Neural Networks in Cybersecurity: Applications for Predictive Threat Modeling

<abstract><p>Due to the complexities of systems thinking and the communication between independent Cyber-Physical Systems (CPSs) areas through accumulative expansion, several security threats are posed, such as deception of channels for information sharing, hardware aspects and virtual machines. CPSs have become increasingly complex, sophisticated, knowledgeable and fully independent. Because of their complex interactions between heterogeneous virtual and objective components, CPSs are subject to significant disturbances from intended and unintended events, making it extremely difficult for scientists to predict their behavior. This paper proposes a framework for Cyber-Physical Business Systems based on Artificial Intelligence (CPBS-AI). It summarizes several safety risks in distinct CPS levels, their threat modeling and the scientific challenges they face in building effective security solutions. This research provides a thorough overview of current state-of-the-art static capable of adapting detection and tracking approaches and their methodological limitations, namely, the difficulty of identifying runtime security attacks caused by hibernation or uncertainty. The way of identifying the threat and the security attacks in networks reduce the complexities in the communication in CPS. The negligible threats exhibit an inability to be identified, avoided and blocked by Intrusion Prevention Security Systems (IPSSs), and misbehavior in the database of the safety measures is analyzed. Neural Networks (NN) and Variable Structure Control (VSC) are designed to estimate attacks and prevent the risk of threats in tracking applications using a nonlinear monitoring system based on VSC. NN and the VSC evaluate the different attacks based on the nonlinear monitoring system. The evaluation of the proposed CPBS-AI is based on the request time analysis, accuracy, loss and reliability analysis. The overall effectiveness of the system is about 96.01%.</p></abstract>

Verifying robustness of neural networks given a specified threat model is a fundamental yet challenging task. While current verification methods mainly focus on the $\ell_p$-norm threat model of the input instances, robustness verification against semantic adversarial attacks inducing large $\ell_p$-norm perturbations, such as color shifting and lighting adjustment, are beyond their capacity. To bridge this gap, we propose \textit{Semantify-NN}, a model-agnostic and generic robustness verification approach against semantic perturbations for neural networks. By simply inserting our proposed \textit{semantic perturbation layers} (SP-layers) to the input layer of any given model, \textit{Semantify-NN} is model-agnostic, and any $\ell_p$-norm based verification tools can be used to verify the model robustness against semantic perturbations. We illustrate the principles of designing the SP-layers and provide examples including semantic perturbations to image classification in the space of hue, saturation, lightness, brightness, contrast and rotation, respectively. In addition, an efficient refinement technique is proposed to further significantly improve the semantic certificate. Experiments on various network architectures and different datasets demonstrate the superior verification performance of \textit{Semantify-NN} over $\ell_p$-norm-based verification frameworks that naively convert semantic perturbation to $\ell_p$-norm. The results show that \textit{Semantify-NN} can support robustness verification against a wide range of semantic perturbations.

PRUNE: A patching based repair framework for certifiable and privacy-robust unlearning of neural networks.

Deep convolutional neural networks have achieved great success in recent years. They have been widely used in various applications such as optical and SAR image scene classification, object detection and recognition, semantic segmentation, and change detection. However, deep neural networks rely on large-scale high-quality training data, and can only guarantee good performance when the training and test data are independently sampled from the same distribution. Deep convolutional neural networks are found to be vulnerable to subtle adversarial perturbations. This adversarial vulnerability prevents the deployment of deep neural networks in security-sensitive applications such as medical, surveillance, autonomous driving and military scenarios. This paper first presents a holistic view of security issues for deep convolutional neural network-based image recognition systems. The entire information processing chain is analyzed regarding safety and security risks. In particular, poisoning attacks and evasion attacks on deep convolutional neural networks are analyzed in detail. The root causes of adversarial vulnerabilities of deep recognition models are also discussed. Then, we give a formal definition of adversarial robustness and present a comprehensive review of adversarial attacks, adversarial defense, and adversarial robustness evaluation. Rather than listing existing research, we focus on the threat models for the adversarial attack and defense arms race. We perform a detailed analysis of several representative adversarial attacks on SAR image recognition models and provide an example of adversarial robustness evaluation. Finally, several open questions are discussed regarding recent research progress from our workgroup. This paper can be further used as a reference to develop more robust deep neural network-based image recognition models in dynamic adversarial scenarios.

