Ransomware has evolved into a complex, adaptive, and fast–moving adversary category in which static signatures and monolithic classifiers fail to generalise under concept drift, evasion, and behavioural polymorphism. In this paper we present Agentic SABRE (Semantic–Behavioural Arbitration for Ransomware Evaluation) : an uncertainty–aware, neuro–symbolic, multi–agent framework for adaptive ransomware detection. SABRE fuses semantic (representation–based) and behavioural (time–window forensic telemetry) evidence, and employs Monte Carlo Dropout inference to quantify epistemic uncertainty for each agent. We introduce a decision–layer orchestrator that performs risk– and uncertainty–aware triage via two interpretable thresholds: a risk score τ and an uncertainty budget κ . High–confidence, high–risk samples are automatically contained, while uncertain or borderline cases are escalated to human analysts, establishing a flexible computational contract between autonomous response and analyst oversight. To support auditability and trust, SABRE integrates post–hoc explainability mechanisms including gradient saliency, permutation importance, and counterfactual analysis, enabling both local and global interpretation of agent decisions. Extensive evaluation on RDset and RanSMAP demonstrates that Agentic SABRE preserves perfect discrimination on saturated semantic datasets (AUC = 1.0 ) while improving robustness under weak behavioural signals, achieving up to a 4.9% relative reduction in false escalations at equal recall and maintaining calibrated predictive uncertainty. Counterfactual analysis further shows that semantic and behavioural decisions can be flipped with bounded perturbation cost, indicating stable and interpretable decision boundaries. Overall, Agentic SABRE is not merely a higher–accuracy detector but an agentic cyber–defence system that combines uncertainty–aware automation, explainable reasoning, and adaptive triage under evolving ransomware threats.

Artificial intelligence techniques have achieved strong performance in classifying Windows Portable Executable (PE) malware, but their reliability often degrades under dataset shifts, leading to misclassifications with severe security consequences. To address this, we enhance an existing LightGBM (LGBM) malware detector by integrating Neural Networks (NN), PriorNet, and Neural Network Ensembles, evaluated across three benchmark datasets: EMBER, BODMAS, and UCSB. The UCSB dataset, composed mainly of packed malware, introduces a substantial distributional shift relative to EMBER and BODMAS, making it a challenging testbed for robustness. We study uncertainty-aware decision strategies, including probability thresholding, PriorNet, ensemble-derived estimates, and Inductive Conformal Evaluation (ICE). Our main contribution is the use of ensemble-based uncertainty estimates as Non-Conformity Measures within ICE, combined with a novel threshold optimisation method. On the UCSB dataset, where the shift is most severe, the state-of-the-art probability-based ICE (SOTA) yields an incorrect acceptance rate (IA%) of 22.8%. In contrast, our method reduces this to 16% a relative reduction of about 30% while maintaining competitive correct acceptance rates (CA%). These results demonstrate that integrating ensemble-based uncertainty with conformal prediction provides a more reliable safeguard against misclassifications under extreme dataset shifts, particularly in the presence of packed malware, thereby offering practical benefits for real-world security operations.

Current mobile payment schemes gather detailed information about purchases customers make. This data can then be used to infer a customer’s spending behaviour, potentially violating their privacy. To tackle this problem, we propose an untraceable mobile payment scheme that strikes a better balance, preserving user privacy while allowing the Third-Party Service Provider (TPSP) to collect necessary information such as card details and transaction amount for regulatory compliance. Our scheme offers untraceability for legitimate users from malicious adversaries and curious TPSPs using cryptographic primitives such as partially blind signatures, zero-knowledge proofs, and identity-based signatures. It also guarantees that only authorised TPSPs can issue valid payment tokens, and even with limited data, the TPSP can still prevent dishonest customers/merchants from double-spending a payment token. We also propose a comprehensive evaluation framework to assess the untraceable payment schemes against seven key criteria such as untraceability, exculpability—merchant double-spending, exculpability—customer double-spending, unforgeability, confidentiality, message authenticity, efficiency, and regulatory compliance. We rigorously benchmark the security and privacy of our proposed payment scheme against this framework and other established schemes. Furthermore, we formally verify these properties using complexity-based analysis and Proverif modelling.

