Explainable artificial intelligence methods remain critical for trustworthy insider threat detection, yet existing approaches lack systematic frameworks for validating explanation quality against domain expertise. This research presents a SHAP (SHapley Additive exPlanations) based reclassification framework that integrates exact Shapley value computation with domain knowledge mapping to enhance detection accuracy whilst enabling transparent analyst oversight. The framework introduces a threat directions mapping that systematically translates feature attributions into cybersecurity interpretations, achieving high alignment with security analyst assessments across 27 behavioural indicators. Human-in-the-loop reclassification guided by automated explanation quality assessment demonstrates practical feasibility for operational deployment. Experimental evaluations with the help of 316,250 CMU CERT instances yield substantial accuracy improvements and significant false positive reduction compared to baseline classification. Statistical validation through paired t-tests confirms highly significant improvements ( p = 0 . 0023 , Cohen’s d = 0 . 368 ). A thorough comparative analysis demonstrates the strengths of our scheme: LIME (Local Interpretable Model-agnostic Explanations) provides computational efficiency for real-time response, whilst SHAP delivers mathematical rigour supporting forensic analysis and regulatory compliance. This work advances trustworthy artificial intelligence in cybersecurity through mathematically rigorous explanation frameworks enabling confident human oversight without sacrificing detection performance.

The fast evolution of Internet of Things (IoT) is placing increased demands on network infrastructures to be versatile and robust, especially in dynamic, heterogeneous, and resource-limited environments. Existing cluster-based and communication protocols struggle with protocol rigidity, insufficient integrated security, and limited reconfigurability. This paper proposes a novel security-aware hybrid clustering framework integrating BIRCH-DBSCAN algorithms, MQTT/CoAP switching adaptively, and AES-128 encryption with session-based key rotation for end-to-end confidentiality. By featuring a three-layer architecture designed with autonomous cluster recovery, layered verification, and a reconfiguration system upon performance, energy, and mobility changes. Evaluated and tested on ContikiNG simulation, the approach provides $43.3 \%$ latency reduction, 22.8 % energy efficiency improvement, 99.91 % delivery reliability, and zero breaches over 39 adaptive switches with just $4.2 \%$ overhead. The results attest to the platform’s strength and viability for future IoT deployments for efficient and responsive communications in changing conditions.

Insider threats remain a persistent challenge in cybersecurity due to the deceptive nature of malicious activities conducted under legitimate user accounts. This paper presents a session-based detection framework integrating SMOTE-IPF oversampling and XGBoost classification to address temporal context limitations and class imbalance in insider threat datasets. To mitigate the extreme class imbalance characteristic of insider threat datasets, the framework integrates SMOTE-IPF, an advanced oversampling technique that maintains minority class structure while reducing overfitting. The model, trained with a GPU-accelerated XGBoost classifier, achieves notable performance improvements: $50 \%$ recall for threat instances at the F1-optimal threshold, 99.995 % accuracy for normal activity, and only four false positives. An ROC-AUC of 0.9429 and an F1score of 0.5263 demonstrate the model’s effectiveness in balancing precision and recall. These results indicate the proposed approach can enhance threat identification while maintaining operational feasibility in high-stakes security environments.

Machine unlearning has garnered widespread attention, due to various reasons, including privacy-preserving, model usability, and legal regulations. It requires model providers to unlearning users' data from models upon receiving unlearning request. Recommendation systems have also been extensively researched in the field of deep learning, particularly within the context of big data environments. However, little research can be found to verify the effectiveness of unlearning approach using pure tabular data-based recommendation scenario. In this paper, we propose a recommendation unlearning verification (RUV) scheme based on non-influential trigger data, which fills this gap. Users can use the recommendation rate for selected target items to determine whether the recommendation system complies with unlearning requests. Evaluation results on real datasets confirm the efficiency and effectiveness of our proposed RUV scheme.

