The routing protocol for low-power and lossy networks (RPL) has become the de facto routing standard for resource-constrained IoT systems, but its lightweight design exposes critical vulnerabilities to a wide range of routing-layer attacks such as hello flood, decreased rank, and version number manipulation. Traditional countermeasures, including protocol-level modifications and machine learning classifiers, can achieve high accuracy against known threats, yet they fail when confronted with novel or zero-day attacks unless fully retrained, an approach that is impractical for dynamic IoT environments. In this paper, we investigate incremental learning as a practical and adaptive strategy for intrusion detection in RPL-based networks. We systematically evaluate five model families, including ensemble models and deep learning models. Our analysis highlights that incremental learning not only restores detection performance on new attack classes but also mitigates catastrophic forgetting of previously learned threats, all while reducing training time compared to full retraining. By combining five diverse models with attack-specific analysis, forgetting behavior, and time efficiency, this study provides systematic evidence that incremental learning offers a scalable pathway to maintain resilient intrusion detection in evolving RPL-based IoT networks.

We propose the Wasserstein Black Hole Transformer (WBHT) framework for detecting black hole (BH) anomalies in communication networks. These anomalies cause packet loss without failure notifications, disrupting connectivity and leading to financial losses. WBHT combines generative modeling, sequential learning, and attention mechanisms to improve BH anomaly detection. It integrates a Wasserstein generative adversarial network with attention mechanisms for stable training and accurate anomaly identification. The model uses long-short-term memory layers to capture long-term dependencies and convolutional layers for local temporal patterns. A latent space encoding mechanism helps distinguish abnormal network behavior. Tested on real-world network data, WBHT outperforms existing models, achieving significant improvements in F1 score (ranging from 1.65% to 58.76%). Its efficiency and ability to detect previously undetected anomalies make it a valuable tool for proactive network monitoring and security, especially in mission-critical networks.

Network backbone black holes(BH) pose significant challenges in the Internet by causing disruptions and data loss as routers silently drop packets without notification. These silent BH failures, stemming from issues like hardware malfunctions or misconfigurations, uniquely affect point-to-point packet flows without disrupting the entire network. Unlike cyber attacks and network intrusions, BHs are often untraceable, making early detection vital and challenging. This study addresses the need for an effective forecasting solution for BH occurrences, especially in environments with unlabeled traffic data where traditional anomaly detection methods fall short. The Type-Independent Black Hole Forecasting Model is introduced to predict BH occurrences with high precision across various anomalies, including contextual and collective anomaly types. The three-stage methodology processes unlabeled time-series network data, where the data is not pre-labeled as anomaly or normal, using machine learning and deep learning techniques to identify and forecast potential BH occurrences. The ’Point BH Identification and Segregation’ stage segregates point BH traffic using Density-Based Spatial Clustering of Applications with Noise(DBSCAN), followed by Reintegration and Time Series Smoothing. The final stage, Advanced Contextual and Collective BH Detection leverages Convolutional AutoEncoder(Conv-AE) with window sliding for advanced anomaly detection. Evaluation using a dual-dataset approach, including real backbone network traffic and a time-series adapted public dataset, demonstrates the adaptability of the model to real backbone BH detection systems. Experimental results show superior performance compared to state-of-the-art unsupervised anomaly forecasting models, with a 98% detection rate and 90% F-1 score, outperforming models like MultiHeadSelfAttention, which is the main building block of Transformers.

Despite the crucial importance of addressing Black Hole failures in Internet backbone networks, effective detection strategies in backbone networks are lacking. This is largely because previous research has been centered on Mobile Ad-hoc Networks (MANETs), which operate under entirely different dynamics, protocols, and topologies, making their findings not directly transferable to backbone networks. Furthermore, detecting Black Hole failures in backbone networks is particularly challenging. It requires a comprehensive range of network data due to the wide variety of conditions that need to be considered, making data collection and analysis far from straightforward. Addressing this gap, our study introduces a novel approach for Black Hole detection in backbone networks using specialized Yet Another Next Generation (YANG) data models with Black Hole-sensitive Metric Matrix (BHMM) analysis. This paper details our method of selecting and analyzing four YANG models relevant to Black Hole detection in ISP networks, focusing on routing protocols and ISP-specific configurations. Our BHMM approach derived from these models demonstrates a 10% improvement in detection accuracy and a 13% increase in packet delivery rate, highlighting the efficiency of our approach. Additionally, we evaluate the Machine Learning approach leveraged with BHMM analysis in two different network settings, a commercial ISP network, and a scientific research-only network topology. This evaluation also demonstrates the practical applicability of our method, yielding significantly improved prediction outcomes in both environments.

