AI-based models have been extensively investigated for integration into IoT botnet intrusion detection systems. However, their deployment in enterprise environments remains limited due to their inability to adapt to the non-stationary characteristics of IoT attack traffic, which are often influenced by persistent concept drift. These detection models are typically trained on stationary IoT attack data, leading to a substantial degradation in detection performance when concept drift occurs. One widely adopted strategy for addressing concept drift is incremental learning which involves retraining and updating the classifier whenever a drift occurs. Nonetheless, the rapid evolution of IoT attacks results in frequent concept drifts, which not only impose substantial retraining costs but also heighten the risk of catastrophic forgetting of previously learned information, caused by model shift arising from continuous weight updates. To address these limitations and support practical deployment, this study proposes VLSA-CL, a method that integrates variational latent space alignment with contrastive learning to achieve robust attack detection under continuous concept drift. In the proposed framework, latent representations of incoming traffic are aligned with previously learned latent spaces prior to classification. The alignment model employs contrastive learning to enforce class-wise coherence between new and historical representations, thereby enhancing traffic discrimination. Notably, the classifier is trained once on historical data, eliminating the need for continual retraining and reducing the risk of catastrophic forgetting. Comprehensive experiments conducted on three real-world IoT attack datasets validate the effectiveness of the proposed method, showing that it sustains strong detection performance under concept drift while substantially lowering false alarm rates and missed detections on unseen traffic.

With the increasing sophistication of Advanced Persistent Threats (APTs), the demand for effective detection and mitigation strategies and methods has escalated. Program execution leaves traces in the system audit log, which can be analyzed to detect malicious activities. However, collecting and analyzing large volumes of audit logs over extended periods is challenging, further compounded by insufficient labeling that hinders their usability. Addressing these challenges, this paper introduces SAGA (Synthetic Audit log Generation for APT campaigns), a novel approach for generating find-grained labeled synthetic audit logs that mimic real-world system logs while embedding stealthy APT attacks. SAGA generates configurable audit logs for arbitrary duration, blending benign logs from normal operations with malicious logs based on the definitions the MITRE ATT&CK framework. Malicious audit logs follow an APT lifecycle, incorporating various attack techniques at each stage. These synthetic logs can serve as benchmark datasets for training machine learning models and assessing diverse APT detection methods. To demonstrate the usefulness of synthetic audit logs, we ran established baselines of event-based technique hunting and APT campaign detection using various synthetic audit logs. In addition, we show that a deep learning model trained on synthetic audit logs can detect previously unseen techniques within audit logs.

In this article, we focus on the robustness of behavior-based malware analysis models, justified by the need to address the high mutation rates of malware executables that debilitate conventional signature-based approaches and even behavior-based AI solutions. In response to these challenges, we propose MAMBA + , an obfuscation-resistant dynamic analysis approach tailored for uncovering malware behavior. We have assembled a comprehensive collection of behavioral obfuscation attacks designed to undermine behavior-based models. The central concept behind MAMBA + involves treating obfuscated calls as perturbed data and introducing a novel loss function to effectively balance ground-truth predictions and the handling of these perturbations. To facilitate this approach, MAMBA + designs adapted embedding mechanisms to transform traces of API calls into high-dimensional vectors for attention calculations. Through a comprehensive empirical study with seven obfuscations and three unseen attacks, we reveal important qualitative properties of MAMBA + , and quantitatively demonstrate its superiority in performance and robustness to all compared methods.

Allocating guaranteed resources and optimizing system parameters for Cloud-native Network Function (CNF) deployments introduce significant complexity in management. The performance of CNFs deployed on shared resources always depends on their incoming traffic and their competition for the underlying resource, both of which are usually very dynamic. The complexity of managing their deployments across many physical resources can explode very quickly and become infeasible for taking runtime management decisions in closed-loops. In this work we experimentally analyze the impact of CNFs sharing Central Processing Unit (CPU) and memory resources and make a key observation that increasing the number of deployed CNFs results in an increase of packet service time variability which in turn leads to longer waiting times. We also propose a model of CNF performance when sharing these resources, and discuss its extension to a general compute-network resource model for CNF performance estimation in closed management loops.

