Jul 2026· International Journal for Research in Applied Science and Engineering Technology· Vol 14, pp. 787-794· 0 citations
TL;DR
This work proposes a graphstructured detection framework underpinned by a Graph Convolutional Network (GCN), enabling the model to capture interaction-driven threat indicators that scalar feature vectors cannot represent.
Abstract
Among the most consequential vulnerabilities in contemporary IoT-based systems is the insider threat — a class of
attack in which authorised users deliberately or inadvertently misuse their privileges, often evading detection for prolonged
intervals. Mainstream detection approaches continue to be undermined by three unresolved obstacles: severe class imbalance
between benign and malicious records, the curse of dimensionality arising from rich feature sets, and the non-stationary nature
of user behavioural profiles. To address these co-occurring challenges within a unified architecture, this work proposes a graphstructured detection framework underpinned by a Graph Convolutional Network (GCN). Relational dependencies among users,
devices, and system resources are encoded as graph topology, enabling the model to capture interaction-driven threat indicators
that scalar feature vectors cannot represent. Improved Principal Component Analysis (IPCA) performs dimensionality reduction
while maximising the retention of discriminative variance. An Outlier-Resistant K-Means algorithm segments the activity space
into semantically coherent clusters, and the Enhanced Bidirectional Generative Adversarial Network (EBiGAN) synthesises
statistically faithful malicious samples to redress class skew. Hyperparameter optimisation is conducted via Bayesian search
guided by the Probability of Improvement (PI) acquisition function. On the CMU CERT benchmark, the proposed system
achieves a detection accuracy of 96.8%, a detection rate of 96.7%, and a false alarm rate of only 3%, outperforming all
compared baselines and demonstrating readiness for deployment in production IoT security environments.
This paper introduces an interpretable deep learning defence framework in the context of user anomaly detection for both IaaS and PaaS cloud service layers and SaaS application layer and shows that the detection accuracy and F1-score are much higher than those of the conventional rule-based and black-box deep learning IDSs.
Madhavi Kapre, P. Sahu, Raman Verma et al.· Journal of Intelligent Decis...· 0 citations
The widespread adoption of end-to-end encryption in 5G networks limits the effectiveness of traditional intrusion detection systems that rely on payload inspection. This challenge is particularly critical for detecting Advanced Persistent Threats (APTs), which employ low-rate, long-duration, and stealthy communication strategies to evade conventional defenses. This study presents a privacy-preserving intrusion detection framework that operates exclusively on flow-level traffic metadata without deep packet inspection. Network packets are aggregated into bidirectional flows, from which temporal, statistical, and directional features are extracted to characterize behavioral patterns. A Transformer-based model with self-attention is employed to capture long-range dependencies across encrypted traffic sequences and identify subtle, temporally dispersed attack indicators. The framework is evaluated on a large-scale 5G-relevant dataset containing over one million flow records and compared against classical machine learning, ensemble, CNN, and LSTM models. Results demonstrate high recall and strong F1-score in distinguishing APT from benign traffic. Attention-based and feature-level explanations further reveal that prolonged communication, irregular timing gaps, and directional asymmetry significantly influence detection decisions. The findings support the practicality of explainable Transformer models for secure and scalable APT detection in encrypted 5G environments.
By integrating temporal graph construction, adversarial augmentation, and GCN classification, GraphGAN effectively models coordinated attack behaviors and mitigates class imbalance, providing a robust and topology-aware solution for intrusion detection in data-constrained environments.
Mohammad Arif Hossain, Yeahia Sarker, Md Jafrin Hossain et al.· 0 citations
An Intrusion Detection System (IDS)-contextual ensemble learning framework that assigns network traffic to three operationally meaningful risk tiers: High, Medium and Low is presented.
Reeta Mishra, Neelu Chaudhary· Journal of Trends in Compute...· 0 citations
Cloud computing has emerged as an important core to the contemporary digital services, facilitating scalable, on demand provisioning of resources across a variety of application fields. Nevertheless, this multi-tenant and dynamic environment of clouds and the amplified attack surface make the detection of intrusions through reliable methods a consistent issue that cloud security systems struggle with. The proposed work is a Generative Adversarial Network (GAN)-based hardening framework of cloud intrusion detection systems, targeting better resilience to changing and low-rate cyberattacks. The methodology combines a conditional generator which is used to generate realistic cloud-specific attack traffic, a discriminator used to refine the adversarial traffic, as well as a co-trained intrusion classifier trained on both clean and synthetic data in a closed-loop way. The feature-aware regularization is introduced to maintain the statistical consistency of network traffic, and optimize the attack diversity. The proposed approach is proved to yield better results in comparison with signature-based, machine learning, deep learning, and adversarial ML-based IDS models by experimental assessment. Significant gains in the accuracy of identifying, the ability to recall, stability, and minimizing errors are also noticed with quantifiable increases observed in all evaluation measures. These findings represent the usefulness of adversarial data-driven learning to develop robust, adaptive, and future-ready cloud intrusion detection systems.
T. Divya, Sheik Saidhbi, S. Umarani et al.· 2026 International Conferenc...· 0 citations
The rapid advancement of digital communication and networking technologies has resulted in a significant increase in the frequency and sophistication of cyber threats, creating new challenges for securing modern computer networks. Traditional intrusion detection approaches mainly depend on signature-based techniques and predefined security rules, making them less effective against newly emerging and continuously evolving cyber attacks. To address these limitations, this study presents an Explainable Artificial Intelligence (XAI)-based cyber threat detection framework that combines Long Short-Term Memory (LSTM) and Autoencoder models for accurate and transparent threat detection. The LSTM model captures sequential network traffic patterns to identify temporal attack behaviours, whereas the Autoencoder detects anomalous activities by learning the characteristics of normal network traffic. The integration of Explainable AI enables users to understand prediction outcomes by highlighting the factors influencing each detection decision. Furthermore, the framework performs quantitative risk assessment, categorizes threats into multiple severity levels, and generates suitable mitigation recommendations through an interactive web-based dashboard. Experimental results demonstrate that the proposed framework provides reliable, interpretable, and effective cyber threat detection, thereby supporting security professionals in making timely and well-informed decisions.
Indu Asitha, M. N.· International Journal of Com...· 0 citations