The security of Internet of Things (IoT) edge networks is often compromised by static schedules, infrequent credential renewal, and cryptographic mechanisms that operate independently of network reconfiguration. Existing approaches rarely integrate session-awareness, adaptive clustering, Quality of Service (QoS) control, and trust-based routing with coordinated cryptographic adaptation, leaving IoT deployments vulnerable to evolving threats. To address this gap, we propose SecuRecNet-IoT, a session-aware and reconfigurable security framework that couples event-triggered AES-128 key rotation with cluster reconfiguration. In a 61-node Contiki-NG testbed, 402 key rotations across 57 adaptation events were performed, sustaining forward secrecy with only 3.2% security overhead. The framework combines Balanced Iterative Reducing and Clustering using Hierarchies (BIRCH) with Density-Based Spatial Clustering of Applications with Noise (DBSCAN) to optimise trust propagation and resource efficiency, while autonomously renewing credentials based on key aging and validity. By embedding cryptographic agility directly into the reconfiguration process. Evaluation shows that our work improves secure session concurrency, reduces latency, increases throughput, and lowers energy use, all while preserving baseline QoS and performance. These findings highlight SecuRecNet-IoT as a practical, scalable solution for next-generation IoT edge deployments requiring both strong security and high efficiency.

This paper introduces a novel, multi-dimensional approach to address the evolving challenges in cybersecurity incident response. Our proposed framework uniquely integrates adaptive metrics with a layered security model, providing organisations with a dynamic and context-sensitive tool for building robust response capabilities. We present an innovative integration of proactive threat hunting, real-time threat intelligence, and AI/ML analysis within a cohesive, adaptable structure-a combination not previously explored in incident response literature. This approach not only serves as a comprehensive baseline for managing and responding to incidents but also offers a comparative measure for organisations to continuously evaluate and enhance their cybersecurity postures. Through practical implementation scenarios and future prospects analysis, we demonstrate the framework's unique ability to adapt to the rapidly changing digital landscape, addressing critical gaps in current incident response strategies.

Controlling access to data is essential in ensuring data is only accessed by authorised and trusted users. For these reasons, zero-trust frameworks have been in the centre of interest in the past few years. Zero-Trust frameworks assume that users and systems have been compromised and deal with them as untrusted entities that require multiple levels of authorisation and security attributes to be compliant in order to be considered trusted. The most common zero trust frameworks use static thresholds to grant levels of access to systems which could introduce false positives and incorrect access privileges to systems/networks. This research paper proposes a machine-learning (ML)-based zero-trust framework that utilises an anomaly detection algorithm. The output of the anomalous detection would inform the observers the trustworthiness of systems in their environments. Moreover, performance, complexity and impact of our proposed scheme is compared against a static threshold zero-trust framework.

Protecting information flow, data and assets is paramount to every establishment. Therefore, enterprise security architecture design is essential in achieving this protection as it directly implements enterprise security policies. Existing research revealed that researchers have made little effort to investigate inference security challenges to enterprise security architecture design and to assess how the existing security architecture models fare against inference attacks. It was also discovered that existing security architecture models are too old and susceptible to inference attacks. Hence, this research explores a novel solution for designing effective enterprise security architecture and addressing inference attacks.

While deep learning-based recommendation systems have achieved great success, recommendation system models are also at serious risk of intellectual property infringement. Current model watermarking research faces significant challenges in terms of fidelity, invisibility, and efficiency. Additionally, existing model watermarking techniques are predominantly applied to image data, with limited applicability to tabular data. In this paper, we introduce an innovative watermarking framework designed to safeguard the ownership of recommendation system models. Specifically, we verify recommendation system model ownership by embedding a type of backdoor watermark into the training dataset, which does not affect model performance. We have conducted experiments on several classical datasets to validate the reliability and effectiveness of our approach.

Due to massive growth in IoT devices in recent years, security of these devices is a major concern. IoT applications span across a number of fields including but not limited to smart cities, intelligent agriculture systems, and the innovative industry. Despite its benefits, cybersecurity challenges have increased significantly in IoT environments. The lack of resource capacity and sophisticated security measurement exposes IoT devices to large number of recent attacks. A strong intrusion detection system (IDS) is the best way to secure IoT devices. Various studies have shown that the current IDS fails to detect modern malware in IoT environments. Some datasets do not have complex scenarios of attack. There are limitations of current datasets, or heterogeneous data of the IoT environment, such as KDD99, NLS_KDD, and UNSW _NB15. In addition, these datasets do not include an operating system and network monitoring audits. This paper comprehensively compares five machine-learning models on the recent EDGE-IIoT dataset. We examine these machine learning methods on Binary and Multiclass class IDS and the security challenges in managing current and future attacks in an IoT environment.

