Magecart skimming attacks have emerged as a significant threat to client-side security and user trust in online payment systems. This paper addresses the challenge of achieving robust and explainable detection of Magecart attacks through a comparative study of Machine Learning (ML) models with a real-world dataset. Tree-based, linear, and kernel-based models were applied with hyperparameter tuning and feature selection, to distinguish between benign and malicious scripts. The models are supported by a Behavior Deterministic Finite Automaton (DFA), which captures structural behavior patterns in scripts, helping to analyze and classify client-side script execution logs. To ensure robustness against adversarial evasion attacks, adversarial training and evaluations were performed using attacks from Adversarial Robustness Toolbox and Adaptative Perturbation Pattern Method. In addition, concise explanations of ML decisions are provided, supporting transparency and user trust. Experimental validation demonstrated high detection performance and interpretable reasoning, demonstrating that traditional ML models can be effective in real-world web security contexts.

Magecart skimming attacks pose a significant threat to client-side security and user trust in online payment systems. This poster details an approach for the robust and explainable detection of these attacks, with a deep focus on the critical role of feature engineering in optimizing Machine Learning model performance. A suite of classifiers was evaluated under three distinct conditions to determine the most effective feature set: a comprehensive set of 103 features, a 60-feature subset selected via Random Forest importance scores, and an 80-feature subset identified through Pearson’s correlation. The findings demonstrate that the importance-based selection strategy yields a superior trade-off between model performance and computational efficiency. This is best exemplified by the Support Vector Machine model, which achieved a peak F1-score and recall when trained on the 60 most important features. The resilience of this optimized model was subsequently confirmed through extensive adversarial testing against a range of evasion attacks, where it consistently outperformed other models.

Network intrusion detection systems are fundamental to the early detection of anomalous behaviour in networks. Modern versions of these tools take advantage of Machine Learning to process large amounts of data, identify patterns, and make predictions. Their development relies on the ability to access good historical network data. Therefore, the research community has been actively working on creating new datasets, and network traffic analysis tools are frequently used in this context. This study provides a comprehensive review of existing tools for network traffic analysis, highlighting their main advantages and drawbacks. A categorisation for these tools is introduced, as well as an overview of the dataset creation process by combining one or more of these categories. An updated analysis of existing datasets is also provided, along with details regarding their creation, highlighting the progression in dataset production. Finally, the impact of dataset features is discussed, underscoring their role in enhancing the effectiveness of network intrusion detection systems.

The increasing concerns about data privacy and the stringent enforcement of data protection laws are placing growing pressure on organizations to secure large datasets. The challenge of ensuring data privacy becomes even more complex in the domains of Artificial Intelligence and Machine Learning due to their requirement for large amounts of data. While approaches like differential privacy and secure multi-party computation allow data to be used with some privacy guarantees, they often compromise data integrity or accessibility as a tradeoff. In contrast, when using encryption-based strategies, this is not the case. While basic encryption only protects data during transmission and storage, Homomorphic Encryption (HE) is able to preserve data privacy during its processing on a centralized server. Despite its advantages, the computational overhead HE introduces is notably challenging when integrated into Neural Networks (NNs), which are already computationally expensive. In this work, we present a framework called ENNigma, which is a Private Neural Network (PNN) that uses HE for data privacy preservation. Unlike some state-of-the-art approaches, ENNigma guarantees data security throughout every operation, maintaining this guarantee even if the server is compromised. The impact of this privacy preservation layer on the NN performance is minimal, with the only major drawback being its computational cost. Several optimizations were implemented to maximize the efficiency of ENNigma, leading to occasional computational time reduction above 50%. In the context of the Network Intrusion Detection System application domain, particularly within the sub-domain of Distributed Denial of Service attack detection, several models were developed and employed to assess ENNigma’s performance in a real-world scenario. These models demonstrated comparable performance to non-private NNs while also achiev ing the two-and-a-half-minute inference latency mark. This suggests that our framework is approaching a state where it can be effectively utilized in real-time applications. The key takeaway is that ENNigma represents a significant advancement in the field of PNN as it ensures data privacy with minimal impact on NN performance. While it is not yet ready for real-world deployment due to its computational complexity, this framework serves as a milestone toward realizing fully private and efficient NNs.

