Attention cybersecurity scholars and researchers! The Mesopotamian Journal of Cybersecurity has successfully launched and is rapidly gaining recognition in the academic community. With three impactful issues already published, our journal is attracting attention from respected publishers such as Scopus, Taylor & Francis, and others. We invite you to contribute your cutting-edge research and insights to our esteemed publication.
Zero-Day Vulnerabilities: Unveiling the Threat Landscape in Network Security
Today's digital ecosystem is particularly vulnerable to attacks due to zero-day vulnerabilities. Attackers take advantage of these flaws, which software developers and security experts are unaware of, leading to catastrophic outcomes. Through an analysis of their lifetime, discovery approaches, exploitation methods, disclosure protocols, and patching strategies, this study tries to reveal the danger landscape of zero-day vulnerabilities. We examine the effects of zero-day vulnerabilities on network security and the difficulties that businesses confront by reviewing the relevant literature and discussing actual cases. We also investigate preventative measures and methods of defense, such as intrusion and anomaly detection systems and cutting-edge AI. We stress the need for responsible disclosure, prompt patching, and continued research to counter these difficult to detect dangers. In order to better understand zero-day vulnerabilities, implement countermeasures, and respond to them, this article is an invaluable resource for researchers, security experts, and organizations.
Copyright (c) 2022 Raheela zaib, Kai-Qing Zhou https://creativecommons.org/licenses/by/4.0
AntDroidNet Cybersecurity Model: A Hybrid Integration of Ant Colony Optimization and Deep Neural Networks for Android Malware Detection
Malware detection is a vital problem, and efficient methods that can efficiently detect malware are needed. The increasing use of mobile computers makes malware detection a vital part of security in an era where smartphones have come to play a key role in many of our daily lives. Earlier approaches, however, suffer from high false positive rates; they are not scalable for larger databases, or they are not amenable to adapt well to novel zero-day malware. For these reasons, the demand for more sensitive and flexible detection models is high. In this study, we develop a hybrid mobile malware detection framework that leverages ant colony optimization (ACO) and deep neural networks (DNNs) to improve detection accuracy, reduce the rate of false positives, and make the model resilient to new malware. AntDroidNet is a novel ACO-enabled feature selection model that dynamically reduces the feature dimensionality by selecting single instances to include the most informative properties and avoid dimensionality. A DNN is consequently constructed to train the determined set of features, improving the identified classification performance and decreasing the number of instances with false discoveries. In this way, a self-optimizing feedback loop can iteratively improve the feature selection process given the performance of the DNN, leading to a dynamic and efficient detection model. Using the CICMalDroid2020 dataset, the proposed AntDroidNet model achieves a remarkable accuracy of 99.89% and an excellent false positive rate of only 0.13% and outperforms the classical machine learning algorithms in terms of accuracy and efficiency. AntDroidNet is a scalable and powerful mobile malware detection model that eclipses all state-of-the-art methods and shows important enhancements in efficiency and reliability. By prototyping whitelisting systems, this work opens new avenues in mobile security and lays the groundwork for future work on building real-time detection components and system components able to scale to the fast pace of evolution of mobile malware in new connected ecosystems.
Copyright (c) 2025 Riyadh Rahef Nuiaa Al Ogaili, Osamah Adil Raheem, Mohamed H Ghaleb Abdkhaleq, Zaid Abdi Alkareem Alyasseri, Saif Ali Abd Alradha Alsaidi, Ali Hakem Alsaeedi, Yousif Raad Muhsen, Selvakumar Manickam https://creativecommons.org/licenses/by/4.0
Transaction Security and Management of Blockchain-Based Smart Contracts in E-Banking-Employing Microsegmentation and Yellow Saddle Goatfish
The process security of money transactions is considered an important issue in e-banking. Additionally, it is an enormous problem if never controlled. particular, security should be a combination of fast and sturdy characteristics, which is the subject of previous studies suffered from. Our research attempts to improve the system in which banks deal with the security of financial transactions. This research leverages the idea of microsegmenting the entire system into designated zones to concentrate on security, where each zone has its own rules and limitations. These rules are managed by a smart contract, which decides whether they have been observed to verify the legitimacy of the customer. First, the two-phase commit algorithm (2PC) was used to specify the type of e-banking request. After this, the microsegmentation principle was applied to isolate each type of e-transaction process alone in a separate segment. Then, the yellow saddle goatfish algorithm (YSGA) was used to determine whether the smart contract conditions were optimized. Finally, if the customer is authorized, then the entire transaction process is saved in the blockchain's main ledger and secured by a unique hash. The blockchain application makes our system capable of dealing with large numbers of users in a decentralized manner. In addition, using a hash with each block prevents fraudulent transactions by adversaries. Our system has been examined against several recent well-known assaults/attacks, such as falsification, advanced persistent threat, bribery, spoofing, double spending, chosen text, race, and transaction replay attacks, and has proven to overcome them. In terms of the performance evaluation, we obtained an execution time of approximately 0.0056 nanoseconds, 3.75% complexity, and 1500 KB of memory and disk drive, which is considered low compared to that of state-of-the-art research. Thus, our proposed system is highly acceptable for banking sector applications.
Copyright (c) 2024 Mishall Al-Zubaidie, Wid https://creativecommons.org/licenses/by/4.0
SQL injection is a type of security vulnerability that occurs in database-driven web applications where an attacker injects malicious code into the application to gain unauthorized access to sensitive information. This paper aims to provide a comprehensive and systematic review of the existing methods for preventing and detecting SQL injection attacks. The review covers a range of techniques, including input validation, parameterized queries, and intrusion detection systems, as well as the advantages and disadvantages of each method. The most common prevention techniques include input validation, parameterized queries, and stored procedures, while the most common detection techniques include intrusion detection systems (IDS), honeypots, and signature-based detection. The choice of method will depend on the specific requirements of the organization and the level of security required. Still, a combination of prevention and detection methods is likely to be the most effective way to secure web applications against SQL injection attacks. The paper concludes that SQL injection attacks continue to be a significant security threat to web applications, and it is essential for organizations to implement effective prevention and detection methods to secure their web applications against SQL injection attacks.