Deep learning is being extensively utilized across various domains, with deep learning-based recommendation systems gaining prominence due to their exceptional performance. However, these systems are vulnerable to data poisoning attacks, where adversaries introduce carefully crafted fake user ratings to compromise the integrity of the recommendation model. We propose a dual defense to address this threat. The first line of defense, termed active defense, preemptively reduces the system’s vulnerability to poisoning attacks by incorporating crafted regularization into the loss function. This approach diminishes the attacker’s impact while preserving system performance, thereby lowering the success rate of targeted attacks. To further enhance the system’s robustness, we introduce a Generative Adversarial Network (GAN) based detection model as a passive defense strategy to accurately identify and filter out poisoned data. Empirical evaluations on three distinct datasets demonstrate that our dual defense approach significantly enhances both the proactive defense and passive detection capabilities of recommendation systems, effectively countering data poisoning attacks.

Online proctoring has become a necessity in online teaching. Video-based crowd-sourced online proctoring solutions are being used, where an exam-taking student's video is moni-tored by third-parties, leading to privacy concerns. In this paper, we propose a privacy-preserving online proctoring system. The proposed image-hashing-based system can detect the student's excessive face and body movement (i.e., anomalies) that is resulted when the student tries to cheat in the exam. The detection can be done even if the student's face is blurred or masked in video frames. Experiment with an in-house dataset shows the usability of the proposed system.

Photo Response Non-Uniformity (PRNU) noise obtained from images or videos is used as a camera fingerprint to attribute visual objects captured by a camera. The PRNU-based source attribution method, however, fails when there is misalignment between the fingerprint and the query object. One example of such a misalignment, which has been overlooked in the field, is caused by the in-camera resizing technique that a video may have been subjected to. This paper investigates the attribution of visual media in the context of matching a video query object to an image fingerprint or vice versa. Specifically this paper focuses on improving camera attribution performance by taking into account the effects of binning, a commonly used in-camera resizing technique applied to video. We experimentally show that the True Positive Rate (TPR) obtained when binning is considered is approximately 3% higher.

The connectivity of devices has increased in the last decade enabling multiple innovative applications and solutions to serve industries and societies. This has solved multiple challenges and facilitated the improvement of methodologies and techniques adapted by humanity. One of the newly created paradigms that changed industries and technology is the Industrial Internet of Things (IIoT). IIoT is currently being adapted by various industries creating interactive supply chain ecosystems through the use of cloud computing. The size and distributions of these ecosystems introduced latency and Quality of Service (QoS) issues for edge devices sending data to the cloud. This research paper explores a paradigm called “Fog Computing” which aims to reduce the latency between IIoT devices and the cloud by deploying a “cloud-like” computing layer closer to the IIoT devices. In addition, a Context-Aware implementation of fog computing is proposed in this paper to provide the most optimised service to edge devices. Furthermore, this paper includes various experiments that examine the different context-awareness perspectives this paper proposes for fog computing. The results and outcomes of these experiments show reduction in latency and automated resource scaling from the use of context-awareness with fog computing over cloud computing for IIoT.

Photo Response Non-Uniformity (PRNU) noise-based source camera attribution is a popular digital forensic method. In this method, a camera fingerprint computed from a set of known images of the camera is matched against the extracted noise of an anonymous questionable image to find out if the camera had taken the anonymous image. The possibility of privacy leak, however, is one of the main concerns of the PRNU-based method. Using the camera fingerprint (or the extracted noise), an adversary can identify the owner of the camera by matching the fingerprint with the noise of an image (or with the fingerprint computed from a set of images) crawled from a social media account. In this article, we address this privacy concern by encrypting both the fingerprint and the noise using the Boneh-Goh-Nissim (BGN) encryption scheme, and performing the matching in encrypted domain. To overcome leakage of privacy from the content of an image that is used in the fingerprint calculation, we compute the fingerprint within a trusted environment, such as ARM TrustZone. We present e-PRNU that aims at minimizing privacy loss and allows authorized forensic experts to perform camera attribution. The security analysis shows that the proposed approach is semantically secure. Experimental results show that the run-time computational overhead is 10.26 seconds when a cluster of 64 computing nodes are used.

