This paper surveys the application of explainable artificial intelligence (XAI) in cybersecurity, including malware detection, intrusion detection, and adversarial attacks. Without a doubt, artificial intelligence (AI) has made its way to decision-making in these applications. The primary focus has been on building AI models that are both accurate and efficient. However, cyber analysts and security experts must understand the underlying reasons behind security decisions to resolve existing issues and improve system security. The black-box nature of AI models makes it difficult to provide such an understanding, leading to a lack of AI robustness and its widespread adoption across industries. On the other hand, XAI is a collection of AI models that enhance AI robustness, thereby having the potential to address the aforementioned challenges. The primary objective of this paper is to discuss AI cybersecurity challenges and how XAI can be utilized to address these challenges, provide an overview of XAI techniques, and present and compare state-of-the-art research in XAI for cybersecurity. The paper also addresses the weaknesses of XAI techniques related to their security vulnerabilities and resiliency to adversarial attacks. Finally, challenges associated with using XAI for cybersecurity are also discussed to spur further research.

Undoubtedly, Machine Learning (ML) has revolutionized many applications in recent years. A vast amount of heterogeneous data distributed globally is being used to build efficient and robust prediction models. This has led to the need for decentralized ML paradigms. Federated Learning (FL) has emerged as a decentralized ML paradigm that creates global models from multiple privately trained local datasets. Nevertheless, FL comes with some challenges, such as using a central server, leading to a single point of failure and trust issues. Blockchain-based Federated learning (BFL) has been proposed to resolve these challenges. However, due to the openness of the Blockchain system, malicious clients can access critical information, such as the number of participating clients, and launch attacks on the BFL system. This paper presents a practicable model poisoning attack on BFL systems. Several experiments are conducted with different attack scenarios and settings explored. The evaluations and results show the efficacy and impact of the model poisoning.

Crowdsourcing applications, such as Uber for ride-sharing, enable distributed problem-solving. A subset of these applications is intelligent crowd-forecasting applications, e.g., Virustotal, for malware detection. In crowd-forecasting applications, multiple agents respond with predictions about potential future event outcome(s). These responses are then combined to assess the events collaboratively and act accordingly. Unlike conventional crowdsourcing applications that only communicate information, crowd-forecasting applications need to additionally process information to achieve a collaborative assessment. Hence, they require knowledge-based systems instead of simple storage-based ones for crowdsourcing applications. Most existing crowd-forecasting systems are centralized, leading to the inherent single point of failure and inefficient collaborative assessment. This paper presents CrowdFAB,CrowdsourcedForecastingApplications usingBlockchains. We deploy a knowledge-based blockchain paradigm that transforms blockchains from simple storage to knowledge-based systems, thereby achieving crowd-forecasting requirements without centralization. In addition, we formulate a novel reputation scheme that assigns reputations to agents based on their performance. We then use this scheme when making assessments. We implement and analyze CrowdFAB in terms of overhead and security features. Further, we evaluate CrowdFAB for a collaborative malware detection use case, where multiple detectors are involved for crowd forecasting. Results demonstrate CrowdFAB's superior accuracy and other metrics performance compared to other works with the same settings.

The rapid evolutions in microcomputing, mini-hardware manufacturing, and machine-to-machine (M2M) communications have enabled novel Internet-of-Things (IoT) solutions to reshape many networking applications. Healthcare systems are among these applications that have been revolutionized with IoT, introducing an IoT branch known as the Internet-of-Medical Things (IoMT) systems. IoMT systems allow remote monitoring of patients with chronic diseases. Thus, it can provide timely patients' diagnostic that can save their life in case of emergencies. However, security in these critical systems is a major challenge facing their wide utilization. In this article, we present state-of-the-art techniques to secure IoMT systems' data during collection, transmission, and storage. We comprehensively overview IoMT systems' potential attacks, including physical and network attacks. Our findings reveal that most security techniques do not consider various types of attacks. Hence, we propose a security framework that combines several security techniques. The framework covers IoMT security requirements and can mitigate most of its known attacks.

Federal Aviation Administration (FAA) of the United States is considering Remote ID systems for unmanned aerial vehicles (UAVs). These systems act as license plates used on automobiles, but they transmit information using radio waves. To be useful, the transmissions in such systems need to reach long distances to minimize the number of ground stations to capture these transmissions. LoRaWAN is designed as a cheap long-range technology to be used for long-range communication for the Internet of Things. Several manufacturers make LoRaWAN modules, which are readily available on the market and are, therefore, ideal for the UAVs Remote IDs at a low cost. In this paper, we present our experiences in using LoRaWAN technology as a communication technology. Our experiments to identify and locate the UAV systems uncovered several issues of using LoRaWAN in such systems that are documented in this paper. Using several ground stations, we can determine the location of a UAV equipped with a LoRaWAN module that transmits the UAV Remote ID. Hence, it can help identify UAVs that unintentionally, or intentionally, fly into restricted zones.

