Detecting botnets in IoT environments is difficult because most intrusion detection systems treat network events as independent observations. In practice, infections spread through device relationships and evolve through distinct temporal phases. A system that ignores either aspect will miss important patterns. This paper explores a hybrid architecture combining Graph Neural Networks with Long Short-Term Memory networks to capture both structural and temporal dynamics. The GNN component models behavioral similarity between traffic flows in feature space, while the LSTM tracks how patterns change as attacks progress. The two components are trained jointly so that relational context is preserved during temporal learning. We evaluated the approach on two datasets with different characteristics. N-BaIoT contains traffic from nine devices infected with Mirai and BASHLITE, while CICIoT2023 covers 105 devices across 33 attack types. On N-BaIoT, the model achieved 99.88% accuracy with F1 of 0.9988 and Brier score of 0.0015. Cross-validation on CICIoT2023 yielded 99.73% accuracy with Brier score of 0.0030. The low Brier scores suggest that probability outputs are reasonably well calibrated for risk-based decision making. Consistent performance across both datasets provides some evidence that the architecture generalizes beyond a single benchmark setting.

This paper presents a certificateless group signature scheme designed specifically for Unmanned Aerial Vehicle (UAV) communications in resource-constrained environments. The scheme leverages Physical Unclonable Functions (PUFs) and elliptic curve cryptography (ECC) to provide a lightweight security solution while maintaining essential security properties including anonymity, unforgeability, traceability, and unlikability. We describe the cryptographic protocols for system setup, key generation, signing, verification, and revocation mechanisms. The implementation shows promising results for UAV applications where computational resources are limited, while still providing robust security guarantees for group communications. Our approach eliminates the need for computationally expensive certificate management while ensuring that only legitimate group members can create signatures that cannot be linked to their identities except by authorized group managers.

Feature selection is widely used in machine-learning-based intrusion detection systems (IDSs/NIDSs) to reduce dimensionality and computational burden, yet its benefits are difficult to attribute when feature evaluation, subset search, preprocessing, classifier design, and deployment conditions are assessed together. This systematic review analyzed 104 IDS/NIDS studies published from 2010 to 2026, identified through Scopus and Web of Science and supplemented by targeted Google Scholar searches. The corpus comprised 56 filter/relevance, 18 greedy/sequential, 28 hybrid/metaheuristic contrast, and 2 Other/Unclear studies. We assessed feature reduction, computational reporting, repeated-run evidence, feature-subset stability, leakage control, online cost, and deployment evidence. Among 42 studies with a single unambiguous reduction value, the median feature reduction was 73.8% (IQR: 59.3–84.2%). The runtime or computational cost was reported in 56.7% of studies and independent repeated runs in 9.6%, and no study explicitly evaluated feature-subset stability. Leakage-safe processing was clearly demonstrated in 13.5%, whereas 56.7% presented potential leakage risk; clear or partial deployment evidence was available in 6.7%. Out of six strict same-study comparisons, broader hybrid/metaheuristic methods improved reported detection performance in five, but gains in feature reduction and computational cost were inconsistent. Based on these findings, the review formulates feature-selection choice as a resource-constrained decision problem and proposes an algorithmic conditional-escalation workflow in which a broader search is introduced only when simpler strategies fail to satisfy predefined predictive or operational constraints. Additional search complexity should therefore be justified by comparable, reproducible, leakage-safe, and deployment-relevant evidence rather than by cross-study accuracy alone.

This paper examines the dual role of generative artificial intelligence in cybersecurity: as an enabler of attacks and as a practical defense component. It is shown that realistic generation of text, images, and audio lowers the barrier for abuse (phishing, deepfakes, impersonation), while machine learning systems face a distinct risk class­small but targeted input perturbations. The practical part is implemented as a reproducible benchmark around an MNIST handwritten-digit classifier. After verifying stable performance on clean inputs, adversarial examples were generated using FGSM with multiple values of e. The results confirm that a visually subtle perturbation can flip a confident prediction to an incorrect class (in a representative case, a “7” was forced to be classified as “3”). Two reconstruction-based defenses were then compared: a standard autoencoder (AE) and a denoising autoencoder (DAE) trained to recover clean signals from noisy inputs. As e increases, DAE reduces the misclassification rate more noticeably than AE, which is consistent with its training objective of separating high-frequency noise from meaningful strokes. To make the defense actionable in an operational setting, a simple anomaly detector based on reconstruction energy E(x) was also introduced. This adds a second layer: the DAE attempts to restore the input for correct classification, while E(x) provides an explicit alert signal suitable for logging and incident review.

