Galal eldin Abbas Eltayeb

Dr. Galal eldin Abbas Eltayeb


Research Focus & Metrics

Academic Career Length

7Years (2020-Present)

(Calculated once Scilit publication data is synced: current year − year of first publication + 1)

Representative Publications

View All Publications
8 November 2024 in International Journal of Interactive Mobile Technologies (iJIM)
Verified
Journal Article
Open access
PDF file
GEGalal eldin Abbas Eltayeb
Galal eldin Abbas Eltayeb
The Internet of Things (IoT) technology is used in smart homes to enhance comfort, security, and energy efficiency. This study outlines a theoretical framework for the deployment and dissemination of IoT technologies in intelligent residential environments. The framework of this study highlights the significance of many components that cater to people’s individual needs. The study offers a systematic explanation of IoT principles, tangible devices, services, data creation, software, applications, and logistical needs. Furthermore, it contains an extensive table that assists users in choosing the most appropriate resources and components. The study points to smart home systems based on IoT, which utilize sensors, controllers, and cloud solutions to manage data and provide user control while ensuring privacy and confidentiality. The study addresses various needs of users by utilizing a semantic vision framework for smart house design that guarantees economic advantages, enhanced security, and user contentment, ultimately leading to enhanced community interactions and the overall welfare of residents.

29 July 2026 in Symmetry
Verified
Journal Article
Open access
PDF file
صاصالح عبداارحمن الخميس
صالح عبداارحمن الخميس
Abdalilah AlhalangyAbdalilah Alhalangy
Abdalilah Alhalangy
GEGalal eldin Abbas Eltayeb
Galal eldin Abbas Eltayeb
EAEman Abouelkeir
Eman Abouelkeir
Unmanned aerial vehicles (UAVs) have become essential cyber-physical platforms for applications such as surveillance, infrastructure inspection, emergency response, and intelligent transportation. However, their tight coupling among sensing, communication, control, actuation, and swarm coordination also exposes them to sophisticated cyber-physical attacks that are difficult to detect using conventional intrusion detection systems. Existing machine learning, deep learning, graph-based, and federated intrusion detection approaches generally rely on statistical feature representations or temporal patterns, providing limited capability to model causal dependencies among interacting UAV subsystems and to generalize across heterogeneous operating environments. To address these limitations, this paper proposes Fed-CGIDS-UAV, a federated causal graph learning framework for cross-domain intrusion detection in cyber-physical UAV networks. The proposed framework models each telemetry window as a typed causal graph in which nodes represent navigation, sensing, communication, control, actuation, and swarm states, while directed edges capture stable operational dependencies. Intrusions are detected by identifying violations of these learned causal relationships, and the framework provides interpretable node-edge explanations to support root-cause analysis. Furthermore, federated learning enables collaborative model training across distributed UAV clients without sharing raw telemetry, thereby preserving data privacy while improving robustness under heterogeneous operating conditions. The proposed framework was implemented and experimentally evaluated in a controlled simulation environment covering four UAV operating domains and six representative attack classes. All experiments were repeated over five independent runs using different random seeds, and the reported results correspond to the measured average performance. The proposed framework was implemented using Python 3.12 (Python Software Foundation, Wilmington, DE, USA) and PyTorch 2.3 (Meta Platforms, Menlo Park, CA, USA). UAV flight data were generated using Microsoft AirSim 1.9.1 (Microsoft Corporation, Redmond, WA, USA), integrated with PX4 Autopilot v1.14 (Dronecode Foundation, San Francisco, CA, USA) and Gazebo Sim 11 (Open Source Robotics Foundation, Mountain View, CA, USA). Within this simulation-based evaluation, Fed-CGIDS-UAV achieved an accuracy of 0.968, an F1-score of 0.956, and an internal–external stability gap (IESG) of 0.028, outperforming conventional machine learning, deep learning, graph-based, and centralized causal baselines while maintaining competitive computational latency. Although these results demonstrate the effectiveness of the proposed framework under controlled simulation conditions, validation using real-flight UAV telemetry remains an important direction for future research. These results demonstrate that integrating causal graph learning with federated optimization provides an effective and interpretable solution for privacy-preserving intrusion detection in heterogeneous cyber-physical UAV environments.