The effectiveness of Intrusion Detection Systems (IDS) is critical in an era where cyber threats are becoming increasingly complex. Machine learning (ML) and deep learning (DL) models provide an efficient and accurate solution for identifying attacks and anomalies in computer networks. However, using ML and DL models in IDS has led to a trust deficit due to their non-transparent decision-making. This transparency gap in IDS research is significant, affecting confidence and accountability. To address, this paper introduces a novel Explainable IDS approach, called X-CBA, that leverages the structural advantages of Graph Neural Networks (GNNs) to effectively process network traffic data, while also adapting a new Explainable AI (XAI) methodology. Unlike most GNN-based IDS that depend on labeled network traffic and node features, thereby overlooking critical packet-level information, our approach leverages a broader range of traffic data through network flows, including edge attributes, to improve detection capabilities and adapt to novel threats. Through empirical testing, we establish that our approach not only achieves high accuracy with 99.47% in threat detection but also advances the field by providing clear, actionable explanations of its analytical outcomes. This research also aims to bridge the current gap and facilitate the broader integration of ML/DL technologies in cybersecurity defenses by offering a local and global explainability solution that is both precise and interpretable.

Demand prediction is crucial for companies in the retail industry to increase their profit and customer satisfaction. Although recent studies show the success of state-of-art machine learning and deep learning models in demand prediction, enriching datasets using graph-based feature representations to improve demand forecasting models is still rare. In this study, we propose a demand forecasting model that forecasts demand with the usage of graph-based product embeddings. Unlike most of the existing methods, the sale information data is used to extract the relations and several relationships are utilized to construct graphs. Using the Node2Vec and GraphSAGE algorithms, five different embeddings are evaluated to reflect the different relationships of products. Extreme Gradient Boosting Regressor (XGBR) is preferred over other models because of the ability to handle high sparse data. In order to observe and compare the results of different models, we also implement Long Short Term Memory (LSTM). The performance is evaluated using a public retail dataset and the results show that the proposed model gives less error using Node2Vec graph-based embedding with XGBR.

This paper presents an approach to popularity prediction task. The approach differs from existing works by combining enriched user and post features with statistical features and image object detection related features. Moreover, in this paper, generic popularity prediction models are built that can make predictions for all types of posts from any users which is different from existing works. Briefly, the study contributes by combining various types of features, using more image related visual features and having a dramatically larger dataset compared to previous studies. A specific dataset containing 210.630 posts was crawled from Instagram in order to be used in the study and state-of-the-art Machine Learning algorithms were run on the dataset. Models predicted the log-normalized number of likes of posts as popularity value (ranging between 0 and 18.48) and the results show that the popularity of Instagram posts can be predicted with 0.92 rank-order correlation and 0.4212 Mean Absolute Error. The results indicate that combining user and post features with statistical features and image object detection related features yields good performance on popularity prediction.

Supply and demand are two fundamental concepts of sellers and customers. Predicting demand accurately is critical for organizations in order to be able to make plans. In this paper, we propose a new approach for demand prediction on an e-commerce web site. The proposed model differs from earlier models in several ways. The business model used in the e-commerce web site, for which the model is implemented, includes many sellers that sell the same product at the same time at different prices where the company operates a market place model. The demand prediction for such a model should consider the price of the same product sold by competing sellers along the features of these sellers. In this study we first applied different regression algorithms for specific set of products of one department of a company that is one of the most popular online e-commerce companies in Turkey. Then we used stacked generalization or also known as stacking ensemble learning to predict demand. Finally, all the approaches are evaluated on a real world data set obtained from the e-commerce company. The experimental results show that some of the machine learning methods do produce almost as good results as the stacked generalization method.