Copyright (c) 2023 Vugar Abdullayev, Dr. Alok Singh Chauhan https://creativecommons.org/licenses/by/4.0
Detection of False Data Injection Attack using Machine Learning approach
The "False Data Injection" (FDI) attack is one of the significant security risks that the deep neural Network is susceptible to. The purpose of the FDI attacks is to deceive industrial platforms by faking sensor readings. considered a few relevant systematic reviews that have been previously published. Recent systematic reviews may include both older and more recent works on the topic. Therefore, I restricted myself to recently published works. Specifically, we analyzed data from 2016-2021 for this work. Attacks using FDI have effectively beaten out traditional threat detection strategies. In this paper, we provide an innovative auto-encoder-based technique for FDI attack detection (AEs). use of the temporal and spatial correlation of sensor data, which may be used to spot fake data. Additionally, the fabricated data are denoised using AEs. Performance testing demonstrates that our method is effective in finding FDI attacks. Additionally, it performs much better than a similar technique based on a support vector machine. The ability of the denoising AE data cleaning method to recover clean data from damaged (attacked) data is also shown to be quite strong.
Copyright (c) 2022 Siti Nur Fathin Najwa Binti Mustaffa, muhammad Farhan https://creativecommons.org/licenses/by/4.0
PRIFLEX: A Secure Federated Learning Framework for Evaluating Privacy Leakage and Defense in Cross-Modal Medical Data
Federated learning (FL) enables decentralized, privacy-preserving machine learning by training models across distributed data without sharing raw patient information. However, most FL frameworks focus on unimodal data and overlook critical challenges in multimodal healthcare settings, such as privacy risks, fairness disparities, and reduced model interpretability. We present PRIFLEX (Privacy-Resilient Integration Framework for Learning Exchange), a novel FL framework designed for secure integration of structured and unstructured medical data. PRIFLEX combines 12-lead electrocardiograms (ECG) from the PhysioNet PTB-XL dataset and clinical notes from the Medical Information Mart for Intensive Care IV (MIMIC-IV), supporting early, late, and hybrid data fusion strategies. To safeguard model updates, it evaluates standalone and hybrid defenses using Differential Privacy (DP) and Secure Aggregation (SA) against gradient leakage, model inversion, and membership inference attacks. Results show that early fusion improves the area under the Receiver Operating Characteristic curve (AUROC) by up to 6.2%, while hybrid DP+SA reduces attack success rates by up to 84% and improves fairness with manageable system overhead. PRIFLEX also quantifies interpretability loss using SHapley Additive exPlanations (SHAP) and gradient-based methods, highlighting the trade-off between privacy and transparency. Overall, PRIFLEX sets a new benchmark for building secure, fair, and explainable federated learning systems in healthcare.
Copyright (c) 2025 Mohammad Othman Nassar , Feras Fares AL-Mashagba https://creativecommons.org/licenses/by/4.0
A Proposed Algorithm For Avoiding Jammer In Structure-Free Wireless Sensor Networks
Wireless Sensor Networks (WSNs) have emerged as a transformative technology with applications in critical and often inaccessible environments, including military and security domains. These networks comprise cooperative sensor nodes that gather and relay data to a base station. However, their inherent resource constraints—particularly the non-rechargeable nature of energy—pose a major challenge to network longevity and reliability. Conventional fixed-path transmission protocols exacerbate this issue, as energy-depleted or jammed nodes can disrupt communication, leading to partial or complete data loss. The primary objective of this study is to design and evaluate a structure-free transmission protocol that dynamically adapts data routing in order to optimize energy utilization and enhance resilience against jamming attacks. To achieve this, our study examines the impact of four distinct jammer types—Constant, Deceptive, Random, and Reactive—on key performance indicators, including energy consumption, signal-to-jamming ratio, and data rate. Simulation results reveal that jamming increases the number of transmission levels by up to 55%, with Deceptive Jammers generating the fewest and Constant Jammers the most. Energy consumption rises by as much as 62% under jamming, with Random Jammers causing the highest drain. Moreover, data rates increase by approximately 37% in the presence of jamming. These findings highlight the proposed protocol’s effectiveness in mitigating jamming effects while preserving network energy, offering a robust solution for WSNs deployed in hostile or high-risk environments.
Signal-To-Jamming Ratio ) SJR) And Attack.
Copyright (c) 2025 Zainab Shaker Matar Al-Husseini , Hussain K. Chaiel , Amel Meddeb , Ahmed Fakhfakh https://creativecommons.org/licenses/by/4.0
Mitigating Zero-Day Vulnerabilities in IIoT Systems: Challenges and Advances in AI-Powered Intrusion Detection Systems
Zero-day attacks are one of the great challenges that intrusion detection systems have been facing and keep on facing today, especially worsening within Industrial Internet of Things environments since their ability to take advantage of unknown vulnerabilities results in a high rate of false negatives. It is under this framework that this paper presents a set of experiments that have been carried out with the objective of analyzing the consequences of zero-day attacks with regard to performance degradation in Intrusion Detection System (IDS) and, secondly, and with greater emphasis, about those failings which have been pointed out up to now as those affecting precision in detection. This has been done through the systematic review of 200 research papers published from the years 2023 to 2024, further categorized into the four main focus areas: general AI-based IDS, Machine learning (ML)-based IDS, Deep Learning (DL)-based IDS, and Deep Reinforcement Learning (DRL)-based IDS. Accordingly, 45% were DL-based IDS reviews; 35% related to machine learning; 15% consisted of the ones about DRL-based ones, while 5% pertain to the General AI-based ones. Results show that the approaches with DL-based systems will come up with extensive promises, reducing the impact brought by false negatives, besides extending the issues even when one considers a background of adversarial attack issues. It underlines that, in IDS, apart from accuracy, detection specificity and recall are also of essence for dealing with low frequent but high-impact zero-day threats. These techniques further make the following proposal: the use of both machine learning and deep learning techniques should be improved in enhancing the performance of IDS.
