Network Security and Intrusion Detection
New papers in network security and intrusion detection, the code and data they release, and the open problems their authors admit. Rebuilt every day from OpenAlex and arXiv.
New papers
Cyber security: Challenges, Threats and Modern Solutions
Abstract Cyber security is the practice of protecting computers, networks, software, systems, and data from unauthorized access, attacks, damage, or disruption.
BAg-IDS: A Blockchain-Enabled Agentic AI Architecture for Trustworthy Intrusion Detection
We present BAg-IDS, a distributed detection architecture in which autonomous agents detect, independently re-check, and co-sign every remediation-triggering verdict on a Hyperledger Fabric ledger before it is acted upon, placing certification on the decision path rather than in an after-the-fact…
A Data-Center Protection System Based on a Security Operations Center (SOC): A Comparative Architectural Framework and Performance-Indicator Analysis
Data centers have become a critical node of the digital economy, hosting identity systems, cloud services, business applications, and facility-operation technologies.
Uncertainty-Guided Cross-Modal Alignment for Diffusion-Based IoT Intrusion Detection
To address this gap, we introduce a novel reliability-guided alignment rule that uses normalized VAE posterior variance to control directional cross-modal influence before diffusion training.
Integrating Perception, Comprehension, and Projection for Alert Validation: A Unified Cyber Situational Awareness Framework
This paper presents the first systematic evaluation of perception-, comprehension-,and projection-level CSA within a unified alert validation framework.
DYNAS: A Dynamic Network Penetration Testing Framework Using Deep Hierarchical Reinforcement Learning
We present DYNAS (Dynamic Network Attack Simulator), which combines parameterized large-scale scenario generation with stateful intrusion detection responses, explicit scan false-positive and false-negative noise, temporary service unavailability, and duration-based action timeouts.
X-AI Enabled Hybrid Approach for Detection of Cyber Terrorism
The revolution in cyber-based technologies has altered the face of terrorism and, consequently, it has become a primary threat in terms of security and the eventual downfall of society.
Lightweight, Agentless Host Auditing and Security Hardening for Distributed Linux Infrastructure: An Automated Bash Framework
In this paper, we present an automated, lightweight, and agentless host auditing framework implemented purely in native Bash.
Explainable Federated Learning Framework for IoT Malware and Network-Based Attack Detection
The size and complexity of Internet of Things (IoT) botnets have brought the traditional intrusion-detection model to its breaking point, where sensitive networktraffic from various systems and devices must be aggregated to a centralized pointfor analysis.
AI-Powered Zero Trust Smart Shopping Mall Security System: A Review and Proposed Framework
Modern Shopping Malls consist of many Payment Terminals, CCTV Cameras, IoT Devices, Cloud Services and Public Wi-Fi.
Stability-Constrained Meta-Reinforcement Defence against Learning-Enabled Autonomous Malware
This paper introduces the stability-constrained meta-reinforcement defence, a framework modelling attacker–defender interaction as a partially observable stochastic game.
A Review of Ransomware Detection and Analysis Techniques
Ransomware has turned from an opportunistic nuisance into one of the most costly classes of cyber-attack, and the research effort aimed at detecting it has grown accordingly.
Dual-layer edge intelligence for secure real-time medical IoT: a Zero-Trust sequential framework integrating soft-voting intrusion detection and Histogram Gradient Boosting
Introduction The Internet of Medical Things (MIoT) enables continuous transmission of patient vital signs for real-time monitoring and clinical decision making in intensive care units.
Securing the Swarm:
To overcome these limitations, this paper presents a Multi-Boundary Federated Intrusion Detection System (MB-FIDS) which builds upon disparate cyber-physical defense layers without sacrificing swarm privacy.
AI and Machine Learning Approaches to Address Cybersecurity Challenges in Smart Grid Systems
Smart grid systems have been utilized with artificial intelligence (AI) which has substantially improved their efficiency and reliability.
OmNet: A Homestead Network Where Code Decides
OmNet is the network that watches my homestead in north-central Pennsylvania: weather, frost, the chicken coop, cameras, power and the network itself.
Key Banking Software Vulnerability Issues: An OWASP Top 10-Based Assessment of NVD Data (2022–2024)
Financial information is extremely valuable, so the international banking sector is a top target for hackers.
A Survey on Honeypot-Based Cyber Attack Detection Systems for IoT Devices
The growing number of Internet of things (IoT) devices has dramatically expanded the scope of attack to which cybercriminals utilize it, and network security became a core issue of research and design.
AI-Powered Cybersecurity: A Review of Intelligent Threat Detection, Automated Blocking, and Incident Reporting
Cyber attacks are increasing with many being very targeted and difficult to detect using signature based approaches.
Successful Cyber Operations and Team Structure
This chapter examines how organizations can structure cybersecurity operations to effectively manage risk, support business objectives, and sustain operational resilience.
