Timely detection of anomalous activity in wireless sensor network is critical for the smooth working of the network. This paper presents an intrusion detection technique based on the calculation of trust of the neighboring node. In the proposed IDS, each node observes the trust level of its neighboring nodes. Based on these trust values, neighboring nodes may be declared as trustworthy, risky or malicious. Trustworthy nodes are recommended to the forwarding engine for packet forwarding purposes. The proposed scheme successfully detects Hello flood attack, jamming attack and selective forwarding attack by analyzing the network statistics and malicious node behavior. The simulation results show that network performs better when neighbor node trust management based anomaly detection technique is in place

Distributed Denial of Service (DDoS) attacks have caused significant disruptions in the operations of Internet-based services. These DDoS attacks use large scale botnets, which often exploit millions of compromised Internet of Things (IoT) devices worldwide. IoT devices are traditionally less secure and are easy to be exploited. The extent of these exploitations has increased after the publication of the Mirai botnet source code on GitHub that provided a foundation for the attackers to develop and launch Mirai botnet variants. The Internet Engineering Task Force (IETF) proposed RFC 8520 Manufacturer Usage Description (MUD) so that an IoT device can convey to the network the level of network access it requires to accomplish its standard functionality. Though MUD is a promising effort, there is a need to evaluate its effectiveness, identify its limitations, and enhance its architecture to overcome its weakness and improve its efficiency. The latest Mirai variant malware is exploiting vulnerabilities of Internet of Things devices [1]. As MUD does not consider identifying and patching vulnerabilities present in the device before the issuance of the MUD profile, a device can be compromised even in the presence of the Manufacturer Usage Description profile by exploiting either the configuration vulnerabilities or firmware vulnerabilities present in the device [2]. This paper presents an evaluation study of the Manufacturer Usage Description (MUD), identifies its weaknesses, and proposed enhancements in its architecture. This research proposed a mechanism for identifying and eliminating the configuration vulnerabilities before creating the MUD profile for a device to minimize the attack surface. This research adopts the OWASP firmware testing methodology [3] for discovering vulnerabilities in the firmware of WiFi home routers. The device is allowed to request the MUD profile only if the identified firmware vulnerabilities are low. The identified firmware vulnerabilities are patched in case the score of the identified firmware vulnerabilities is moderate or high. The device is allowed to request the MUD profile after the vulnerabilities are patched. The firmware vulnerabilities are shared with other peers using blockchain smart contracts. There is a possibility that the MUD URL might be pointing to a corrupted or malicious MUD profile hosted at the attacker file server due to the absence of an authentication mechanism in the MUD process. This research also proposed an authentication mechanism for device MUD profile, MUD file generator, and MUD file server. Implementation results show that proposed enhancements improve the security services provided by the Manufacturer Usage Description (MUD).

Current data on cybercrime shows a rising influence of online threats, leading to significant financial impacts across vital industries like finance, healthcare, and energy. These impacts encompass the theft of confidential information, service interruptions, and expenses tied to breach remediation, underscoring the urgent necessity for strengthened cybersecurity strategies. Machine learning (ML) is highly effective in signifying cybersecurity standards, leveraging large-scale data analysis, pattern recognition, and adaptability to emerging threats. Unlike other traditional methods such as rule-based that relay on predefined criteria. This study presents an automated ML framework to recommend cybersecurity standards, audits, and compliance measures, enhancing and monitoring cybersecurity infrastructure systematically. Nine cybersecurity standards, including seven international (e.g., ISO/IEC 27001:2022, NIST, CIS) and two national standards (UAE, KSA), were analyzed using data from official sources. Data preprocessing addressed duplicates and missing values, with validation via Pearson Correlation and Chi-square tests (Chi-square = 55.79, p = 0.0017). Attributes were extracted using the Term Frequency-Inverse Document Frequency (TF-IDF) technique and refined through Recursive Feature Elimination (RFE). A content-based filtering (CBF) recommender system, aligned with organizational maturity levels, was developed and enhanced with a feedback loop for user insights. The recommendation model was validated across three organizational growth scenarios: ad-hoc, managed, and adaptive. The UAE standard recommended 158 controls for Scenario-1, while KSA led in Scenario-2. We evaluate the performance of the model using 3-ML classifiers including Random Forest (RF), K-Nearest Neighbor (KNN), and Support Vector Machine (SVM). Model performance was assessed using the F1 score and ROC AUC score. Testing in ad-hoc, managed, and adaptive scenarios showed the UAE standard recommended 158 controls for Scenario-1, while KSA led Scenario-2. The RF classifier achieved 81% accuracy and an ROC AUC score of 0.98. This framework supports alignment with global standards, enhances cybersecurity governance, and enables ongoing cybersecurity maturity tracking, aiding resilience and improving GCI rankings.

The modern digital world is experiencing growing security risks, with cyber threats happening more often and becoming more complicated. These threats affect both businesses and individuals. Machine learning (ML) and deep learning (DL) have emerged as vital tools in cybersecurity, enabling the analysis of extensive datasets to identify potential cyber threats. This study proposes a novel technique utilizing ML and DL algorithms for threat detection. We began with data preprocessing, which included cleansing the data, addressing missing values through Multiple Imputation by Chained Equations (MICE), and applying transformations such as encoding and standard scaling. To address class imbalance, we employed the Synthetic Minority Over-sampling Technique (SMOTE). For feature selection, we used Forward Feature Elimination (FFE), Backward Feature Elimination (BFE), and Recursive Feature Elimination (RFE) to identify the most relevant features. We trained three ML classifiers: Support Vector Machine (SVM), Naïve Bayes (NB), and K-Nearest Neighbors (KNN), along with three DL models: Long Short-Term Memory (LSTM), Recurrent Neural Network (RNN), and Convolutional Neural Network (CNN). Model performance was evaluated using metrics such as accuracy, precision, recall, and F1 score, alongside loss graphs and confusion matrices. The highest accuracy at 99% was attained by the LSTM model, while the CNN demonstrated superior precision (98%), recall (97%), and F1 score (97%). Additionally, the CNN, RNN, and SVM models achieved an accuracy of 98%. These results illustrate the effectiveness of ML and DL in identifying cybersecurity threats, highlighting their potential to enhance defenses against emerging cyber risks.

Modern organizations have migrated from localized physical offices to work-from-home environments. This surge in remote work culture has exponentially increased the demand for and usage of Virtual Private Networks (VPNs), which permit remote employees to access corporate offices effectively. However, the technology raises concerns, including security threats, latency, throughput, and scalability, among others. These newer-generation threats are more complex and frequent, which makes the legacy approach to security ineffective. This research paper gives an overview of contemporary technologies used across enterprises, including the VPNs, Zero Trust Network Access (ZTNA), proxy servers, Secure Shell (SSH) tunnels, the software-defined wide area network (SD-WAN), and Secure Access Service Edge (SASE). This paper also presents a comprehensive cybersecurity framework named Zero Trust VPN (ZT-VPN), which is a VPN solution based on Zero Trust principles. The proposed framework aims to enhance IT security and privacy for modern enterprises in remote work environments and address concerns of latency, throughput, scalability, and security. Finally, this paper demonstrates the effectiveness of the proposed framework in various enterprise scenarios, highlighting its ability to prevent data leaks, manage access permissions, and provide seamless security transitions. The findings underscore the importance of adopting ZT-VPN to fortify cybersecurity frameworks, offering an effective protection tool against contemporary cyber threats. This research serves as a valuable reference for organizations aiming to enhance their security posture in an increasingly hostile threat landscape.