Healthcare data contains some of the most sensitive information about an individual, yet sharing this data with healthcare practitioners can significantly enhance patient care and support research efforts. However, current systems for sharing health data between patients and caregivers do not fully address the critical security requirements of privacy, confidentiality, and consent management. Furthermore, compliance with regulatory laws such as GDPR and HIPAA is often deficient, largely because patients typically are asked to provide general consent for healthcare entities to access their data. Recognizing the limitations of existing systems, we present a novel approach to sharing health data that provides patients with control over who accesses their data, what data is accessed, and when. Our system ensures end-to-end privacy by integrating a Proxy ReEncryption Scheme with a Searchable Encryption Scheme, utilizing Homomorphic Encryption to enable healthcare practitioners to easily and securely search and access patients’ documents. A time performance analysis is also presented, which allowed us to observe that the number of keywords has a much greater impact on the running time of the different processes than the number of files.

Cybersecurity threats highlight the need for robust network intrusion detection systems to identify malicious behaviour. These systems rely heavily on large datasets to train machine learning models capable of detecting patterns and predicting threats. In the past two decades, researchers have produced a multitude of datasets, however, some widely utilised recent datasets generated with CICFlowMeter contain inaccuracies. These result in flow generation and feature extraction inconsistencies, leading to skewed results and reduced system effectiveness. Other tools in this context lack ease of use, customizable feature sets, and flow labelling options. In this work, we introduce HERA, a new open-source tool that generates flow files and labelled or unlabelled datasets with user-defined features. Validated and tested with the UNSW-NB15 dataset, HERA demonstrated accurate flow and label generation.

Abstract Various studies have been conducted to detect network anomalies. However, because anomaly signals are determined by the pattern characteristics using the dataset, the real-time detection problem continues. Even if there is a signal with an attack sign among the constantly transmitted and received signals, the attack cannot be blocked in advance. Moreover, it appears in many places in a distributed denial-of-service (DDoS) attack, so the real-time defense must be the best option. Therefore, it is necessary first to discover the characteristics and elements regarded as abnormal signals to discover anomalies in real time. Finally, by analyzing the correlation between network data and features, extracting the elements of the anomaly, and analyzing the behavior of the extracted elements in detail, we aim to increase the accuracy of the anomaly. In this study, we used Coburg intrusion detection and KDDCup datasets and analyzed the correlation of elements in the dataset using a graph neural network. The calculated accuracy values of the anomaly detection were 94.5% and 98.85%.

Machine learning is an area of Artificial Intelligence in which applying algorithms to a dataset makes it possible to predict results or even discover relationships that would be unnoticeable at first glance. Currently the amount of information available in different areas, especially in health care where data collection and analysis seek to define personalized medicine strategies. This is a field where using Machine Learning-based tools can assume a relevant role. This work presents a study of diverse classification algorithms in the area of machine learning applied to identification of amino acid profiles. The authors defined as a major objective to develop a new biomarker profile for prediction and prognosis of rectal cancer. The data involved in the training of classification algorithms refer to patients with metabolic diseases and rectal cancer. The best machine learning classification models will be tested to achieve the most effective decision support system for a most adequate treatment option selection in order to reduce the morbidity and mortality rate.

Machine Learning (ML) can be incredibly valuable to automate anomaly detection and cyber-attack classification, improving the way that Network Intrusion Detection (NID) is performed. However, despite the benefits of ML models, they are highly susceptible to adversarial cyber-attack examples specifically crafted to exploit them. A wide range of adversarial attacks have been created and researchers have worked on various defense strategies to safeguard ML models, but most were not intended for the specific constraints of a communication network and its communication protocols, so they may lead to unrealistic examples in the NID domain. This Systematization of Knowledge (SoK) consolidates and summarizes the state-of-the-art adversarial learning approaches that can generate realistic examples and could be used in real ML development and deployment scenarios with real network traffic flows. This SoK also describes the open challenges regarding the use of adversarial ML in the NID domain, defines the fundamental properties that are required for an adversarial example to be realistic, and provides guidelines for researchers to ensure that their future experiments are adequate for a real communication network.