Social media usage has increased marginally in the last decade and it is still continuing to grow. Companies, data scientists, and researchers are trying to infer meaningful information from this vast amount of data. One of the most important target applications is to find influential people in these networks. This information can serve many purposes such as; user or content recommendation, viral marketing, and user modeling. Social media is divided into subcategories like where one can share photos (i.e. Instagram, Flickr), video or music (i.e. Youtube, Last.fm), restaurant suggestions like Foursquare, or text like Twitter. Twitter is more of an idea and news sharing media than other types of social media and it has a huge amount of public profiles. These features of Twitter make it a more interesting and valuable media to research on. In this paper, we are addressing to identify topical authorities/influential users in Twitter. We provide a novel representation of users' topical interests called focus rate. We incorporate nodal features into network features and introduce a modified version of Pagerank algorithm which efficiently analyzes topical influence of users. Experimental results show that focus rate of users on specific topics increase their influence scores and lead to higher information diffusion. We use also distributed computing environment which enables to work with large data sets. We demonstrate our results on Turkish Twitter messages. For the best of our knowledge, this is the first influence analysis on Twitter that is conducted for Turkish language.

Evolving networks, which are composed of objects and relationships that change over time, are prevalent in many real-world domains and have become an significant research topic in recent years. Most of the previous link prediction studies neglect the evolution of the network over time and mainly focus on the predicting the future links based on a static features of nodes and links. However, real-world networks have complex dynamic structures and non-linear varying topological features, which means that both nodes and links of the networks may appear or disappear. These dynamicity of the networks make link prediction a more challenging task. To overcome these difficulties, link prediction in such networks must model nonlinear temporal evolution of the topological features and link occurrences information of the network structure simultaneously. In this article, we propose a novel link prediction method based on NARX Neural Network for evolving networks. Our model first calculates similarity scores based on quasi-local measures for each pair of nodes in different snapshots of the network and create time series for each pair. Then, NARX network is effectively applied to prediction of the future node similarity scores by using past node similarities and node connectivities. The proposed method is tested on DBLP coauthorship networks. It is shown that combining time information with node similarities and node connectivities improves the link prediction performance to a large extent.

Link prediction in social networks refers to predicting the emergence of future connections between nodes. It is considered as one of the important tasks in various data mining applications for recommendation systems, bioinformatics, world wide web and it has attracted a great deal of attention recently. There are several studies on link prediction based on static topological similarity metrics and static graph representation without considering the temporal evolutions of link occurrences. Most of the previous methods for link prediction in evolving networks use the exisiting connections in the network to predict new ones. In this paper, we propose a novel method, called Multivariate Time Series Link Prediction, for link prediction in evolving networks that integrates (1) temporal evolution of the network; (2) node similarities; (3) node connectivity information. The proposed method is based on a Vector Autoregression (VAR) Model for Multivariate Time Series forecasting which enables to represent time information over a combination of node similarities and node connectivities. The proposed method is tested on coauthorship networks. It is shown that integrating time information with node similarities and node connectivities improves the link prediction performance to a large extent.

In recent years, analyzing data streams has attracted considerable attention in different fields of computer science. In this paper, two different frameworks, namely MOA and Spark MLlib, are examined for linear regression on streaming data. The focus is placed on determining how well the linear regression techniques implemented in the frameworks that could be used to model the data streams. We also examine the challenges of massive data streams and how MOA and Spark Streaming solve these kinds of challenges. As a result of the experiments, we see that although the usage of MOA is more easier than Spark MLlib, Spark MLlib linear regression performance on streaming data is better.

Communities in real life are usually dynamic and community structures evolve over time. Detecting community evolution provides insight into the underlying behavior of the network. A growing body of study is devoted in studying the dynamics of communities in evolving social networks. Most of them provide an event-based framework to characterize and track the community evolution. A part of these studies take a step further and provide a predictive model of the events by exploiting community features. However, the proposed models require the community extraction and computing the community features relevant to the time point to be predicted. In this paper, we proposed a new approach for predicting events by estimating feature values related to the communities in a given network. An event-based framework is used to characterize community behavior patterns. Then, a time series ARIMA model is used to predict how particular community features will change in the following time period. Distinct time windows are examined in constituting and analyzing time series. Our proposed approach efficiently tracks similar communities and identifies events over time. Furthermore, community feature values are forecasted with an acceptable error rate. Event prediction using forecasted feature values substantially match up with actual events.