Copyright (c) 2025 Khalid Asaad Hashim, Yusnani Binti Mohd Yussoff1, Shahrani Binti Shahbudin https://creativecommons.org/licenses/by/4.0
Improvement of the Face Recognition Systems Security Against Morph Attacks using the Developed Siamese Neural Network
Face Recognition Systems (FRS) are increasingly targeted by morphing attacks, where facial features of multiple individuals are blended into a synthetic image to deceive biometric verification. This paper proposes an enhanced Siamese Neural Network (SNN)-based system for robust morph detection. The methodology involves four stages. First, a dataset of real and morphed images is generated using StyleGAN, producing high-quality facial images. Second, facial regions are extracted using Faster Region-based Convolutional Neural Networks (R-CNN) to isolate relevant features and eliminate background noise. Third, a Local Binary Pattern-Convolutional Neural Network (LBP-CNN) is used to build a baseline FRS and assess its susceptibility to deception by morphed images. Finally, morph detection and classification are conducted using the proposed SNN framework, which incorporates a novel feature fusion strategy based on Canonical Correlation Analysis (CCA) to enhance discriminative power. The model is trained and evaluated using publicly available Face Recognition Technology (FERET) and Face Recognition Grand Challenge (FRGC) datasets, comprising 1,030 real and 2,000 morphed images. Experimental results demonstrate that the proposed method significantly strengthens the resilience of FRS to morphing attacks, achieving a high detection accuracy of 99.9%. This confirms the model’s effectiveness in distinguishing between real and manipulated images with minimal errors.
Faster Region-based Convolutional Neural Networks (R-CNN)
Local Binary Pattern-Convolutional Neural Network (LBP-CNN)
Copyright (c) 2025 Sura Abed Sarab Hussien , Thair Abed Sarab Hussien, Nada Hussien Mohammed Ali https://creativecommons.org/licenses/by/4.0
Global Research Trends and Collaboration in MITRE ATT&CK Framework: A Bibliometric and Network Analysis in Cybersecurity
The MITRE ATT&CK framework has become a foundational tool for organizing adversarial behaviors and techniques in cybersecurity. While its adoption in practice and academia has grown significantly, no prior bibliometric review has comprehensively mapped the global research landscape surrounding this framework. This study addresses that gap by conducting a systematic bibliometric and network analysis of publications related to ATT&CK indexed in Scopus from 2017 to 2025. Using VOSviewer and quantitative bibliometric methods, we analyzed 391 publications to identify trends in research output, influential works, key contributors, thematic areas, and patterns of collaboration. Results show exponential growth in studies related to ATT&CK, with North America, Europe, and Asia as major contributors. Network analysis revealed highly interconnected author clusters, while keyword mapping identified five dominant research themes, including threat intelligence, adversary emulation, and machine learning-based detection. Citation analysis further identified inspiring publications that have significantly influenced the field. This review clarifies the intellectual structure and collaborative dynamics of ATT&CK research, offering insights into its development and pointing to future opportunities in interdisciplinary cybersecurity research.
Copyright (c) 2025 Asad Maqsood, Syifak Izhar Hisham, Ahmad Firdaus https://creativecommons.org/licenses/by/4.0
Blockchain-Integrated Edge-Cloud-Enabled Healthcare Data Analytics Based on Distributed Federated Learning and Deep Neural Networks
The exponential growth of healthcare Internet of Things (IoT) data necessitates secure, low-latency analytics that extend beyond centralized architectures. This paper presents BDAFL DNN, a blockchain-integrated data analytics framework that combines Federated Learning (FL) and Deep Neural Networks (DNNs) for real-time, privacy-preserving healthcare analytics across edge and cloud resources. Local devices such as smartwatches and phones collect noninvasive time series sensor streams (heart rate, temperature, and abdomen sensors), perform on device DNN training, and send only model updates to healthcare edge nodes, where a blockchain ledger validates updates for integrity and traceability; validated updates are then aggregated in the cloud via FL to produce a global model without sharing raw data. In a simulation study against representative baselines, BDAFL DNN reduced execution time, energy use, and resource consumption, lowered the deadline miss ratio, and improved blockchain validation correctness. These results show that integrating blockchain with FL-driven edge and cloud DNN analytics can deliver scalable, secure, and timely insights for future healthcare IoT systems.
Copyright (c) 2025 Mazin Abed Mohammed, Mohd Khanapi Abd Ghani, Israa Badr Al-Mashhadani, Sajida Memon, Abdullah Lakhan, Haydar Abdulameer Marhoon, Marwan Ali Albahar https://creativecommons.org/licenses/by/4.0
A New Framework Enhancing, Evaluation, and Benchmarking for Cybersecurity DDoS Attack Detection Models Through the Integration of BWM and VIKOR Methods
The proposed work aims to develop a DDoS attack detection model that targets web servers by selecting the appropriate classifier based on several criteria and enhancing the accuracy. The detection system has been constructed using machine-learning algorithms to train and test the CIC-DDoS2019 dataset, and it is integrated with a stacked classifier to enhance accuracy. The classifiers depend on multiple criteria. For that, we employed the BWM to calculate the criteria weights and VIKOR to rank the classifiers, which are part of the MCDM methods. We consulted three experts to establish weights for the categories. Also, we utilized two methods to verify the results: objective validation and sensitivity analysis. BWM and VIKOR have effectively selected the most suitable classifier based on multiple criteria, making them one of the most appropriate choices. The BWM method achieved the highest weight of 0.2436 for the time criterion and 0.2302 for the accuracy criterion. VIKOR methods demonstrated that the SVM classifier proved more efficient and superior to other classifiers. It achieved 99.32% accuracy and a processing time of 9 seconds, making it suitable for use on high-priority websites, such as e-commerce platforms or state security websites. The stacked classifier can be applied to other projects where the time criterion is less critical, achieving a 99.57% accuracy enhancement in 143 seconds. Objective validation and sensitivity analysis confirmed the validity of the results, demonstrating that all scenarios consistently ranked the SVM as the highest among all classifiers, highlighting this classifier's remarkable ability to balance the criteria.