The Internet has resulted in cyber-threats and cyber-crimes, which can occur anywhere at any time. Among various cyber threats, modern malware with applied metamorphosis and polymorphic technology is a concern as it can proliferate to advanced variants from its original shape. The typical malware analysis methods, including signature-based approach, remain vulnerable to such advanced variants. This paper proposes a visualization-based approach for malware analysis using the state-of-the-art Convolution Neural Network (CNN) model such as ResNeXt, which had achieved outstanding performance in image classifications with competitive computational complexity. The proposed method transforms the attributes of raw malware binary executable files to greyscale images for further analysis by well-established deep learning models. The greyscale images, which result of data transformation for visualization, are classified using ResNeXt. The experiment results show that the proposed solution achieves 98.32% and 98.86% of accuracy in malware classification on Malimg dataset and modified Malimg dataset, respectively. The proposed method outperforms other comparable methods in terms of classification accuracy and requires similar level of computational power.

Photo Response Non-Uniformity (PRNU) based camera attribution is an effective method to determine the source camera of a visual object (an image or a video). To apply this method, images or videos need to be obtained from a camera to create a “camera fingerprint” which then can be compared against the PRNU of the query media whose origin is under question. The fingerprint extraction process can be time consuming when a large number of video frames or images have to be denoised. This may need to be done when the individual images have been subjected to high compression or other geometric processing such as video stabilization. This paper investigates a simple, yet effective and efficient technique to create a camera fingerprint when so many still images need to be denoised. The technique utilizes Spatial Domain Averaged (SDA) frames. An SDA-frame is the arithmetic mean of multiple still images. When it is used for fingerprint extraction, the number of denoising operations can be significantly decreased with little or no performance loss. Experimental results show that the proposed method can work more than 50 times faster than conventional methods while providing similar matching results.

The unavailability of a pornographic image database has been an impediment for automated detection of child pornographic images. Beyond data confidentiality and privacy issues, even mere possession of such images is illegal in many countries. In this paper, these issues are addressed for skin tone detection, which is an essential component for filtering pornographic images. A pornographic image is encrypted using order preserving encryption, randomization, and permutation. Skin pixels are detected from the encrypted image in the encrypted domain without revealing the image content. Experiments and analysis show that the proposed scheme has low overhead and no degradation in detection accuracy.

PRNU (Photo Response Non-Uniformity)-based camera fingerprints are useful for identifying the source camera of an anonymous image. As the query image has to be correlated with each candidate camera fingerprint, one key concern of this approach is the high run time overhead when using a large camera database. Clever techniques have been proposed to reduce the computation and I/O time either by reducing the size of the fingerprint or by group testing where multiple candidate fingerprints can be eliminated by a single correlation operation. However, these techniques assume that the query images have not been scaled or cropped. In practice this may often not be the case, especially when query images are taken from social media sites. This paper presents a simple scaling-based approach for source camera identification when the query image is of full resolution or if it is cropped from an unknown location (of the original image). The proposed approach can also be easily combined with other known approaches for PRNU matching of scaled images. Experiments using 250 cameras showed that the run time overhead can decrease by a factor 13 when the query is a cropped image.

Photo response non-uniformity (PRNU) noise-based source attribution is a well-known technique to verify the camera of an image or video. Researchers have proposed various countermeasures to prevent PRNU-based source camera attribution. Forced seam-carving is one such recently proposed counter forensics technique. This technique can disable PRNUbased source camera attribution by forcefully removing seams such that the size of most uncarved image blocks is less than 50 × 50 pixels. In this paper, we show that given multiple seamcarved images from the same camera, source attribution can still be possible even if the size of uncarved blocks in the image is less than the recommended size of 50 × 50 pixels. Theoretical analysis and experiments with multiple cameras demonstrate that the effectiveness of our scheme depends on the number of seams carved from an image and the randomness of the seam positions.

Photo Response Non-Uniformity (PRNU) noise based source attribution is a well known technique to verify the source camera of an anonymous image or video. Researchers have proposed various counter measures to PRNU based source camera attribution. Forced seam-carving is a recently proposed counter forensics measure that was proposed to defeat PRNU based source attribution by disturbing the alignment of PRNU noise patterns. This paper shows that given a multiple number of seam-carved images, source attribution can still be reliably made even if the size of a non-carved image block is less than the recommended size of 50×50.

