The lack of interpretability in AI-based intrusion detection systems poses a critical barrier to their adoption in forensic cybersecurity, which demands high levels of reliability and verifiable evidence. To address this challenge, the integration of explainable artificial intelligence (XAI) into forensic cybersecurity offers a powerful approach to enhancing transparency, trust, and legal defensibility in network intrusion detection. This study presents a comparative analysis of SHapley Additive exPlanations (SHAP) and Local Interpretable Model-Agnostic Explanations (LIME) applied to Extreme Gradient Boosting (XGBoost) and Attentive Interpretable Tabular Learning (TabNet), using the UNSW-NB15 dataset. XGBoost achieved 97.8% validation accuracy and outperformed TabNet in explanation stability and global coherence. In addition to classification performance, we evaluate the fidelity, consistency, and forensic relevance of the explanations. The results confirm the complementary strengths of SHAP and LIME, supporting their combined use in building transparent, auditable, and trustworthy AI systems in digital forensic applications.

Malicious Software, commonly known as Malware, represents a persistent threat to cybersecurity, targeting the confidentiality, integrity, and availability of information systems. The digital era, marked by the proliferation of connected devices, cloud services, and the advancement of machine learning, has brought numerous benefits; however, it has also exacerbated exposure to cyber threats, affecting both individuals and corporations. This systematic review, which follows the PRISMA 2020 framework, aims to analyze current trends and new methods for malware detection and classification. The review was conducted using data from Web of Science and Scopus, covering publications from 2020 and 2024, with over 47 key studies selected for in-depth analysis based on relevance, empirical results and citation metrics. These studies cover a variety of detection techniques, including machine learning, deep learning and hybrid models, with a focus on feature extraction, malware behavior analysis and the application of advanced algorithms to improve detection accuracy. The results highlight important advances, such as the improved performance of ensemble learning and deep learning models in detecting sophisticated threats. Finally, this study identifies the main challenges and outlines opportunities of future research to improve malware detection and classification frameworks.

The increase in malicious cyber activities has generated the need to produce effective tools for the field of digital forensics and incident response. Artificial intelligence (AI) and its fields, specifically machine learning (ML) and deep learning (DL), have shown great potential to aid the task of processing and analyzing large amounts of information. However, models generated by DL are often considered “black boxes”, a name derived due to the difficulties faced by users when trying to understand the decision-making process for obtaining results. This research seeks to address the challenges of transparency, explainability, and reliability posed by black-box models in digital forensics. To accomplish this, explainable artificial intelligence (XAI) is explored as a solution. This approach seeks to make DL models more interpretable and understandable by humans. The SHAP (SHapley Additive eXplanations) and LIME (Local Interpretable Model-agnostic Explanations) methods will be implemented and evaluated as a model-agnostic technique to explain predictions of the generated models for forensic analysis. By applying these methods to the XGBoost and TabNet models trained on the UNSW-NB15 dataset, the results indicated distinct global feature importance rankings between the model types and revealed greater consistency of local explanations for the tree-based XGBoost model compared to the deep learning-based TabNet. This study aims to make the decision-making process in these models transparent and to assess the confidence and consistency of XAI-generated explanations in a forensic context.

The widespread adoption of Internet of Things (IoT) devices has significantly increased the exposure of cloud-based architectures to cybersecurity risks, particularly Distributed Denial-of-Service (DDoS) attacks. Traditional detection methods often fail to efficiently identify and mitigate these threats in dynamic IoT/Cloud environments. This study proposes a machine-learning-based framework to enhance DDoS attack detection and mitigation, employing Random Forest, XGBoost, and Long Short-Term Memory (LSTM) models. Two well-established datasets, CIC-DDoS2019 and N-BaIoT, were used to train and evaluate the models, with feature selection techniques applied to optimize performance. A comparative analysis was conducted using key performance metrics, including accuracy, precision, recall, and F1-score. The results indicate that Random Forest outperforms other models, achieving a precision of 99.96% and an F1-score of 95.84%. Additionally, a web-based dashboard was developed to visualize detection outcomes, facilitating real-time monitoring. This research highlights the importance of efficient data preprocessing and feature selection for improving detection capabilities in IoT/Cloud infrastructures. Furthermore, the potential integration of metaheuristic optimization for hyperparameter tuning and feature selection is identified as a promising direction for future work. The findings contribute to the development of more resilient and adaptive cybersecurity solutions for IoT/Cloud-based environments.

The growing sophistication of cyber threats has increased the need for advanced detection techniques, particularly in cloud computing environments. Zero-day threats pose a critical risk due to their ability to bypass traditional security mechanisms. This study proposes a deep learning model called mixed vision transformer (MVT), which converts binary files into images and applies deep attention mechanisms for classification. The model was trained using the MaLeX dataset in a simulated Docker environment. It achieved an accuracy between 70% and 80%, with better performance in detecting malware compared with benign files. The proposed MVT approach not only demonstrates its potential to significantly enhance zero-day threat detection in cloud environments but also sets a foundation for robust and adaptive solutions to emerging cybersecurity challenges.

This study presents a Systematic Literature Review (SLR) of gamified platforms for cybersecurity education and training, with a particular focus on environments that incorporate attack–defence simulation. The review examines how the literature addresses gamification, User eXperience (UX), didactics, platform design, and sustainability-related deployment conditions across higher education as the primary reference context, while also considering adjacent applied training contexts when they provide transferable evidence for platform design, deployment, or evaluation, including online learning. We analysed 172 studies published between 1 January 2015 and 8 March 2026. The findings show that the field combines authentic hands-on practice with challenge-based learning, feedback-rich progression, and diverse technical formats, including cyber range environments, serious games, CTF-oriented platforms, cloud-based infrastructures, and modular training systems. The review also indicates that the educational value of these approaches depends on the alignment between pedagogical structure, interaction design, and technical architecture, as well as on safe experimentation, adaptability, governance, and long-term maintainability. The review contributes an evidence-based taxonomy and configurational synthesis of recurrent design patterns across UX, didactics, gamification, architecture, and sustainability, and it identifies implications for future empirical research and for the design of sustainable, learner-centred cybersecurity teaching platforms.