Guzin Ulutas

In recent years, the widespread adoption of Internet of Medical Things (IoMT) systems in healthcare has provided significant advantages, particularly through rapid decision support and remote monitoring. At the same time, the growing number of heterogeneous and Internet-connected medical devices has expanded the cyberattack surface of healthcare infrastructures. Resource-constrained device characteristics, variable traffic patterns, and evolving attack types make fixed and conventional security mechanisms insufficient, especially for detecting previously unseen threats. This study proposes the Dynamic Data-Driven Pipeline (D3P), an adaptable and explainable intrusion detection framework for IoMT environments. Rather than relying on a fixed balancing strategy or a single predetermined model family, D3P automatically identifies an appropriate sampling strategy, selects the most successful learners from a candidate pool, performs model-specific feature selection, and constructs the final decision mechanism using a stacking-based meta-learner. The framework also incorporates explainability components based on SHapley Additive exPlanations (SHAP), Local Interpretable Model-agnostic Explanations (LIME), and BorutaSHAP to support both global and local interpretation. Experimental results on the test sets (mean ± standard deviation over five random seeds) show that D3P achieves 0.9701 ± 0.0015 accuracy, 0.9694 ± 0.0019 precision, 0.9701 ± 0.0015 sensitivity, and 0.9697 ± 0.0014 F1-score on WUSTL-EHMS-2020, while reaching 0.9978 ± 0.0004 accuracy, 0.9977 ± 0.0005 precision, 0.9978 ± 0.0005 sensitivity, and 0.9977 ± 0.0005 F1-score in the 6-class scenario of CICIoMT2024. These results indicate that D3P provides a balanced, reliable, and high-performance intrusion detection solution across IoMT datasets with different structural characteristics.

Internet of Medical Things (IoMT) devices are inherently vulnerable to cyberattacks, typically due to their limited processing power and memory capacity. Their widespread use in healthcare poses a significant security risk, threatening patient data privacy and the continuity of services. This study examines the effects of data imbalance correction and balancing strategies on the performance of machine and deep learning models using openly available IoMT datasets. In this context, four different balancing methods—RandomUnderSampler, SMOTE, Borderline-SMOTE, and ADASYN—were applied to three open-access IoMT datasets: ECU-IoHT, WUSTL, and CICIoMT2024. Performance analyses were conducted using five machine learning algorithms (AdaBoost, Logistic Regression, Random Forest, XGBoost, and K-Nearest Neighbor (KNN)) and two deep learning algorithms (Convolutional Neural Networks (CNN) and Deep Neural Networks (DNN)). In the highly imbalanced binary setting of the CICIoMT2024 dataset, the combination of RandomUnderSampler and SMOTE under the balanced-training/original-testing scenario produced the strongest improvement in the binary CICIoMT2024 setting, increasing the F1-Score from the unbalanced baseline to 99.87% for Random Forest and 99.86% for XGBoost across repeated runs. However, the benefit of balancing was not universal. In datasets with stronger class separability, such as ECU-IoHT, and in several multi-class settings, the effect of balancing was limited or, in some cases, inferior to the unbalanced baseline. These findings indicate that balancing is most effective under specific conditions, particularly in highly imbalanced binary tasks, and should be validated using class-sensitive metrics rather than overall performance alone.