Cloud computing has been widely adopted by application service providers (ASPs) and enterprises to reduce both capital expenditures (CAPEX) and operational expenditures (OPEX). Applications and services previously running on private data centers are now being migrated to private or public clouds. Since most of the ASPs and enterprises have globally distributed user bases, their services need to be distributed across multiple clouds, spread across the globe which can achieve better performance in terms of latency, scalability and load balancing. The shift has eventually led the research community to study multi-cloud environments. However, the widespread acceptance of such environments has been hampered by major security concerns. Firewalls and traditional rule-based security protection techniques are not sufficient to protect user-data in multi-cloud scenarios. Recently, advances in machine learning techniques have attracted the attention of the research community to build intrusion detection systems (IDS) that can detect anomalies in the network traffic. Most of the research works, however, do not differentiate among different types of attacks. This is, in fact, necessary for appropriate countermeasures and defense against attacks. In this paper, we investigate both detecting and categorizing anomalies rather than just detecting, which is a common trend in the contemporary research works. We have used a popular publicly available dataset to build and test learning models for both detection and categorization of different attacks. To be precise, we have used two supervised machine learning techniques, namely linear regression (LR) and random forest (RF). We show that even if detection is perfect, categorization can be less accurate due to similarities between attacks. Our results demonstrate more than 99% detection accuracy and categorization accuracy of 93.6%, with the inability to categorize some attacks. Further, we argue that such categorization can be applied to multi-cloud environments using the same machine learning techniques.

Estimating the number of sources is a key task in many array signal processing applications. Conventional algorithms such as Akaike's information criterion (AIC) and minimum description length (MDL) suffer from underestimation and overestimation errors. In this study, the authors propose four algorithms to estimate the number of sources in white Gaussian noise. The authors’ proposed algorithms are categorised into two main categories; namely, sample correlation matrix (CorrM) based and correlation coefficient matrix (CoefM) based. Their proposed algorithms are applied on the CorrM and CoefM eigenvalues. They propose to use two decision statistics, which are the moving increment and the moving standard deviation of the estimated eigenvalues as metrics to estimate the number of sources. For their two CorrM based algorithms, the decision statistics are compared to thresholds to decide on the number of sources. They show that the conventional process to estimate the threshold is mathematically tedious with high computational complexity. Alternatively, they define two threshold formulas through linear regression fitting. For their two CoefM based algorithms, they re‐define the problem as a simple maximum value search problem. Results show that the proposed algorithms perform on par or better than AIC and MDL as well as recently modified algorithms at medium and high signal‐to‐noise ratio (SNR) levels and better at low SNR levels and low number of samples, while using a lower complexity criterion function.

Estimating the number of sources received by an antenna array have been well known and investigated since the starting of array signal processing. Accurate estimation of such parameter is critical in many applications that involve prior knowledge of the number of received signals. Information theoretic approaches such as Akaikes information criterion (AIC) and minimum description length (MDL) have been used extensively even though they are complex and show bad performance at some stages. In this paper, a new algorithm for estimating the number of sources is presented. This algorithm exploits the estimated eigenvalues of the auto correlation coefficient matrix rather than the auto covariance matrix, which is conventionally used, to estimate the number of sources. We propose to use either of a two simply estimated decision statistics, which are the moving increment and moving standard deviation as metric to estimate the number of sources. Then process a simple calculation of the increment or standard deviation of eigenvalues to find the number of sources at the location of the maximum value. Results showed that our proposed algorithms have a better performance in comparison to the popular and more computationally expensive AIC and MDL at low SNR values and low number of collected samples.

Signal-to-noise ratio (SNR) estimation is an important parameter that is required in any receiver or communication systems. It can be computed either by a pilot signal data-aided approach in which the transmitted signal would be known to the receiver, or without any knowledge of the transmitted signal, which is a non-data-aided (NDA) estimation approach. In this paper, a NDA SNR estimation algorithm for QPSK signal is proposed. The proposed algorithm modifies the existing Signal-to-Variation Ratio (SVR) SNR estimation algorithm in the aim to reduce its bias and mean square error in case of negative SNR values at low number of samples of it. We first present the existing SVR algorithm and then show the mathematical derivation of the new NDA algorithm. In addition, we compare our algorithm to two baselines estimation methods, namely the M2M4 and SVR algorithms, using different test cases. Those test cases include low SNR values, extremely high SNR values and low number of samples. Results showed that our algorithm had a better performance compared to second and fourth moment estimation (M2M4) and original SVR algorithms in terms of normalized mean square error (NMSE) and bias estimation while keeping almost the same complexity as the original algorithms.