Vertical Federated Learning (VFL) is a privacy-preserving distributed learning paradigm where parties with disjoint features collaboratively train a unified Machine Learning (ML) model without leaking private data. This approach effectively addresses medical data fragmentation, allowing organizations to build unified models even when regulations like GDPR or HIPAA prevent raw data sharing. However, VFL faces a critical scalability challenge due to its static architecture. Onboarding new participants typically requires costly system-wide retraining, demanding that all original participants remain online. This bottleneck limits the growth of real-world collaborative ecosystems. To address this, we propose DistillVFL, a novel framework leveraging Knowledge Distillation for efficient client onboarding. Our approach employs a teacher–student paradigm where a pre-trained multi-party “teacher” model transfers knowledge to a new “student” client. This approach allows original clients to remain offline, eliminating re-participation requirements and additional computational costs. We evaluate DistillVFL through extensive experiments on four diverse medical datasets. The results demonstrate that student clients can achieve performance comparable to the comprehensive teacher model while drastically reducing computational overhead. DistillVFL provides a practical, scalable solution to the client onboarding problem, facilitating more dynamic and adaptable VFL collaborations.

Explainable artificial intelligence methods remain critical for trustworthy insider threat detection, yet existing approaches lack systematic frameworks for validating explanation quality against domain expertise. This research presents a SHAP (SHapley Additive exPlanations) based reclassification framework that integrates exact Shapley value computation with domain knowledge mapping to enhance detection accuracy whilst enabling transparent analyst oversight. The framework introduces a threat directions mapping that systematically translates feature attributions into cybersecurity interpretations, achieving high alignment with security analyst assessments across 27 behavioural indicators. Human-in-the-loop reclassification guided by automated explanation quality assessment demonstrates practical feasibility for operational deployment. Experimental evaluations with the help of 316,250 CMU CERT instances yield substantial accuracy improvements and significant false positive reduction compared to baseline classification. Statistical validation through paired t-tests confirms highly significant improvements ( p = 0 . 0023 , Cohen’s d = 0 . 368 ). A thorough comparative analysis demonstrates the strengths of our scheme: LIME (Local Interpretable Model-agnostic Explanations) provides computational efficiency for real-time response, whilst SHAP delivers mathematical rigour supporting forensic analysis and regulatory compliance. This work advances trustworthy artificial intelligence in cybersecurity through mathematically rigorous explanation frameworks enabling confident human oversight without sacrificing detection performance.

Arabic spam detection remains a critical challenge in cybersecurity, due to the complexity of language and inadequate resources compared to those available for English. This research introduces a human-centered framework for Arabic spam classification, integrating behavioral insights from phishing vulnerability studies with advanced machine learning models. Building on our previous work for student phishing awareness and behavioral patterns, we have developed customized translation workflows and enhanced state-of-the-art detection techniques through the integration of human factors. Our enhanced models demonstrate a significant improvement in classification accuracy and a reduction in false positive rates. The results indicate that incorporating human perceptual elements not only bolsters technical performance but also enhances the real-world effectiveness of Arabic spam detection systems. This approach effectively bridges the gap between technical capability and practical deployment, providing a more robust solution for Arabic-language cybersecurity applications.

Insider threats remain a persistent challenge in cybersecurity due to the deceptive nature of malicious activities conducted under legitimate user accounts. This paper presents a session-based detection framework integrating SMOTE-IPF oversampling and XGBoost classification to address temporal context limitations and class imbalance in insider threat datasets. To mitigate the extreme class imbalance characteristic of insider threat datasets, the framework integrates SMOTE-IPF, an advanced oversampling technique that maintains minority class structure while reducing overfitting. The model, trained with a GPU-accelerated XGBoost classifier, achieves notable performance improvements: $50 \%$ recall for threat instances at the F1-optimal threshold, 99.995 % accuracy for normal activity, and only four false positives. An ROC-AUC of 0.9429 and an F1score of 0.5263 demonstrate the model’s effectiveness in balancing precision and recall. These results indicate the proposed approach can enhance threat identification while maintaining operational feasibility in high-stakes security environments.