The ever-evolving cybersecurity environment has given rise to sophisticated adversaries who constantly explore new ways to attack cyberinfrastructure. Recently, the use of deep learning-based intrusion detection systems has been on the rise. This rise is due to deep neural networks (DNN) complexity and efficiency in making anomaly detection activities more accurate. However, the complexity of these models makes them black-box models, as they lack explainability and interpretability. Not only is the DNN perceived as a black-box model, but recent research evidence has also shown that they are vulnerable to adversarial attacks. This paper developed an adversarial robust and explainable network intrusion detection system based on deep learning by applying adversarial training and implementing explainable AI techniques. In our experiments with the NSL-KDD dataset, the PGD adversarial-trained model was a more robust model than DeepFool adversarial-trained and FGSM adversarial-trained models, with a ROC-AUC of 0.87. The FGSM attack did not affect the PGD adversarial-trained model’s ROC-AUC, while the DeepFool attack caused a minimal 9.20% reduction in PGD adversarial-trained model’s ROC-AUC. PGD attack caused a 15.12% reduction in the DeepFool adversarial-trained model’s ROC-AUC and a 12.79% reduction in FGSM trained model’s ROC-AUC.

The Dark Web is an internet domain that ensures user anonymity and has increasingly become a focal point for illegal activities and a repository for information on cyberattacks owing to the challenges in tracking its users. This study examined the classification of the Dark Web in relation to these cyber threats. We processed Dark Web texts to extract vector types suitable for machine learning classification. Traditional methods utilizing the entirety of Dark Web texts to generate features result in vectors including all words found on the Dark Web. However, this approach incorporates extraneous information in the vectors, diminishing learning effectiveness and extending processing duration. The research aimed to optimize the classification process by selectively focusing on keywords within each class, thereby curtailing word vector dimensions. This optimization was facilitated by leveraging the anonymity characteristic of the Dark Web and employing topic-modeling-based weight generation. These methods enabled the creation of word vectors with a constrained feature set, enhancing the distinction of Dark Web classes. To further improve classification performance, we integrated TextCNN with topic modeling weights. For validation, we employed two datasets and compared the performance of the model with other text classification algorithms, where the proposed model demonstrated superior effectiveness in Dark Web classification.

This study was conducted to enable prompt classification of malware, which was becoming increasingly sophisticated. To do this, we analyzed the important features of malware and the relative importance of selected features according to a learning model to assess how those important features were identified. Initially, the analysis features were extracted using Cuckoo Sandbox, an open-source malware analysis tool, then the features were divided into five categories using the extracted information. The 804 extracted features were reduced by 70% after selecting only the most suitable ones for malware classification using a learning model-based feature selection method called the recursive feature elimination. Next, these important features were analyzed. The level of contribution from each one was assessed by the Random Forest classifier method. The results showed that System call features were mostly allocated. At the end, it was possible to accurately identify the malware type using only 36 to 76 features for each of the four types of malware with the most analysis samples available. These were the Trojan, Adware, Downloader, and Backdoor malware.

As information technology advances, it provides user convenience but also has more vulnerabilities than ever before. In particular, attackers use advanced techniques to perform new attacks. In cyber security, such attacks are defined as unknown attacks and target previously undetected vulnerabilities or excavate gaps in the system. Because these attacks are unidentified or unanalyzed, they are difficult to identify in signature-based misuse detection that learns rules or patterns. Furthermore, anomaly-based detection that learns from normal data to detect outliers cannot detect unknown attacks accurately, because it does not distinguish between known and unknown attacks. To overcome these problems, this study applied Open-Set Recognition with dissimilarity weight(OSRDW). A OSRDW method was used to effectively train the extreme value distribution, which was calculated by applying the dissimilarity weight, through which unknown attack’s weights were calculated and classified unknown attacks. Through research analysis, unknown attack divide two types, and three data sets(NSL-KDD, UNSW-NB15, CICIDS-2017) were used in the experiment. For the first type of unknown attack, the unknown attack detection rate of the proposed method was approximately 10%–20% better than that of the conventional method. For the second type of unknown attack, the accuracy and unknown attack detection rate were higher for the proposed method. The experimental results confirmed that the proposed method had better performance in detecting unknown attacks and it was detected various attacks in the three data sets.

Modern networks are increasingly targeted by sophisticated cyber threats, making effective intrusion detection a critical challenge. Traditional intrusion detection systems (IDSs) often struggle with capturing the complex relationships within network traffic and suffer from a lack of explainability in their decision-making processes. To address these limitations, we propose X-GANet, Explainable Graph Anomaly Network, a novel graph-based intrusion detection framework that models network traffic as a graph and leverages deep representation learning for precise threat identification. The model extracts both flow-based and structural features, aligns multi-view representations through contrastive learning, and employs a transformer-based embedding module for enhanced feature extraction. An adaptive graph detection fusion mechanism ensures effective graph-level representation and detection techniques for robust attack classification. Experimental results obtained from benchmark intrusion detection datasets demonstrate that X-GANet significantly improves detection performance while maintaining interpretability, making it a promising solution for real-world cybersecurity applications.