Copyright (c) 2025 Alaa Mohammed Mahmood, İsa AVCI, Sahar Yousif Mohammed https://creativecommons.org/licenses/by/4.0
Blockchain-Based Accountability: A Systematic Literature Review
The Blockchain algorithm has advanced the accountability and transparency of modern digital infrastructures. Enforcing responsible behavior and data integrity across distributed environments involves several key components, such as smart contracts, access control models, cryptographic techniques, and a decentralized identity framework. Because the blockchain ledger is immutable and transparent, once a transaction is recorded, it cannot be altered without detection, making fraudulent actions easily traceable and thereby ensuring accountability. However, the need for hybrid approaches that combine on-chain and off-chain solutions for an efficient reliability system introduces challenges, including privacy preservation, scalability, and regulatory compliance. This paper analyzes the effective features that enhance blockchain accountability, such as immutability, traceability, auditability, and decentralized control. We propose research gap directions for the research community. To improve the reliability of blockchain systems across various domains, based on a systematic analysis and integration of recent developments and real-world demands. Consequently, we have distinguished 33 relevant research studies from a total of 358 publications covering the period between 2020 and 2025 by employing the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) framework. We identified three major themes addressed by the papers in the reviewed studies: further investigations into the ML role in enhancing accountability are required, especially using lightweight ML algorithms such as BNN and Tseltin machine, examining the limitations of blockchain’s auditability for real-time applications and decision-making efficiency, and a practical study of mechanism scalability in trade-off cost-efficiency.
Copyright (c) 2025 Nabeel Z. Tawfeeq, Dujan B. Taha https://creativecommons.org/licenses/by/4.0
Comprehensive study of Integrating Clustering and Adversarial Learning for Enhanced Recommender Systems: A Systematic Review of Hybrid Methodologies and Applications
Recommender systems (RSs) have become critical elements in modern instances of information and decision-support systems, resulting in a transformation of user experiences through highly personalized suggestions for an undeniably vast range of items. Although RSs have become commonplace, they continue to evolve, and their challenges, including sparsity, cold-start, scalability, and vulnerability to adversarial challenges remain. The use of clustering methods has proven highly effective in resolving these issues through the discovery and exploitation of latent user behaviour patterns, segmenting user groups that contribute more towards personalized and adaptable RSs. Additionally, adversarial learning has become a growing focus of study as a proposed solution for shielding and defending RSs, processes, and data from manipulation and attacks, resulting in greater resistance and trustworthiness. This study presents a systematic literature review (SLR) that explores the intersection of RSs, clustering methods, and adversarial learning. This paper synthesizes a critique of the latest hybrid recommendations, detailing motivations, challenges, directions for future study, and practical recommendations drawn from the examined studies. An SLR search of four academic databases, ScienceDirect (SD), IEEE Xplore (IEEE), Scopus, and Web of Science (WoS), delivered an initial yield of 843 studies; after filtration, 51 studies remained. All the retained articles were examined and characterized in terms of dataset details, techniques, frameworks, and performance. A significant gap in research has emerged regarding the overreliance on datasets from commercial and entertainment domains, with a notable scarcity of studies addressing critical domains such as healthcare, finance, and other critical fields where diverse data sources should invoke robust, secure, and trustworthy RSs recommendations. Future research is needed to develop adversarially robust RSs for high-stakes applications requiring stringent accuracy and safety standards. This review provides a rich critical examination of the literature to embolden the ideas and theories associated with clustering methods and adversarial learning working together within RSs. It offers concrete opportunities and directions for carrying out future work in developing next-generation secure, adaptive recommendation frameworks. These findings corroborate a change in perspective on designing systems that seek to develop an RSs that can withstand adversarial threats and promote the development of safer, fairer, and more reliable decision-support systems in a variety of domains.
Copyright (c) 2025 M. E. Alqaysi, Murtadha M. Hamad, Ahmed Subhi Abdalkafor https://creativecommons.org/licenses/by/4.0
Enhancing Internet of Things (IoT) Network Security: A Machine Learning-Driven Framework for Real-Time Intrusion Detection and Anomaly Classification
The rapid proliferation of IoT devices presents serious IoT network cybersecurity threats; hence, advanced IDSs are necessary. Signature and rule-based IDS mechanisms cannot address novel attacks, generate excessive alarms, and are computationally inefficient. Therefore, in response, in this paper, a machine learning IDS for IoT network real-time intrusion detection and anomaly categorization is proposed via black widow optimization (BWO) for optimal feature and hyperparameter selection. The IDS employs standard machine learning models, such as random forest and support vector machines (SVMs), and deep models, such as long short-term memory (LSTM), to address IoT environment nuances. The framework is evaluated on Bot-IoT and UNSW-NB15 datasets, such as various IoT-based attacks and normal traffic. The BWO algorithm maximizes feature reduction; for Bot-IoT, 57.1%; and for UNSW-NB15, 55.1%, while retaining better detection accuracy. Experimental evidence demonstrates the strength of the framework, where LSTM offers optimal detection accuracy (99.1%) and low false alarms (0.9%). The SVM model is computationally efficient and has a low training time (90 s), inference time (10 ms), space (200 MB) and power (40 joules). The framework's scalability is also an advantage, maintaining good precision despite expanding the dataset, and is therefore perfect for extensive IoT networks. The ability of BWO to rapidly converge ensures timely and efficient optimization, which is crucial for IoT applications in practice. The tradeoff between the capability to detect and the computational cost is achieved by the framework, overcoming the drawbacks of traditional IDSs and providing an efficient solution for IoT network protection. In conclusion, our solution innovates IoT security by using BWO and machine learning to ensure accurate detection, computational power, and scalability. The developed framework presents an efficient and effective solution for real-time intrusion detection, addressing the IoT's current and future needs for cybersecurity.
