Sana Qadir

The increasing complexity and scale of cyber threats demand intelligent and adaptive defense mechanisms that extend beyond traditional approaches. Artificial Intelligence (AI) has emerged as a key enabler for enhancing cyber security through automated detection, analysis, and response. This paper presents a comprehensive survey of AI applications in cyber security across five major domains: malware detection, intrusion detection, phishing and spam detection, botnet detection, and cyber forensics. A systematic methodology based on data and methodological triangulation is employed to analyze 75 studies published between 2021 and 2025. The paper introduces a multi-layer taxonomy that maps cyber threats to application domains, analysis methods, AI approaches, and their associated capabilities and limitations. In addition, a cross-domain meta-analysis is conducted to identify recurring trends and assess the adoption of AI across different cyber security scenarios. The analysis reveals that deep learning and transformer-based models dominate data-intensive domains such as intrusion detection and malware analysis, whereas traditional machine learning techniques remain effective in structured and resource-constrained settings, particularly for phishing detection. Key challenges include dataset limitations, limited explainability, adversarial vulnerabilities, and computational constraints. Unlike existing surveys that focus on specific techniques or individual cyber security domains, this work provides a unified, application-oriented perspective on AI-driven cyber security. It further highlights emerging trends, open challenges, and future research directions toward more robust, scalable, and trustworthy cyber security systems.

Quantum computing developments hold the promise of transforming the IT security landscape. Advances in quantum processors have introduced new theoretical threats to traditional cryptographic primitives through algorithms such as Grover’s search and Shor’s factorization, which can be used to cryptanalyze symmetric and asymmetric ciphers, respectively; however, the practical realization of these attacks depends critically on the availability of Cryptographically Relevant Quantum Computers (CRQCs). While current quantum hardware is still a considerable distance from achieving this threshold, the steady progress in technology suggests that the realization of CRQCs depends fundamentally on ongoing advances in scaling and engineering. In response to this emerging long-term threat, NIST has revised traditional encryption standards by introducing post-quantum cipher suites. While post-quantum cryptography research has primarily focused on conventional asymmetric cryptosystems, symmetric ultralightweight ciphers—commonly employed in resource-constrained environments such as RFID systems—remain an underexplored target of quantum cryptanalysis. This work takes an initial step toward addressing this gap by demonstrating full disclosure attacks on three ultralightweight mutual authentication protocols: the Ultra-Lightweight RFID Authentication and Renewal Protocol (ULRARP+), the Lightweight RFID Authentication Protocol (LRAP), and the Ultra-Lightweight RFID Authentication Protocol (URAP). Based on these findings, the paper proposes a set of design principles to guide the development of quantum-resilient minimalist ciphers for the post-quantum era.

The controller placement problem and controller selection problem are two major issues that, if not considered seriously, lead to high network costs, load unbalancing, and high latency. To ensure stable connection in software-defined vehicular network (SDVN) with low cost, balanced load, and less latency, an optimal solution must be found that tackles all issues simultaneously. The aim of this article is to propose a solution called Opti-Route. Opti-Route focuses on solving three major problems simultaneously for SDVN. The cost of installing controllers at almost every roadside unit (RSU) to ensure stable connections is high. The second problem lies in the imbalance of load caused by the presence of a single main controller (MC) and multiple local controllers (LCs), and the third problem is the high latency involved in creating an end-to-end path from source to destination in a highly dynamic network. Opti-Route tackles these challenges by first analyzing the optimal placement of controllers from among all the RSUs in the network using a support vector machine (SVM) algorithm. From these selected LCs, it then selects the optimal controller (OC) to share the burden of the MC at the location where traffic density is high. And then, finally, taking instructions from optimal and local controllers, Opti-Route selects an optimal network route that ensures a high delivery ratio with minimum delay and overhead. To demonstrate the effectiveness of SVM in a dynamic SDVN architecture, we tested our Opti-Route in various case scenarios and compared it with different learning algorithms. Our result shows a minimum delay of 0.04 ms, a high delivery ratio of 97%, and a minimum overhead of 4%.