Twitter is one of the largest micro blogging web sites where users share news, their opinions, moods, recommendations by posting text messages, and it is mostly used like a news media. Since the data being shared via Twitter is vast, many researches are focusing on extracting meaningful information with the help of information retrieval systems. Retrieving meaningful information from social media applications became important for several tasks such as sentiment analysis, detecting anomalies, and recommendation systems. Topic modeling is one of the mostly studied and hard problems in information retrieval area, and it is even more challenging to model topics when the documents are too short such as tweets. In this paper, we focus on developing an effective and efficient method to overcome this challenge of tweets being too short for topic modeling. We compare different topic modeling schemes, one of which is not studied before, based on Latent Dirichlet Allocation (LDA) that merges tweets in order to improve LDA performance. We also demonstrate our experimental results with unbiased data collection and evaluation methodologies.

Communities are fundamental units of every social network, their structure and evolution are essential to understanding the structure and functionality of large networks. Also, community evolution prediction is an important task with various real-life applications in social network analysis. In this paper, we present a framework for modeling community evolution prediction in social networks. Each community is characterized by a wide range of structural features to describe community characteristics and a series of evolutionary events. A community matching algorithm is also proposed to efficiently identify and track similar communities over time. Experiments on different data sets prove that a high rate of community evolution prediction has been achieved.

Social Bookmarking systems enable users to store, organize and search their resources. Furthermore, a social bookmarking system allows users to share their resources with others and even join groups of people with similar interests. The data size in social bookmarking systems has been increased sharply in recent years with the usage of such systems. However, such systems attract spammers due to their ease of use and popularity. Spammers have started misleading search engines and other bookmarking system users in order to direct web traffic towards their own pages. Strong prevention and detection methods in social bookmarking systems are indispensable in order to stop spam activities and guaranty the accuracy and reliability of information. In this paper, we introduce a novel framework for spam detection task in social bookmarking systems. Here, we propose a set of new features to improve the accuracy of spammer detection. Our experiments show that our features demonstrate a high discriminative power. A performance evaluation of our proposed method over different spammer detection methods indicate that the proposed framework yields an improvement of the prediction accuracy.

The concept of Web 2.0 or "semantic web" has been getting more and more popular during the last half decade. The potential of very subtle yet important emergent semantics hidden in such environments calls for equally elegant and powerful methods to "mine" them. However, much of the previous work on model based recommender systems for folksonomies considered user to resource and resource to tag similarity separately, ignoring the dependency of users' interest to both the tags and the corresponding resources. In this paper, we propose a probabilistic personalized recommendation model, Latent Interest Model, that accounts for users, tags and resources jointly. The proposed method's performance is evaluated on real data sets obtained from a popular online bookmarking site using different performance measures for tag and resource recommendation tasks. Our experimental results show that our model captures personal preferences for tag usage and resource selection. Performance evaluation of Latent Interest Model indicates that the proposed personalized method yields significant improvement of recommendation accuracy.

Attractiveness of social network analysis as a research topic in many different disciplines is growing in parallel to the continuous growth of the Internet, which allows people to share and collaborate more. Nowadays, detection of community structures, which may be established on social networks, is a popular topic in Computer Science. High computational costs and non-scalability on large-scale social networks are the biggest drawbacks of popular community detection methods. The main aim of this study is to reduce the original network graph to a maintainable size so that computational costs decrease without loss of solution quality, thus increasing scalability on such networks. In this study, we focus on Ant Colony Optimization techniques to find quasi-cliques in the network and assign these quasi-cliques as nodes in a reduced graph to use with community detection algorithms. Experiments are performed on commonly used social networks with the addition of several large-scale networks. Based on the experimental results on various sized social networks, we may say that the execution times of the community detection methods are decreased while the overall quality of the solution is preserved.