6 August 2025 in Stress and Health
Verified
Journal Article
Closed access
HDHacer Demirkol
Hacer Demirkol
Ahmed S BaHammamAhmed S BaHammam
Ahmed S BaHammam
ESEbru Savucu
Ebru Savucu
AEAhmet EROL
Ahmet EROL
MTMohd Amzari Tumiran
Mohd Amzari Tumiran
GEGalal eldin Abbas Eltayeb
Galal eldin Abbas Eltayeb

10 August 2026 in Preprints.org
Verified
Preprint
Open access
PDF file
Abdalilah AlhalangyAbdalilah Alhalangy
Abdalilah Alhalangy
GEGalal eldin Abbas Eltayeb
Galal eldin Abbas Eltayeb
This paper discusses the world of zero-day cyberattacks, which exploit unknown vulnerabilities that often slip past traditional defenses that rely on signatures. This situation has led to a push for behavioral detection methods that can adapt to new attack patterns. However, many intrusion detection systems that use machine learning are still tested on data that's been shuffled over time, which can lead to misleading results and a failure to account for changes in real-world traffic. To address these issues, we introduce a drift-aware continual generative behavioral-detection framework. This framework does three key things: it maintains an up-to-date baseline of normal behavior, uses generative techniques to maintain visibility into rare but significant patterns even when conditions change, and provides risk scores that are ready for Security Information and Event Management (SIEM) systems to support triage and correlation in security operations. To ensure our methods are robust, we have developed a reproducible evaluation protocol that relies on strict time-ordered data splits, stress tests focused on drift, and reporting that emphasizes practical aspects like latency, update frequency, and auditability. Our framework is designed to work with publicly available network traffic data and encourages transparent studies and sharing of findings for independent verification. By merging ongoing adaptation with careful evaluation and practical alerting, our approach aims to fill critical gaps that often hinder the reliability and readiness of cybersecurity research in high-stakes environments.

3 September 2026 in Information
Verified
Journal Article
Open access
PDF file
Abdalilah AlhalangyAbdalilah Alhalangy
Abdalilah Alhalangy
GEGalal eldin Abbas Eltayeb
Galal eldin Abbas Eltayeb
Zero-day cyberattacks remain difficult to detect because their behavioral characteristics are not represented in the data available during model training. In addition, intrusion detection models operating in dynamic environments are vulnerable to concept drift, while continual-learning approaches may suffer from catastrophic forgetting. Many published evaluations are further affected by temporal leakage, which can lead to overly optimistic performance estimates. This study proposes DC-GenAIS, a drift-aware continual generative behavioral detection framework for adaptive intrusion detection. The framework combines concept-drift monitoring, bounded model adaptation, and drift-triggered generative replay to preserve rare attack behaviors while adapting to changing traffic distributions. To improve experimental validity, a leakage-aware temporal evaluation protocol is employed, including chronological data partitioning, train-only preprocessing, and time-separated model selection. The framework also produces calibrated risk scores and structured alert metadata through a SIEM-oriented integration interface. The proposed framework was evaluated on the CICIDS2017, UNSW-NB15, and NSL-KDD benchmark datasets under static, streaming, concept-drift, and leave-one-attack-family-out (LOAFO) evaluation settings. Results indicate improved robustness under distributional shifts, lower false-alert rates, and stronger generalization to previously unseen attack behaviors compared with representative baseline approaches. The findings further demonstrate the importance of leakage-aware temporal evaluation for obtaining reliable estimates of intrusion-detection performance. Overall, the study highlights the value of integrating drift monitoring, continual adaptation, and generative replay within a reproducible framework for behavioral intrusion detection in evolving cybersecurity environments.

4 August 2026 in Preprints.org
Verified
Preprint
Open access
PDF file
Abdalilah AlhalangyAbdalilah Alhalangy
Abdalilah Alhalangy
GEGalal eldin Abbas Eltayeb
Galal eldin Abbas Eltayeb
Social media sites often have to decide whether an account is real or fake before it has had a chance to make many posts or build up a history of what it has done. In this study, we examined the efficacy of early identification based solely on brief biographical and fundamental profile information. We used 4,465 tagged accounts from the Cresci-2017 dataset to test this. 3,474 of these were human individuals, and 991 were known bots. We could only examine profile information, simple follower/following numbers, and bio text for the real accounts because we could not see their actual tweet history. Next, we examined three separate "early windows" of account data and compared how effectively Logistic Regression, Random Forest, and XGBoost could discern the difference between actual and phony accounts. First, we could not segregate the data by date alone because there were no bots in the later time period. To remedy this, we split the timeline into two parts: one for legitimate accounts and another for false accounts. This retained the order of events in each group and helped us determine how well the models held up over time. The second window included the most powerful settings for the model. It added the number of followers, friends, favorites, lists, and follower-to-friend ratio. Extreme Gradient Boosting achieved a precision of 0.9778, a recall of 0.8844, a harmonic mean of precision and recall of 0.9288, and an area under the precision-recall curve of 0.9593 with that setting. Incorporating short descriptive features yielded no measurable performance gains once the core relational indicators were included. Both the feature attribution analysis and the three-way workflow revealed the same finding: a small relational block contained the majority of the valuable early signals. Only 2.35 percent of accounts fell within the review band.