Badraddin Alturki

Local label manipulation can threaten federated medical-image classification. We evaluated Pneumonia-to-Normal poisoning in a client-local feature-federated ensemble using 20,795 chest X-rays from three sources. Three of 10 simulated clients with differing class distributions changed all Pneumonia classifier-training labels to Normal. Across 10 seeds, matched attack and zero-poison runs kept perceptually linked images within the same partition. The vulnerable configuration used first-in-first-out retention, equal weighting, and no tuning. The protected configuration used local-validation retention, validation weighting, and class-score tuning. Their mean attack-minus-control increases in Pneumonia-to-Normal error were 12.12 and 0.79 percentage points, respectively, with 95% confidence intervals of 7.51–16.72 and 0.14–1.43. The paired reduction was 11.33 points, with a 95% confidence interval of 6.86–15.80. Without retraining, tuning alone and retention with weighting alone left increases of 0.91 and 4.11 points, respectively. Complete server-validation Pneumonia-to-Normal contamination in protected control and attacked runs produced an increase of 21.41 points when tuning averaged F1 over classes present in validation labels or predictions, versus 17.90 over all four classes. Respective 95% confidence intervals were 13.17–29.65 and 9.53–26.27. This scorer sensitivity limits contamination-effect interpretation. Inference remains exploratory and conditional on the selected attack direction. Simulated clients, unavailable patient identifiers, and lack of source-held-out testing limit generalization.

Standard federated averaging gives clients with larger training datasets greater weight. How reducing these weight differences affects overall and client-level short message service (SMS) spam detection remains unclear. We compare nine federated methods using logistic regression on 5023 ExAIS messages from 20 clients, defined by source files. The methods include equal weighting, weighting proportional to training size, and square-root weighting to reduce differences in aggregation weights. Evaluation repeats two-fold cross-validation five times, assigning identical normalized messages entirely to the training or testing set in each split. With class-weighted loss, three local epochs per round, and a threshold of 0.5, square-root weighting has the highest mean pooled F1 (0.8150), calculated from all test messages together within each fold. However, none of the four primary comparisons is significant after multiple-testing correction. Equal-client weighting has the highest observed average client F1 and mean F1 for the lowest-performing quarter of clients. Thresholds selected on inner validation data reduce the square-root weighting’s advantage over class-weighted proportional aggregation from 0.0112 to 0.0010. With equal local update counts per client and round, proportional weighting ranks first on pooled F1, followed by square-root and equal-client weighting. In this equal-step analysis, only the square-root versus equal-client contrast is significant after correction for the two post hoc comparisons. On an external SMS corpus, equal-client weighting ranks first among the three rules, with a mean pooled F1 of 0.3960. No aggregation rule performs best across all evaluated settings, and rankings depend on local training, classification thresholds, and whether performance is assessed across messages or clients.

Next-day stock direction forecasting combines market signals with news, but many trading days contain no firm-specific articles. We develop Gated News-Event Fusion (GNEF), an availability-aware model mapping price sequences, engineered market features, and news features to direction probabilities and a nonnegative return-magnitude estimate. GNEF retains price as a residual representation and uses a scalar sigmoid gate to interpolate between technical and news representations. We prove that the gated component is a norm-bounded convex combination whose gate-logit sensitivity is at most one quarter of the distance between these representations. We also establish conditional Lipschitz stability and forward complexity linear in sequence length. GNEF has 67,625 trainable parameters. Evaluation covers ten large-cap equities under prospective expanding walk-forward testing, paired moving-block bootstrap inference, and transaction-cost analysis. Across five random initializations, the residual design has higher mean directional accuracy than a gated mixture of price, technical, and news representations on 7 of 10 tickers. In a single-seed ablation, full GNEF exceeds no-gate and no-news variants in directional accuracy on 3 of 10 tickers. A broader validation-selected policy exceeds momentum in directional accuracy on 5 of 10 tickers. These findings provide selective support for residual fusion but do not establish a consistent advantage across equities.

Healthcare systems worldwide face increasing pressure to deliver accurate, affordable, and scalable diagnostic services while maintaining long-term sustainability. Chest X-ray screening is considered one of the most cost-effective methods for detecting lung disease. However, many deep learning approaches are computationally intensive and difficult to interpret, which limits their adoption in high-throughput, resource-constrained clinical settings. This study proposes a hybrid CNN–tree framework for automated lung disease classification from chest X-ray images, which targets COVID-19, pneumonia, tuberculosis, lung cancer, and normal cases. To ensure robustness and generalization, four publicly available chest X-ray datasets from different sources are merged into a unified five-class dataset, which introduces realistic variations in imaging conditions and patient populations. A ResNet-18 model is fine-tuned to extract domain-specific deep feature representations. Feature dimensionality and redundancy are reduced using Principal Component Analysis, while class imbalance is addressed through the Synthetic Minority Over-sampling Technique. The resulting compact feature vectors are used to train interpretable tree-based classifiers, which include Decision Tree, Random Forest, and XGBoost. Experiments conducted using five-fold stratified cross-validation demonstrate substantial and consistent performance gains. When trained on fine-tuned and preprocessed deep features, all evaluated tree-based classifiers achieve weighted F1-scores between 0.977 and 0.982 using five-fold cross-validation, with a significant reduction in inter-class confusion. In addition, the proposed framework maintains low per-sample inference latency, which supports energy-efficient and scalable deployment. These results indicate that combining deep feature learning with interpretable tree-based models provides a practical and reliable solution for sustainable chest X-ray screening in real-world clinical environments.