The fast evolution of technologies like wireless sensor networks, cloud computing services, advanced AI driven applications and the Internet of Things (IoT) have led to increased reliance on internet by both individual users and enterprises—both small and large. On the contrary, the advancements in cybersecurity have not matched this pace consequently attracting exponentially rising trends of cyberattacks in the past decade. To enhance network security, this work proposes ResDNViT, a robust model integrating a self-attention-based Vision Transformer (ViT) architecture with a simplified ResNet-based architecture for NetFlow-based attack detection. Motivated by the strong performance of transformers in tasks related to NLP and computer vision, ResDNViT extends the ViT-based architecture for network traffic analysis by expressing NetFlow features as 2D matrices, and splitting them into equal-sized sub-matrices, that are used as input patches for the encoder component. A simplified residual dense network (ResDN) with two residual dense blocks (RDB) is stacked to the encoder’s output layer for classification. The novelty of this approach lies in effectively adapting the ViT-based architecture, originally designed for images, to analyzing NetFlow packets for attack classification. The model was evaluated on four well-studied benchmark datasets: the CICIDS2017_improved, Bot-IoT, CICIoT2022, and N-BaIoT, demonstrating an impressive performance across various classification tasks. The proposed approach’s ability to detect traffic from unseen device kinds was assessed by grouping devices from N-BaIoT into five categories based on usage: Thermostats, Baby Monitors, Doorbells, Security Cameras and Webcams. The model was trained using samples from four categories at a time and tested on samples from the remaining category. A high performance across metrics including accuracy, precision, recall, and F1-score for all categories highlighted the model’s robustness in traffic discrimination. • Combines a ViT-encoder and simplified ResNet-based architecture. • Proposed model removes conv layers, avoiding local spatial dependencies of ResNet. • Enhanced NetFlow attack detection over state-of-the-art detection methods. • Model adapts to unseen device types, removing need for retraining on new devices.

• Proposed an approach for IoT botnet attack detection under non-stationarity. • Deployed latent space alignment to mitigate frequent classifier retraining. • Demonstrated the impact of non-stationarity on detection performance. • Improved attack detection under non-stationary IoT traffic. • Prevents catastrophic forgetting by preserving historical information. Although earlier research has demonstrated that AI-driven models can attain exceptionally high accuracy in identifying IoT-based threats, their practical integration into enterprise environments for real-world attack detection and classification remains limited. This is primarily due to their reliance on stationary datasets for training and evaluation, which fail to capture the dynamic nature of real-world IoT NetFlow traffic, characterized by frequent concept drifts. A common solution is to retrain and update the classifier whenever a concept drift is detected. However, the rapid evolution of IoT attacks translates into frequent drifts, leading to high retraining costs and the risk of the model forgetting historical patterns, making it vulnerable to previously seen attack types. To address these challenges and facilitate real-world adoption, this study proposes a method for detecting novel attacks in non-stationary environments without requiring constant model retraining. The approach involves training a Variational Auto-encoder (VAE) on historical data, followed by training a classifier on the VAE’s latent space representations. Through latent space alignment, new instances are mapped to the established latent space learned from historical data, enabling the classifier to effectively detect attacks without retraining while preserving knowledge of past attack patterns. Our evaluation, using both synthetic and real-world IoT attack traffic, demonstrates the robustness of this approach, achieving improved detection performance under concept drift while significantly reducing false alarms and missed detections on unseen traffic.

