy and the devices use a set of novel and heterogenous technologies. Therefore, providing light‐weight security mechanisms play a vital role in timely detection and prevention of IoT routing attacks. In this paper, we proposed a novel anomaly detection–based trust management model using the concepts of sequence prediction and deep learning. We have formulated the problem of routing behavior anomaly detection as a time series forecasting method, which is solved based on a stacked long–short term memory (LSTM) sequence to sequence autoencoder; that is, a hybrid training model of recurrent neural networks and autoencoders. The proposed model is then utilized to provide a detection mechanism to address four prevalent and destructive RPL attacks including: black‐hole attack, destination‐oriented directed acyclic graph (DODAG) information solicitation (DIS) flooding attack, version number (VN) attack, and decreased rank (DR) attack. In order to evaluate the efficiency and effectiveness of the proposed model in timely detection of RPL–specific routing attacks, we have implemented the proposed model on several RPL–based IoT scenarios simulated using Contiki Cooja simulator separately, and the results have been compared in details. According to the presented results, the implemented detection scheme on all attack scenarios, demonstrated that the trend of estimated anomaly between real and predicted routing behavior is similar to the evaluated attack frequency of malicious nodes during the RPL process and in contrast, analyzed trust scores represent an opposite pattern, which shows high accurate and timely detection of attack incidences using our proposed trust scheme.

Abstract Extensive network receptive field is key for unsupervised affine registration because instead of deformable registration that takes care of local subtleties, the affine registration is global so that the last layers need to see big patches of the organ‐in‐interest. To extend the network's receptive field, we need to go for deeper networks, which causes producing complex models. On the other hand, affine transformation is restricted by its low degree‐of‐freedom (DoF) where larger models increasingly develop the hazard of overfitting. To worsen the situation, the regularizer module cannot be applied to the affine transformation with such a restricted DoF. In this paper, we propose a differentiable computational layer to convert the affine transformation outputted by the network to its corresponding dense displacement field. Such an affine‐to‐field layer enables us to apply different regularization terms on the outputted transformation in order to avoid the overfitting phenomenon while deepening the network. The proposed approach was evaluated on an annotated hard multimodal dataset containing 1109 pairs of CT/MR images of the brain with different heterogeneity for example, variety in scanners, setups and resolutions. Based on the results, the proposed customized layer is fully successful to handle the overfitting for deeper networks that are able to produce richer transformations than the shallower networks from different evaluation metrics for example, in target registration error the proposed network with seven layers has a 13.3% (or 9.1 mm) improvement in performance. The implementation of the proposed customized affine‐to‐field layer in the Python, Keras package with the Tensorflow backend can be publically accessed via https://github.com/boveiri/Deep-coReg .

Abstract Nowadays, increase in time complexity of applications and decrease in hardware costs are two major contributing drivers for the utilization of high‐performance architectures such as cluster computing systems. Actually, cluster computing environments, in the contemporary sophisticated data centres, provide the main infrastructure to process various data, where the biomedical one is not an exception. Indeed, optimized task scheduling is key to achieve high performance in such computing environments. The most distractive assumption about the problem of task scheduling, made by the state‐of‐the‐art approaches, is to assume the problem as a whole and try to enhance the overall performance, while the problem is actually consisted of two disparate‐in‐nature subproblems, that is, sequencing subproblem and assigning one, each of which needs some special considerations. In this paper, an efficient hybrid approach named ACO‐CLA is proposed to solve task scheduling problem in the mesh‐topology cluster computing environments. In the proposed approach, an enhanced ant colony optimization (ACO) is developed to solve the sequence subproblem, whereas a cellular learning automata (CLA) machine tackles the assigning subproblem. The utilization of background knowledge about the problem (i.e., tasks' priorities) has made the proposed approach very robust and efficient. A randomly generated data set consisting of 125 different random task graphs with various shape parameters, like the ones frequently encountered in the biomedicine, has been utilized for the evaluation of the proposed approach. The conducted comparison study clearly shows the efficiency and superiority of the proposed approach versus traditional counterparts in terms of the performance. From our first metric, that is, the NSL (normalized schedule length) point of view, the proposed ACO‐CLA is 2.48% and 5.55% better than the ETF (earliest time first), which is the second‐best approach, and the average performance of all other competing methods. On the other hand, from our second metric, that is, the speedup perspective, the proposed ACO‐CLA is 2.66% and 5.15% better than the ETF (the second‐best approach) and the average performance of all the other competitors.

