The ISC International Journal of Information Security

Abstract Intrusion Detection Systems (IDS) are vital for defending modern networks against emerging cyber threats, including zero-day attacks. In this article, we introduce GAT-AID (Graph Attention-based Anomaly and Intrusion Detection), an IDS architecture that integrates Graph Attention Networks (GATs), Multi-Layer Perceptron (MLP) classifiers, and Autoencoders. The proposed methodology represents network traffic as a graph, allowing GAT to extract complex node-wise associations across traffic flows. The embeddings generated are further processed through a dual-branch architecture, an MLP-based classifier for identifying known attack types, and an Autoencoder-based anomaly detector for flagging zero-day intrusions. The proposed GAT-AID methodology is evaluated on two widely used benchmark datasets, namely CICIDS2017 and UNSW-NB15. The experiment results demonstrate that it outperforms conventional IDS baselines, including SVM, Random Forest, CNN, and GCN models, achieving higher detection rates, improved robustness against unseen threats, and greater adaptability to evolving network environments. These findings suggest that GAT-AID is an effective and scalable solution for intelligent, real-time intrusion detection.

Abstract Ensuring secure and continuous access in smart environments requires dynamic and context-aware policy enforcement, which traditional access control models cannot adequately support. This paper presents SmartUcon, a model-driven domain-specific modeling language (DSML) based on the UCON+ model, designed for specifying and managing usage control policies in IoT-enabled and cyber-physical systems. SmartUcon provides a Sirius-based graphical editor for intuitive policy modeling, along with an EGL-based code generator that automatically transforms high-level models into executable Axiomatics Language for Authorization (ALFA) policies. The semantics of the DSML are defined translationally via explicit mapping rules to ALFA, ensuring semantic preservation. The framework further incorporates design-time conflict detection and model-time validation using the Epsilon Validation Language (EVL) to reduce policy misconfigurations. To evaluate its applicability, 14 case studies were developed across five domains—smart vehicles, smart homes, smart cities, healthcare, and industrial systems—while a user study with 32 participants and statistical significance tests confirm the usability advantages of graphical modeling. A structural comparison with related metamodels confirms its superior coverage of obligations, advice, and device interactions. Overall, SmartUcon offers a practical and extensible model-driven solution for secure and trustworthy policy enforcement in smart environments.

Abstract Insider threats pose a critical cybersecurity challenge, causing damage that extends beyond immediate financial harm to include reputational erosion, diminished customer confidence, legal ramifications, and loss of stakeholder trust. Mitigating such threats requires a multifaceted approach that combines technological safeguards with a deep understanding of human behavior. Deep Learning (DL) and stacked generalization techniques have emerged as promising solutions for detecting these complex attacks. This paper proposes a deep ensemble Intrusion Detection System (IDS) designed to accurately detect insider threats by leveraging DL-based stacked generalization. The proposed approach transforms raw tabular data into an image-based format and applies a stacking ensemble strategy comprising three base learners, a Convolutional Neural Network (CNN), a Convolutional Autoencoder (CAE), and a CNN-LSTM. evaluated on two versions of the CERT insider threat dataset (r4.2 and r5.2). To address class imbalance in the training data, the Synthetic Minority Oversampling Technique (SMOTE) was applied, and a Deep Neural Network (DNN) was employed as the meta-classifier within the stacked generalization framework. The proposed system achieved high performance on both dataset versions, attaining a Precision of 99.98%, Recall of 99.98%, and an AUC of 100% on r4.2, and a Precision of 99.98%, Recall of 99.98%, and an AUC of 99.69% on r5.2. These results demonstrate that integrating image-based data transformation with deep ensemble learning and stacked generalization yields a robust and highly accurate IDS for insider threat detection, with future work directed toward broader dataset generalization and the incorporation of behavioral analytics to further enhance detection capabilities.

Abstract Advanced fingerprint spoofing attacks often threaten biometric authentication systems, such as the presence of non-contiguous minutiae to form a double-identity fingerprint. This research paper offers a deep learning system based on MobileNet to differentiate between authentic and anomalous fingerprints. The SOCOFing dataset (in the public domain) with real fingerprints and synthetically deformed samples at three levels of difficulty (easy, medium, and hard) was experimented with, which is used as a reference point in assessing the performance of spoof detection. In order to enhance the generalization, data augmentation and transfer learning were utilized, which helped in increasing the resilience of the model to different fingerprint modifications. The overall test accuracy of the MobileNet-based model was 88%, which declined with the case of medium and hard alterations, which suggests the inability to detect extremely complicated spoofing patterns. However, the model is efficient and has low computational expense, thus it can form a viable yet lightweight real-time biometric verification architecture. The future research ought to cover more sophisticated architectures, cross-dataset testing, and feature-level analysis in order to enhance the detection of difficult forms of spoofing.

Abstract Existing cybersecurity frameworks suffer from static threat assessment, inadequate modeling of system dependencies, oversimplified risk propagation, and inflexible countermeasure selection. This study presents a data-driven, multi-agent decision-support framework that optimizes countermeasure selection under operational constraints. The approach employs a dynamic graph structure representing relationships among missions, tasks, assets, threats, vulnerabilities, and countermeasures, with weighted dependencies across confidentiality, integrity, and availability dimensions. The framework comprises a modular architecture of ten specialized agents—namely the Main (serving as the Environment Controller agent), Node, Edge, Mission, Task, Asset, Threat, Vulnerability, Countermeasure, and Mapping Agents—organized into four functional categories (Control, Structural, Mission-Centric, and Security-Focused). These agents collaboratively operate through four sequential phases: (1) Data Gathering and Graph Construction, (2) Weight Propagation and Risk Assessment, (3) Multi-Criteria Optimization, and (4) Implementation and Reassessment. Experimental results demonstrate substantial improvements in risk mitigation efficiency and resource allocation compared to conventional approaches, enabling organizations to dynamically align security investments with evolving threats, mission priorities, and budget constraints while maintaining operational continuity.

Abstract One of the challenging issues for software developers is detecting vulnerabilities at different development stages. Security researchers are always seeking new methods to detect vulnerabilities more precisely in a short time. While there are many static and dynamic methods for detecting and discovering vulnerabilities, many of these approaches come with a high computational cost, which leads to inefficiencies, particularly in large-scale codebases. In recent years, deep learning has gained prominence in extracting vulnerability features from code without requiring direct intervention from cybersecurity experts.
This paper proposes a multi-class vulnerability detection scheme at both the line-level (LLVD) and function-level (FLVD) using graph neural networks, based on node-level and graph-level prediction models,, respectively. Moreover, by combining LLVD as a fine-grained approach with FLVD as a coarse-grained one, we propose a multi-granularity scheme called Function/Line-Level Vulnerability Detection (FLLVD) scheme. More specifically, it uses FLVD to detect the type of vulnerability while employing LLVD to identify its location in the source code. Our scheme's variants work with any abstraction graph extracted from incoming source code, such as Data Dependency Graph (DDG) and Program Dependency Graph (PDG).
We evaluate our schemes using both man-made and real-world datasets : SARD and BigVul. Particularly, LLVD and FLLVD achieve performance gains of 0.90 and 0.94, respectively, in terms of $F_1$ metrics for a subset of SARD with 20 vulnerability types. In contrast, for the combination of SARD and BigVul with 6 vulnerability types, LLVD and FLLVD have $F_1$ scores of approximately 0.76 and 0.82, respectively.