Numerous deep learning-based methods have been developed to address the intricacies of anomaly detection tasks within system logs, presenting two significant challenges. First, balancing model complexity with the capacity to generate semantically meaningful representations for the downstream detection model, is a delicate task. Second, these methods generally depend on extensive labeled data for effective training. Despite efforts to address these challenges separately, a comprehensive solution that efficiently tackles both issues simultaneously are lacking. In response, we introduce Semantic-aware Robust Log (SaRLog), a comprehensive solution designed to overcome the limitations of existing methods by leveraging the contextual semantic information extraction capability of bidirectional encoder representations from transformers (BERTs) and the few-shot learning capability of the Siamese network. The Siamese network, featured with contractive loss, is implemented on top of a custom domain-specific fine-tuned BERT. Our comparative analysis validates SaRLog’s effectiveness against established baseline methods, demonstrating F1 score improvement of up to 31.2% and 46.7% on BGL and Thunderbird data sets, respectively. Moreover, additional experimental analysis aimed at evaluating the few-shot learning capability highlights the robustness and generalization efficiency of SaRLog. Thus, by overcoming data set variability and improving model generalization, SaRLog advances log anomaly detection, thereby effectively handling complex log data challenges.

With the continuously growing requirement for encryption in network environments, web browsers are increasingly employing hypertext transfer protocol security. Despite the increase in encrypted malicious network traffic, the encryption itself limits the data accessible for analyzing such behavior. To mitigate this, several studies have examined encrypted network traffic by analyzing metadata and payload bytes. Recent studies have furthered this approach, utilizing graph neural networks to analyze the structural data patterns within malicious encrypted traffic. This study proposed an enhanced encrypted traffic analysis leveraging graph neural networks which can model the symmetric or asymmetric spatial relations between nodes in the traffic network and optimized feature dimensionality reduction. It classified malicious network traffic by leveraging key features, including the IP address, port, CipherSuite, MessageLen, and JA3 features within the transport-layer-security session data, and then analyzed the correlation between normal and malicious network traffic data. The proposed approach outperformed previous models in terms of efficiency, using fewer features while maintaining a high accuracy rate of 99.5%. This demonstrates its research value as it can classify malicious network traffic with a high accuracy based on fewer features.

As smart manufacturing environments continue to evolve, operational technology systems are increasingly integrated with external networks and cloud-based platforms. However, many manufacturing facilities still use legacy systems running on end-of-support/life operating systems with discontinued security updates. It is difficult to mitigate the cyber threats and risks for these systems using perimeter-based security models that isolate them from other networks. To address these constraints, a Zero Trust-based security architecture tailored for legacy manufacturing environments with practical field applicability is proposed. Our architecture builds upon the six core functions outlined in National Institute of Standards and Technology Cybersecurity Framework 2.0—identify, protect, detect, respond, recover, and govern—adapting them specifically to manufacturing environment security challenges. To achieve this, the architecture combines asset identification, policy-driven access control, secure SMB gateway transfers, automated anomaly detection and response, clean image recovery, and organizational governance procedures. This study validates the effectiveness and scalability of the proposed architecture through scenario-based simulations. When combining the EoSL defense hardening and gateway-based perimeter control, the architecture achieves approximately 99% overall threat suppression and a 98% reduction in critical-asset infection rates, demonstrating its strong resilience and scalability in large-scale legacy OT environments.

Log anomaly detection in cloud computing environments is essential for maintaining system reliability and security. While sequence modeling architectures such as LSTMs and Transformers have been widely employed to capture temporal dependencies in log messages, their effectiveness deteriorates in zero-shot transfer scenarios due to distributional shifts in log structures, terminology, and event frequencies, as well as minimal token overlap across datasets. To address these challenges, we propose an effective detection approach integrating a domain-specific pre-trained language model (PLM) fine-tuned on cybersecurity-adjacent data with a novel loss function, Loss with Decaying Factor (LDF). LDF introduces an exponential time decay mechanism into the training objective, ensuring a dynamic balance between historical context and real-time relevance. Unlike traditional sequence models that often overemphasize outdated information and impose high computational overhead, LDF constrains the training process by dynamically weighing log messages based on their temporal proximity, thereby aligning with the rapidly evolving nature of cloud computing environments. Additionally, the domain-specific PLM mitigates semantic discrepancies by improving the representation of log data across heterogeneous datasets. Extensive empirical evaluations on two supercomputing log datasets demonstrate that this approach substantially enhances cross-dataset anomaly detection performance. The main contributions of this study include: (1) the introduction of a Loss with Decaying Factor (LDF) to dynamically balance historical context with real-time relevance; and (2) the integration of a domain-specific PLM for enhancing generalization in zero-shot log anomaly detection across heterogeneous cloud environments.

In artificial-intelligence-of-things (AIoT) deployments, fleets of heterogeneous, long-lived sensing devices sit behind an edge tier whose cloud is not always reachable, so a device trusted at enrolment must be re-assessed continuously, with a response it can afford and with knowledge shared across sites. We present EASA, an Edge-centric Adaptive Security API: a gateway fuses per-flow anomaly evidence with each device’s reported posture and decision history into a composite trust score, maps it with hysteresis to four persistent enforcement levels, budgets the step-up action by the device’s reported energy, and uses a cloud security service only for cross-gateway state—a federated detector and a credential-revocation registry. Every component can be disabled, so baselines are configurations of one implementation. We evaluate the prototype on per-address traces of 65 real consumer devices (CIC IoT-DIAD 2024) under synthetic campaigns built from weakly labelled attacker traces, with three emulated gateways and a cloud service deployed on Google Cloud Run, all calibrated to one target false-positive rate. Over 30 paired seeds, federated aggregation raised recall on attack families unseen at a gateway from 0.24 to 0.60, the shared registry caught 81% of credential-replay device-epochs across all runs, the full EASA configuration isolated about 45% fewer clean devices than per-alarm blocking, the energy-aware selector performed 37% fewer re-authentications under simulated low battery, and a 15-minute cloud outage after warm-up reduced replay rejection with no change detected in the evaluated local metrics (103 ms mean per-run median round trip); the composite score’s history term, in contrast, prolonged benign-side restriction without a demonstrated detection gain. The released simulator, cloud service and protocol give AIoT operators and API designers a reproducible basis for graded, resource-aware enforcement at the edge.