With the swift progression of artificial intelligence and deep learning, neural networks have achieved remarkable success in domains such as image recognition, natural language processing, and autonomous driving. However, the proliferation of data scales and the extensive deployment of computational resources have engendered significant privacy concerns for users. In scenarios involving personal sensitive data, the safeguarding of privacy is of utmost importance. Homomorphic encryption technology, particularly the CKKS scheme, is capable of performing computations with minimal computational error while preserving data privacy, and it has been extensively utilized in encrypted neural networks. This paper studies Bit-Flip Attacks (BFAs) on encrypted neural networks under the RNS-CKKS scheme. We empirically analyze the effects of bit flips at different memory locations—covering ciphertext data, model weights, and evaluation keys—and report their observable outcomes (silent misclassification, irregular yet decodable outputs, or computation aborts). Under a realistic threat model where the adversary cannot precisely target bytes nor observe model predictions, BFAs can corrupt results but do not leak additional information. Our findings indicate that key corruption often produces conspicuous anomalies that offer detection potential for defenders.

In the rapidly advancing field of AI and ML, this paper explores their pivotal role in transforming cybersecurity. Highlighting the integration of sophisticated techniques like deep learning for intrusion detection and reinforcement learning for adaptive threat modeling, it emphasizes the shift towards AI-driven cybersecurity solutions. The study meticulously analyzes supervised and unsupervised learning's impact on threat detection accuracy and the dynamic capabilities of neural networks in real-time threat identification. It reveals how these methodologies enhance digital defenses against complex cyber threats, underscoring the theoretical underpinnings and practical applications of AI and ML in cybersecurity. The paper also discusses the challenges and future directions, contributing significant insights into the evolving landscape of cybersecurity technologies. This comprehensive research background sets the stage for understanding the unique contributions and potential of AI and ML in strengthening cybersecurity measures.

This book develops an integrated scholarly framework for understanding how graph neural networks and transformer architectures can be combined to strengthen advanced cyber threat detection and network security under conditions of scale, uncertainty, and adversarial adaptation. It argues that contemporary defence environments require models capable of representing topology, temporal dependence, semantic context, and operational uncertainty simultaneously, rather than treating logs, packets, flows, identities, and infrastructure states as isolated variables. The manuscript therefore moves from foundational epistemic questions and research design principles to statistical explanation, causal analysis, predictive machine learning, scalable data engineering, reproducibility, MLOps, and governance. Across the chapters, attention is given to the full analytical lifecycle: threat modelling, representation learning, evaluation design, trustworthiness, deployment, policy translation, and sectoral implementation. Conceptual diagrams, methodological tables, mathematical formulations, algorithmic sketches, and governance frameworks are embedded throughout the text to support researchers, practitioners, and policymakers working in heterogeneous contexts across South Asia, Europe, Africa, and the Americas. The central contribution of the book is to show that secure and accountable cyber analytics emerges not from isolated algorithmic performance gains, but from coherent alignment among data architecture, inference strategy, operational workflow, human oversight, and institutional governance. In that sense, the text is designed as both a research monograph and a strategic reference handbook for long-horizon cyber defence innovation. Keywords graph neural networks, transformers, cyber threat detection, network security, adversarial learning, anomaly detection, causal inference, statistical modeling, trustworthiness, explainable AI, reproducibility, MLOps, threat intelligence, attack graphs, intrusion detection, zero-trust architecture, cyber governance, scalable analytics, security operations centers, representation learning, uncertainty quantification, risk modeling, privacy-preserving analytics, policy

The advancement in deep learning has taken the technology world by storm in the last decade. Although, there is enormous progress made in terms of algorithm performance, the security aspect of these algorithms has not received a lot of attention from the research community. As more industries start to adopt these algorithms the issue of security is becoming even more relevant. Security vulnerabilities in machine learning (ML), especially in deep neural networks (DNN), is becoming a concern. Various techniques have been proposed, including data manipulations and model stealing. However, most of them are focused on ML algorithms and target threat models that require access to training dataset. In this paper, we present a methodology that analyzes the DNN weight parameters under the threat model that assumes the attacker has the access to the weight memory only. This analysis is then used to develop an attack that manipulates weight parameters with respect to their sensitivity. To evaluate this attack, we implemented our methodology on a MLP trained on IRIS dataset and LeNet (DNN architecture) trained on MNIST dataset. Our experimental results demonstrate that alteration of model parameters results in subtle accuracy drop of the model. Depending on the applications such subtle changes can cause significant system malfunction or disruption, for example in vision-based industrial applications. Our results show that using our methodology a subtle accuracy drop can be achieved in a reasonable amount of time with very few parameter changes.

