Electrical and Electronic Engineering, Computer Networks and Communications, Computer Engineering
40
Scopus Publications
Scopus Publications
AegisGuard: A Multi-Stage Hybrid Intrusion Detection System with Optimized Feature Selection for Industrial IoT Security Mounir Mohammad Abou Elasaad, Samir G. Sayed, Mohamed M. El-Dakroury Sensors, 2025 The rapid expansion of the Industrial Internet of Things (IIoT) within smart grid infrastructures has increased the risk of sophisticated cyberattacks, where severe class imbalance and stringent real-time requirements continue to hinder the effectiveness of conventional intrusion detection systems (IDSs). Existing approaches often achieve high accuracy on specific datasets but lack generalizability, interpretability, and stability when deployed across heterogeneous IIoT environments. This paper introduces AegisGuard, a hybrid intrusion detection framework that integrates an adaptive four-stage sampling process with a calibrated ensemble learning strategy. The sampling module dynamically combines SMOTE, SMOTE-ENN, ADASYN, and controlled under sampling to mitigate the extreme imbalance between benign and malicious traffic. A quantum-inspired feature selection mechanism then fuses statistical, informational, and model-based significance measures through a trust-aware weighting scheme to retain only the most discriminative attributes. The optimized ensemble, comprising Random Forest, Extra Trees, LightGBM, XGBoost, and CatBoost, undergoes Optuna-based hyperparameter tuning and post-training probability calibration to minimize false alarms while preserving accuracy. Experimental evaluation on four benchmark datasets demonstrates the robustness and scalability of AegisGuard. On the CIC-IoT 2023 dataset, it achieves 99.6% accuracy and a false alarm rate of 0.31%, while maintaining comparable performance on TON-IoT (98.3%), UNSW-NB15 (98.4%), and Bot-IoT (99.4%). The proposed framework reduces feature dimensionality by 54% and memory usage by 65%, enabling near real-time inference (0.42 s per sample) suitable for operational IIoT environments.
Smart Grid intrusion detection system based on AI techniques Mounir Mounir, Samir G. Sayed, Mohamed M. El El-Dakroury Journal of Cybersecurity and Information Management, 2025 Smart grids (SGs) are integral to modern utility systems, managing power generation, energy consumption, and communication networks. However, as these systems become increasingly interconnected, they are exposed to sophisticated cyber threats that can compromise their functionality and security. To address these challenges, this paper presents an AI-driven detection framework designed to significantly enhance cybersecurity in smart grids. The proposed system combining Recurrent Neural Networks (RNNs) with Support vector classifier to improve detection accuracy, recognition capabilities, and system robustness. The methodology comprises four main stages: (1) data preprocessing to ensure high-quality input for analysis, (2) traffic detection using RNNs to capture temporal patterns, (3) classification of traffic as normal or abnormal via support vector classifier (SVC), and (4) identification of specific attack types through another SVC for refined threat categorization. This integrated approach enables real-time detection of both known and emerging threats, focusing on minimizing false positives and maximizing detection precision. The system was evaluated on three comprehensive benchmark datasets: UNSW_NB15 and BoT-IoT, achieving an average accuracy of 100%. These results underscore the superiority of this AI-based solution over traditional intrusion detection systems, providing a robust and scalable framework for securing smart grids and other critical infrastructures.
Securing the Future: Real-Time intrusion Detection in IIoT Smart Grids through Innovative AI Solutions Mounir Mounir, Samir G. Sayed, Mohamed M. El El-Dakroury Journal of Cybersecurity and Information Management, 2025 The world is witnessing an unprecedented boom in the development of information technology, which has come to encompass all aspects of life, Smart networks based on the Industrial Internet of Things (IIoT) are among the latest technologies used in various industries, contributing to improved production efficiency, reduced costs, and enhanced security, With the increasing reliance on this technology, the challenge of complex cyberattacks are also on the rise, These attacks are considered one of the major challenges facing smart networks, as attackers can exploit vulnerabilities in systems to access sensitive data or disrupt industrial operations, To counteract these threats, advanced intrusion detection systems should be developed, leveraging artificial intelligence and big data analytics to effectively detect and respond to attacks in real-time. Therefore, it is imperative to strive towards developing advanced and intelligent security systems to combat cyberattacks, ensuring the safety of industrial operations and data protection. This paper provides two IDS based on AI that are developed to negate the raising sophisticated cyberattacks. IN the first technique, Group of ML techniques such as Decision tree, Random Forrest classifiers, support vector classifier, and K_Nearest Neigbor are used with Feature reduction algorithms classifying network traffic subspecies to enhancing the accuracy and efficiency of detection systems. The second proposed technique for specifying the type of intrusion advantage various methodologies, particularly in the context of IoT networks and deep learning, the two algorithms are trained and tested using three well-known datasets to investigate wide domain of cyberattacks targeting the IIoT infrastructure. Results of the simulation show that the algorithm proposed in this work provides high improvement in detection of cyberattacks. The first algorithm achieved an accuracy of 99.9% and a very low false positive rate of just 0.1%. In addition, the second proposed algorithm identifies type of attack with a detection ratio of 99.76%. These results demonstrate how the proposed IDS based on AI algorithms can effectively detect network intrusion, and significantly enhance the security of IIoT system
Intrusion Detection in IoT Networks Using Deep Learning: A Comprehensive Approach Abdallah S. Elnamaky, Emad Elsamahy, Samir G. Sayed, Ahmed Salem 2025 15th International Conference on Electrical Engineering Iceeng 2025, 2025 Due to the wide availability and usage of Internet of Things (IoT) devices in many fields, these devices have inherent vulnerabilities due to their design. Therefore, the probability of cyberattacks which target the IoT networks has significantly increased. To increase the security of IoT networks, this study suggests an Intrusion Detection System (IDS) that makes use of a deep learning technique. Moreover, to effectively categorize network traffic into normal and potentially harmful attacks, our suggested approach utilizes deep learning techniques such as: Long Short-Term Memory (LSTM), Recurrent neural network (RNN), Dense neural network (DNN). Reducing the dimensionality of traffic characteristics using feature selection approaches minimizes the detection delays and computational resources. The system was trained and tested using benchmark BoT-IoT dataset which has a variety of attack types. Our findings demonstrate that the suggested IDS attain high accuracy and F1-score of 96.91% and 95.78% in addition to low false negative and false positive rates 0.1690 and 0.00834 in comparison to their corresponding results in literature.