Since the Internet of Things (IoT) is widely adopted using Android applications, detecting malicious Android apps is essential. In recent years, Android graph-based deep learning research has proposed many approaches to extract relationships from the application as a graph to generate graph embeddings. First, we demonstrate the effectiveness of graph-based classification using graph neural networks (GNNs)-based classifier to generate API graph embedding. The graph embedding is used with “Permission” and “Intent” to train multiple machine learning and deep learning algorithms to detect Android malware. The classification achieved an accuracy of 98.33% in CICMaldroid and 98.68% in the Drebin data set. However, the graph-based deep learning is vulnerable as an attacker can add fake relationships to avoid detection by the classifier. Second, we propose a generative adversarial network (GAN)-based algorithm named VGAE-MalGAN to attack the graph-based GNN Android malware classifier. The VGAE-MalGAN generator generates adversarial malware API graphs, and the VGAE-MalGAN substitute detector (SD) tries to fit the detector. Experimental analysis shows that VGAE-MalGAN can effectively reduce the detection rate of GNN malware classifiers. Although the model fails to detect adversarial malware, experimental analysis shows that retraining the model with generated adversarial samples helps to combat adversarial attacks.

Many works have proposed integrating sentiment analysis with collaborative filtering algorithms to improve the accuracy of recommendation systems. As a result, service providers collect both reviews and ratings, which is increasingly causing privacy concerns among users. Several works have used the Local Differential Privacy (LDP) based input perturbation mechanism to address privacy concerns related to the aggregation of ratings. However, researchers have failed to address whether perturbing just ratings can protect the privacy of users when both reviews and ratings are collected. We answer this question in this paper by applying an LDP based perturbation mechanism in a recommendation system that integrates collaborative filtering with a sentiment analysis model. On the user-side, we use the Bounded Laplace mechanism (BLP) as the input rating perturbation method and Bidirectional Encoder Representations from Transformers (BERT) to tokenize the reviews. At the service provider’s side, we use Matrix Factorization (MF) with Mixture of Gaussian (MoG) as our collaborative filtering algorithm and Convolutional Neural Network (CNN) as the sentiment classification model. We demonstrate that our proposed recommendation system model produces adequate recommendation accuracy under strong privacy protection using Amazon’s review and rating datasets.

Cyberbullying has become a highly problematic occurrence due to its potential of anonymity and its ease for others to join in the harassment of victims. The distancing effect that technological devices have, has led to cyberbullies say and do harsher things compared to what is typical in a traditional face-to-face bullying situation. Given the great importance of the problem, detection is becoming a key area of cyberbullying research. Therefore, it is highly necessary for a framework to accurately detect new cyberbullying instances automatically. To review the machine learning and deep learning approaches, two datasets were used. The first dataset was provided by the University of Maryland consisting of over 30,000 tweets, whereas the second dataset was based on the article `Automated Hate Speech Detection and the Problem of Offensive Language' by Davidson et al., containing roughly 25,000 tweets. The paper explores machine learning approaches using word embeddings such as DBOW (Distributed Bag of Words) and DMM (Distributed Memory Mean) and the performance of Word2vec Convolutional Neural Networks (CNNs) to classify online hate.

In recent years the number and sophistication of Android malware have increased dramatically. A prototype framework which uses static analysis methods for classification is proposed which employs two feature sets to classify Android malware, permissions declared in the Androidmanifest.xml and Android classes used from the Classes.dex file. The extracted features were then used to train a variety of machine learning algorithms including Random Forest, SGD, SVM and Neural networks. Each machine learning algorithm was subsequently optimised using optimisation algorithms, including the use of bio-inspired optimisation algorithms such as Particle Swarm Optimisation, Artificial Bee Colony optimisation (ABC), Firefly optimisation and Genetic algorithm. The prototype framework was tested and evaluated using three datasets. It achieved a good accuracy of 95.7 percent by using SVM and ABC optimisation for the CICAndMal2019 dataset, 94.9 percent accuracy (with fl-score of 96.7 percent) using Neural network for the KuafuDet dataset and 99.6 percent accuracy using an SGD classifier for the Andro-Dump dataset. The accuracy could be further improved through better feature selection.

