Vertical Federated Learning (VFL) is a privacy-preserving distributed learning paradigm where parties with disjoint features collaboratively train a unified Machine Learning (ML) model without leaking private data. This approach effectively addresses medical data fragmentation, allowing organizations to build unified models even when regulations like GDPR or HIPAA prevent raw data sharing. However, VFL faces a critical scalability challenge due to its static architecture. Onboarding new participants typically requires costly system-wide retraining, demanding that all original participants remain online. This bottleneck limits the growth of real-world collaborative ecosystems. To address this, we propose DistillVFL, a novel framework leveraging Knowledge Distillation for efficient client onboarding. Our approach employs a teacher–student paradigm where a pre-trained multi-party “teacher” model transfers knowledge to a new “student” client. This approach allows original clients to remain offline, eliminating re-participation requirements and additional computational costs. We evaluate DistillVFL through extensive experiments on four diverse medical datasets. The results demonstrate that student clients can achieve performance comparable to the comprehensive teacher model while drastically reducing computational overhead. DistillVFL provides a practical, scalable solution to the client onboarding problem, facilitating more dynamic and adaptable VFL collaborations.

Explainable artificial intelligence methods remain critical for trustworthy insider threat detection, yet existing approaches lack systematic frameworks for validating explanation quality against domain expertise. This research presents a SHAP (SHapley Additive exPlanations) based reclassification framework that integrates exact Shapley value computation with domain knowledge mapping to enhance detection accuracy whilst enabling transparent analyst oversight. The framework introduces a threat directions mapping that systematically translates feature attributions into cybersecurity interpretations, achieving high alignment with security analyst assessments across 27 behavioural indicators. Human-in-the-loop reclassification guided by automated explanation quality assessment demonstrates practical feasibility for operational deployment. Experimental evaluations with the help of 316,250 CMU CERT instances yield substantial accuracy improvements and significant false positive reduction compared to baseline classification. Statistical validation through paired t-tests confirms highly significant improvements ( p = 0 . 0023 , Cohen’s d = 0 . 368 ). A thorough comparative analysis demonstrates the strengths of our scheme: LIME (Local Interpretable Model-agnostic Explanations) provides computational efficiency for real-time response, whilst SHAP delivers mathematical rigour supporting forensic analysis and regulatory compliance. This work advances trustworthy artificial intelligence in cybersecurity through mathematically rigorous explanation frameworks enabling confident human oversight without sacrificing detection performance.

Arabic spam detection remains a critical challenge in cybersecurity, due to the complexity of language and inadequate resources compared to those available for English. This research introduces a human-centered framework for Arabic spam classification, integrating behavioral insights from phishing vulnerability studies with advanced machine learning models. Building on our previous work for student phishing awareness and behavioral patterns, we have developed customized translation workflows and enhanced state-of-the-art detection techniques through the integration of human factors. Our enhanced models demonstrate a significant improvement in classification accuracy and a reduction in false positive rates. The results indicate that incorporating human perceptual elements not only bolsters technical performance but also enhances the real-world effectiveness of Arabic spam detection systems. This approach effectively bridges the gap between technical capability and practical deployment, providing a more robust solution for Arabic-language cybersecurity applications.

The fast evolution of Internet of Things (IoT) is placing increased demands on network infrastructures to be versatile and robust, especially in dynamic, heterogeneous, and resource-limited environments. Existing cluster-based and communication protocols struggle with protocol rigidity, insufficient integrated security, and limited reconfigurability. This paper proposes a novel security-aware hybrid clustering framework integrating BIRCH-DBSCAN algorithms, MQTT/CoAP switching adaptively, and AES-128 encryption with session-based key rotation for end-to-end confidentiality. By featuring a three-layer architecture designed with autonomous cluster recovery, layered verification, and a reconfiguration system upon performance, energy, and mobility changes. Evaluated and tested on ContikiNG simulation, the approach provides $43.3 \%$ latency reduction, 22.8 % energy efficiency improvement, 99.91 % delivery reliability, and zero breaches over 39 adaptive switches with just $4.2 \%$ overhead. The results attest to the platform’s strength and viability for future IoT deployments for efficient and responsive communications in changing conditions.

Insider threats remain a persistent challenge in cybersecurity due to the deceptive nature of malicious activities conducted under legitimate user accounts. This paper presents a session-based detection framework integrating SMOTE-IPF oversampling and XGBoost classification to address temporal context limitations and class imbalance in insider threat datasets. To mitigate the extreme class imbalance characteristic of insider threat datasets, the framework integrates SMOTE-IPF, an advanced oversampling technique that maintains minority class structure while reducing overfitting. The model, trained with a GPU-accelerated XGBoost classifier, achieves notable performance improvements: $50 \%$ recall for threat instances at the F1-optimal threshold, 99.995 % accuracy for normal activity, and only four false positives. An ROC-AUC of 0.9429 and an F1score of 0.5263 demonstrate the model’s effectiveness in balancing precision and recall. These results indicate the proposed approach can enhance threat identification while maintaining operational feasibility in high-stakes security environments.

The security of Internet of Things (IoT) edge networks is often compromised by static schedules, infrequent credential renewal, and cryptographic mechanisms that operate independently of network reconfiguration. Existing approaches rarely integrate session-awareness, adaptive clustering, Quality of Service (QoS) control, and trust-based routing with coordinated cryptographic adaptation, leaving IoT deployments vulnerable to evolving threats. To address this gap, we propose SecuRecNet-IoT, a session-aware and reconfigurable security framework that couples event-triggered AES-128 key rotation with cluster reconfiguration. In a 61-node Contiki-NG testbed, 402 key rotations across 57 adaptation events were performed, sustaining forward secrecy with only 3.2% security overhead. The framework combines Balanced Iterative Reducing and Clustering using Hierarchies (BIRCH) with Density-Based Spatial Clustering of Applications with Noise (DBSCAN) to optimise trust propagation and resource efficiency, while autonomously renewing credentials based on key aging and validity. By embedding cryptographic agility directly into the reconfiguration process. Evaluation shows that our work improves secure session concurrency, reduces latency, increases throughput, and lowers energy use, all while preserving baseline QoS and performance. These findings highlight SecuRecNet-IoT as a practical, scalable solution for next-generation IoT edge deployments requiring both strong security and high efficiency.