Health care artificial intelligence (AI) systems are increasingly integrated into clinical workflows, yet remain vulnerable to data-poisoning attacks. A small number of manipulated training samples can compromise AI models used for diagnosis, documentation, and resource allocation. Existing privacy regulations, including the Health Insurance Portability and Accountability Act and the General Data Protection Regulation, may inadvertently complicate anomaly detection and cross-institutional auditing, thereby limiting visibility into adversarial activity. This study provides a comprehensive threat analysis of data poisoning vulnerabilities across major health care AI architectures. The goals are to (1) identify attack surfaces in clinical AI systems, (2) evaluate the feasibility and detectability of poisoning attacks analytically modeled in prior security research, and (3) propose a multilayered defense framework appropriate for health care settings. We synthesized empirical findings from 41 key security studies published between 2019 and 2025 and integrated them into an analytical threat-modeling framework specific to health care. We constructed 8 hypothetical yet technically grounded attack scenarios across 4 categories: (1) architecture-specific attacks on convolutional neural networks, large language models, and reinforcement learning agents (scenario A); (2) infrastructure exploitation in federated learning and clinical documentation pipelines (scenario B); (3) poisoning of critical resource allocation systems (scenario C); and (4) supply chain attacks affecting commercial foundation models (scenario D). Scenarios were aligned with realistic insider-access threat models and current clinical deployment practices. Multiple empirical studies demonstrate that attackers with access to as few as 100-500 poisoned samples can compromise health care AI systems, with attack success rates typically ≥60%. Critically, attack success depends on the absolute number of poisoned samples rather than their proportion of the training corpus, a finding that fundamentally challenges assumptions that larger datasets provide inherent protection. We estimate that detection delays commonly range from 6 to 12 months and may extend to years in distributed or privacy-constrained environments. Analytical scenarios highlight that (1) routine insider access creates numerous injection points across health care data infrastructure, (2) federated learning amplifies risks by obscuring attribution, and (3) supply chain compromises can simultaneously affect dozens to hundreds of institutions. Privacy regulations further complicate cross-patient correlation and model audit processes, substantially delaying the detection of subtle poisoning campaigns. Health care AI systems face significant security challenges that current regulatory frameworks and validation practices do not adequately address. We propose a multilayered defense strategy that combines ensemble disagreement monitoring, adversarial testing, privacy-preserving yet auditable mechanisms, and strengthened governance requirements. Ensuring patient safety may require a shift from opaque, high-performance models toward more interpretable and constraint-driven architectures with verifiable robustness guarantees.

Adversarial examples are crucial tools for assessing the robustness of deep neural networks (DNNs) and revealing potential security vulnerabilities. Adversarial example generation methods based on Generative Adversarial Networks (GANs) have made significant progress in generating image adversarial examples, but still suffer from insufficient sparsity and transferability. To address these issues, this study proposes a novel semi-white-box untargeted adversarial example generation method named Wavelet-AdvGAN, with an explicit threat model defined as follows. Specifically, the attack is strictly untargeted without predefined target categories, aiming solely to mislead DNNs into classifying adversarial examples into any category other than the original label. It adopts a semi-white-box setting where attackers are denied access to the target model’s private information. Regarding the generator’s information dependence, the training phase only utilizes public resources (i.e., the target model’s public architecture and CIFAR-10 public training data), while the test phase generates adversarial examples through one-step feedforward of clean images without interacting with the target model. The method incorporates a Frequency Sub-band Difference (FSD) module and a Wavelet Transform Local Feature (WTLF) extraction module, evaluating the differences between original and adversarial examples from the frequency domain perspective. This approach constrains the magnitude of perturbations, reinforces feature regions, and further enhances the attack effectiveness, thereby improving the sparsity and transferability of adversarial examples. Experimental results demonstrate that the Wavelet-AdvGAN method achieves an average increase of 1.26% in attack success rates under two defense strategies—data augmentation and adversarial training. Additionally, the adversarial transferability improves by an average of 2.7%. Moreover, the proposed method exhibits a lower l0 norm, indicating better perturbation sparsity. Consequently, it effectively evaluates the robustness of deep neural networks.

