More than 1.3 million people are killed in traffic accidents annually. Road traffic accidents are mostly caused by human error. Therefore, an accurate driving fatigue detection system is required for drivers. Most driving fatigue detection studies concentrated on improving feature engineering and classification methods. We propose a novel driving fatigue detection framework concentrating on the development of the preprocessing, feature extraction, and classification stages to improve the classification accuracy of fatigue states. The proposed driving fatigue detection framework measures fatigue using a two-electrode ECG. The resampling method and heart rate variability analysis were used to extract features from the ECG data, and an ensemble learning model was utilized to classify fatigue states. To achieve the best model performance, 40 possible scenarios were applied: a combination of 5 resampling scenarios, 2 feature extraction scenarios, and 4 classification model scenarios. It was discovered that the combination of a resampling method with a window duration of 300 s and an overlap of 270 s, 54 extracted features, and AdaBoost yielded an optimum accuracy of 98.82% for the training dataset and 81.82% for the testing dataset. Furthermore, the preprocessing resampling method had the greatest impact on the model’s performance; it is a new approach presented in this study.

One of the WHO’s strategies to reduce road traffic injuries and fatalities is to enhance vehicle safety. Driving fatigue detection can be used to increase vehicle safety. Our previous study developed an ECG-based driving fatigue detection framework with AdaBoost, producing a high cross-validated accuracy of 98.82% and a testing accuracy of 81.82%; however, the study did not consider the driver’s cognitive state related to fatigue and redundant features in the classification model. In this paper, we propose developments in the feature extraction and feature selection phases in the driving fatigue detection framework. For feature extraction, we employ heart rate fragmentation to extract non-linear features to analyze the driver’s cognitive status. These features are combined with features obtained from heart rate variability analysis in the time, frequency, and non-linear domains. In feature selection, we employ mutual information to filter redundant features. To find the number of selected features with the best model performance, we carried out 28 combination experiments consisting of 7 possible selected features out of 58 features and 4 ensemble learnings. The results of the experiments show that the random forest algorithm with 44 selected features produced the best model performance testing accuracy of 95.45%, with cross-validated accuracy of 98.65%.

Snort is a well-known, signature-based network intrusion detection system (NIDS). The Snort sensor must be placed within the same physical network, and the defense centers in the typical NIDS architecture offer limited network coverage, especially for remote networks with a restricted bandwidth and network policy. Additionally, the growing number of sensor instances, followed by a quick increase in log data volume, has caused the present system to face big data challenges. This research paper proposes a novel design for a cloud-based Snort NIDS using containers and implementing big data in the defense center to overcome these problems. Our design consists of Docker as the sensor’s platform, Apache Kafka, as the distributed messaging system, and big data technology orchestrated on lambda architecture. We conducted experiments to measure sensor deployment, optimum message delivery from the sensors to the defense center, aggregation speed, and efficiency in the data-processing performance of the defense center. We successfully developed a cloud-based Snort NIDS and found the optimum method for message-delivery from the sensor to the defense center. We also succeeded in developing the dashboard and attack maps to display the attack statistics and visualize the attacks. Our first design is reported to implement the big data architecture, namely, lambda architecture, as the defense center and utilize rapid deployment of Snort NIDS using Docker technology as the network security monitoring platform.

Data breach attacks are unique, especially when attackers exfiltrate data from their target’s systems. Furthermore, as data breaches continue to increase in frequency and severity, they pose a growing risk to society and organizations. Unfortunately, no prior research focused on predicting exfiltration occurrence based on a sequence of tactics identified from low-level logs. In addition, integrating low-level logs with a high-level conceptual framework presents a critical challenge. The need for automation in the mapping process and advanced methods to assist defenders in analyzing the occurrence of exfiltration within their systems is urgent. In this paper, we focus on developing a machine learning (ML) model to predict the occurrence of data exfiltration by analyzing the sequence of tactics employed by an attacker. We propose two main contributions, including addressing the gap level between low-level logs and high-level data breach conceptual steps and integrating collected event logs and ML models to predict exfiltration tactics. Our dataset for the MLmodel is created based on tactics identified in threat reports, cleaned to obtain ten features, and balanced using the SMOTE+ENN technique. The prediction is made using tactics identified from low-level logs that serve as input to the ML model to determine whether the events lead to the occurrence of exfiltration. We benchmarked three resampling methods, five feature selection techniques, and five ML algorithms to achieve optimal ML model performance. A new dataset, comprehensive techniques used to develop the ML model, and the proposed prediction method represent the key contributions of this study compared to existing research. In addition, to demonstrate the effectiveness of our proposed method, we present case studies using event logs from real-world incidents. The investigation shows that our proposed method effectively predicts the occurrence of exfiltration with higher accuracy than existing studies.

This study proposes the use of a hybrid precopy/postcopy virtual machine (VM) migration framework to aid an autonomous agent when making migration decisions to continuously optimize the balance between the migration time, downtime, and energy consumption. The data center state and the resource load, including the CPU, memory, and network, are represented in the agent's state space using a two-layer graph neural network (GNN), and the asynchronous advantage actor–critic (A3C) algorithm is employed to dynamically determine whether to continue the precopy phase or switch to postcopy, optimizing the trade-off among the total migration time, downtime, and energy consumption while adhering to the service-level agreement (SLA) constraints. An adaptive host selection policy ensures that VMs are migrated only to underloaded machines, preventing overload and ensuring system stability. A simulation evaluation that employed the VM workload from the GWA-Bitbrains dataset revealed that this framework achieved a total migration time of 45.5 s, with 30.1 s spent on the precopy phase and 15.4 s on the postcopy phase, resulting in a downtime of 15.4 s. Compared with previous approaches, this result represents an improvement of 12.5% in total migration time, reducing it from 52 s to 45.5 s; 23% in downtime reduction, from 20 s to 15.4 s; and 4.4% in energy efficiency, increasing from 87% to 91.4%. The SLA compliance remained stable at 92.8%, affirming that the service quality was preserved. This study demonstrates the effectiveness of integrating GNN-based embeddings and A3C scheduling in terms of reducing downtime and energy usage while maintaining reliable service delivery in data centers.

Servers play a crucial role in modern digital infrastructure, but misconfiguration in their settings causes security gaps that can potentially lead to serious threats such as data leakage and service disruptions. The Center for Internet Security (CIS) has developed benchmark standards to improve server security, but the manual audit process for server configurations is often time-consuming and prone to human error. This study aims to develop and evaluate the One Stop CIS-Benchmark Auditing Tool (OSCAT), a CIS Benchmark-based server configuration audit automation tool. The research method used is an experimental approach with testing on the Red Hat Enterprise Linux 7 (RHEL 7) operating system using the CIS Benchmark version 3.1.1 security standard. OSCAT is designed with an architecture consisting of Audit Files, Audit Engine, Output Processor, Report Generator. Testing was carried out by auditing 248 security controls and comparing the results with a manual audit to assess the effectiveness of OSCAT in improving the efficiency and accuracy of the audit process. The results showed that OSCAT is able to automate the server configuration audit process with a high level of accuracy, reducing manual workload and increasing efficiency in identifying and handling security risks. Of the 248 security controls tested, OSCAT successfully classified the audit results into Pass, Fail, and Manual Review categories, with advantages in speed and consistency over manual methods. The implications of this research show that OSCAT can be an effective solution for organizations to improve the security of their systems through faster and more accurate automated audits.