Android has become the leading mobile ecosystem because of its accessibility and adaptability. It has also become the primary target of widespread malicious apps. This situation needs the immediate implementation of an effective malware detection system. In this study, an explainable malware detection system was proposed using transfer learning and malware visual features. For effective malware detection, our technique leverages both textual and visual features. First, a pre-trained model called the Bidirectional Encoder Representations from Transformers (BERT) model was designed to extract the trained textual features. Second, the malware-to-image conversion algorithm was proposed to transform the network byte streams into a visual representation. In addition, the FAST (Features from Accelerated Segment Test) extractor and BRIEF (Binary Robust Independent Elementary Features) descriptor were used to efficiently extract and mark important features. Third, the trained and texture features were combined and balanced using the Synthetic Minority Over-Sampling (SMOTE) method; then, the CNN network was used to mine the deep features. The balanced features were then input into the ensemble model for efficient malware classification and detection. The proposed method was analyzed extensively using two public datasets, CICMalDroid 2020 and CIC-InvesAndMal2019. To explain and validate the proposed methodology, an interpretable artificial intelligence (AI) experiment was conducted.

The Internet of Drones (IoD) has recently gained popularity in several military, commercial, and civilian applications due to its unique characteristics, such as high mobility, three-dimensional (3D) movement, and ease of deployment. Drones, on the other hand, communicate over an unencrypted wireless link and have little computational capability in a typical IoD environment, making them exposed to a wide range of cyber-attacks. Security vulnerabilities in IoD systems include man-in-the-middle attacks, impersonation, credential leaking, GPS spoofing, and drone hijacking. To avoid the occurrence of such attacks in IoD networks, we need an extremely powerful security protocol. To address these concerns, we propose a blockchain-based authentication scheme employing Hyperelliptic Curve Cryptography (HECC). The concepts of a blockchain as a Certificate Authority (CA) and a transaction as a certificate discussed in this article are meant to facilitate the use of a blockchain without CAs or a Trusted Third Party (TTP). We offer a security analysis of the proposed scheme, which demonstrates its resistance to known and unknown attacks. The proposed scheme resists replay, man-in-the-middle, device impersonation, malicious device deployment, Denial-of-Service (DoS), and De-synchronization attacks, among others. The security and performance of the proposed scheme are compared to relevant existing schemes, and their performance is shown to be better in terms of security attributes as well as computation and communication costs than existing competitive schemes. The total computation cost of the proposed scheme is 40.479 ms, which is 37.49% and 49.79% of the two comparable schemes. This shows that the proposed scheme is better suited to the IoD environment than existing competitive schemes.

For efficient distribution of electric power, the demand for Smart Grids (SGs) has dramatically increased in recent times. However, in SGs, a safe environment against cyber threats is also a concern. This paper proposes a novel Fog-based Artificial Intelligence (AI) framework for SG Networks. It uses Machine Learning (ML) and Deep Learning (DL)-based ensemble models to enhance the accuracy of detecting intrusions in SG networks. This work has two main goals, which include addressing class imbalance in network intrusion detection datasets and building interpretable models for targeted security interventions. It is achieved by using ensemble modeling, such as Logistic Regression (LR), Random Forest (RF), K-Nearest Neighbors (KNN) for ML-based ensemble, while the DL ensembles consist of aggregated neural network models trained using TensorFlow. The paper assess their effectiveness in identifying malicious activities in the SG network traffic. The present study utilizes a large dataset that was custom-designed for SG intrusion detection. Most of the previous studies explored different ML techniques using a single dataset; however, the performance improvement by ensemble modeling has not been explored intensively. Therefore, this paper bridges this research gap by suggesting a novel ML-based ensemble model for intrusion detection using two datasets: CIC-IDS-Collection and a specifically designed Power System Intrusion dataset. This study has made benchmark results demonstrating the effectiveness of the proposed ensemble models for intrusion detection in SGs. Results demonstrated better accuracy, precision, recall, and F1 Scores for the proposed ensemble models over the two datasets. The accuracy, precision, recall, and F1 Scores for the proposed Ensemble model 1 for the CIC-IDS Collection dataset are 98.57%, 98.75%, 99.00%, and 98.25% and for the Power System dataset they are 98.75%, 99.05%, 99.20%, and 99.10%, respectively. Similarly, for the proposed Ensemble model 2 for the CIC-IDS Collection dataset, we have 98.84%, 99.00%, 99.00%, and 99.00% accuracy, precision, recall, and F1 Score values. For the Power System dataset, these values are 99.05%, 99.30%, 99.25%, and 99.27% for the mentioned parameters.

