As Internet of Things (IoT) networks expand globally with an annual increase of active devices, providing better safeguards to threats is becoming more prominent. An intrusion detection system (IDS) is the most viable solution that mitigates the threats of cyberattacks. Given the many constraints of the ever-changing network environment of IoT devices, an effective yet lightweight IDS is required to detect cyber anomalies and categorize various cyberattacks. Additionally, most publicly available datasets used for research do not reflect the recent network behaviors, nor are they made from IoT networks. To address these issues, in this paper, we have the following contributions: (1) we create a dataset from IoT networks, namely, the Center for Cyber Defense (CCD) IoT Network Intrusion Dataset V1 (CCD-INID-V1); (2) we propose a hybrid lightweight form of IDS—an embedded model (EM) for feature selection and a convolutional neural network (CNN) for attack detection and classification. The proposed method has two models: (a) RCNN: Random Forest (RF) is combined with CNN and (b) XCNN: eXtreme Gradient Boosting (XGBoost) is combined with CNN. RF and XGBoost are the embedded models to reduce less impactful features. (3) We attempt anomaly (binary) classifications and attack-based (multiclass) classifications on CCD-INID-V1 and two other IoT datasets, the detection_of_IoT_botnet_attacks_N_BaIoT dataset (Balot) and the CIRA-CIC-DoHBrw-2020 dataset (DoH20), to explore the effectiveness of these learning-based security models. Using RCNN, we achieved an Area under the Receiver Characteristic Operator (ROC) Curve (AUC) score of 0.956 with a runtime of 32.28 s on CCD-INID-V1, 0.999 with a runtime of 71.46 s on Balot, and 0.986 with a runtime of 35.45 s on DoH20. Using XCNN, we achieved an AUC score of 0.998 with a runtime of 51.38 s for CCD-INID-V1, 0.999 with a runtime of 72.12 s for Balot, and 0.999 with a runtime of 72.91 s for DoH20. Compared to KNN, XCNN required 86.98% less computational time, and RCNN required 91.74% less computational time to achieve equal or better accurate anomaly detections. We find XCNN and RCNN are consistently efficient and handle scalability well; in particular, 1000 times faster than KNN when dealing with a relatively larger dataset-Balot. Finally, we highlight RCNN and XCNN’s ability to accurately detect anomalies with a significant reduction in computational time. This advantage grants flexibility for the IDS placement strategy. Our IDS can be placed at a central server as well as resource-constrained edge devices. Our lightweight IDS requires low train time and hence decreases reaction time to zero-day attacks.

Recent trends show that the popularity of online social networks (OSNs) has been increasing rapidly. From daily communication sites to online communities, an average person's daily life has become dependent on these online networks. Hence, it has become evident that protection should be provided to these networks from unwanted intruders. In this paper, we consider the data privacy on OSNs at the network level rather than the user level. This network-level privacy helps us to prevent information leakage to third-party users, such as advertisers. We propose a novel scheme that combines the privacy of all the elements of a social network: node, edge, and attribute privacy by clustering the users based on their attribute similarity. We use an enhanced equi-cardinal clustering (ECC) as a way to achieve k-anonymity. We further improve k-anonymity with l-diversity. Our proposed enhanced ECC ensures that there are at least “k” users in any given network as well as the attributes in each cluster has at least l-distinct values. We further provide proofs on how the proposed ECC ensures k-anonymity and the maximum information loss. We consider a weighted directed social network graph as an input to our method to consider the existing complexities in a social network. With the help of two real-world data sets, we evaluate this method in terms of privacy and efficiency.

The advent of machine learning techniques has given rise to modern devices with built-in models for decision making and providing rich content to users. This typically involves processing huge volumes of data in central servers and sending updated models to end-user devices. There are two main concerns on this server architecture, one is the privacy of data that is being transferred to a central server and the other is volumes of data sent over the network for the model update. Federated Learning helps solve these problems by training models on local data within the device and aggregating the model with other devices. Federated Learning involves a central server for the aggregation and the resulting updates to the clients, here only model parameters are shared with the central server not the data itself thereby preserving privacy. But all the applications are not being compatible with Federated Learning and also there is a privacy concern of models being shared to the central server which can be susceptible to malicious attacks. In this paper, central server free Federated Learning, which is decentralized Federated Learning is used, where the parameters will be exchanged between the clients one to one and get their models updated removing the need for a central server for aggregation. Peer-to-peer techniques are used for communicating between clients and different node architectures to achieve better accuracy. This happens when the clients meet another client in a connected social network environment. The results show that the communication happens between clients in a decentralized fashion and thereby achieving privacy in a more trusted manner.

The realm of cybersecurity places significant importance on early ransomware detection. Feature selection is critical in this context, as it enhances detection accuracy, mitigates overfitting, and reduces training time by eliminating irrelevant and redundant data. However, iterative feature selection techniques tend to select the best-performing subset of features through an iterative process which leaves chance for a crucial feature not being selected and the number of selected features may not always be the optimal or the most suitable for a given problem. Hence, this study aims to conduct a performance comparison analysis of an iterative feature selection technique- Recursive Feature Elimination with Cross-Validation (RFECV) with six supervised Machine Learning (ML) models to evaluate its efficiency in classifying ransomware utilizing the Application Programming Interface (API) call and network traffic features. The study employs an Explainable Artificial Intelligence (XAI) framework called SHapley Additive exPlanations (SHAP) to derive the crucial features when RFECV is not integrated with the ML models. These features are then compared with RFECV-selected features when it is integrated. Results show that without RFECV the ML models achieve better classification accuracies on two datasets. Again, RFECV falls short of selecting impactful features, leading to more false alarms. Moreover, it lacks the capability to rank the features based on their importance, reducing its efficiency in ransomware classification overall. Thus, this study underscores the importance of integrating explainability techniques to identify critical features, rather than solely relying on iterative feature selection methods, to enhance the resilience of ransomware detection systems.