The growing sophistication and occurrence of cybersecurity threats demand intelligent and adaptive ways of assessing cyber risk. Traditional approaches may be based on static rules and post-incident analysis that may be inadequate to deal with dynamic threat landscapes that modern enterprises confront. This study develops a machine learning-based model for predicting cyber risk including proactive threat detection and enterprise vulnerability analysis. Using historical incident data as well as system logs, configuration details and user behaviors, a variety of supervised and unsupervised learning models are trained to identify both indicators of compromise as well as patterns associated with higher levels of cyber risk. The learning integration studies the effectiveness of a range of machine learning models such as decision trees, support vector machines, random forests, gradient boosting, and deep neural networks in predicting high risk situations. Feature extraction methodologies are used to derive features such as privilege abuse, lateral movement behaviors and anomalous access times. These characteristics assist both the profiling of threats with higher resolution and predicting and detecting possible exploits before attacks are perpetrated on large scale. The models are verified against enterprise data and synthetic threat simulations to demonstrate their strength across various attack surfaces and enterprise infrastructures. The results demonstrate that ensemble learning methods and deep learning architectures achieve significantly higher precision, recall and overall risk classification accuracy than traditional methods. By doing so, the models don’t only predict attack likelihood, but also generate explainable risk scores and reveal most likely threat vectors. Also described is a hybrid risk scoring approach that combines the probabilistic model predictions with domain specific heuristics to allow those responsible for security to focus on mitigations in an efficient manner. This method is in line with transforming the posture of cybersecurity from reactive to proactive, with a predictive defense model. It helps in the building of smart cyber risk assessment systems that can learn vicariously and are adaptive in real time. It showcases the real-world application of machine learning to enterprise security operation, enabling automated threat prediction and risk-based decision-making. The predictive models proposed are the foundation components in developing scalable and intelligent SIEM systems. In the end, the research illustrates the usefulness of data for improving the readiness and resilience of enterprise environments against new cyber threat models.

Deep learning detectors operating on time-frequency images (TFIs) achieve strong performance in detecting and recognizing low-probability-of-intercept (LPI) radar waveforms, yet their robustness to adversarial perturbations has received limited attention. This paper provides a modulation-wise evaluation of two canonical attacks—Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD)—against a convolutional neural networks based LPI detector under a black-box threat model, where transferable perturbations are crafted via surrogate models. Experiments cover twelve representative LPI modulations. Using per-modulation adversarial accuracy, attack success rate, and a TFI-domain perturbation budget , we demonstrate both the effectiveness of adversarial examples and quantify the distortion–evasion trade-off relative to the original signals. The findings offer modulation-aware guidance on optimal attack settings, and highlight configurations that achieve maximal evasion with minimal perturbation.

Spiking Neural Networks (SNNs) aim at providing energy-efficient learning capabilities when implemented on neuromorphic chips with event-based Dynamic Vision Sensors (DVS). This paper studies the robustness of SNNs against adversarial attacks on such DVS-based systems, and proposes R-SNN, a novel methodology for robustifying SNNs through efficient DVS-noise filtering. We are the first to generate adversarial attacks on DVS signals (i.e., frames of events in the spatio-temporal domain) and to apply noise filters for DVS sensors in the quest for defending against adversarial attacks. Our results show that the noise filters effectively prevent the SNNs from being fooled. The SNNs in our experiments provide more than 90% accuracy on the DVS-Gesture and NMNIST datasets under different adversarial threat models.

This article explores Intelligent Routing as a Service (iRaaS), a transformative approach to network routing that leverages machine learning to overcome the limitations of traditional protocols. The article explores how iRaaS employs dynamic adaptability, service orientation, and context awareness to address the challenges of increasingly complex network environments. The discussion first examines core architectural elements, exploring both microservice structures and machine learning pipelines. It then advances to a comparative evaluation of performance metrics, contrasting the system against traditional routing approaches and demonstrating significant enhancements in response time, processing capacity, and system stability. The article further shows security and governance frameworks necessary for iRaaS implementation, including threat models specific to AI-driven routing and compliance considerations. The article concludes by investigating future research directions, particularly integration with intent-based networking, edge computing applications, standardization efforts, and emerging use cases across government, finance, healthcare, and enterprise sectors.

We present FACESEC, a framework for fine-grained robustness evaluation of face recognition systems. FACESEC evaluation is performed along four dimensions of adversarial modeling: the nature of perturbation (e.g., pixel-level or face accessories), the attacker’s system knowledge (about training data and learning architecture), goals (dodging or impersonation), and capability (tailored to individual inputs or across sets of these). We use FACESEC to study five face recognition systems in both closed-set and open-set settings, and to evaluate the state-of-the-art approach for defending against physically realizable attacks on these. We find that accurate knowledge of neural architecture is significantly more important than knowledge of the training data in black-box attacks. Moreover, we observe that open-set face recognition systems are more vulnerable than closed-set systems under different types of attacks. The efficacy of attacks for other threat model variations, however, appears highly dependent on both the nature of perturbation and the neural network architecture. For example, attacks that involve adversarial face masks are usually more potent, even against adversarially trained models, and the ArcFace architecture tends to be more robust than the others.