Journal of Hacking Techniques, Digital Crime Prevention and Computer Virology

Drift-Aware Graph Aggregation and Explanation under Controlled Attack Shifts in IoT Traffic

2026-10-30T10:34:54+00:00

Fixed nearest neighbour aggregation is a feature transformation, while the loss monitor is a supervised update trigger rather than a drift detector. This study evaluates the fixed feature transformation under a deliberately ordered sequence of capture-associated attack subpopulations. Initial training uses benign and acknowledgement-fragmentation captures, while the stream introduces SYN flooding, port scanning, and TCP denial-of-service. Capture separation, training-only feature scaling, duplicate exclusion, and a one-batch label delay restrict several information paths. The experiment contains 7,998 training records, 8,000 validation records, and 7,960 stream records. Five optimiser seeds compare fixed and continually updated tabular and graph classifiers, alongside an alarm-triggered graph variant. Continual tabular learning obtains average precision of 0.9834, compared with 0.9805 for continual graph aggregation and 0.9739 for alarm-triggered graph adaptation. Fixed graph average precision is 0.7374 overall, with especially weak ranking in the port scan and TCP denial-of-service phases. A supplemental reproduction of the fixed graph head yielded phase average precision of 0.4472 for port scan and 0.4067 for TCP denial-of-service across five seeds. Grouped feature occlusion is a retrospective sensitivity analysis and does not test explanation stability. These results describe controlled shifts in selected attack subpopulations and capture associated distributions. They do not establish strict concept drift, early attack detection, or general benefits from graph aggregation.

Real-Time Log Analysis and Automated Threat Detection for Cybersecurity

2026-11-04T04:47:55+00:00

Security Operations Centres (SOCs) act as the nerve centre of an organization’s cyber-defence strategy, bringing together people, processes, and technology to watch over digital infrastructure around the clock. As enterprises expand their networks and adopt cloud, mobile, and IoT-connected systems, the volume of security-relevant events generated every day has grown far beyond what analysts can review manually. This escalation makes real-time, automated monitoring not just useful but necessary, since delays in identifying malicious activity can translate directly into data breaches, financial loss, and reputational damage. The project set out to address this gap by building a practical, real-time monitoring and threat-detection workflow that could be deployed on common Windows/Linux environments without requiring specialised or expensive infrastructure. At the core of the proposed work is a Security Information and Event Management (SIEM) approach that continuously ingests logs from authentication services, operating systems, applications, and network devices, then normalises and correlates them to surface patterns indicative of compromise. Particular emphasis is placed on authentication behaviour, since repeated failed logins, brute-force attempts, and unauthorized access are among the earliest and most reliable indicators of an ongoing attack. By combining structured log collection with rule-based correlation, the system is able to separate routine, benign activity from genuinely suspicious behaviour, generate timely alerts, and compile investigation-ready reports. The resulting framework demonstrates that even a lightweight, rule-driven SIEM pipeline can meaningfully strengthen SOC operations, while also laying the groundwork for future enhancement through machine learning, artificial intelligence, and large language model-based analysis.

Ransomshield: A Proactive, Behavior-Based Ransomware Detection and Automated Recovery System Using Real-Time File Entropy Analysis

2026-10-06T05:09:53+00:00

Ransomware is one of the most rapidly growing cyber threats globally, encrypting critical data and demanding ransom payments from victims. Traditional antivirus solutions depend on signature-based detection, which fails against new, polymorphic, and AI-generated ransomware variants. By the time conventional tools identify an attack, significant data encryption has already occurred, leading to irreversible data loss. This paper presents the design and development of a Behavior-Based Ransomware Detection and Auto-Recovery System deployed on the Linux (Ubuntu) platform. Instead of relying on known malware signatures, the system monitors and analyzes runtime behavior, making it effective against both known and zero-day ransomware variants. Testing with simulated ransomware scenarios demonstrates that the system detects attacks within 2–3 seconds, isolates malicious processes before significant damage, and restores affected files with zero permanent data loss in the tested scenarios, making it a sustainable, future-proof cybersecurity solution for critical infrastructure. All data is stored in PostgreSQL. The system continuously monitors file system activity in real time using the Linux inotify kernel subsystem, analyzes file content using the Shannon entropy algorithm to detect early-stage encryption patterns, and identifies suspicious mass file modifications that indicate ransomware propagation. Upon detection, it automatically isolates the compromised process, terminates its execution, blocks its network access, and instantly restores affected files from secure shadow backups with MD5 hash integrity verification ensuring complete data protection.