Enhancing Security in Healthcare Frameworks using Optimal Deep Learning-based Attack Detection and Classification for Medical Wireless Sensor Networks

The rapid expansion of Internet of Things (IoT) networks has introduced new cybersecurity risks, particularly due to their heterogeneous, dynamic, and resource-constrained nature. Intrusion Detection Systems (IDS) are commonly used to detect cyber threats in such environments, but traditional IDSs and many machine learning (ML) or deep learning (DL)-based methods face challenges. These include poor detection of unknown attacks, dependence on large datasets, static feature learning, and an inability to adapt to evolving traffic patterns without frequent retraining. Furthermore, while graph-based IDSs capture relational context, their high computational cost and difficulty in adapting to dynamic IoT networks hinder their scalability. To address these challenges, we propose LNNIDS , a novel IDS method that integrates spike encoding with a Hybrid Liquid Neural Network (HLLN) to capture the temporal evolution of IoT attack network traffic. To further enhance accuracy, we introduce DYNGraph , a dynamic graph-based method that performs n → 1 pattern clustering for scalable attack classification. This allows the LNNIDS to dynamically group related flow behaviors and adapt to new or unknown attacks without retraining. We evaluated LNNIDS on two public IoT datasets. This method achieved 99.50% accuracy and maintained robust performance with only 20% training data. Furthermore, we compared the LNNIDS with the seven recent state-of-the-art methods, and we found that LNNIDS outperformed them in the detection of known and unknown IoT attacks with 13.45% and 11.99% better accuracy, respectively.

At present, APT attack detection has become the focus of the network security protection field. APT attacks are one of the most difficult attacks in cyber attacks. The complexity and variability of APT attack behavior greatly increases the difficulty of attack detection. In order to cope with APT attack, some well-known network security companies at home and abroad have developed a commercial APT intrusion detection system. This highly targeted attack can not be identified by the traditional intrusion detection system. Therefore, in order to deal with this new type of cyber attack. The paper proposes a new method to detect APT attack from different organizations. Data mining algorithm is used to analyze every organization’s APT network attack behavior and obtain association rules, so as to customize the design of the Snort rules and apply them to intrusion detection system. Experiments have shown that the evaluation index of the intrusion detection system using the extended Snort rule is significantly better than the traditional Snort intrusion detection system when detecting the same test data. The precision of the extended Snort intrusion detection system is as high as 98.3%, and the false alarm rate is almost 0, which ultimately achieves the purpose of APT detection.

Nowadays, cyber-attacks are beginning to be smart and hard to be detected, these attacks can be classified as Advance Persistence Threat(APT), which are hard to be detected and need sophisticated mechanisms of cybersecurity detection systems to be implemented to detect these types of attacks. Snort is an Intrusion Detection System (IDS) open source application that gained a high level of trust from hundreds of companies by using it as an IDS sensor whether Host-based Intrusion Detection System (HIDS) or Network Intrusion Detection System (NIDS) mode. Snort is depending on rules that are predefined to detect known attacks where if there is a new attack released and have not been registered to CheckPoint as an attack, then Snort will not detect it as an attack and the attack will bypass. The main problem that stands with traditional IDS (Snort) is the rate of false positive alerts. A new technique has been revealed by understanding the behavior of the traffic flow and deciding if the traffic flow matches the attributes that have abnormal activities that the traditional misuse IDS cannot detect. The new technique is a machine learning process that depending on training and testing the data of the traffic after converting the PCAP file to CSV file through an application that calls CICFlowMeter. it is an open source machine learning application that used as GUI mode calls Weka. After the PCAP file converted through CICFlowMeter, a dataset end with CSV extension will be generated with 80 plus attributes that Weka will learn as the training phase after that the testing phase will determine the matched traffic if they are normal or abnormal.

The black hole attack is an adverse issue in Wireless Sensor Networks (WSNs). Research for detection and circumvention of the black hole attack is underway. However, the false alarm rate, amount of time required to identify the black hole attack nodes in network has not reduced. To overcome such limitations, the Jensen–Shannon Divergence Based Independent Component Analysis (JDICA) technique is proposed in this paper. This technique is introduced with the application of Jensen–Shannon Divergence estimation in Independent Component Analysis model on the contrary to existing works, in order to achieve higher black hole detection accuracy in healthcare WSN. The JDICA technique identifies the black hole attack by analyzing the physiological data gathered from biomedical sensors. The proposed JDICA technique carries out attack detection based on sensor nodes behaviors such as energy, trust and cooperative count. It determines the dependence among the nodes, based on the independent probability distribution functions and mutual probability function by using the Jensen–Shannon Divergence. The divergence result enables JDICA technique to detect black hole attacks with greater accuracy, and helps to quarantine the malicious node from the network by broadcasting the isolation message to all sensor nodes in the network. Hence, JDICA technique enhances the detection of black hole attack nodes as compared to state-of-the-art works, thereby increasing the packet delivery ratio and reducing delay. The JDICA technique simulation is done considering the metrics such as detection rate, detection time, false alarm rate, and packet delivery ratio with respect to a varied number of sensor nodes and data packets. Simulation results makes it apparent that the JDICA technique improves the detection rate and minimizes the detection time of the black hole attack when compared to state-of-the-art works.