The coming era of widespread integration of Internet of Things (IoT) devices to all areas of society has facilitated a fundamental transformation of local and global communication networks, giving rise to novel issues relating to capacity planning, network administration, and cybersecurity. Accurate network traffic prediction is one of the key enablers for addressing these challenges. While there are methods for quantifying the complexity (predictability in timing, shape, and volume) of wide-scale aggregate traffic, they cannot be directly applied to IoT traffic as they do not account for the heterogeneity of IoT devices. Lacking an effective complexity characterization for IoT traffic, network traffic administrators are under-informed on the impacts of IoT device-type traffic on their networks. In this work, the complexity of IoT traffic is examined from two novel perspectives, the information-theoretic approach of Lempel–Ziv, a foundational algorithm in lossless data compression, and in the distribution of spectral components of the Fourier transform. Based on these perspectives, two new measures of IoT network traffic complexity are proposed. Furthermore, we introduce a novel mathematical framework to permit a formal comparison of new and existing methods. The new framework additionally verifies that the new metrics satisfy desirable properties for a measure of complexity. In a comprehensive empirical study, our results, when compared with existing approaches, exceed all others in behavioral resolution, convergence rate, physical interpretability, and algorithmic stability, under severely heterogeneous conditions. Benchmark experiments demonstrate substantial run-time improvements over existing approaches, creating a strong case for their use in online, real-time settings.

Federated learning methods offer secured monitor services and privacy-preserving paradigms to end-users and organisations in the Internet of Things networks such as smart healthcare systems. Federated learning has been coined to safeguard sensitive data, and its global aggregation is often based on a centralised server. This design is vulnerable to malicious attacks and could be breached by privacy attacks such as inference and free-riding, leading to inefficient training models. Besides, uploaded analysing parameters by patients can reveal private information and the threat of direct manipulation by the central server. To address these issues, we present a three-fold Federated Edge Aggregator, the so-called Edge Intelligence, a federated learning-based privacy protection framework for safeguarding Smart Healthcare Systems at the edge against such privacy attacks. We employ an iteration-based Conventional Neural Network (CNN) model and artificial noise functions to balance privacy protection and model performance. A theoretical convergence bound of Edge Intelligence on the trained federated learning model's loss function is also introduced here. We evaluate and compare the proposed framework with the recently established methods using model performance and privacy budget on popular and recent datasets: MNIST, CIFAR10, STL10, and COVID19 chest x-ray. Finally, the proposed framework achieves 90% accuracy and a high privacy rate demonstrating better performance than the baseline technique.

A single quantitative measure for characterizing the complexity of Internet-of-Things (IoT) network traffic remains elusive. Such a quantifier holds value in distinguishing the relative complexities of IoT network traffic in an increasingly heterogeneous IoT device landscape, enabling network operators to anticipate and provision for, as well as manage existing network infrastructure. In this paper, we apply relevant contemporary techniques used to quantify the complexity of regular network traffic to a modern, comprehensive empirical IoT network traffic dataset. The results were interpreted to discover their merits and pitfalls. Based on our findings, we contend there is a need to develop new quantitative measures that can accommodate the diversity of IoT traffic.

Ability to predict the risk of damaging events (e.g. wildfires) is crucial in helping emergency services in their decision making processes, to mitigate and reduce the impact of such events. Today, wildfire rating systems have been in operation extensively in many countries around the world to estimate the danger of wildfires. In this paper we propose a data-driven approach to predict wildfire risk using weather data. We show how we address the inherent challenge arising due to the temporal dynamicity of weather data. Weather observations naturally change in time, with finer-scale variation (e.g. stationary day or night) or large variations (nonstationary day or night), and this determines a temporal variation of the predicted wildfire danger. We show how our dynamic wildfire danger prediction model addresses the aforementioned challenge using context-based anomaly detection techniques. We call our predictive model a Context-Based Fire Risk (CBFR) model. The advantage of our model is that it maintains multiple historical models for different temporal variations (e.g. day versus night), and uses ensemble learning techniques to predict wildfire risk with high accuracy. In addition, it is completely unsupervised and does not rely on expert knowledge, which makes it flexible and easily applied to any region of interest. Our CBFR model is also scalable and can potentially be parallelised to speed up computation. We have considered multiple wildfire locations in the Blue Mountains, Australia as a case study, and compared the results of our system with the existing well-established Australian wildfire rating system. The experimental results show that our predictive model has a substantially higher accuracy in predicting wildfire risk, which makes it an effective model to supplement the operational Australian wildfire rating system.