Complementary and alternative medicine are commonly used concomitantly with conventional medications leading to adverse drug reactions and even fatality in some cases. Furthermore, the vast possibility of herb-drug interactions prevents health professionals from remembering or manually searching them in a database. Decision support systems are a powerful tool that can be used to assist clinicians in making diagnostic and therapeutic decisions in patient care. Therefore, an original and hybrid decision support system was designed to identify herb-drug interactions, applying artificial intelligence techniques to identify new possible interactions. Different machine learning models will be used to strengthen the typical rules engine used in these cases. Thus, using the proposed system, the pharmacy community, people’s first line of contact within the Healthcare System, will be able to make better and more accurate therapeutic decisions and mitigate possible adverse events.

Cyber-physical systems are infrastructures that use digital information such as network communications and sensor readings to control entities in the physical world. Many cyber-physical systems in airports, hospitals and nuclear power plants are regarded as critical infrastructures since a disruption of its normal functionality can result in negative consequences for the society. In the last few years, some security solutions for cyber-physical systems based on artificial intelligence have been proposed. Nevertheless, knowledge domain is required to properly setup and train artificial intelligence algorithms. Our work proposes a novel anomaly detection framework based on error space reconstruction, where genetic algorithms are used to perform hyperparameter optimization of machine learning methods. The proposed method achieved an F1-score of 87.89% in the SWaT dataset.

Due to amount of today's electricity consumption, one of the most important tasks of the energy operators is to be able to predict the consumption and be ready to control the energy generation based on the estimated consumption for the future. In this way, having a trustable forecast of the electricity consumption is essential to control the consumption and maintain the balance in energy distribution networks. This study presents a day ahead forecasting approach based on a genetic fuzzy system for fuzzy rule learning based on the MOGUL methodology (GFS.FR.MOGUL). The proposed approach is used to forecast the electricity consumption of an office building in the following 24 hours. The goal of this work is to present a more reliable profile of the electricity consumption comparing to previous works. Therefore, this paper also includes the comparison of the results of day ahead forecasting using GFS.FR.MOGUL method against other fuzzy rule based methods, as well as a set of Artificial Neural Network(ANN) approaches. This comparison shows that using the GFS.FR.MOGUL forecasting method for day-ahead electricity consumption forecasting is able to estimate a more trustable value than the other approaches.

The increase of distributed energy resources, mainly based on renewable sources, requires new solutions that are able to deal with this type of resources' particular characteristics (namely, the renewable energy sources intermittent nature). The smart grid concept is increasing its consensus as the most suitable solution to facilitate the small players' participation in electric power negotiations while improving energy efficiency. The opportunity for players' participation in multiple energy negotiation environments (smart grid negotiation in addition to the already implemented market types, such as day-ahead spot markets, balancing markets, intraday negotiations, bilateral contracts, forward and futures negotiations, and among other) requires players to take suitable decisions on whether to, and how to participate in each market type. This paper proposes a portfolio optimization methodology, which provides the best investment profile for a market player, considering different market opportunities. The amount of power that each supported player should negotiate in each available market type in order to maximize its profits, considers the prices that are expected to be achieved in each market, in different contexts. The price forecasts are performed using artificial neural networks, providing a specific database with the expected prices in the different market types, at each time. This database is then used as input by an evolutionary particle swarm optimization process, which originates the most advantage participation portfolio for the market player. The proposed approach is tested and validated with simulations performed in multiagent simulator of competitive electricity markets, using real electricity markets data from the Iberian operator-MIBEL.