The integration of IDS and Internet of Things (IoT) with deep learning plays a significant role in safety. Security has a strong role to play. Application of the IoT network decreases the time complexity and resources. In the traditional intrusion detection systems (IDS), this research work implements the cutting-edge methodologies in the IoT environment. This research is based on analysis, conception, testing and execution. Detection of intrusions can be performed by using the advanced deep learning system and multiagent. The NSL-KDD dataset is used to test the IoT system. The IoT system is used to test the IoT system. In order to detect attacks from intruders of transport layer, efficiency result rely on advanced deep learning idea. In order to increase the system performance, multi -agent algorithms could be employed to train communications agencies and to optimize the feedback training process. Advanced deep learning techniques such as CNN will be researched to boost system performance. The testing part an IoT includes data simulator which will be used to generate in continuous of research work finding with deep learning algorithms of suitable IDS in IoT network environment of current scenario without time complexity.

As 5G and beyond networks grow in heterogeneity, complexity, and scale, traditional Intrusion Detection Systems (IDS) struggle to maintain accurate and precise detection mechanisms. A promising alternative approach to this problem has involved the use of Deep Learning (DL) techniques; however, DL-based IDS suffer from issues relating to interpretation, performance variability, and high computational overheads. These issues limit their practical deployment in real-world applications. In this study, CiNeT is introduced as a novel DL-based IDS employing Convolutional Neural Networks (CNN) within a bijective encoding–decoding framework between network traffic features (such as IPv6, IPv4, Timestamp, MAC addresses, and network data) and their RGB representations. This transformation facilitates our DL IDS in detecting spatial patterns without sacrificing fidelity. The bijective pipeline enables complete traceability from detection decisions to their corresponding network traffic features, enabling a significant initiative towards solving the ‘black-box’ problem inherent in Deep Learning models, thus facilitating digital forensics. Finally, the DL IDS has been evaluated on three datasets, UNSW NB-15, InSDN, and ToN_IoT, with analysis conducted on accuracy, GPU usage, memory utilisation, training, testing, and validation time. To summarise, this study presents a new CNN-based IDS with an end-to-end pipeline between network traffic data and their RGB representation, which offers high performance and enhanced interpretability through revisable transformation.

Distributed denial of service (DDoS) attacks pose a significant security risk, particularly with the increasing reliance on cloud computing and information technology (IT). These attacks not only allow unauthorized users to access services but also deny legitimate users the ability to utilize them. Traditional antivirus solutions and firewalls prove insufficient in detecting DDoS attacks within large networks. Intrusion detection systems (IDS) are essential for detecting unauthorized or malicious activities and ensuring the confidentiality, integrity, and availability of services. However, traditional IDS often rely on predefined signatures and patterns, making them susceptible to evasion tactics. In response, this research introduces a deep learning (DL)-based IDS that integrates convolutional neural networks (CNN) with principal component analysis (PCA) and explores the application of vision transformers (ViT). The proposed hybrid model was tested on the CICDDoS2019 dataset, achieving a notable improvement in detection accuracy. Specifically, the CNN-based model initially identified DDoS attacks with an accuracy of 99.72%. Upon integrating ViT, the model’s accuracy further improved to 99.99%. This innovative approach signifies a considerable advancement in the detection capabilities for DDoS attacks and underscores the potential for integrating more sophisticated DL models into cybersecurity defenses.

Wireless sensor networks (WSNs) are increasingly being used for data monitoring and collection purposes. Typically, they consist of a large number of sensor nodes that are used remotely to collect data about the activities and conditions of a particular area, for example, temperature, pressure, motion. Each sensor node is usually small, inexpensive, and relatively easy to deploy compared to other sensing methods. For this reason, WSNs are used in a wide range of applications and industries. However, WSNs are vulnerable to different kinds of security threats and attacks. This is primarily because they are very limited in resources like power, storage, bandwidth, and processing power that could have been used in developing their defense. To ensure their security, an effective Intrusion detection system (IDS) need to be in place to detect these attacks even under these constraints. Today, traditional IDS are less effective as these malicious attacks are becoming more intelligent, frequent, and complex. Denial of service (DOS) attack is one of the main types of attacks that threaten WSNs. For this reason, we review related works that focus on detecting DoS attacks in WSN. In addition, we developed and implemented several Deep learning (DL) based IDS. These systems were trained on a specialized dataset for WSNs called WSN-DS in detecting four types of DoS attacks that affects WSNs. They include the Blackhole, Grayhole, Flooding, and Scheduling attacks. Finally, we evaluated and compared the results and we discuss possible future works.

