The Software-Defined Network (SDN) is a new network paradigm that promises more dynamic and efficiently manageable network architecture for new-generation networks. With its programmable central controller approach, network operators can easily manage and control the whole network. However, at the same time, due to its centralized structure, it is the target of many attack vectors. Distributed Denial of Service (DDoS) attacks are the most effective attack vector to the SDN. The purpose of this study is to classify the SDN traffic as normal or attack traffic using machine learning algorithms equipped with Neighbourhood Component Analysis (NCA). We handle a public “DDoS attack SDN Dataset” including a total of 23 features. The dataset consists of Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and Internet Control Message Protocol (ICMP) normal and attack traffics. The dataset, including more than 100 thousand recordings, has statistical features such as byte_count, duration_sec, packet rate, and packet per flow, except for features that define source and target machines. We use the NCA algorithm to reveal the most relevant features by feature selection and perform an effective classification. After preprocessing and feature selection stages, the obtained dataset was classified by k-Nearest Neighbor (kNN), Decision Tree (DT), Artificial Neural Network (ANN), and Support Vector Machine (SVM) algorithms. The experimental results show that DT has a better accuracy rate than the other algorithms with 100% classification achievement.

In computer networks, diverse applications generate network traffic with different characteristics. Network traffic classification is significant to manage networks better, improve service quality and ensure security. Software-Defined Networks (SDN) provides flexible and adaptable techniques for traffic classification with its programmable structure. SDN flows naturally exhibit particular characteristics of network applications and protocols. Therefore, it can be said that SDN can present significant opportunities in traffic classification using machine learning. This study proposes a traffic classification approach using machine learning models in SDN. In this study, DNS, Telnet, Ping and Voice traffic flows were created on the SDN using the Distributed Internet Traffic Generator (D-ITG) tool. Twelve-attributes representing these traffic flows (the number of packets transmitted, average transmission time, the number of instantly transmitted packets, etc.) were determined, and over the SDN controller in the physical network, a real-time data set was created by collecting data depending on the attributes. Later, the performance of k Nearest Neighbor (k-NN), Support Vector Machine (SVM), Multi-Layer Perceptron (MLP), Decision Tree (DT) and Naive Bayes (NB) machine learning models were tested for traffic classification on this data set. When the k-NN model was tested on this real-time data set, its classification accuracy was obtained as the maximum with 99.4%. Therefore this model has been determined as a machine learning giving the highest classification performance with the lowest cost flow attributes in traffic classification in SDN.

This study aims to improve the automatic detection of unwanted emails using advanced machine learning and deep learning methods. By reviewing current research over the past five years, a comprehensive combined dataset structure was created containing a total of 81,586 email samples from seven different spam datasets. Class imbalance was addressed through the application of random oversampling and class-weighted loss, and the decision threshold was subsequently tuned for deployment. Among classical machine learning solutions, Random Forest (RF) emerged as the most successful method, while deep learning approaches, such as Transformer-based models like Distilled Bidirectional Encoder Representations from Transformers (DistilBERT) and Robustly Optimized BERT Pretraining Approach (RoBERTa), demonstrated superior performance. The highest test score (99.62%) on a combined static dataset was achieved with a multimodal architecture that combines deep meaningful text representations from DistilBERT with structural text features. Beyond this static performance benchmark, the study investigates the critical challenge of concept drift by performing a temporal analysis on datasets from different eras. The results reveal a significant performance degradation in all models when tested on modern spam, highlighting a critical vulnerability of statically trained systems. Notably, the Transformer-based model demonstrated greater robustness against this temporal decay compared to traditional methods. This study offers not only an effective classification solution but also provides crucial empirical evidence on the necessity of adaptive, continually learning systems for robust spam detection.

Smart objects have grown in popularity and acceptance over the past period due to their decreasing size, greater intelligence, and lower costs. The Internet of Things (IoT) connects physical devices, including actuators, sensors, and cameras, to a network via the Internet. The widespread use of IoT devices has led to an exponential rise in network traffic volume and complexity, creating new challenges for real-time network security and threat detection. This study attempts to design an intrusion detection system which is scalable and capable of handling the vast number and variety of IoT traffic. It is based on improving the scalability and precision of the detection of threats by employing machine learning (ML) and deep learning (DL) techniques and hybrid model. The model is trained and tested on the CIC IoT DIAD 2024 dataset, a large high-volume dataset consisting of diversified IoT traffic, benign and malicious activity. It includes extensive data preprocessing, feature selection, and training of various models. Features were selected using an Analysis of Variance (ANOVA)–based feature selection technique to reduce computational overhead and time complexity while mitigating the curse of dimensionality and enhancing model accuracy. The resulting optimal feature subset was then used to train and evaluate several classifiers, including Decision Trees, K-Nearest Neighbors (KNN), Convolutional Neural Networks (CNN), Long Short-Term Memory (LSTM) networks, and a hybrid CNN–LSTM model. The models are compared using typical measures of performance such as accuracy, precision, recall, F1-score, and confusion matrix. The results indicate that hybrid deep learning models specifically the CNN-LSTM outperformed the other models in recognizing binary attacks achieving the highest performance with accuracy of 94.08% followed by CNN and LSTM with accuracies of 93.37% and 93.24% respectively. In contrast, the traditional machine learning model, Decision trees demonstrated superior performance in multi-class classification, achieving an accuracy of 98.25% defeating KNN (90%) as well as the hybrid deep learning model (CNN-LSTM – 88.30%). This, work paves the foundation for the implementation of scalable intrusion detection models in real IoT infrastructures. The future of the work is to integrate the developed models using massive data streaming infrastructures in support of real-time intrusion detection in large-scale, dynamic IoT infrastructures.

JAIT is a scientific open access journal which focuses on empirical research results and critical analysis of technology development, use, management and impacts in information technology.

Phishing attacks delivered via email continue to pose a significant cybersecurity problem for both individuals and organizations. This study presents a classification model that uses traditional machine learning algorithms to improve the detection accuracy of phishing email attacks. Eleven reliable datasets, including Enron, SpamAssassin, Nazario, and TREC, were combined to create a robust and heterogeneous dataset, yielding approximately 200,000 labeled email samples. Each email was rigorously classified as phishing or legitimate. The dataset was constructed by combining the subject and body content. Before feature extraction, an extensive preprocessing step using the Term Frequency-Inverse Document Frequency (TF-IDF) methodology was applied to the dataset. Analysis was performed using Support Vector Machines (LinearSVC), Random Forest, XGBoost, Multinomial Naive Bayes, and Logistic Regression machine learning models. The Logistic Regression model demonstrated remarkable performance, achieving a classification accuracy of 97.7%. The proposed phishing detection framework, developed in Python, underwent a rigorous validation process with both theoretical evaluation and empirical experiments, confirming its effectiveness in enhancing email security.