With the evolution of cloud computing, organizations are outsourcing the storage and rendering of volume (i.e., 3D data) to cloud servers. Data confidentiality at the third-party cloud provider, however, is one of the main challenges. In this paper, we address this challenge by proposing – 3DCrypt – a modified Paillier cryptosystem scheme for multi-user settings that allows cloud datacenters to render the encrypted volume. The rendering technique we consider in this work is pre-classification volume ray-casting. 3DCrypt is such that multiple users can render volumes without sharing any encryption keys. 3DCrypt’s storage and computational overheads are approximately 66.3 MB and 27 seconds, respectively when rendering is performed on a 256 × 256 × 256 volume for a 256×256 image space.

The evolution of cloud computing and a drastic increase in image size are making the outsourcing of image storage and processing an attractive business model. Although this outsourcing has many advantages, ensuring data confidentiality in the cloud is one of the main concerns. There are state-of-the-art encryption schemes for ensuring confidentiality in the cloud. However, such schemes do not allow cloud datacenters to perform operations over encrypted images. In this paper, we address this concern by proposing 2DCrypt, a modified Paillier cryptosystem-based image scaling and cropping scheme for multi-user settings that allows cloud datacenters to scale and crop an image in the encrypted domain. To anticipate a high storage overhead resulted from the naive per-pixel encryption, we propose a space-efficient tiling scheme that allows tile-level image scaling and cropping operations. Basically, instead of encrypting each pixel individually, we are able to encrypt a tile of pixels. 2DCrypt is such that multiple users can view or process the images without sharing any encryption keys-a requirement desirable for practical deployments in real organizations. Our analysis and results show that 2DCrypt is INDistinguishable under Chosen Plaintext Attack secure and incurs an acceptable overhead. When scaling a 512×512 image by a factor of two, 2DCrypt requires an image user to download approximately 5.3 times more data than the un-encrypted scaling and need to work approximately 2.3 s more for obtaining the scaled image in a plaintext.

Secret image sharing is a popular image hiding scheme that typically uses (3, 3, n) multi-secret sharing to hide the colors of a secret image. The use of (3, 3, n) multi-secret sharing, however, can lead to information loss. In this paper, we study this loss of information from an image perspective, and show that one-third of the color values of the secret image can be leaked when the sum of any two selected share numbers is equal to the considered prime number in the secret sharing. Furthermore, we show that if the selected share numbers do not satisfy this condition (for example, when the value of each of the selected share number is less than the half of the value of the prime number), then the colors of the secret image are not leaked. In this case, a noise-like image is reconstructed from the knowledge of less than three shares.

Advances in cloud computing have allowed volume rendering tasks, typically done by volume ray-casting, to be outsourced to cloud data centers. The availability of volume data and rendered images (which can contain important information such as the disease information of a patient) to a third-party cloud provider, however, presents security and privacy challenges. This paper addresses these challenges by proposing a secure cloud-based volume ray-casting framework that distributes the rendering tasks among the data centers and hides the information that is exchanged between the server and a data center, between two data centers, and between a data center and the client by using Shamir's secret sharing, such that none of the data centers has enough information to know the secret data and/or rendered image. Experiments and analyses show that our framework is highly secure and requires low computation cost.

Secret image sharing is a method for distributing a secret image amongst n data stores, each storing a shadow image of the secret, such that the original secret image can be recovered only if any k out of the n shares is available. Existing secret image sharing schemes, however, do not support scaling and cropping operations on the shadow image, which are useful for zooming on large images. In this paper, we propose an image sharing scheme that allows the user to retrieve a scaled or cropped version of the secret image by operating directly on the shadow images, therefore reducing the amount of data sent from the data stores to the user. Results and analyses show that our scheme is highly secure, requires low computational cost, and supports a large number of scale factors with arbitrary crop.

Outsourcing the tasks of medical data visualization to cloud centers presents new security challenges. In this paper, we propose a framework for cloud-based remote medical data visualization that protects the security of data at the cloud centers. To achieve this, we integrate the cryptographic secret sharing with pre-classification volume ray-casting and propose a secure volume ray-casting pipeline that hides the color-coded information of the secret medical data during rendering at the data centers. Results and analysis show the utility of the proposed framework.