It is generally accepted that adopting both static application security testing (SAST) and dynamic application security testing (DAST) approaches is vital for thorough and effective security testing. However, this suggestion has not been comprehensively evaluated, especially with regard to the individual risk categories mentioned in Open Web Application Security Project (OWASP) Top 10:2021 and common weakness enumeration (CWE) Top 25:2023 lists. Also, it is rare to find any evidence-based recommendations for effective tools for detecting vulnerabilities from a specific risk category or severity level. These shortcomings increase both the time and cost of systematic security testing when its need is heightened by increasingly frequent and preventable incidents. This study aims to fill these gaps by empirically testing seventy-five real-world Web applications using four SAST and five DAST tools. Only popular, free, and open-source tools were selected and each Web application was scanned using these nine tools. From the report generated by these tools, we considered two parameters to measure effectiveness: count and severity of the vulnerability found. We also mapped the vulnerabilities to OWASP Top 10:2021 and CWE Top 25:2023 lists. Our results show that using only DAST tools is the preferred option for four OWASP Top 10:2021 risk categories while using only SAST tools is preferred for only three risk categories. Either approach is effective for two of the OWASP Top 10:2021 risk categories. For CWE Top 25:2023 list, all three approaches were equally effective and found vulnerabilities belonging to three risk categories each. We also found that none of the tools were able to detect any vulnerability in one OWASP Top 10:2021 risk category and in eight CWE Top 25:2023 categories. This highlights a critical limitation of popular tools. The most effective DAST tool was OWASP Zed Attack Proxy (ZAP), especially for detecting vulnerabilities in broken access control, insecure design, and security misconfiguration risk categories. Yasca was the best-performing SAST tool, and outperformed all other tools at finding high-severity vulnerabilities. For medium-severity and low-severity levels, the DAST tools Iron Web application Advanced Security testing Platform (WASP) and Vega performed better than all the other tools. These findings reveal key insights, such as, the superiority of DAST tools for detecting certain types of vulnerabilities and the indispensability of SAST tools for detecting high-severity issues (due to detailed static code analysis). This study also addresses significant limitations in previous research by testing multiple real-world Web applications across diverse domains (technology, health, and education), enhancing generalization of the findings. Unlike studies that rely primarily on proprietary tools, our use of open-source SAST and DAST tools ensures better reproducibility and accessibility for organizations with limited budget.

Effective Android malware detection is a complex problem because of the rapidly-evolving, complicated, and diverse nature of malware. The design of malware detectors should prioritise high detection rate, efficient use of computational resources, and sustainability. Keeping these design priorities in mind, we develop and empirically evaluate four different classifiers. Firstly, to ensure high detection rate, we use a dataset compiled using hybrid analysis of a diverse set of apps. Unlike most publicly-available Android datasets, the dynamic analysis of each app was carried out on a real device and not on a virtual setup. This means that this dataset contains a comprehensive profile of sophisticated malware capable of changing its behaviour on a virtual setup. Secondly, to enhance efficiency, we explore the use of a GPU-based setup and different feature selection techniques. Lastly, we emphasize sustainability by training the models using apps that date back to the beginning of the Android ecosystem i.e. from 2008 until 2020. Our results show that Random Forest (RF) is the most effective classifier with the highest accuracy of 97.86%. This accuracy is 2.78% higher than the best accuracy reported in existing literature. The data also shows that RF is the most sustainable classifier with minimal decrease in F1 score for over-time performance. With regard to efficiency, we find that Logistic Regression (LR) is the best option and that the training time of most models improves significantly when a GPU-based setup instead of a CPU-based setup.