The widespread connectivity of the Industrial Internet of Things (IIoT) improves the efficiency and functionality of connected devices. However, it also raises serious concerns about cybersecurity threats. Implementing an effective intrusion detection system (IDS) for IIoT is challenging due to heterogeneous data, high feature dimensionality, class imbalance, and the risk of data leakage during evaluation. This paper presents a leakage-safe hybrid intrusion detection framework that combines text-based and numerical network flow features in an IIoT environment. Each network flow is converted into a short text description and encoded using a frozen Large Language Model (LLM) called the Bidirectional Encoder Representations from Transformers (BERT) model to obtain fixed semantic embeddings, while numerical traffic features are standardized in parallel. To improve class separation, class prototypes are computed in Principal Component Analysis (PCA) space, and cosine similarity scores for these prototypes are added to the feature set. Class imbalance is handled only in the training data using the Synthetic Minority Over-sampling Technique (SMOTE). A Random Forest (RF) is used to select the top features, followed by a Histogram-based Gradient Boosting (HGB) classifier for final prediction. The proposed framework is evaluated on the Edge-IIoTset and ToN_IoT datasets and achieves promising results. Empirically, the framework attains 98.19% accuracy on Edge-IIoTset and 99.15% accuracy on ToN_IoT, indicating robust, leakage-safe performance.

Software-Defined Networking (SDN) enables centralized control and programmability, providing a promising foundation for intelligent traffic management and enhanced security. This paper proposes a simulation-based SDN framework that integrates multiple Machine Learning (ML) models to evaluate the effectiveness of cyberattack detection and to manage packet resilience through the analysis of metrics such as throughput, switch delay, controller response time, and security performance indicators. Experimental results demonstrate that the Decision Tree (DT) and Extreme Gradient Boosting (XGBoost) classifiers achieved higher throughput, whereas the Deep Neural Network (DNN) and Transformer models imposed greater computational overhead. In addition, the DT and Random Forest (RF) models showed an accuracy–responsiveness trade-off, with better throughput and less processing time. Experimental results demonstrate high classification accuracy, with DT, RF, and XGBoost achieving near-perfect detection rates, whereas DNN and Transformer models maintained competitive performance despite certain class-specific limitations. The F1-scores validate the robustness of these classifiers. Complementary SDN simulations assessed packet management efficiency, yielding a consistent packet drop rate of approximately 31–32%, throughput ranging from 7.55 to 9.79 packets/s, and average switch delays around 12 ms across models. The findings confirm that the suggested hybrid approach not only detects cyberattacks effectively but also maintains acceptable SDN performance under diverse traffic conditions.

Malware continues to develop, posing significant challenges for traditional signature-based detection systems. Visual malware classification, which transforms malware binaries into grayscale images, has emerged as a promising alternative for recognizing patterns in malicious code. This study presents a hybrid deep learning architecture that combines the local feature extraction capabilities of ConvNeXt-Tiny (a CNN-based model) with the global context modeling of the Swin Transformer. The proposed model is evaluated using three benchmark datasets—Malimg, MaleVis, VirusMNIST—encompassing 61 malware classes. Experimental results show that the hybrid model achieved a validation accuracy of 94.04%, outperforming both the ConvNeXt-Tiny-only model (92.45%) and the Swin Transformer-only model (90.44%). Additionally, we extended our validation dataset to two more datasets—Maldeb and Dumpware-10—to strengthen the empirical foundation of our work. The proposed hybrid model achieved competitive accuracy on both, with 98% on Maldeb and 97% on Dumpware-10. To enhance model interpretability, we employed Gradient-weighted Class Activation Mapping (Grad-CAM), which visualizes the learned representations and reveals the complementary nature of CNN and Transformer modules. The hybrid architecture, combined with explainable AI, offers an effective and interpretable approach for malware classification, facilitating better understanding and trust in automated detection systems. In addition, a real-time deployment scenario is demonstrated to validate the model’s practical applicability in dynamic environments.

The growth of Internet of Things (IoT) systems has brought serious security concerns, especially in asymmetrical environments where device capabilities and communication flows vary widely. Many machine-learning-based intrusion detection systems struggle to address noise, uncertainty, and class imbalance. For that reason, intensive data preprocessing procedures were required. These challenges are in real-world data. In this work, we introduce a semi-supervised learning approach that uses entropy-based uncertainty filtering to improve intrusion detection in IoT environments. By dynamically identifying uncertain predictions from tree-based classifiers, we retain only high-confidence results during training. Later, confident samples from the uncertain set are used to retrain the model through a self-training loop. We evaluate this method using three diverse and benchmark datasets named RT-IoT2022, CICIoT2023, and CICIoMT2024, which include up to 34 different attack types. The experimental results reveal that XGBoost and Random Forest outperformed other tree-based models while maintaining their robustness when predicting attacks in the IoT environment. In addition, our proposed model was compared with other models proposed by researchers in the field, and the findings confirmed that our model presented promising results.