The rapid growth of the Internet of Things (IoT) devices has increased the attack area of modern networks, which makes effective intrusion detection systems (IDSs) essential to detect attacks that target IoT infrastructures. Federated learning is a promising approach for collaborative model training in the absence of centralized raw data. Conventional federated approaches rely on fixed client participation and static training configurations, which ensure symmetric treatment of clients despite heterogeneous local data distributions. This can limit convergence and degrade detection performance in non-IID conditions. This paper proposes an Adaptive Action-Based Federated Learning (AA-FL) framework for decentralized intrusion detection in heterogeneous IoT environments. The framework dynamically adjusts both participating clients and local training workload at each communication round using a Linear Upper Confidence Bound (LinUCB) contextual bandit controller. The proposed Adaptive-FL model is based on XGBoost boosters and uses quality-weighted server-side ensemble aggregation. At the same time, adaptation is guided by a multi-objective reward that balances classification performance, training latency, communication overhead, and computational cost. The framework is evaluated on CIC IoMT 2024 and RT-IoT2022 under realistic non-IID conditions using stratified 5-fold cross-validation and benchmarked against Static-FL, FedAvg-FL, and a centralized XGBoost upper bound. Experimental results demonstrate that Adaptive-FL outperforms all federated baselines across both datasets, achieving Macro-F1 scores of 98.27% on RT-IoT2022 and 94.21% on CIC IoMT 2024, with statistically significant improvements over Static-FL on both datasets. Adaptive-FL maintains superior classification stability while avoiding raw-data centralization. It remains within 0.67 and 0.35 percentage points of the centralized upper bounds on RT-IoT2022 and CIC IoMT 2024, respectively.

Vision Transformers (ViTs) have recently achieved high performance in retinal Optical Coherence Tomography (OCT) classification studies. However, ViT models continue to face significant challenges, including high computational cost, vulnerability to adversarial attacks, and pronounced sensitivity to preprocessing techniques. This study introduces GreenShield, a unified framework designed to produce an efficient and robust ViT model, referred to as GreenShield-ViT, which outperforms existing lightweight ViT variants in terms of adversarial robustness for retinal OCT classification. The framework integrates a gradient-based block-importance pruning strategy to compress the ViT/B-16 architecture, and adversarial training with proper ImageNet normalization and anti-saturation techniques. The robustness was evaluated using FGSM, PGD, PGD-R3, Transfer-PGD, BIM, and the proposed hybrid attack (FGSM-PGD). The proposed approach achieves an approximately 50% reduction in Floating-Point Operations (FLOPs), inference time, and carbon footprint emissions, while preserving diagnostic accuracy. Experiments conducted using GPU P100 on the OCT-c8, OCTID, and UCSD-3 datasets achieved clean accuracies of 92.5%, 94.78%, and 89.20%, respectively, alongside a significant reduction in attack success rates and improved model calibration. GreenShield-ViT outperformed lightweight ViT variants (Mobile-ViT, ViT-Tiny, ViT-Small) in terms of robustness while offering competitive efficiency. These results suggest its applicability to similar ViT-based medical tasks.

QR codes are widely used in applications such as information sharing, advertising, and digital payments. However, their growing adoption has made them attractive targets for malicious activities, including malware distribution and phishing attacks. Traditional detection approaches rely on URL analysis or image-based feature extraction, which may introduce significant computational overhead and limit real-time applicability, and their performance often depends on the quality of extracted features. Previous studies in malicious detection do not fully focus on QR code security when combining convolutional neural networks (CNNs) with recurrent neural networks (RNNs). This research proposes a deep learning model that integrates AlexNet for feature extraction, principal component analysis (PCA) for dimensionality reduction, and RNNs to detect malicious activity in QR code images. The proposed model achieves both efficiency and accuracy by transforming image data into a compact one-dimensional sequence. Experimental results, including five-fold cross-validation, demonstrate that the model using gated recurrent units (GRU) achieved an accuracy of 99.81% on the first dataset and 99.59% in the second dataset with a computation time of only 7.433 ms per sample. A real-time prototype was also developed to demonstrate deployment feasibility. These results highlight the potential of the proposed approach for practical, real-time QR code threat detection.

In modern automotive systems, introducing multiple connectivity protocols has transformed in-vehicle network communication, resulting in the widely recognized Controller Area Network (CAN) standard. Despite its ubiquitous use, the CAN protocol lacks critical security features, making vehicle communications vulnerable to message injection attacks. These assaults might confuse original electronic control units (ECUs) or cause system failures, emphasizing the need for strong cybersecurity solutions in automobile networks. This study addresses this need by developing a quick and efficient abnormal traffic detection system to protect vehicular communications from cyber attacks. The proposed system utilizes four machine learning techniques: Adaboost Trees (ABT), Coarse Decision Trees (CDT), Naive Bayes Classifier (NBC), and Support Vector Machine (SVM). These models were carefully assessed on the Car-Hacking-2018 dataset, which simulates real-time vehicular communication scenarios. Specifically, the system considers five balanced classes, including one normal traffic class and four classes for message injection attacks over the in-vehicle controller area network: fuzzy attack, DoS attack, RPM attack (spoofing), and gear attack (spoofing). Our best performance outcomes belong to the ABT model, which notched 99.8% classification accuracy and 6.67 µs of classification overhead. Such results have outweighed existing in-vehicle intrusion detection systems employing the same/similar dataset.