Copyright (c) 2025 Loiy Alsbatin, Firas Zawaideh, Basem Mohamad Alrifai, Tareq A. Alawneh https://creativecommons.org/licenses/by/4.0
Blockchain-Powered Dynamic Segmentation in Personal Health Record
Sensitive patient data must be handled securely in modern oncology care to protect patient privacy, regulatory compliance, and clinical decision-making integrity. Conventional centralized healthcare systems pose serious threats to patient confidentiality and treatment continuity because of their susceptibility to data breaches, illegal access, and single points of failure. This study suggests a blockchain-based decentralized cancer healthcare security solution. The proposed system is based on the idea of layers; each layer has a distinct function that gives it a feature that sets it apart from the others. A hierarchical clustering algorithm (HCA) is used in the first layer to determine the patient's cancer type. The second layer follows, which is mostly founded on the dynamic segmentation (DS) principle. To guarantee high security, patients are isolated on the basis of their kind in various segments. The data are then compressed via the snappy algorithm (SA) at the compression layer. To prevent hacking, the smart contracts layer then applies conditions to each of those segments. These conditions are based on the named entity recognition (NER) algorithm's decision, which is crucial in deciding whether to use blockchain technology (BCT), and ChaCha20 encryption is used to protect the confidentiality of distributed transactions in BCT. Data analysis revealed that, in comparison with earlier methods, the suggested system offers good security, and the high-performance speed of system interaction did not surpass 0.18 ms. Additionally, we were able to acquire a segmentation time of 0.25 ms, a discrimination time of 1.5 ms, and a smart contract verification time of 0.45 ms.
Copyright (c) 2025 Mishall Al-Zubaidie (Author); Wid Alaa Jebbar https://creativecommons.org/licenses/by/4.0
Enhanced Key Generation Method using Deep Q-Networks Algorithm with Chaotic Maps
In contemporary digital environments, exponential cyber threat growth has made cryptographic key generation a critical security challenge. Traditional Pseudo-Random Number Generators (PRNGs) and existing chaos-based methods often exhibit insufficient entropy, limited randomness quality, and inadequate resistance to statistical attacks. Current implementations frequently produce suboptimal entropy values and fail to meet modern cryptographic security standards and rigorous randomness testing protocols. This paper aims to design and implement an advanced cryptographic key generation system that combines Deep Q-Networks (DQN) algorithms with multiple chaotic maps to produce cryptographically secure stream key bits with high randomness and strong resistance to cryptanalytic attacks. The proposed DRLKG-Chaotic (Deep Reinforcement Learning Key Generation with Chaotic maps) system implements six distinct experimental scenarios utilizing five chaotic maps: Tent, Ikeda, Chua's, Rössler, and Double Pendulum. The first five scenarios individually integrate each chaotic map with a DQN algorithm, whereas the sixth scenario implements a novel fusion approach that incorporates all five maps simultaneously. Each scenario generates key streams of three different lengths (128-bit, 192-bit, and 256-bit) to accommodate varying security requirements. A comprehensive evaluation using the National Institute of Standards and Technology (NIST) statistical test suite, brute-force attack resistance analysis, Auto Correlation (AC), Cross Correlation (CC), and Discrete Fourier Transform (DFT) analysis demonstrates the significant improvements over standard chaotic implementations. The results indicate that the DQN scenarios achieve entropy values ranging from 0.9097--0.9999, whereas the standard chaotic maps achieve values ranging from only 0.3627--0.5463. All NIST test P values consistently exceed 0.90 across all the parameters, indicating superior randomness characteristics. In addition, reliable results are obtained when various types of attacks, such as brute-force attacks, side‑channel attacks, and timing attacks, are applied.
Copyright (c) 2025 Ali A. Mahdi , Mays M. Hoobi https://creativecommons.org/licenses/by/4.0
Multilevel Text Protection System Using AES and DWT-DCT-SVD Techniques
In the digital age, protecting intellectual property and sensitive information against unauthorized access is of paramount importance. While encryption helps keep data private and steganography hides the fact that data are present, using both together makes the security much stronger. This paper introduces a new way to hide encrypted text inside color images by integrating discrete wavelet transform (DWT), discrete cosine transform (DCT), and singular value decomposition (SVD), along with AES-GCM encryption, to guarantee data integrity and authenticity. The proposed method operates in the YCbCr color space, targeting the luminance (Y) channel to preserve perceptual quality. Embedding is performed within the HL subband obtained from DWT decomposition via SVD coefficients extracted from DCT-transformed images in the midfrequency band. A content-aware strategy combining Gaussian blurring, Canny edge detection, and zigzag scanning is employed to increase robustness against image processing attacks. The experimental results demonstrate the effectiveness of the proposed approach, which achieves up to a 10.4% improvement in PSNR, an SSIM score of 0.996, and a 0.10% increase in NCC over those of previous methods, which mostly rely on grayscale images. These results reflect the ability of the system to maintain high visual quality while offering strong resilience and security for embedded data in full-color images.
Copyright (c) 2025 Nuha Mohammed Khassaf , Nada Hussein M. Ali https://creativecommons.org/licenses/by/4.0
Enhancing Multifactor Authentication Using Machine Learning Techniques
Securing access to distributed database systems presents unique challenges because of their decentralized nature and exposure to multipoint threats. Traditional single-factor authentication mechanisms, such as passwords or PINs, are insufficient in such environments, prompting the need for more resilient solutions. This study proposes a biometric-based multifactor authentication (MFA) framework that combines fingerprint and facial modalities through a unified machine learning (ML) pipeline. ML plays a crucial role in enhancing classification performance by enabling the system to learn complex patterns across biometric inputs. The framework standardizes input preprocessing (by applying grayscale conversion, histogram equalization, and normalization) and employs the histogram of oriented gradients (HOG) technique for feature extraction. To improve classification performance and generalizability, three decision-level ensemble models are used: support vector machine (SVM) integrated with random forest (RF), stochastic gradient descent (SGD), and eXtreme gradient boosting (XGBoost). These hybrid combinations exploit the complementary strengths of different classifiers, such as margin optimization, ensemble learning, and fast convergence, resulting in superior accuracy compared with standalone models. All the models were trained and evaluated via a 10-fold cross-validation scheme on the family fingerprint dataset and face recognition dataset under consistent conditions. The experimental results indicate that the SVM with the RF model achieves the highest accuracy, with scores of 0.92 for fingerprint recognition and 0.97 for facial recognition. These outcomes underscore the framework’s suitability for high-security applications, particularly in distributed database environments where reliable and adaptive authentication is essential.