In this article, we propose an intelligent hybrid model that combines deep learning with optimization techniques to enhance the security of wireless sensor networks (WSN) by detecting and preventing cyberattacks. In the rapidly expanding Internet landscape, security has become crucial due to the surge in Internet users. Various intrusion detection systems have been developed over time to detect and identify intruders using data processing methods. However, existing systems often fall short in achieving high detection accuracy. To address this, the article introduces an Enhanced Black Widow Optimization (EBWO) algorithm integrated with a Bidirectional Gated Recurrent Unit (BiGRU) and Attention Mechanism (ATTN) model for detecting malicious activities in IoT‐based WSNs. The EBWO algorithm optimizes the parameters of the BiGRU‐ATTN network, enhancing its performance. The proposed model's effectiveness is evaluated using various metrics and benchmarked against other popular deep learning algorithms. An experimental study is conducted using the WSN‐DS dataset to demonstrate that the proposed approach detects cyber threats in WSNs better than any other approach.

Critical infrastructure protection and national security are enhanced by the security and reliability of networks. Various types of information circulate on these networks, ranging in classification from open to closed. The consequences of cyberattacks on these networks can be severe, including reputational damage, financial loss, operational disruption and data leakage. Traditional security methods, such as firewalls and anti-virus software, are becoming less effective against modern and ever-changing cyber threats. As a result, powerful network intrusion detection systems (IDS) have become indispensable for proactive detection and mitigation of cyber attacks. Machine learning has become a viable method for creating adaptive intrusion detection tools that can detect new and complex attack patterns. By learning from huge labelled network traffic datasets, ML models can understand the subtle patterns and differentiating features of normal and abnormal or malicious traffic flows. This allows them to detect possible cyber threats and intrusions that traditional signature-based IDSs cannot detect. Extracting discriminative features and training appropriate classification models from such data is a challenging task. In the presented study, we analyse the effectiveness of ML algorithms for detecting cyberattacks, in particular distributed denial of service (DDoS) attacks, in network traffic data. In the presented study, a network attack detection system is developed using ML and deep learning (DL) models and experimented on the CICIDS2017 dataset. The main objectives of the study are to develop a strategy for extracting valuable information from raw network streams; to study the impact of data preparation on the false positive rate; and to conduct a comparative analysis of ML models for cyberattack detection. The main goal of the study is to provide an understanding of the development of a reliable adaptive network intrusion detection system using ML approaches that increase cybersecurity capabilities and protect against future cyberattacks.

With the development of Internet of Things communities, the complexity and scale of cyber security threats multiply swiftly in these intelligent cities and their connected digital infrastructure. As hybrid computing and cyber environment continue to develop, NGID systems become increasingly fragile because of their lack of adaptability and the ability to understand local context to accurately detect the cyber-attacks in dynamic cyber environment like cloud computing. The current work investigates the design and deployment of context-awareness intrusion detection systems (IDS) based on advanced artificial intelligence (AI) approaches to improve a security framework in smart city. Utilizing the real time environmental, network and user behavior data, the IDS models introduced here can optimize detection parameters as dynamic, to improve the anomaly recognition, false positives’ reduction and response time. The research is aiming at combining context information from multiple and diverse internet of things devices, and sensors, and communication networks, so as to enable AI algorithms to build a complete situational awareness model. Such context-aware processing enables the IDS to draw the borderline between normal operation and attacks more accurately. Machine learning techniques, like deep learning and reinforcement learning, can be used to continuously enhance the power of detection over adaptive leaning and build robustness against zero-day attacks and adaptive threats. In addition, the software architecture highlights fog computing for real-time threat detection and transmission from edge to network and it emphasizes a decentralized processing system at the edge of the network while maintaining data privacy. Experimental results, analyzed on several simulated smart city networks, clearly show that the context-aware AI-based IDS performs considerably better than traditional IDSs on detecting a variety of cyber threats like DDoS attacks, data breaches, and unauthorized access attempts. The results demonstrate the system's strength, scalability, and efficiency, which points a promising trend for securing the digital backbone of the future smart cities. This work paves the way for smarter, secure urban ecosystems by leveraging AI and context-awareness in the domain of cybersecurity.