Bluffing the Hackers: Automated Decoy Creation and Real-Time Cyber Deception Mohamed Farrag, Samir G. Sayed, Marwa Zamzam 2024 7th International Conference on Signal Processing and Information Security Icspis 2024, 2024 In the digital age, the proliferation of cyber threats necessitates advanced cybersecurity solutions. This paper introduces “Bluff,” an innovative cybersecurity platform designed to enhance intrusion prevention through automated decoy deployment and real-time threat tracking. “Bluff” integrates both backend and frontend components within a single cross-platform executable, simplifying installation and use. Leveraging deception technology, “Bluff” creates strategic decoys that divert cyber attackers, thereby protecting critical systems and gathering valuable threat intelligence. This comprehensive solution not only fortifies defenses but also manipulates adversaries’ perceptions, enabling early threat detection. Through detailed implementation and performance evaluation, we demonstrate “Bluff’s” efficacy in providing a proactive and sophisticated defense mechanism, contributing significantly to the evolving landscape of cybersecurity.
Automating Cyber Defense: Enhancing Threat Intelligence with AI-Driven Annotation Youssef Mostafa, Samir G. Sayed, Marwa Zamzam 2024 7th International Conference on Signal Processing and Information Security Icspis 2024, 2024 The cybersecurity landscape is increasingly challenged by the growing digital footprint and the sophistication of cyber threats, necessitating experts to stay updated and extract actionable insights from a deluge of Cyber Threat Intelligence data. Given the impracticality of manually processing approximately 60,000 pieces of Cyber Threat Intelligence released monthly, this paper introduces the Cybersecurity Entity Extraction Tool, an efficient technique leveraging pre-trained transformer-based large language models and an artificial neural network to extract named entities from unstructured sources within the cybersecurity domain. This tool not only facilitates the identification and contextual understanding of cyber threats but also achieves a commendable F1-score of 92% across 14 distinct labels, significantly mitigating the limitations of previous methods and enhancing the capability of analysts to process large volumes of Cyber Threat Intelligence data efficiently.
Joint trajectory and CoMP clustering optimization in UAV-assisted cellular systems: a coalition formation game approach Mostafa M. Abdelhakam, Mahmoud M. Elmesalawy, Ibrahim I. Ibrahim, Samir G. Sayed Eurasip Journal on Wireless Communications and Networking, 2023 In this paper, the flexibility of unmanned aerial vehicles (UAVs), as well as the benefits of coordinated multi-point (CoMP) transmission, are utilized for mitigating the interference in cellular networks. Specifically, the joint problem of CoMP clusters and UAVs’ trajectories is addressed for downlink transmission in a UAV-assisted cellular system. The problem is presented as a non-convex optimization problem that aims to maximize the sum rate of the ground users by taking into account the clustering, UAV mobility and backhaul capacity constraints. Since the formulated problem is known to be NP-hard, we partition it into two sub-problems. Particularly, by using coalitional game theory, the CoMP clusters are obtained with a given UAVs’ trajectories. Then, UAVs’ trajectories are optimized with given CoMP clusters using successive convex approximation technique. Based on the block coordinate descent method, the two sub-problems are solved alternatively until convergence. Numerical results are conducted and demonstrated the effectiveness of the proposed algorithm.
Detecting Malware Activities With MalpMiner: A Dynamic Analysis Approach Mustafa F. Abdelwahed, Mustafa M. Kamal, Samir G. Sayed IEEE Access, 2023 Day by day, malware as a service becomes more popular and easy to acquire, thus allowing anyone to start an attack without any technical background, which in turn introduces challenges for detecting such attacks. One of those challenges is the detection of malware activities early to prevent harm as much as possible. This paper presents a trusted dynamic analysis approach based on Answer Set Programming (ASP), a logic engine inference named Malware-Logic-Miner (MalpMiner). ASP is a nonmonotonic reasoning engine built on an open-world assumption, which allows MalpMiner to adopt commonsense reasoning when capturing malware activities of any given binary. Furthermore, MalpMiner requires no prior training; therefore, it can scale up quickly to include more malware-attack attributes. Moreover, MalpMiner considers the invoked application programming interfaces’ values, resulting in correct malware behaviour modelling. The baseline experiments prove the correctness of MalpMiner related to recognizing malware activities. Moreover, MalpMiner achieved a detection ratio of 99% with a false-positive rate of less than 1% while maintaining low computational costs and explaining the detection decision.
Data Mining Based Strategy for Detecting Malicious PDF Files Samir G. Sayed, Mohmed Shawkey Proceedings 17th IEEE International Conference on Trust Security and Privacy in Computing and Communications and 12th IEEE International Conference on Big Data Science and Engineering Trustcom Bigdatase 2018, 2018
A network-based framework for RAT-bots detection Ahmed A. Awad, Samir G. Sayed, Sameh A. Salem 2017 8th IEEE Annual Information Technology Electronics and Mobile Communication Conference Iemcon 2017, 2017