Copyright (c) 2025 Rafea Mohammed Ibrahim https://creativecommons.org/licenses/by/4.0
Optimizing Cybersecurity in 5G-Enabled IoT Networks via a Resource-Efficient Random Forest Model
With the widespread deployment of 5G networks together with many Internets of Things (IoT) devices, the demand for secure space has grown substantially. The proposed research focuses on improving the existing cybersecurity solutions in 5G based IoT networks through resource-efficient implementation of the random forest (RF) model. This study evaluated an IDPS based on a completely simulated 5G-era IoT scenario. The study evaluated an IDPS using a simulated 5G-era IoT environment replicating real-world device interactions. Synthetic datasets representing normal and malicious traffic, including distributed denial-of-service (DDoS) attacks, were used for model training and testing. The performance of the RF model was assessed via important metrics, including accuracy, recall, precision, and the F-measure. The RF model achieved a high F-measure of 77%, reflecting a strong ability to identify and mitigate threats. Additionally, the model performs exceptionally well in terms of essential characteristics such as the identification of anomalies, the ability to respond in real time, the management of resources, and the protection of privacy. Within the context of a 5G network, the findings demonstrate that is random forest an acceptable and effective method for securing resource-constrained Internet of Things networks. Future work may explore hybrid AI models to enhance security capabilities
Intrusion Detection And Prevention System (IDPS)
Copyright (c) 2025 Zainab Ali Abbood , Aysar Hadi Oleiwi, Raghad Tariq Al-Hassani, Jenan Ayad https://creativecommons.org/licenses/by/4.0
Adversarial Attacks on Hybrid Attention Integrated Transfer Learning for Lung Cancer CT Classification
Deep learning–based classification of lung cancer from CT images can achieve high accuracy but is vulnerable to adversarial attacks that introduce imperceptible perturbations, potentially leading to misdiagnoses. Paying attention to neural networks in transfer learning could improve both the effectiveness and resistance to change. In this paper, we propose a hybrid framework that combines a MobileNetV2 backbone with channel–spatial attention modules and white‑box adversarial testing via the fast‑focused gradient sign method (FFGSM) and projected gradient descent under an L₂ norm constraint (PGDL₂). The model was trained end‑to‑end on a stratified CT dataset of 3,451 images (normal, benign, malignant) with adversarial examples injected during training (ε=4/255; PGDL₂: α=1/255, 7 steps). The evaluation of the performance was based on accuracy and precision, recall, the F1- score and the reduction in model performance due to adversarial attacks. For clean inputs, the attention‑augmented model achieved 86% accuracy (FFGSM) and 95% accuracy (PGDL₂), with balanced F1‑scores >0.90 across classes. Under adversarial attack, the accuracy decreases to 78% (FFGSM) and 86% (PGDL₂), indicating a smaller robustness drop for PGDL₂‑augmented training. Having attention modules in the model significantly enhanced the ability to discern features, saving up to 9% in performance compared with the models without attention. These methods made it clear that the model was more focused on clinically important parts. Incorporating hybrid channel–spatial attention into transfer‑learning pipelines substantially improve the accuracy and resilience of lung cancer CT classification to strong adversarial attacks. The results of our study can help guide the development of strong AI tools for examining medical images.
Copyright (c) 2025 Omar Ibrahim Obaid, Abdulbasit alazawi https://creativecommons.org/licenses/by/4.0
A Novel Diffusion-Based Cryptographic Method for Cyber Security
Data security remains a critical concern, especially for lightweight and resource-constrained environments. Traditional lightweight designs, such as those relying on linear congruential generators (LCGs) are susceptible to predictability and vulnerability to statistical attacks. This paper proposes an enhanced diffusion-based encryption framework that replaces the LCG with the ChaCha20 stream cipher for pseudorandom sequence generation and introduces a key-dependent bit-shuffling mechanism to strengthen diffusion. The methodology integrates three key stages. First, pseudorandom keystream generation is performed via ChaCha20 with a 256-bit key and a 96-bit nonce derived from the encryption key. Second, modular arithmetic-based diffusion (addition/XOR) is applied between the plaintext and the keystream. Finally, Fisher-Yates bit-level shuffling is seeded by the ChaCha20 output, ensuring robust decorrelation. Experimental evaluation demonstrates that the proposed scheme achieves near-ideal Shannon entropy (7.998–7.999 bits/byte), a negligible plaintext-ciphertext correlation (≈0.0142), and passes 100% of the NIST statistical randomness tests. The avalanche effect consistently reaches 100%, confirming high sensitivity to key and plaintext changes. Comparative analysis shows that the enhanced method provides superior security to LCG-based schemes while maintaining computational efficiency comparable to that of lightweight ciphers (AES, SIMON). The results confirm that the integration of ChaCha20 and enhanced bit-level diffusion significantly improves robustness against predictability and correlation attacks.
Copyright (c) 2025 Kamaran Adil Ibrahim , Basim Najim Al-Din Abed, Sura Abed Sarab Hussien https://creativecommons.org/licenses/by/4.0
Anti-Cyber Childhood Exploitation: An Online Game Chat Monitoring System
Despite its revolutionary benefits, the Internet has been utilized to abuse children through chat in online gaming. Exhibiting harmful content can negatively impact children's psychology and behaviour, particularly during their developmental years. This paper examines the psychological effects of online predation and the growing risks posed by Internet predators (with focus on children under 15 years old). This paper proposed an Anti-Cyber Childhood Exploitation (A2CE) system, a comprehensive framework designed to detect and prevent three major forms of online abuse: psychological manipulation, cyberbullying, and online grooming. Leveraging advanced Natural language processing (NLP) techniques, A2CE analyses online conversations in real time. The system is trained on three well-known datasets: PUBG, Dota 2, and PAN12. Upon detecting an attack, A2CE provides immediate alerts and warnings to parents, helping mitigate psychological harm. The experimental results demonstrate high detection accuracy: 96.8% for grooming, 94.2% for psychological manipulation, and 92.8% for cyberbullying. These findings indicate that A2CE can be considered a powerful tool for protecting children in this critical age.