Distributed denial-of-service (DDoS) attacks continue to grow at a rapid rate plaguing Internet Service Providers (ISPs) and individuals in a stealthy way. Thus, intrusion detection systems (IDSs) must evolve to cope with these increasingly sophisticated and challenging security threats. Traditional IDSs are prone to zero-day attacks since they are usually signature-based detection systems. The recent advent of machine learning and deep learning (ML/DL) techniques can help strengthen these IDSs. However, the lack of up-to-date labeled training datasets makes these ML/DL based IDSs inefficient. The privacy nature of these datasets and widespread emergence of adversarial attacks make it difficult for major organizations to share their sensitive data. Federated Learning (FL) is gaining momentum from both academia and industry as a new sub-field of ML that aims to train a global statistical model across multiple distributed users, referred to as collaborators, without sharing their private data. Due to its privacy-preserving nature, FL has the potential to enable privacy-aware learning between a large number of collaborators. This paper presents a novel framework, called MiTFed, that allows multiple software defined networks (SDN) domains ( <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$i.e.,$</tex-math></inline-formula> collaborators) to collaboratively build a global intrusion detection model without sharing their sensitive datasets. In particular, MiTFed consists of: (1) a novel distributed architecture that allows multiple SDN based domains to securely collaborate in order to cope with sophisticated security threats while preserving the privacy of each SDN domain; (2) a novel Secure Multiparty Computation (SMPC) scheme to securely aggregate local model updates; and (3) a blockchain based scheme that uses Ethereum smart contracts to maintain the collaboration in a fully decentralized, trustworthy, flexible, and efficient manner. To the best of our knowledge, MiTFed is the first framework that leverages FL, blockchain and SDN technologies to mitigate the new emerging security threats in large scale. To evaluate MiTFed, we conduct several experiments using real-world network attacks; the experimental results using the well-known public network security dataset NSL-KDD show that MiTFed achieves efficiency and high accuracy in detecting the new emerging security threats in both binary and multi-class classification while preserving the privacy of collaborators, making it a promising framework to cope with the new emerging security threats in SDN.

With the rapid development of information technology, network security issues have become increasingly prominent. In particular, data security intrusions pose serious threats to the data privacy and system security of enterprises and individuals. Traditional intrusion detection systems often exhibit low detection accuracy and high false alarm rates when faced with complex and dynamic network environments and diverse attack methods. Therefore, this paper proposes a data security intrusion detection system based on deep learning, which integrates the Mamba model and ECANet model and employs an end-to-end learning approach for training and optimization. First, the Mamba model is introduced for preliminary data feature extraction, whose efficient feature representation capabilities provide a solid foundation for the subsequent detection process. Then, by integrating the ECANet model, feature selection is further optimized through the attention mechanism, enhancing the model’s focus on important features. Finally, an end-to-end learning approach is adopted to train and optimize the entire system, ensuring excellent performance and robustness in practical applications. Experimental results show that the proposed intrusion detection system demonstrates higher detection accuracy on multiple test datasets, improving by approximately 5% compared to traditional methods, providing a new and effective solution for data security.

Aerial-aided Edge Computing (AEC) promises to provide low-latency computing services as a critical component for future low-altitude intelligent transportation systems. However, the complex edge network environment poses security challenges, as traditional Intrusion Detection Systems (IDS) struggle to handle AEC’s large traffic volume and resource constraints. To address this, we propose a collaborative detection mechanism called Switch IDS. First, Switch IDS adopts a packet-level detection solution to meet real-time detection requirements. Next, Switch IDS is designed for resource-constrained nodes. By introducing the Mixture of Experts (MoE) structure into the traditional Deep Learning (DL) model, it enables seamless and scalable multi-node deployment. Switch IDS establishes a resource status-based capability for each Expert and incorporates steering loss in the loss function to enable autonomous near-optimal traffic steering, ultimately maximizing system processing capacity. Finally, the Switch IDS utilizes parallelized Service Function Chaining (SFC) for practical multi-node deployment. To the best of our knowledge, this is the first realization of multi-node deployment and autonomous traffic steering for DL-based IDS. Experiments on public datasets show that Switch IDS and its multi-node deployment scheme notably boost processing capacity while maintaining high detection performance.

This paper presents a deep learning based multi-label attack detection approach for the distributed control in AC microgrids. The secondary control of AC microgrids is formulated as a constrained optimization problem with voltage and frequency as control variables which is then solved using a distributed primal-dual gradient algorithm. The normally distributed false data injection (FDI) attacks against the proposed distributed control are then designed for the distributed gener-ator's output voltage and active/reactive power measurements. In order to detect the presence of false measurements, a deep learning based attack detection strategy is further developed. The proposed attack detection is formulated as a multi-label classification problem to capture the inconsistency and co-occurrence dependencies in the power flow measurements due to the presence of FDI attacks. With this multi-label classification scheme, a single model is able to identify the presence of different attacks and load change simultaneously. Two different deep learning techniques are compared to design the attack detector, and the performance of the proposed distributed control and the attack detector is demonstrated through simulations on the modified IEEE 34-bus distribution test system.