Android is the most widely used mobile operating system and responsible for handling a wide variety of data from simple messages to sensitive banking details. The explosive increase in malware targeting this platform has made it imperative to adopt machine learning approaches for effective malware detection and classification. Since its release in 2008, the Android platform has changed substantially and there has also been a significant increase in the number, complexity, and evolution of malware that target this platform. This rapid evolution quickly renders existing malware datasets out of date and has a degrading impact on machine learning-based detection models. Many studies have been carried out to explore the effectiveness of various machine learning models for Android malware detection. Majority of these studies use datasets that have compiled using static or dynamic analysis of malware but the use of hybrid analysis approaches has not been addressed completely. Likewise, the impact of malware evolution has not been fully investigated. Although some of the models have achieved exceptional results, their performance deteriorated for evolving malware and they were also not effective against antidynamic malware. In this paper, we address both these limitations by creating an enhanced subset of the KronoDroid dataset and using it to develop a supervised machine learning model capable of detecting evolving and antidynamic malware. The original KronoDroid dataset contains malware samples from 2008 to 2020, making it effective for the detection of evolving malware and handling concept drift. Also, the dynamic features are collected by executing the malware on a real device, making it effective for handling antidynamic malware. We create an enhanced subset of this dataset by adding malware category labels with the help of multiple online repositories. Then, we train multiple supervised machine learning models and use the ExtraTree classifier to select the top 50 features. Our results show that the random forest (RF) model has the highest accuracy of 98.03% for malware detection and 87.56% for malware category classification (for 15 malware categories).

Rootkits are malicious programs designed to conceal their activities on compromised systems, making them challenging to detect using conventional methods. As the threat landscape continually evolves, rootkits pose a serious threat by stealthily concealing malicious activities, making their early detection crucial to prevent data breaches and system compromise. A promising strategy for monitoring system activities involves analyzing volatile memory. This study proposes a rootkit detection model that combines memory analysis with Machine Learning (ML) and Deep Learning (DL) techniques. The model aims to identify suspicious patterns and behaviors associated with rootkits by analyzing the contents of a system’s volatile memory. To train the model, a diverse dataset of known rootkit samples is employed, and ML and deep learning algorithms are utilized. Through extensive experimentation and evaluation using SVM, RF, DT, k-NN, and LSTM algorithms, it is determined that SVM achieves the highest accuracy rate of 96.2%, whereas Execution Time (ET) shows that k-NN depicts the best performance, and LSTM (a DL model) shows the worst performance among the tested algorithms. This research contributes to the development of advanced defense mechanisms and enhances system security against the constantly evolving threat of rootkit attacks.

The popularity of IoT has raised many security concerns. Multiple devices with new and improved features are introduced into the market every year, expanding the IoT attack surface. The number of emerging malware variants are also increasing along with the use of antidetection mechanisms such as packing and obfuscation. The cyber security community has proposed multiple solutions, but the platform heterogeneity of IoT devices poses a unique challenge. Most studies use a static analysis approach for malware detection. However, this approach is not effective for the detection of packed and obfuscated malware. A few studies use a dynamic analysis approach, but they do not address the multiarchitecture nature of IoT devices. The main contribution of this research is to present a machine learning model that can detect rapidly evolving, packed or obfuscated malware that targets MIPS, ARM, and x86 IoT devices. We compile our own dataset by dynamically analysing 524 malware samples and 524 benign samples for various IoT architectures. The extracted system call data is preprocessed and used to train five machine learning models. The best results are achieved using Random Forest (RF) with a detection accuracy of 99.04% and FPR of 0.01.

Smartphones and Internet have become prevalent in our society with various applications in businesses, education, healthcare, gaming, and research. One of the major issues with the Internet today is its lack of security since an eavesdropper can potentially intercept the communication. This has contributed towards an increased number of cyber-crime incidents, resulting in an increase in users’ consciousness about the security and privacy of their communication. One example is the shift towards using private browsers such as Tor. Tor is a well-recognized and widely used privacy browser based on The Onion Router network that provisions anonymity over the insecure Internet. This functionality of Tor has been a major hurdle in cybercrime investigations due to the complex nature of its anonymity. This paper investigates artifacts from the Tor privacy browser on the latest Windows 10 and Android 10 devices to determine potential areas where evidence can be found. We examine the registry, storage, and memory of Windows 10 devices and the memory, storage, logs, and Zram of Android 10 devices for three possible scenarios i.e. before, during, and after use of the Tor browser. Our results do not support the claims made by the Tor Project regarding user privacy and anonymity. We find that it is possible to retrieve significant details about a user’s browsing activities while the Tor browser is in use as well as after it is closed (on both operating systems). This paper also provides an investigative methodology for the acquisition and analysis of Tor browser artifacts from different areas of the targeted operating systems. Therefore, it can serve as a base to expand research in the forensic analysis of other privacy browsers and improve the efficiency of cybercrime investigations efficiency.