Phishing is a type of social engineering attack that can affect any company or anyone. This paper explores the effect that different features and optimisation techniques have on the accuracy of intelligent phishing detection using machine learning algorithms. This work looks at both hyperparameter optimisation as well as feature selection optimisation. For hyperparameter tuning, both TPE (Tree-structured Parzen Estimator) and GA (Genetic Algorithm) were tested, with the best option being model dependent. For feature selection, GA, MFO (Moth Flame Optimisation) and PSO (Particle Swarm Optimisation) were used with PSO working best with a Random Forest model. This work used URL (Uniform Resource Locator), DOM (Document Object Model) structure, page rank and page information related features. This research found that the best combination was Random Forest using PSO for feature selection and TPE for hyperparameter optimisation, giving an accuracy of 99.33%.

Twitter has changed the way people get information by allowing them to express their opinion and comments on the daily tweets. Unfortunately, due to the high popularity of Twitter, it has become very attractive to spammers. Unlike other types of spam, Twitter spam has become a serious issue in the last few years. The large number of users and the high amount of information being shared on Twitter play an important role in accelerating the spread of spam. In order to protect the users, Twitter and the research community have been developing different spam detection systems by applying different machine-learning techniques. However, a recent study showed that the current machine learning-based detection systems are not able to detect spam accurately because spam tweet characteristics vary over time. This issue is called “Twitter Spam Drift”. In this paper, a semi-supervised learning approach (SSLA) has been proposed to tackle this. The new approach uses the unlabeled data to learn the structure of the domain. Different experiments were performed on English and Arabic datasets to test and evaluate the proposed approach and the results show that the proposed SSLA can reduce the effect of Twitter spam drift and outperform the existing techniques.

The retinal blood vessel segmentation plays a significant role in the automatic or computer-assisted diagnosis of retinopathy. Manual blood vessel segmentation is very time-consuming and requires a great amount of domain knowledge. In addition, the blood vessels are only a few pixels wide and cover the entire fundus image. This further hinders the recent systems from automating the retinal blood vessel segmentation efficiently. In this paper, we propose a modified differential evolution (DE) algorithm to carry out automatic retinal blood vessel segmentation. The modified DE employs cross-communication among multiple populations to select three types of features i.e. thick blood vessels, thin blood vessels and non-blood vessels. Multiple classifiers such as neural networks (NN), Support vector machines (SVM), NN based and SVM based ensembles are used to further measure the performance of segmentation. The proposed algorithm is evaluated on three publicly available retinal image datasets like DRIVE, STARE and HRF. It outperformed the state-of-the-art with a high average accuracy of 98.5% along with high sensitivity and specificity.

Automatic facial expression recognition is widely used for various applications such as health care, surveillance and human-robot interaction. In this paper, we present a novel system which employs automatic facial emotion recognition technique for adaptive AI agent behaviour. The proposed system is equipped with kirsch operator based local binary patterns for feature extraction and diverse classifiers for emotion recognition. First, we nominate a novel variant of the local binary pattern (LBP) for feature extraction to deal with illumination changes, scaling and rotation variations. The features extracted are then used as input to the classifier for recognizing seven emotions. The detected emotion is then used to enhance the behaviour selection of the artificial intelligence (AI) agents in a shooter game. The proposed system is evaluated with multiple facial expression datasets and outperformed other state-of-the-art models by a significant margin.