The smart grid relies on Advanced Metering Infrastructure (AMI) to function. A high failure rate, low information, and instability in correspondence links recognize them. Because of the significant packet loss and slow transmission rate of the wireless connection between smart meters in AMI, these infrastructures are considered Low-power and Lossy Networks (LLNs). The routing protocol in an AMI network is crucial for ensuring the availability and timeliness of data transfer. IPv6 Routing Protocol for Low-power and lossy networks (RPL) is the optimal routing option for the AMI communication configuration. However, it is highly at risk against many outer and Internal attacks, and its effectiveness may be severely diminished by Sybil assault. Different trust-based techniques have been suggested to mitigate Internal attacks. However, existing trust systems have high energy consumption issues, which causes a reduction in the performance of LLNs due to complex calculations at the node level. Therefore, this paper presents a novel fog-enabled GINI index-based trust mechanism, "GITM," to mitigate Sybil attacks using the forwarding behavior of legitimate member nodes. Regarding identifying and isolating Sybil assaults, our approach outperforms the state-of-the-art methods. GITM detects and isolates a more significant amount of malicious network nodes compared to other techniques within a similar time frame. The Sybil attack detection rate increases by 4.48%, energy consumption reduces by 21%, and isolation latency reduces by 26.30% (concerning time). Furthermore, the end-to-end delay is merely 0.30% more in our case, and the number of control messages decreases by 28%.

Internet of Things (IoT) allows the integration of the physical world with network devices for proper privacy and security in a healthcare system. IoT in a healthcare system is vulnerable to spoofing attacks that can easily represent themselves as a legal entity of the network. It is a passive attack and can access the Medium Access Control address of some valid users in the network to continue malicious activities. In this paper, an algorithm is proposed for detecting spoofing attacks in IoT using Received Signal Strength (RSS) and Number of Connected Neighbors (NCN). Firstly, the spoofing attack is detected, located and eliminated through Received Signal Strength (RSS) in an inter-cluster network. However, the RSS is not useful against intra-cluster spoofing attacks and therefore the NCN is introduced to detect, identify and eliminate the intra-cluster spoofing attack. The proposed model is implemented in Network Simulator 2 (NS-2) to compare the performance of the proposed algorithm in the presence and absence of spoofing attacks. The result is that the proposed model increases the detection and prevention of spoofing.

Date fruits are the most common fruit in the Middle East and North Africa. There are a wide variety of dates with different types, colors, shapes, tastes, and nutritional values. Classifying, identifying, and recognizing dates would play a crucial role in the agriculture, commercial, food, and health sectors. Nevertheless, there is no or limited work to collect a reliable dataset for many classes. In this paper, we collected the dataset of date fruits by picturing dates from primary environments: farms and shops (e.g., online or local markets). The combined dataset is unique due to the multiplicity of items. To our knowledge, no dataset contains the same number of classes from natural environments. The collected dataset has 27 classes with 3228 images. The experimental results presented are based on five stages. The first stage applied traditional machine learning algorithms for measuring the accuracy of features based on pixel intensity and color distribution. The second stage applied a deep transfer learning (TL) model to select the best model accuracy of date classification. In the third stage, the feature extraction part of the model was fine-tuned by applying different retrained points to select the best retraining point. In the fourth stage, the fully connected layer of the model was fine-tuned to achieve the best classification configurations of the model. In the fifth stage, regularization was applied to the classification layer of the best-selected model from the fourth stage, where the validation accuracy reached 97.21% and the best test accuracy was 95.21%.