Most approaches to network intrusion detection look only at the header part of network packets. These approaches are able to detect high-rate attacks, such as Denial of Service or probing, with high degrees of accuracy. However, it remains to be seen whether they are also able to detect more subtle attacks, such as when adversaries try to exploit a vulnerability or plant a backdoor. In these cases, the attributes of network packets are usually very similar to the legitimate traffic which presents a limitation for header-only intrusion detection methods. Such attacks present an increasing problem to network security, especially given the rise of Internet of Things (IoT) and the rapidly increasing number of devices that can be exploited through low-intensity attacks. To address this problem we propose the use of the Autoencoder method for network intrusion detection. Autoencoder is a deep learning architecture that has the capability to identify outliers in a dataset. Thus it does not need labelled datasets which contain both legitimate and malicious traffic for training purposes. Through our experiments, we show that the proposed approach was able to detect 100% of low rate attack traffic with an average false positive rate of 8.01%. To demonstrate the improvement over the state of the art we have compared our results to a number of other similar works and our proposed method gave at least 32.81% better in detection rate.

Fall situations can be risky especially for elderly people with health problems. This fact has highlighted the need of fall detection systems. Various fall detection systems have been proposed. The proposed systems commonly used special devices placed at several position of user's body. On the other hand, smartphones with various sensors including gyroscopes are available in the market nowadays. This has motivated us to propose a prototype system of fall detection application designed for a smart phone. A threshold based fall detection algorithm is adapted for the proposed system since it relatively requires lower computational processes compared to complex reasoning techniques. Hence is more suitable to be implemented in smart phones with limited resource and processing power. The basic idea of the algorithm is to detect dynamic situations of posture, followed by unintentional falls to lying postures. The algorithm monitors sets of linear acceleration data and angular velocity and compares them to set of thresholds obtained from training data from the observed user. The process to detect a fall situation followed by sending notification to colleagues can be done in real-time manners while still maintain high accuracy for certain fall situations.

Attackers are most likely to exploit invalidated and unsanitized user input with several attacks such as cross-site scripting (XSS) or SQLinjection. Many methods were proposed to prevent those attacks. Some of them were created to learn about pattern and behavior of the attacker. That is honeypot. Honeypot is classified into two types based on the simulation that honeypot can do : low interaction and high interaction. In this paper, we propose a low-interaction honeypot for emulating vulnerabilities that can be exploited using XSS and SQL injection attacks. But this honeypot not only records attacker's request, but also try to expose attacker identity by using some browser exploitation techniques. Some attackers would use techniques to hide their identity, thus they couldn't be tracked. Our proposed honeypot was trying to overcome this problem by giving them malicious JavaScript codes. The malicious JavaScript codes will be run when an attacker open the honeypot's website. We have conducted several test to see how our honeypot's performance. Our honeypot could catch more useful information about the HTTP request than popular web-based honeypot, Glastopf. Moreover, there were attacker's social media accounts caught by using LikeJacking technique although they might have used proxy or TOR to hide their identity.

Detecting exploits is crucial since the effect of undetected ones can be devastating. Identifying their presence on the network allows us to respond and block their malicious payload before they cause damage to the system. Inspecting the payload of network traffic may offer better performance in detecting exploits as they tend to hide their presence and behave similarly to legitimate traffic. Previous works on deep packet inspection for detecting malicious traffic regularly read the full length of application layer messages. As the length varies, longer messages will take more time to analyse, during which time the attack creates a disruptive impact on the system. Hence, we propose a novel early exploit detection mechanism that scans network traffic, reading only 35.21 of application layer messages to predict malicious traffic while retaining a 97.57 detection rate and a 1.93 false positive rate. Our recurrent neural network- (RNN-) based model is the first work to our knowledge that provides early prediction of malicious application layer messages, thus detecting a potential attack earlier than other state-of-the-art approaches and enabling a form of early warning system.

The Android operating system continues to face escalating security challenges, primarily due to its open-source nature and the rapid proliferation of applications from untrusted sources. Traditional static analysis tools lack the flexibility to capture evolving malware behaviors, limiting their interpretability and scalability. Large Language Models (LLMs) are now applied in cybersecurity for malware detection, phishing classification, and cyber threat intelligence. However, their use has not been extended to producing detailed and interpretable Android malware analysis reports. This study integrates LLMs into Android malware analysis by creating a dataset for instruction tuning and fine-tuning the Qwen-7B model using the LoRA method. The model MalQwen is developed by fine-tuning Qwen 2.5-7B with 489 malware samples containing decompiled code and expert-labeled security reports. MalQwen outperforms models like Gemini and LLaMA, achieving a BERTscore of 0.84 for SMS malware and a Perplexity score of 3.30 for Scareware. These findings confirm MalQwen’s superior performance in generating precise malware reports, validating LLMs as a powerful new method for Android malware analysis.