Authentication protocols are powerful tools to ensure confidentiality as an important feature of Internet of Things (IoT). The Denial-of-Service (DoS) attack is one of the significant threats to availability, as another essential feature of IoT, which deprives users of services by consuming the energy of IoT nodes. On the other hand, computational intelligence algorithms can be applied to solve such issues in the network and cyber domains. Motivated by this, this article links these concepts. To do so, we analyze two lightweight authentication protocols, present a DoS attack inspired by users' misbehavior and suggest a solution called received signal strength, which is easy to compute, applicable for resisting against different kinds of vulnerabilities in Internet protocols, and feasible for practical implementations. We implement it on two scenarios for locating attackers, investigate the effects of IoT devices' internal error on locating, and propose an optimization problem to finding the exact location of attackers, which is efficiently solvable for computational intelligence algorithms, such as TLBO. Besides, we analyze the solutions for unreliable results of accurate devices and provide a solution to detect attackers with less than 12-cm error and the false alarm probability of 0.7%.

Abstract Label manipulation attacks are a subclass of data poisoning attacks in adversarial machine learning used against different applications, such as malware detection. These types of attacks represent a serious threat to detection systems in environments having high noise rate or uncertainty, such as complex networks and Internet of Thing (IoT). Recent work in the literature has suggested using the K -nearest neighboring algorithm to defend against such attacks. However, such an approach can suffer from low to miss-classification rate accuracy. In this paper, we design an architecture to tackle the Android malware detection problem in IoT systems. We develop an attack mechanism based on silhouette clustering method, modified for mobile Android platforms. We proposed two convolutional neural network-type deep learning algorithms against this Silhouette Clustering-based Label Flipping Attack . We show the effectiveness of these two defense algorithms— label-based semi-supervised defense and clustering-based semi-supervised defense —in correcting labels being attacked. We evaluate the performance of the proposed algorithms by varying the various machine learning parameters on three Android datasets: Drebin, Contagio, and Genome and three types of features: API, intent, and permission. Our evaluation shows that using random forest feature selection and varying ratios of features can result in an improvement of up to 19% accuracy when compared with the state-of-the-art method in the literature.

Intrusion Detection Systems (IDSs) can identify the malicious activities and anomalies in networks and present robust protection for these systems. Clustering of attacks plays an important role in defining IDS defense policies. A key challenge in clustering has been finding the optimal value for the number of clusters. In this paper, we propose an automatic clustering algorithm as part of an IDS architecture. This algorithm is based on concepts of coherence and separation. Our automatic clustering algorithms find clusters with the most similarity between the proposed cluster elements and the least similarity with other clusters. The proposed clustering is further optimized by considering two types of objective index functions, and Artificial Bee Colony (ABC), Particle Swarm Optimization (PSO), and Differential Evolution (DE) methods. Comparison of the results obtained with other work in the literature shows improvements in terms of the low average number of evaluations functions, high accuracy, and low computation cost.

Clustering has become an important means to analyze large datasets when labeled data is not available. The volume of data and its variety however challenge classical clustering algorithms, with density-based ones suffering from severe scalability issues.In this paper, we propose a way to perform density-based clustering efficiently by exploiting the horizontal scalability offered by big data solution such as Apache Spark. We are motivated by recent techniques for Internet monitoring that rely on clustering to group similar events and spot anomalies. We focus specifically on textual data, such as URLs or server logs. Computing the distance between points, here represented as strings, becomes a major issue. Indeed, when datasets become large, most of density-based clustering algorithms are bottlenecked by the computation of all the distances between any pairs of elements. To overcome this, we propose to decouple the distance computation, easily amenable to parallelization, from the algorithm execution. By using this approach, we can easily exploit the benefits of distributed platforms like Apache Spark or MapReduce. A faster execution of the algorithms is thus guaranteed, together with more flexibility in the choice of the clustering method.We make both the code and the dataset publicly available, to both guarantee the repeatability of the experiments, and possibly offering a new benchmark dataset.

Software defined networking (SDN) is a novel networking paradigm which decouples control plane from data plane. This separation facilitates a high level of programmability and manageability. On the other hand, it makes the SDN controller a bottleneck and hence vulnerable to control plane saturation attack. One of the key mechanism to achieve control plane saturation is via TCP SYN flooding attack. This is one of the most effective and popular denial of service attack, in which the attacker produces many half-open TCP connections on the targeted server in order to degrade its availability. Furthermore, when applied to SDN, TCP SYN flooding attack also introduces control plane saturation attack. In particular, the attacker generates a significant number of TCP SYN packets and imposes data plane switches to forward them to the controller. As a result, the performance of the controller degrades and the controller will not be able to respond genuine requests in acceptable time. In this paper, we propose SLICOTS, an effective and efficient countermeasure to mitigate TCP SYN flooding attack in SDN. SLICOTS takes the advantage of dynamic programmability nature of SDN to detect and prevent attacks. SLICOTS is implemented in the controller, it surveils ongoing TCP connection requests, and blocks malicious hosts. We implemented SLICOTS as an extension module of OpenDayLight controller and evaluated it under different attack scenarios. The experimental results confirm that, compared to the state-of-art, SLICOTS reduces the response time overhead up to some 50%, while ensuring the same level of protection.