The Internet of Medical Things (IoMT) has become integral to modern healthcare, yet its always-connected and resource-constrained nature enlarges the attack surface and complicates timely intrusion detection. This study presents a deployment-oriented, two-stage anomaly-detection pipeline. First, Principal Component Analysis (PCA) is employed to reduce the dimensionality of network traffic data, capturing the most significant variance. Subsequently, a One-Class Support Vector Machine (OC-SVM) is trained exclusively on these principal components of normal traffic. This approach prioritizes computational efficiency for resource-constrained IoMT devices while maintaining high model robustness. By modeling the principal components of normal behavior, our method achieves state-of-the-art performance across diverse attack families. We adopt a uniform protocol across four public IoMT corpora—BoT-IoT, CICIoMT2024, ECU-IoHT, and IoMT-TrafficData. The model’s hyperparameters, including the optimal number of principal components determined by explained variance, are tuned via randomized search. Despite using no attack labels during training, the proposed PCA-enhanced detector achieves state-of-the-art performance across diverse attack families: on BoT-IoT we obtain 99.92% F1-score (99.84% accuracy), on CICIoMT2024 we obtain 99.88% F1-score (99.77% accuracy), on ECU-IoHT 99.25% F1-score (98.58% accuracy), and on IoMT-TrafficData 99.19% F1-score (98.66% accuracy). The compact model size, enabled by PCA, makes the approach highly amenable to edge or gateway deployment in clinical networks, while the normal-only training paradigm improves robustness to zero-day threats. The results demonstrate that modeling the principal components of routine network behavior is a highly effective and efficient strategy for reliable, low-latency threat detection in realistic IoMT settings.

Phishing attacks are a class of cyberattacks in which adversaries deceive users to obtain sensitive credentials. Such attacks can spread quickly and dynamically through URL-based redirections, threatening network security and personal safety. In the proposed method, we build a stable modeling pipeline for URL-based phishing detection by leveraging the weighted fusion capabilities of an attention-based multi-feature fusion approach (AMFF) on boosting-based learning families. AMFF learns the relative importance of complementary features via an attention mechanism, balancing the fusion and reducing the impact of potential feature conflicts. In this study, the fusion approach is evaluated in the context of URL-based features and strong boosting classifiers (XGBoost and LightGBM); to mitigate the effects of class imbalance and data noise, a SMOTETomek-based balancing/cleaning strategy is applied. The approach is evaluated on different feature configurations of the UCI and Mendeley datasets using both 10-fold cross-validation and a 70/30 hold-out protocol. Experimental results show that the method achieves 97.94% accuracy and 99.76 AUC on UCI, 98.99% accuracy and 99.93 AUC on Mendeley-48, and 97.73% accuracy and 99.65 AUC on Mendeley-87. Additionally, the study provides a comparative analysis of different learning families and proposes a staged solution configuration for practical deployment (baseline model→balancing/cleaning→AMFF-based fusion). Overall, the findings indicate that the proposed AMFF-based configuration yields high discriminative power, low overfitting tendency, and strong generalization capability for URL-based phishing detection.

Federated learning is a distributed machine learning approach where end users train local models with their own data and combine model updates on a reliable server to create a global model. Despite its advantages, this distributed structure is vulnerable to attacks as end users keep their data and training process private. Current defense mechanisms often fail when facing different attack types or high percentages of malicious participants. This paper proposes a new defense algorithm called Neuron-Centric Federated Learning Defense (NC-FLD), a novel approach that dynamically identifies and analyzes the most significant neurons across model layers rather than examining entire gradient spaces. Unlike existing methods that analyze all parameters equally, NC-FLD creates feature vectors from specifically selected neurons that show the highest training impact, then applies dimensionality reduction to enhance their discriminative features. We conduct experiments with various attack scenarios and different malicious participant rates across multiple datasets (CIFAR-10, F-MNIST, and MNIST). Additionally, we perform simulations on the GTSR dataset as a real-world application. Experimental results demonstrate that NC-FLD successfully defends against diverse attack scenarios in both IID and non-IID dataset distributions, maintaining accuracy above 70% with 40% malicious participation, a 5–15% improvement over the state-of-the-art method, showing enhanced robustness across diverse data distributions while effectively mitigating the impacts of both data and model poisoning attacks.

