In the dynamic and ever-evolving realm of network security, the ability to accurately identify and classify portscan attacks both inside and outside networks is of paramount importance. This study delves into the underexplored potential of fusing graph theory with machine learning models to elevate their anomaly detection capabilities in the context of industrial Internet of things (IIoT) network data analysis. We employed a comprehensive experimental approach, encompassing data preprocessing, visualization, feature analysis, and machine learning model comparison, to assess the efficacy of graph theory representation in improving classification accuracy. More specifically, we converted network traffic data into a graph-based representation, where nodes represent devices and edges represent communication instances. We then incorporated these graph features into our machine learning models. Our findings reveal that incorporating graph theory into the analysis of network data results in a modest-yet-meaningful improvement in the performance of the tested machine learning models, including logistic regression, support vector machines, and K-means clustering. These results underscore the significance of graph theory representation in bolstering the discriminative capabilities of machine learning algorithms when applied to network data.

Emerging growth in technology has rapidly changed our homes and cities. Present homes and cities will be upgraded to smart homes and smart cities in the near future. Various solutions used to build the smart-city network demand a scalable and decentralized solution. This study proposes a blockchain-empowered decentralized and scalable solution for a sustainable smart-city network. The Internet of Things (IoT), fog nodes, permissioned trust chain, smart contract, blockchain, and InterPlanetary file system (IPFS) are deployed to construct a scalable and decentralized solution for a sustainable smart city. Three main public sector departments, i.e., electricity, water supply, and health care, are studied over the proposed solution. The proposed solution is implemented over constrained application protocol (CoAP) and Ethereum blockchain. The performance of the proposed model is evaluated for 1500 devices and over 10,000 records. A total 77.44% improvement is registered during performance evaluation over a scalable environment. The performance evaluation of each case study and collaborative performance evaluation concludes the improvised performance of the proposed solution for scalable and distributed applications. Better performance, scalability, and the distributed nature of the presented model make it suitable for the sustainable smart-city network.

Ubiquitous data monitoring and processing with minimal latency is one of the crucial challenges in real-time and scalable applications. Internet of Things (IoT), fog computing, edge computing, cloud computing, and the edge of things are the spine of all real-time and scalable applications. Conspicuously, this study proposed a novel framework for a real-time and scalable application that changes dynamically with time. In this study, IoT deployment is recommended for data acquisition. The Pre-Processing of data with local edge and fog nodes is implemented in this study. The threshold-oriented data classification method is deployed to improve the intrusion detection mechanism’s performance. The employment of machine learning-empowered intelligent algorithms in a distributed manner is implemented to enhance the overall response rate of the layered framework. The placement of respondent nodes near the framework’s IoT layer minimizes the network’s latency. For economic evaluation of the proposed framework with minimal efforts, EdgeCloudSim and FogNetSim++ simulation environments are deployed in this study. The experimental results confirm the robustness of the proposed system by its improvised threshold-oriented data classification and intrusion detection approach, improved response rate, and prediction mechanism. Moreover, the proposed layered framework provides a robust solution for real-time and scalable applications that changes dynamically with time.

Due to the lack of adequate public datasets, the proponents of many existing cloud intrusion detection systems (IDS) have relied on the DARPA dataset to design and evaluate their models. In the current paper, we show empirically that the DARPA dataset by failing to meet important statistical characteristics of real world cloud traffic data center is inadequate for evaluating cloud IDS. We present, as alternative, a new public dataset collected through a cooperation between our lab and a non-profit cloud service provider, which contains benign data and a wide variety of attack data. We present a new hypervisor-based cloud IDS using instance-oriented feature model and supervised machine learning techniques. We investigate 3 different classifiers: Logistic Regression (LR), Random Forest (RF), and Support Vector Machine (SVM) algorithms. Experimental evaluation on a diversified dataset yields a detection rate of 92.08% and a false positive rate of 1.49% for random forest, the best performing of the three classifiers.

Securing virtualized infrastructures is a critical challenge in cloud computing due to dynamic resource allocation and sophisticated cyberattacks. Traditional intrusion detection systems (IDS) often fall short in addressing cloud-specific requirements such as scalability, elasticity, and diverse attack vectors. This work introduces CloudIDS, an intrusion detection system tailored for cloud environments. CloudIDS employs Principal Component Analysis (PCA) to extract key features from network traffic and applies Change Point Models (CPMs), including Mann-Whitney and Cramer-von-Mises statistics, to detect abrupt shifts in network behavior indicative of attacks. Two Riemannian-based sliding window algorithms—chunking and rolling—enable the detection of stable and transient patterns in virtual machine (VM) traffic. Experiments using the ISOT-CID dataset, which covers various attack types (e.g., scanning, dictionary attacks, reconnaissance, and denial-of-service), demonstrate that CloudIDS achieves high detection accuracy with minimal delay compared to conventional methods. Parameter tuning, particularly Average Run Length (ARL0) and startup length, reveals trade-offs between detection speed and false positives. An ablation study further validates the critical roles of PCA feature extraction and Riemann-based windowing. CloudIDS presents a flexible, adaptive solution for intrusion detection in cloud environments. Future work will focus on integrating real-time monitoring, reinforcement learning-based adaptation, and contextual metadata to further enhance detection performance accuracy.