Released code and data
Lightweight, Agentless Host Auditing and Security Hardening for Distributed Linux Infrastructure: An Automated Bash Framework
Experimental validation demonstrates rapid execution times with negligible CPU and memory overhead, establishing an efficient baseline audit mechanism for automated deployment pipelines and production Linux environments. GitHub Repository: https://github.com/Deffult/linux-sys-audit
Securing Internet Routing: Machine-Checked Proofs for ASPA Route-Leak Detection and a False-Positive Flaw in the ASRA Extension
Code is licensed under Apache-2.0; the paper under CC BY 4.0. Repository: https://github.com/otoinobuo/aspa-verify
A temporal-evolving adaptive learning framework with integrated explainable AI dynamic behavioral pattern recognition
the first benchmark, with paired t -tests, Wilcoxon signed-rank tests, and McNemar's tests confirming significance ( p < 0 0.05 for all three tests; p < 0.005 for the t -test and McNemar's test).
IntraSpanNet: Identifying Security Appliances, Endpoint Agents, and Common Software from Five-Packet Intranet Flows without Active Scanning
Code and weights are released under Apache-2.0; the text is licensed CC-BY-4.0.
AquaSense-ICS: A Hybrid Real-Simulated Cyber-Physical Dataset and Leakage-Aware Benchmark for Smart Water Quality Monitoring and Attack Detection
Data and simulation files are released under CC BY 4.0 at https://doi.org/10.5281/zenodo.23390541, and attack generators and benchmark code under MIT.
Sentinel-Bench: A 14-Dimensional Unified Benchmark Standard for Hardware-Aware, Closed-Loop CPS Active Defense
Most academic studies evaluate models against isolated single-dimensional metrics—primarily classification accuracy or F1-score on static offline CSV files—while completely ignoring live line-rate packet ingestion, CPU microarchitecture cache thrashing, worst-case execution time (WCET) determinism, closed-loop physical plant dynamics, and SCADA parser desynchronization zero-days.To establish a unified, open scientific standard, we introduce Sentinel-Bench, the first 14-dimensional hardware-aware benchmark suite for real-time CPS active defense.
Explainable AI for Detecting and Understanding Cyberattacks on IoT-Enabled Critical Infrastructure
By analyzing a large-scale dataset called “Botnet of Things – Internet of Things (BoT-IoT) Dataset” that was developed by the Cyber Range Lab of the University of New South Wales (UNSW), and after cleaning, this dataset was used to check whether explainable AI (XAI) can help detect and even prevent such cases from happening again.
Alignment of Autonomous Cyber Defense Agents via Adaptive Policy Shaping
Our code is publicly available at https://github.com/ITM-Kitware/alignment-cage-challenge-2.
AgentTriage: Replayable Security Diagnosis Across Heterogeneous Agent Runtimes
We release an open-source implementation and selected sanitized evidence at https://github.com/AsnGs/agenttriage-open-source.
SLAFF: Shapley Local Attribution Feature Fusion with Bayesian-Optimized Ensemble Learning for Detecting Intrusions in Renewable Energy Power Systems
The highest accuracy is achieved by the ensemble model with 95.87% accuracy on the Kaggle Power System Intrusion dataset on 25 feature subsets and 95.36% accuracy on the Figshare Power System dataset on 40 feature subsets.
Open problems authors admit
Cyber security: Challenges, Threats and Modern Solutions
The paper also discusses challenges and effects and future directions for building safer digital systems.
A Survey on Honeypot-Based Cyber Attack Detection Systems for IoT Devices
The presented work is intended to inform the future research and suggest strong security practices in the rapidly changing IoT environment by comparing the methods of the major scholarly studies and implementations.
Integrated Cybersecurity Risk Assessment and Threat Modelling Framework (ISACRATF) for Smart Agriculture in South Africa and Sub-Saharan Africa
Expert and field evaluation of the framework is reserved for future research.
Cyber Threat Intelligence and Incident Reporting
The chapter details CTI4BC’s architecture, implementation, and compliance assessment, concluding with future directions including full automation, expanded interoperability, and advanced anonymization for unstructured data.
Multi-Modal AI System for Real Time Insider Threat Recognition
Although the system shows better performance compared to traditional methods, challenges related to computational complexity and real-time deployment remain areas for future work.
Advanced machine learning for space cybersecurity
Finally, the discussion highlights future research directions such as physics-informed learning, neuromorphic computing, post-quantum security, and governance frameworks needed for responsible deployment of ML-based cybersecurity in space networks.
A Hybrid Dense-LSTM Framework for Generalizable Network Intrusion Detection: A Cross-Dataset Evaluation
distribution shifts between the two datasets, highlighting that domain generalization remains a difficult challenge in intrusion detection, yet it also confirmed that hybrid deep learning is practically viable.Overall, these findings position the proposed framework as a scalable and adaptable basis for real-world cybersecurity applications and for future work on cross-dataset network anomaly detection.
Detection, threat intelligence, and incident response for space systems
Finally, the chapter highlights emerging threats, operational challenges, and future research directions for securing next-generation space communication ecosystems.
Ethical Hacking and Penetration Testing in Modern Cybersecurity: A Review of Methods, Value and Emerging Challenges
It closes with three directions for future research: validated AI-assisted testing tools, shared measures for adversary emulation, and governance rules for continuous automated testing.
PHP2Shell (CVE-2026-109618 and CVE-2026-109619): Vulnerability Analysis, Impact Assessment, and a Practical Mitigation Framework for Web Server Operators
It closes by discussing the role of artificial intelligence (AI) in both the discovery of these flaws and the speed of their exploitation, and proposes an anomaly-detection approach for identifying exploitation attempts from server telemetry as future work.