The rapid advancement of digital environments has led to an increase in multimedia forgery, particularly in the realm of audio, which leads to significant threats to the reliability of digital evidence. This paper presents a novel method to detect audio copy-move forgery, a type of manipulation where segments of an audio file are duplicated and moved to different locations within the same file. The proposed method consists of two main stages. In the first stage, the frequency range containing the forged segments is identified by extracting high-resolution spectrograms from the audio and matching keypoints within the spectrogram images to detect duplicated segments. The frequency range of the sub-spectrogram images with the highest match density is considered the location of the repeated segments. A swarm-based optimization approach is used to adaptively determine this dense region. The audio is then bandpass filtered using the identified frequency range, and the second stage begins. In this stage, the filtered audio is represented as a graph using the proposed spiral pattern information extraction method. Graph coloring algorithms are applied to convert the graph into a visual representation, which is then input into a specially designed Convolutional Neural Network (CNN) model for classification. The trained model was evaluated using five different datasets, demonstrating that this approach generally outperforms existing methods in terms of detection accuracy. It provides a robust solution for verifying audio authenticity, even under various additional attack scenarios, and shows potential for generalization.

Automatic Speaker Verification systems are prone to various voice spoofing attacks such as replays, voice conversion (VC) and speech synthesis. Malicious users can perform specific tasks such as controlling the bank account of someone, taking control of a smart home, and similar activities, by using advanced audio manipulation techniques. This study presents a Multi-Pattern Features Based Spoofing detection mechanism using the modified ResNet architecture and OC-Softmax layer to detect various LA and PA spoofing attacks. We proposed a novel Pattern features-based audio spoof detection scheme. The scheme contains three branches to evaluate different patterns on a Mel spectrogram of the audio file. This is the first work for the audio spoofing detection task using three different pattern representations of Mel spectrogram with modified ResNet architecture and OC-Softmax layer. Through the proposed network, we can extract pattern images from the Mel spectrogram and gives each of them into modified ResNet architecture. At the last step of each network, we use OC-Softmax to obtain a score for the current pattern image and then the method fuses three scores to label the input audio. Experimental results on the ASVspoof 2019 and ASVspoof 2021 corpuses show that the proposed method achieves better results in the challenges of ASVspoof 2019 than state-of-the-art methods. For example, in the logical access scenario, our model improves the tandem decision cost function and equal error rate scores by 0.06% and 2.14%, respectively, compared with state-of-the-art methods. Additionally, experiments illustrate that the proposed fused decision improved the performance of the system.

Recently, the development of technology and access to this technology facilitates the possibility of easier access to data in the digitalized world and making effortless changes to the data reached. In this study, a new approach was proposed to copy a part of the audio to the same audio and to determine the forgery obtained by applying various attacks. In the proposed method, the speech recording is divided into syllables by using the Pitch Tracking method, and the Instantaneous frequency feature is extracted from these parts. Before comparing similarity, the Pitch sequences of syllable segment pairs are examined. The equal number of amplitude m value of the first Pitch series determined by experimental studies is obtained and these values are sought in the second Pitch series. If the n element from the first series is found in the second series, the similarity between syllable segment pairs is examined. The minimum Dynamic Time Warping score calculated between syllable regions gives an idea about the location of the copied and pasted areas. The proposed method showed 0.89 precision, 0.87 recall, and 0.87 F-score metrics despite noise, compression, and median filter attacks.

Artificial intelligence training in a single center requires sharing personal data with third parties. In methods such as federated learning, where training is provided without collecting data from the participants, the security of personal data is ensured. However, in Federated learning, since no information is received from the participants about their data, imbalanced data sets may occur and become a target for attacks. Many methods in the literature that defend against security problems in federated learning work on the assumption that participants’ data is distributed homogeneously and malicious users attack independently. The Federated Learning Resistant to Byzantine Attacks with Statistical Distribution Around Quantiles (QBARFL) method proposed in this study offers a Federated learning method that is resistant to Byzantine attacks without making any assumptions about the data sets and in all cases where the attacks are organized or independent.The proposed method calculates the Euclidean distances between the current model from the participants and the main model. Using the found Euclidean matrix, it finds the ideal distance with the mean absolute deviation measure (QMAD) based on percentiles. It detects outliers by examining the spread around the ideal distance on the coordinate plane. The results of two different experiments show that QBARFL achieves higher results than similar methods that use quarter gap as a statistical spread measure, even in scenarios with heterogeneous data distribution, organized attacks and a high rate of malicious participants.