Данная статья посвящена разработке и внедрению интеллектуальной системы управления энергопотреблением на промышленных предприятиях с использованием технологий искусственного интеллекта и машинного обучения. В условиях усиления требований к энергоэффективности и экологической устойчивости предприятия сталкиваются с необходимостью оптимизации потребления энергоресурсов для снижения эксплуатационных затрат и уменьшения углеродного следа. В современных условиях традиционные системы управления энергопотреблением не всегда могут обеспечить гибкое реагирование на изменения в производственных процессах. Применение интеллектуальных технологий, таких как машинное обучение и искусственный интеллект, позволяет создавать системы, способные прогнозировать нагрузку, выявлять аномалии и адаптироваться к изменяющимся условиям в режиме реального времени. Это повышает как экономическую, так и экологическую эффективность предприятий. Цель данной статьи – провести анализ существующих решений, разработать архитектуру интеллектуальной системы управления энергопотреблением и внедрить алгоритмы, способные управлять энергопотреблением с учётом текущих условий и данных. Основное внимание уделяется прогнозированию энергопотребления, обнаружению неэффективных сценариев использования ресурсов и оптимизации нагрузки для достижения наилучших результатов. Пилотные испытания предложенной системы проводятся на основе реальных данных промышленных предприятий, что позволяет оценить её работоспособность и точность алгоритмов. Кроме того, данная статья рассматривает экономическую целесообразность внедрения системы и её потенциал в улучшении экологической устойчивости. Таким образом, результаты исследования направлены на разработку практических решений, которые будут полезны для повышения энергоэффективности и снижения эксплуатационных затрат, а также помогут предприятиям соответствовать современным экологическим стандартам.

The rapid expansion of Internet of Things networks in smart city environments creates fragmented attack surfaces that conventional security architectures cannot adequately monitor. Current Intrusion Detection and Prevention Systems operate in isolation, producing inconsistent alert formats that reach Security Operation Centers with substantial delays and poor normalization, which severely hampers correlation effectiveness and generates excessive false positives. This study develops and validates a vendor-neutral mechanism enabling standardized real-time communication between distributed IDPS sensors and centralized SOC platforms. Our methodology combines analytical review of standards including STIX, TAXII, and ISO/IEC 27001 with prototype implementation using Suricata and Zeek sensors, This study addresses the optimization of regional budget allocation by applying a hybrid approach that combines a baseline genetic algorithm (GA) with Bayesian hyperparameter optimization. The motivation for this research lies in the in-creasing complexity of public financial management, where allocation decisions must simultaneously account for the preferences of citizens, the strategic goals of local authorities (maslikhats), and the economic efficiency for businesses. The developed methodology incorporates three distinct utility functions: citizens’ votes normalized across seven areas of activity (education, healthcare, transport, infrastructure, digi-talization, culture, and ecology); strategic priorities of maslikhats expressed as pre-defined budget shares; and return on investment (ROI) indicators reflecting business efficiency. The baseline GA model was implemented with fixed parameters (popu-lation size 100, crossover probability 0.5, mutation probability 0.2, 50 generations). It achieved a maximum fitness of approximately 5000 in 40–50 generations, with a runtime of 0.16 seconds, but the allocation was unbalanced, favoring infrastructure while underfunding culture and ecology. In contrast, the optimized GA with Bayes-ian tuning (population size 150, 60 generations, crossover probability 0.6, mutation probability 0.3) demonstrated superior results. It reached a maximum fitness of 5200–7779 (depending on scaling), converged faster (30–40 generations), and produced a more balanced allocation, particularly increasing funding for healthcare (80 million Apache Kafka message bus, and Elastic SIEM integration. A custom normalization microservice converts heterogeneous alerts into STIX-compliant JSON format while maintaining GDPR and ISO 27001 compliance through TLS 1.3 encryption. Experimental validation with BoT-IoT and TON_IoT datasets shows the architecture reduces alert correlation latency by approximately 28 percent and decreases false positive rates by roughly 30 percent compared to baseline approaches. The bidirectional feedback mechanism allows SOC analysts to propagate updated detection rules to edge sensors, enabling adaptive threat response. Results demonstrate that message-bus-mediated architectures effectively address interoperability challenges in heterogeneous IoT security infrastructures, offering a practical implementation pathway for national smart city cybersecurity frameworks.