This study investigates the performance of two open source intrusion detection systems (IDSs) namely Snort and Suricata for accurately detecting the malicious traffic on computer networks. Snort and Suricata were installed on two different but identical computers and the performance was evaluated at 10 Gbps network speed. It was noted that Suricata could process a higher speed of network traffic than Snort with lower packet drop rate but it consumed higher computational resources. Snort had higher detection accuracy and was thus selected for further experiments. It was observed that the Snort triggered a high rate of false positive alarms. To solve this problem a Snort adaptive plug-in was developed. To select the best performing algorithm for Snort adaptive plug-in, an empirical study was carried out with different learning algorithms and Support Vector Machine (SVM) was selected. A hybrid version of SVM and Fuzzy logic produced a better detection accuracy. But the best result was achieved using an optimised SVM with firefly algorithm with FPR (false positive rate) as 8.6% and FNR (false negative rate) as 2.2%, which is a good result. The novelty of this work is the performance comparison of two IDSs at 10 Gbps and the application of hybrid and optimised machine learning algorithms to Snort.

In this paper, an existing rule-based intrusion detection system (IDS) is made more intelligent through the application of machine learning. Snort was chosen as it is an open source software and though it was performing well, it showed false positives (FPs). To find the best performing machine learning algorithms (MLAs) to use with Snort so as to improve its detection, we tested some algorithms on three available datasets. Support vector machine (SVM) was chosen along with fuzzy logic and decision tree based on their accuracy. Combined versions of algorithms through ensemble SVM along with other variants were tried on the generated traffic of normal and malicious packets at 10[Formula: see text]Gbps. Optimized versions of the SVM along with firefly and ant colony optimization (ACO) were also tried, and the accuracy improved remarkably. Thus, the application of combined and optimized MLAs to Snort at 10[Formula: see text]Gbps worked quite well.

A Wireless Sensor Network (WSN) is a network of many nodes. These nodes are equipped with sensors which communicate wirelessly using techniques for radio frequency transmission. This network helps to measure and record the physical environment variables and to forward these results to a central location known as a sink. As WSN nodes are only supplied by a battery, the primary challenge is to reduce the energy consumption. The MAC layer is responsible for the establishment of a reliable and efficient communication link between WSN nodes and is responsible for energy waste. The newly proposed MAC protocol in this paper uses an improved variant of CSMA which implements weak signal detection (WSD). This technique enables dividing collisions from weak signals and takes appropriate decisions to reduce energy consumption. The CSMA/WSD protocol is presented as a flowchart and implemented in OMNeT++ by using the MiXiM framework structure. Implementation tests are performed to prove the validity of the implemented protocol in different scenarios. Different simulation scenarios show that this protocol offers a higher throughput, a smaller mean backoff time, and less average delay in critical environments.

Wideband transmission improves the ability of a device to communicate in different scenarios and with a range of devices. Wideband transmission protocols can also make use of multiple bands to implement parallelism and thereby improve throughput. Such transmissions require hardware that is capable of handling wideband signals for both, transmission and reception. The study undertaken in this paper looks at some popular antennae and their performance in wideband scenarios. It is usually noticed that high-frequency signals (mobile phones, WiFi, 3G, etc.) show very high attenuation in foliage. However, it is also noticed that lower frequencies (TV signals, FM radio, CB Radio, etc.) can penetrate the same environments quite well. Hence a wideband protocol that can adaptively use the available frequency band is needed. This paper presents the comparison of antennae that may be beneficial for use with such a protocol, in an attempt to identify a low-cost and effective antenna that will sufficiently satisfy the communication requirements for radio signals from 100 MHz to 2.4 GHz. Some available popular antennae, namely, 2.4 GHz Yagi Antenna, Whip Antenna and the retractable telescopic antenna, was considered for this study since the cost was an important criterion.

As more and more corporations and business entities have been publishing corporate sustainability reports, the current manual process of analyzing the reports is becoming obsolete and tedious. Development of an intelligent software tool to perform the report analysis task would be an ideal solution to this long standing problem. In this paper we argue that, given sufficient quality training using a custom corpus, corporate sustainability reports can be analyzed in mass numbers using a supervised learning based text mining software. We also discuss our methodologies of improving the accuracy of our classifier as well as the feature selector in order to gain better performance and more stability. Additionally, the achieved results of executing the developed software on one hundred reports are discussed in order to prove our claims.