Text clustering has become an important part of the web data organization with the rapid growth of the World Wide Web (www). Clustering simplifies web search engine work by grouping large amount of documents, retrieved according to a given query. Similarity measures used in clustering affect the ou tput of the grouping directly. Most of the document clustering techniques rely on single term analysis of text, such as vector space model. In order to improve grouping of Turkish documents, we investigate several similarity measures based on the semantic similarity of terms. Moreover, some techniques for calculating documents similarity are studied. The aim of this paper is to study the effects of semantic and single term similarity measures to the clustering results of Turkish documents. All experiments are carried out on Turkish web sites, taking into account the relationships of terms based on the ontology for the Turkish language.

In web recommender systems, clustering is done offline to extract usage patterns and a successful recommendation highly depends on the quality of this clustering solution. In these types of applications, data to be clustered is in the form of user sessions which are sequences of web pages visited by the user. Sequence clustering is one of the important tools to work with this type of data. One way to represent sequence data is through weighted, undirected graphs where each sequence is a vertex and the pairwise similarities between the user sessions are the edges. Through this representation, the problem becomes equivalent to graph partitioning which is NP-complete and is best approached using multiple objectives. Hence it is suitable to use multiobjective evolutionary algorithms (MOEA) to solve it. The main focus of this paper is to determine an effective MOEA to cluster sequence data. Several existing approaches in literature are compared on sample data sets and the most suitable approach is determined.

With the rapid growth of the World Wide Web (www), it becomes a critical issue to design and organize the vast amounts of on-line documents on the web according to their topic. Even for the search engines it is very important to group similar documents in order to improve their performance when a query is submitted to the system. Clusterng is useful for taxonomy design and similarity search of documents on such a domain. Similarity is fundamental to many clustering applications on hypertext. In this paper, we will study how measures of similarity are used to cluster a collection of documents on a web site. Most of the document clustering techniques rely on single term analysis of text, such as vector space model. To better group of related documents we propose a new semantic similarity measure. We compare our measure with Wu-Palmer similarity and cosine similarity. Experimental results show that cosine similarity perform better than the semantic similarities. We demonstrate our results on Turkish documents. This is a first study that considers the semantic similarities between Turkish documents.

Content-based classification of audio data is an important problem for various applications such as overall analysis of audio-visual streams, boundary detection of video story segment, extraction of speech segments from video, and content-based video retrieval. Though the classification of audio into single type such as music, speech, environmental sound and silence is well studied, classification of mixed type audio data, such as clips having speech with music as background, is still considered a difficult problem. In this paper, we present a mixed type audio classification system based on Support Vector Machine (SVM). In order to capture characteristics of different types of audio data, besides selecting audio features, we also design four different rep-resentation formats for each feature. Our SVM-based audio classifier can classify audio data into five types: music, speech, environment sound, speech mixed with music, and music mixed with environment sound. The experimental results show that our system outperforms other classification systems using k Nearest Neighbor (k-NN), Neural Network (NN), and Naive Bayes (NB).

Clustering methods provide users with methods to summarize and organize the huge amount of data in order to help them find what they are looking for. However, one of the drawbacks of clustering algorithms is that the result may vary greatly when using different clustering criteria. In this paper, we present a new clustering algorithm based on graph partitioning approach that only considers the pairwise similarities. The algorithm makes no assumptions about the size or the number of clusters. Besides this, the algorithm can make use of multiple clustering criteria functions. We present experimental results on a synthetic data set and a real world Web log data. Our experiments indicate that our clustering algorithm can efficiently cluster data items without any constraints on the number of clusters.

Predicting the next request of a user as she visits Web pages has gained importance as Web-based activity increases. Markov models and their variations, or models based on sequence mining have been found well suited for this problem. However, higher order Markov models are extremely complicated due to their large number of states whereas lower order Markov models do not capture the entire behavior of a user in a session. The models that are based on sequential pattern mining only consider the frequent sequences in the data set, making it difficult to predict the next request following a page that is not in the sequential pattern. Furthermore, it is hard to find models for mining two different kinds of information of a user session. We propose a new model that considers both the order information of pages in a session and the time spent on them. We cluster user sessions based on their pair-wise similarity and represent the resulting clusters by a click-stream tree. The new user session is then assigned to a cluster based on a similarity measure. The click-stream tree of that cluster is used to generate the recommendation set. The model can be used as part of a cache prefetching system as well as a recommendation model.