Murat Ozer

SQL and NoSQL databases are at risk from injection attacks, which is one of the most serious threats to the security of today’s data-centric systems. To address this issue, this research proposes an architecture for evaluating a new hybrid technique for detecting vulnerabilities by using a mixture of lightweight statistical machine learning techniques and a semantically verified locally installed large language model (LLM). Specifically, the proposed detection architecture consists of three major parts: (1) an initial filtering phase that uses rapid filtering through TF-IDF vectorization and logistic regression; (2) a second phase that implements a confidence-based hybrid decision logic model; and (3) a third phase using a deterministic LLM to process semantically ambiguous queries. In our experimental evaluation of a balanced benchmark of 1000 queries (500 SQL and 500 NoSQL), our proposed hybrid method achieved the highest overall performance, yielding a precision of 0.998, recall of 0.986, and F1-score of 0.992. The individual ML model obtained a lower recall of 0.964 than the standalone LLM but had F1-scores (0.981) much higher than that of standalone LLM (0.667). The hybrid architecture reduced the number of false negatives (generated by the standalone ML models) from 18 to 7 and the number of false negatives generated by the standalone LLMs from 228 to 7. The hybrid architecture achieved very few false positives. Therefore, the use of hybrid ML-LLM detection pipelines will provide both greater robustness and practical effectiveness when doing database security monitoring.

Phishing websites continue to evolve in sophistication, making them increasingly difficult to distinguish from legitimate platforms and challenging the effectiveness of current detection systems. In this study, we investigate the role of subtle deceptive behavioral cues such as mouse-over effects, pop-up triggers, right-click restrictions, and hidden iframes in enhancing phishing detection beyond traditional structural and domain-based indicators. We propose a hierarchical hybrid detection framework that integrates dimensionality reduction through Principal Component Analysis (PCA), phishing campaign profiling using K Means clustering, and a stacked ensemble classifier for final prediction. Using a public phishing dataset, we evaluate multiple feature configurations to quantify the added value of behavioral indicators. The results demonstrate that behavioral indicators, while weak predictors in isolation, significantly improve performance when combined with conventional features, achieving a macro F1 score of 97 percent. Explainable AI analysis using SHAP confirms the contribution of specific behavioral characteristics to model decisions and reveals interpretable patterns in attacker manipulation strategies. This study shows that behavioral interactions leave measurable forensic signatures and provides evidence that combining structural, domain, and behavioral features offers a more comprehensive and reliable approach to phishing intrusion detection.

Phishing websites continue to evolve in sophistication, making them increasingly difficult to distinguish from legitimate platforms and challenging the effectiveness of current detection systems. In this study, we investigate the role of subtle deceptive behavioral cues such as mouse over effects, pop up triggers, right click restrictions, and hidden iframes in enhancing phishing detection beyond traditional structural and domain-based indicators. We propose a hierarchical hybrid detection framework that integrates dimensionality reduction through Principal Component Analysis (PCA), phishing campaign profiling using K Means clustering, and a stacked ensemble classifier for final prediction. Using a public phishing dataset, we evaluate multiple feature configurations to quantify the added value of behavioral indicators. The results demonstrate that behavioral indicators, while weak predictors in isolation, significantly improve performance when combined with conventional features, achieving a macro F1 score of 97 percent. Explainable AI analysis using SHAP confirms the contribution of specific behavioral characteristics to model decisions and reveals interpretable patterns in attacker manipulation strategies. This study shows that behavioral interactions leave measurable forensic signatures and provides evidence that combining structural, domain, and behavioral features offers a more comprehensive and reliable approach to phishing intrusion detection.

In edge computing scenarios where constraints on memory, latency, and energy hinder the utilization of large-scale models, lightweight neural networks are increasingly favored for anomaly detection. However, uniform benchmarks for comparing commonly utilized lightweight models under these constraints remain absent. This research addresses the gap by evaluating three prominent lightweight neural architectures, pruned convolutional neural networks (CNNs), quantized long short-term memory networks (LSTMs), and distilled transformers, across two established intrusion detection datasets: CIC-IoT-DIAD 2024 and TON_IoT (TON_IoT_Modbus and TON_IoT_Thermostat). We evaluate each model utilizing standard detection measures (accuracy, precision, recall, and F1-score) and deployment metrics (model size, inference latency, and memory consumption) under simulated edge constraints. Our findings indicate significant trade-offs between model accuracy and efficiency, with performance varying based on the dataset utilized. Certain models perform more effectively with flow-based data compared to others with IoT telemetry. No single model excelled in all evaluation criteria. This research provides future edge-optimized anomaly detection studies with a reliable, reproducible foundation and valuable insights on selecting models for real-time edge deployment. The results also guide our attention in creating our forthcoming architecture, S3LiteNet, intended to enhance performance and deployment in information-centric networks.

The Internet of Medical Things (IoMT) represents a paradigm shift in the healthcare sector, enabling the interconnection of medical devices, sensors, and systems to enhance patient monitoring, diagnosis, and management. The rapid evolution of IoMT presents significant benefits to the healthcare domains. However, there is a rapid increase in distributed denial of service (DDoS) attacks on the IoMT networks due to several vulnerabilities in the IoMT-connected devices, which negatively impact patients' health and can even lead to deaths. Thus, in this paper, we aim to save lives via investigating an extreme learning machine for detecting DDoS attacks on IoMT devices. The proposed approach achieves a high accuracy at a low implementation budget. Thus, it can reduce the implementation cost of the DDoS detection system, making the model capable of executing on the fog level.