Copyright (c) 2025 Saja J. Mohammed, Awos K. Ali, Ibrahim M. Ahmed https://creativecommons.org/licenses/by/4.0
An Artificial Intelligence-based System for Detecting Meta Fake Profiles via Gradient Boosting and Multilayer Perception
The rise of metaverse platforms has renewed interest in detecting fake profiles, which pose a significant threat to digital ownership and asset transactions within these virtual environments. If digital ownership is not guaranteed, platforms risk missing the point of the metaverse. Current supervised learning techniques for fake profile detection often struggle to maintain acceptable accuracy and interpretability in practice. To address this problem, this study investigates the application of two machine learning models, multilayer perceptron and gradient boosted trees, for detecting fake profiles, with model evaluation performed via two Explainable AI (XAI) techniques, Local Interpretable Model-agnostic Explanations (LIME) and SHapley Additive exPlanations (SHAP). The algorithms were implemented and evaluated on a dataset of 1244 profiles (1043 real and 201 fake) with 12 attributes. The major finding is that both techniques perform well, but the gradient boosting model achieves a higher accuracy of 99.2% compared with the multilayer perceptron's accuracy of 98.4%. Furthermore, the LIME and SHAP analyses provide insights into the feature importance and decision-making processes of the models. These results suggest that gradient boosting, in conjunction with explainable AI methods, is a more accurate, interpretable, and representative solution for detecting fake profiles in real-world metaverse scenarios, contributing to the development of more secure and reliable digital ownership within these platforms.
Copyright (c) 2025 Ruaa A. Al-Falluji, Marwan Ali Albahar , Ahmad Mousa Altamimi https://creativecommons.org/licenses/by/4.0
A Systematic Review of Metaverse Cybersecurity: Frameworks, Challenges, and Strategic Approaches in a Quantum-Driven Era
This study aims to perform a detailed systematic review that investigates and synthesizes the available literature on the challenges and strategies in cybersecurity in the Metaverse. The methodology employed was to ensure a comprehensive literary analysis of the study methods, employing databases such as ScienceDirect (SD), Scopus, IEEE Xplore (IEEE), and Web of Science (WoS). The search was conducted by employing a query that would yield articles published until September 2024, resulting in a total of 325 papers. After vigorous screening, deduplication, and application of the inclusion and exclusion criteria, 34 studies were identified for quantitative synthesis. These papers were divided into three classes: cybersecurity, AI-based security and IoT applications, and Metaverse and virtual realities. This article provides a systematic and comprehensive overview of previous studies that highlighted four fundamental challenges of cybersecurity in the Metaverse and discussed three recommendations for future improvement. A systematic science mapping analysis was conducted to synthesize the results regarding key trust issues related to security in the Metaverse. In addition, the study investigated a wide spectrum of practical applications of cybersecurity within Metaverse environments, encompassing authentication approaches, intrusion detection systems, privacy preservation frameworks, AI-based threat identification, and blockchain-enabled security proposals. Furthermore, this review explores how quantum technologies can be integrated into Metaverse cybersecurity frameworks to address advanced threat models and enhance resilience. The study also highlighted developments in cybersecurity for the Metaverse while pinpointing existing gaps, emerging threats, and directions for future research that would inform frameworks for improved security. The insights provided bear great significance for researchers, practitioners, and policy actors engaged with the Metaverse cybersecurity and applications of artificial intelligence (AI).
Copyright (c) 2025 Hasan Ali Al-Tameemi , Ghadeer Ghazi Shayea, Mishall Al-Zubaidie , Yahya Layth Khaleel , Mustafa Abdulfattah Habeeb, Noor Al-Huda K. Hussein , Raad Z. Homod, Mohammad Aljanabi, O.S Albahri , A. H. Alamoodi , Maad M. Mijwil, Mohammed A. Fadhel , Iman Mohamad Sharaf , Mohanad G. Yaseen , Ahmed Hussein Ali, U. S. Mahmoud, Saleh M. Mohammed , A. S. Albahri https://creativecommons.org/licenses/by/4.0
Blockchain and Federated Learning in Edge-Fog-Cloud Computing Environments for Smart Logistics
The rapid growth of smart logistics, driven by IoT devices and data-intensive applications, necessitates secure, scalable, and efficient computing frameworks. As the edge-fog-cloud (EFC) paradigm supports real-time data processing, it faces significant security threats and attacks, including privacy risks, data breaches, and unauthorized access. To address these security threats and attacks, blockchain and federated learning (FL) have gained popularity as potential solutions in EFC computing environments for smart logistics. This survey reviews the current landscape in EFC computing environments for smart logistics, highlighting the existing benefits and challenges identified in 134 research studies published between January 2023 and June 2025. The applications of blockchain and FL demonstrate their ability to enhance data security and privacy, improve real-time tracking and monitoring, and ensure inventory and supply chain optimization. Although these technologies offer promising solutions, challenges such as scalability issues, data quality, interoperability and standardization hinder their effective implementation. The survey suggests future research directions focused on developing advanced blockchain and FL, integrating emerging technologies, developing policies and regulations, fostering collaborative research, and ensuring cross-industry adoption and interoperability. Integrating blockchain and FL within the EFC model offers a transformative path toward building secure, intelligent, and resilient logistics systems.
