The convergence of the Internet of Things (IoT) and software-defined networking (SDN) has paved the way for a new technological paradigm in Healthcare Industry 5.0. This integration addresses the complexity, heterogeneity, and dynamic nature of smart IoT devices within healthcare systems. However, it also increases the risk of cyberattacks, particularly Distributed Denial of Service (DDoS) attacks, which pose significant threats to such critical infrastructure. While deep learning (DL)-based intrusion detection methods have demonstrated high accuracy in detecting these attacks, their opaque decision-making process often leads to their characterization as black-box models, limiting their practical use for security analysts. To overcome these challenges, this study proposes an explainable hybrid model for DDoS attack detection in SDN-IoT-based Healthcare Industry 5.0 environments. The model combines the strengths of convolutional neural networks (CNNs) for spatial feature extraction and long short-term memory (LSTM) networks for capturing temporal dependencies in network traffic. Implemented using an SDN controller, the model accurately classifies DDoS and IoT attacks while providing transparency through the shapley additive explanation (SHAP) method, which identifies the most influential features in the model’s decision-making process. Simulation results on the CICDDoS2019 and IoT Healthcare Security datasets demonstrate the model’s effectiveness, achieving detection accuracy of 99.59% and 98.12%, respectively. These findings confirm the robustness of the proposed hybrid model compared to state-of-the-art methods for detecting potential attacks in Healthcare Industry 5.0 systems.

Prompt injection, ranked first in the OWASP Top 10 for Large Language Model (LLM) applications, enables adversaries to override system instructions and exfiltrate sensitive information by crafting inputs that blur the boundary between data and control. While application-layer defenses such as PromptShield and Prompt-G have advanced, they operate in isolation from enterprise Security Operations Center (SOC) infrastructure and lack the session-level visibility required to detect multi-turn fragmented campaigns. This paper presents a hybrid detection framework that instruments a Phi-3 Mini Instruct gateway to emit structured telemetry, correlates events in Elastic SIEM using four expert-authored detection rules, and augments rule coverage with a One-Class Support Vector Machine (OCSVM) trained exclusively on 1200 benign interactions. Evaluated against 1100 prompts (900 malicious from CySecBench, 200 benign from Stanford Alpaca), the framework achieves a precision of 0.971, a recall of 0.810, and an F1-score of 0.883, and it reduces the Attack Success Rate (ASR) to 19.0% with a Mean Time to Detection (MTTD) of 2.3 s under the evaluated Phi-3 Mini configuration. The OCSVM layer accounts for 162 of 243 incremental true positives over the baseline, identifying attacks whose behavioral feature vectors deviate from the benign manifold. The framework is architected around OpenAI-compatible gateway telemetry and is therefore designed for vendor-neutral integration; however, broader validation across model families, prompt templates, and application domains is required before making general claims about cross-model performance or production-scale effectiveness.

In the field of network security situation assessment based on Hidden Markov Models (HMM), evaluation accuracy critically depends on two key factors: the quality of observation sequences and the design of the state transition matrix. Existing methods often rely on randomly sampled observation sequences and expert-defined transition matrices, resulting in reduced adaptability and subjective bias. To address these limitations, this paper proposes an improved HMM-based network security situation assessment approach that integrates alert quality evaluation and game-theoretic modeling. First, the concept of alert quality is introduced to generate observation sequences that better capture real network behaviors. Second, a state transition matrix is constructed using the strategic interactions between attack and defense behaviors, further refined by the probability of attack success to improve reliability and realism. Experimental validation was conducted using the LDoS 1.0 dataset from the Lincoln Laboratory. Comparative analysis with the Haslum, CRNES, and genetic algorithms demonstrates that the proposed method achieves a more stable and accurate estimation of network state probabilities. Specifically, during the intrusion phase, the improved algorithm correctly identified abnormal behavior peaks around 5400 seconds while maintaining a consistent risk value trend aligned with the actual attack scenario. Unlike the Haslum algorithm, which suffers from oversimplified transition probabilities (58% zero transition probabilities), and the genetic algorithm, which exhibits excessive sensitivity due to over-granular alert levels, the proposed model maintains low compromised state probabilities ($\sim$ 0.001), with a realistic rise to 0.14 at 5400 seconds, accurately reflecting the network's gradual degradation. Results confirm that the improved HMM model offers a more rational, interpretable, and quantitatively precise assessment of cybersecurity situations. This approach effectively reduces subjectivity in modeling and enhances the dynamic tracking capability of network security states, providing a reliable foundation for intelligent cyber defense decision-making.