Drift-Aware Graph Aggregation and Explanation under Controlled Attack Shifts in IoT Traffic

2026-10-30T10:34:54+00:00

Fixed nearest neighbour aggregation is a feature transformation, while the loss monitor is a supervised update trigger rather than a drift detector. This study evaluates the fixed feature transformation under a deliberately ordered sequence of capture-associated attack subpopulations. Initial training uses benign and acknowledgement-fragmentation captures, while the stream introduces SYN flooding, port scanning, and TCP denial-of-service. Capture separation, training-only feature scaling, duplicate exclusion, and a one-batch label delay restrict several information paths. The experiment contains 7,998 training records, 8,000 validation records, and 7,960 stream records. Five optimiser seeds compare fixed and continually updated tabular and graph classifiers, alongside an alarm-triggered graph variant. Continual tabular learning obtains average precision of 0.9834, compared with 0.9805 for continual graph aggregation and 0.9739 for alarm-triggered graph adaptation. Fixed graph average precision is 0.7374 overall, with especially weak ranking in the port scan and TCP denial-of-service phases. A supplemental reproduction of the fixed graph head yielded phase average precision of 0.4472 for port scan and 0.4067 for TCP denial-of-service across five seeds. Grouped feature occlusion is a retrospective sensitivity analysis and does not test explanation stability. These results describe controlled shifts in selected attack subpopulations and capture associated distributions. They do not establish strict concept drift, early attack detection, or general benefits from graph aggregation.

Ransomshield: A Proactive, Behavior-Based Ransomware Detection and Automated Recovery System Using Real-Time File Entropy Analysis

2026-10-06T05:09:53+00:00

Ransomware is one of the most rapidly growing cyber threats globally, encrypting critical data and demanding ransom payments from victims. Traditional antivirus solutions depend on signature-based detection, which fails against new, polymorphic, and AI-generated ransomware variants. By the time conventional tools identify an attack, significant data encryption has already occurred, leading to irreversible data loss. This paper presents the design and development of a Behavior-Based Ransomware Detection and Auto-Recovery System deployed on the Linux (Ubuntu) platform. Instead of relying on known malware signatures, the system monitors and analyzes runtime behavior, making it effective against both known and zero-day ransomware variants. Testing with simulated ransomware scenarios demonstrates that the system detects attacks within 2–3 seconds, isolates malicious processes before significant damage, and restores affected files with zero permanent data loss in the tested scenarios, making it a sustainable, future-proof cybersecurity solution for critical infrastructure. All data is stored in PostgreSQL. The system continuously monitors file system activity in real time using the Linux inotify kernel subsystem, analyzes file content using the Shannon entropy algorithm to detect early-stage encryption patterns, and identifies suspicious mass file modifications that indicate ransomware propagation. Upon detection, it automatically isolates the compromised process, terminates its execution, blocks its network access, and instantly restores affected files from secure shadow backups with MD5 hash integrity verification ensuring complete data protection.

Journal of Hacking Techniques, Digital Crime Prevention and Computer Virology

Drift-Aware Graph Aggregation and Explanation under Controlled Attack Shifts in IoT Traffic

Ransomshield: A Proactive, Behavior-Based Ransomware Detection and Automated Recovery System Using Real-Time File Entropy Analysis