Copyright (c) 2025 Guma Ali , Adebo Thomas, Maad M. Mijwil , Kholoud Al-Mahzoum, Malik Sallam, Ayodeji Olalekan Salau, Ioannis Adamopoulos , Indu Bala, Aseed Yaseen Rashid Al-jubori https://creativecommons.org/licenses/by/4.0
An Efficient Distributed Intrusion Detection System that Combines Traditional Machine Learning Techniques with Advanced Deep Learning
The Internet of Things (IoT), as a network of connected devices, enhances modern life but also introduces significant security vulnerabilities. Addressing these challenges requires intelligent and adaptive cybersecurity systems to ensure secure communication and protection against emerging threats. Among these systems, intrusion detection systems (IDSs) play a vital role in safeguarding IoT environments by continuously monitoring network traffic, detecting abnormal activities, and identifying or preventing unauthorized access and denial-of-service (DoS) attacks. However, despite their importance, IDSs face several limitations, including high false positive and false negative rates, delayed response times to security incidents, and substantial consumption of device resources. This paper proposes a framework for designing and implementing a hybrid for distributed intrusion detection system (DIDS) that combines traditional machine learning and advanced deep learning techniques. The model uses the random forest (RF) algorithm for feature selection (FS) and principal component analysis (PCA) for dimensionality reduction. Additionally, it integrates enhanced deep learning (DL) approaches, including an improved density peak clustering (DPC) algorithm for optimized feature representation and an enhanced long short-term memory (LSTM) algorithm for classification and model training. The proposed model is evaluated on the CICIOT2023 dataset, which reflects realistic network communication behavior alongside synthetically generated attack activities. The experimental results demonstrate a significant improvement in detection accuracy, achieving a detection rate of 97.88% while maintaining efficient resource consumption—making the system suitable for distributed deployment to monitor network traffic and generate alerts in the event of an attack.
Copyright (c) 2025 Wisam Ali Hussein Salman, CHAN HUAH YONG https://creativecommons.org/licenses/by/4.0
Ensure Privacy-Preserving Using Deep Learning
Deep learning has emerged as a powerful approach for treating complex real-world challenges. However, the performance of the deep learning models is heavily reliant on access to large volumes of high-quality training data—an aspect often constrained by privacy concerns. Ensuring data availability while preserving user confidentiality remains a pressing issue. In response, cryptographic techniques like homomorphic encryption (HE), which are grounded in strict mathematical principles, present hopeful solutions for securing data on digital platforms without compromising its usability for learning models. It performs computations on encrypted data without revealing the underlying plaintext. The main attractive feature of this technique is its ability to protect sensitive information in a variety of settings. Moreover, it guarantees the data’s trustworthiness and keeps data from being altered or tampered with. In this paper, sensitive data are encrypted via homomorphic algorithms and then input into deep learning to evaluate the feasibility of privacy-preserving deep learning. The aim is to examine the performance and security implications of fully homomorphic encryption (by the Learning With Errors (LWE) scheme) and partially homomorphic encryption (by the Rivest, Shamir, and Adleman (RSA) algorithms). Both methods were applied to three datasets for osteoporosis diagnosis. The experimental results show that LWE maintains high accuracy, reaching 88.01%, compared with unencrypted models. In contrast, RSA showed lower accuracy with minimum resource consumption. The findings showed that LWE is a more secure and reliable option for privacy-preserving deep learning in medical applications.
Copyright (c) 2025 Abeer Dawood Salman , Ruqayah Rabeea Al-Dahhan https://creativecommons.org/licenses/by/4.0
Optimized Deep Learning Model Using Binary Particle Swarm Optimization for Phishing Attack Detection: A Comparative Study
Phishing attacks manipulate users to disclose critical information, resulting in cybersecurity risks. Traditional phishing detection algorithms usually have large false positive rates and poor feature selection, degrading performance. This paper presents an optimized phishing detection framework that integrates binary particle swarm optimization (BPSO)-based feature selection (FS) with deep learning models. Six deep learning architectures were evaluated on the selected feature subset to identify the most effective model for accurate phishing classification. BPSO was used to select suitable attributes on a public Kaggle dataset with 10,000 samples, comprising phishing and legitimate website data with 48 attributes. NumDots, UrlLength, IpAddress, and NoHttps were selected among the 25 features chosen. BPSO was chosen because it effectively reduces feature dimensionality while preserving crucial attributes that enhance classification accuracy. The BPSO optimally selects relevant phishing-related attributes, improving model efficiency and reducing computational complexity. The BPSO technique optimally selects the most relevant features, reducing dataset dimensionality by 48% while maintaining high classification performance. We used six DL models—MLP, 1D-CNN, RNN, LSTM, GRU, and DNN—to test the specified characteristics. The experimental results demonstrate that the DNN model outperforms the other methods through 99.63% accuracy, 99.74% precision, 99.54% recall, and an AUC of 0.9999.
Copyright (c) 2025 El-Sayed M. El-Kenawy, Marwa M. Eid , Hussein Lafta Hussein , Ahmed M. Osman , Ahmed M. Elshewey https://creativecommons.org/licenses/by/4.0
SDN-Cloud Incident Detection & Response with Segmented Federated Learning for the IoT
The accelerated proliferation of Internet of Things (IoT) apparatuses has rendered intrusion detection and incident response progressively arduous owing to device diversity, constrained resources, and concerns regarding data confidentiality. Addressing these challenges is paramount to sustaining secure and resilient IoT ecosystems. This manuscript introduces an innovative framework that amalgamates software-defined networking (SDN) with segmented federated learning (SFL) to augment the effectiveness and reactivity of anomaly detection within the IoT. The proposed methodology delineates the federated learning (FL) process, facilitating lightweight, localized model training customized to the capabilities of individual IoT devices. The SDN is utilized to dynamically regulate network flows and implement real-time incident response measures. The proposed architecture is structured to reduce communication overhead, safeguard data privacy, and support participation from resource-limited nodes. A simulation-based evaluation strategy is proposed, with both execution and empirical substantiation anticipated in forthcoming stages. This integrated SFL-SDN paradigm provides a scalable and privacy-conscious solution for fortifying IoT infrastructures and is anticipated to surpass conventional centralized and nonsegmented FL methodologies in intricate, real-time threat scenarios
Copyright (c) 2025 Anas Harchi , Hicham Toumi , Mohamed Talea https://creativecommons.org/licenses/by/4.0