Considering the escalating prevalence of cyber threats, data breaches and unauthorized access incidents, the implementation of real-time network monitoring has become imperative for the enhancement of cyber-security protocols in different sectors. The objective of this research was to strengthen cyber-security by delivering real-time traffic visualization with packet classification (TCP, UDP, ICMP) units and automated anomaly detection capacity. The integration of digital technologies in agriculture has increased the reliance on real-time data exchange for market intelligence, precision farming and value chain management. Thus the study developed a real-time network traffic monitoring dashboard utilizing Python and Streamlit, which effectively captures, analyzes and visualizes network traffic to facilitate improved threat detection. The methodology involved Network monitoring, analysis process, real time visualization, anomaly detection and logging which involved online real time monitoring and offline storage repository for archival and analysis where significant research deficiency is identified in the realms of scalability and adaptive anomaly detection. With the growing adoption of Internet of Things (IoT) devices, drones and cloud-based platforms, network traffic monitoring has become critical to ensure reliability, security and efficiency in agricultural operations. Leveraging open-source Python libraries, the framework provides a user-friendly dashboard with low computational overhead, making it accessible to rural and resourceconstrained settings. Results demonstrate the feasibility of real-time monitoring for enhancing data security, minimizing downtime and improving the resilience of digital agriculture systems. Moreover, the consoles architecture will be optimized to handle even the largest networks and highest traffic volumes ensuring it remains effective and efficient, even in the most demandingenvironments such as monitoring of agricultural value chains efficiency.

The air–ground integrated Internet of Vehicles (IoV), which incorporates unmanned aerial vehicles (UAVs), is a key component of a three-dimensional intelligent transportation system. Task offloading is crucial to improving the overall efficiency of the IoV. However, blackhole attacks and false-feedback attacks pose significant challenges to achieving secure and efficient offloading for heavily loaded roadside units (RSUs). To address this issue, this paper proposes a reputation-aware, multi-objective task offloading method. First, we define a set of multi-dimensional Quality of Service (QoS) metrics and combine K-means clustering with a lightweight Proximal Policy Optimization variant (Light-PPO) to realize fine-grained classification of offloading data packets. Second, we develop reputation assessment models for heterogeneous entities—RSUs, vehicles, and UAVs—to quantify node trustworthiness; at the same time, we formulate the RSU task offloading problem as a multi-objective optimization problem and employ the Non-dominated Sorting Genetic Algorithm II (NSGA-II) to find optimal offloading strategies. Simulation results show that, under blackhole and false-feedback attack scenarios, the proposed method effectively improves task completion rate and substantially reduces task latency and energy consumption, achieving secure and efficient task offloading.

Content-Addressable Memory (CAM) circuits enable inherently parallel and high-speed search operations, making them essential for data-intensive applications, such as packet classification in high-speed networking, pattern recognition, and artificial intelligence. However, as CMOS technology continues to scale, conventional electrical CAMs suffer from increasing interconnect delays, hindering their performance and energy efficiency in large-scale deployments. In contrast, photonic systems leverage light as the information carrier, offering ultra-fast data transmission with minimal signal degradation due to their length-independent impedance characteristics. In this work, we introduce OptiCAM—an optical CAM architecture that employs silicon photonic microring resonators and photodiode-based latch structures to store data and execute matching entirely in the optical domain. Furthermore, we present a novel sectioned array architecture that provides a pathway to build scalable CAM arrays, effectively overcoming the wavelength limitations imposed by the microring resonators’ free spectral range. Our OptiCAM design, evaluated on a 16 × 16 photonic CAM array using the commercial GlobalFoundries’ 45SPCLO technology node, achieves a remarkable search latency of 100 ps and an energy consumption of 100.9 fJ/bit per search.

Manual log checking is no longer feasible due to the development of high-velocity data streams in contemporary distributed systems. Using cutting-edge ensemble learning techniques, this study suggests a scalable, distributed architecture for the real-time analysis of heterogeneous log streams, particularly firewall, web server, and system logs. Our method incorporates an ensemble of varied base learners to produce a more robust "collective decision," in contrast to conventional single-classifier models that frequently suffer from excessive bias or overfitting in the face of complex, dynamic threats. A hybrid ensemble architecture is used by the framework. To lower variation in high-speed packet classification for firewall logs, we employ a Bagging technique using Random Forests; for web logs, we use a Boosting-based mechanism. (such as XGBoost) is used to iteratively learn from injection patterns that have been incorrectly classified. We implement a Stacking layer that combines predictions from Transformer-based log parsers with conventional statistical models to handle the various server log formats, greatly improving anomaly detection accuracy. These methods are frequently combined into a single design in contemporary log pipelines. For example, Apache Kafka is widely utilized for data input; logs are concurrently archived into Hadoop for long-term historical reporting and fed into Flink for instantaneous anomaly detection. These designs can process up to 500,000 log events per second with typical latencies as low as 300 milliseconds, according to recent benchmarks. Log analysis is essential for understanding system activity, identifying issues, and improving performance. The increasing volume and complexity of log data makes traditional analysis methods inadequate. The benefits and drawbacks of employing big data technologies like Hadoop, Spark, and Flink for log analysis are examined in this paper. Batch processing and large-scale data storage are ideal uses for Hadoop, a distributed processing platform. However, it could be show for real-time analysis. Because of its high performance and real-time capabilities, Spark is an in-memory processing engine that is perfect for machine learning and iterative workloads. Flink is real time analytics stream processing engine with high throughput and low latency. The main motivation for the use of ensemble techniques in log analysis is to improve predictive performance and robustness beyond what a single model might do. By combining the results of multiple models trained on different data subsets or using diverse learning techniques, the system becomes more flexible and more adept at generalizing new and unseen data. Ensemble learning is a machine learning technique that combines several "weak" learning models to create a single, ultra-reliable, and accurate "strong" model. Ensemble approaches offer a powerful solution to the inherent problems of large-scale log

The goal of the study is to predict the Man in the Middle attack in the packets of Wireshark program by using Support Vector Machines (SVM).In the time of using the internet, it has become a tool targeted by attackers and hackers; it is a serious threat to the devices. A uniqueness of an attack that appears in multiple identities for legitimate agencies. It is very necessary to know the behavior attack and predict the possible actions of an attacker. In this research a detection of Man in the Middle attack by monitoring the Wireshark program and recording any changes can be recognized in packet information. The classification of packets is divided into two categories (normal and abnormal). The proposed model is designed in many stages: loading data, processing data, training data, and testing data. The detection of SVM based on abnormal network packet through movement packets in the Wireshark program that needs to deal with current packets to recognize a new attack that one does not have prior knowledge of its detection, and there is a need for an intelligent way to separate network packets that represent normal. The proposed approach achieved an accuracy of 97.34% in detecting attacks. The results show that the proposed model effectively visualizes attacker behavior from data that represents abnormal network attackers. Research achieves successful accuracy in predicting abnormalities.

MLTree: an efficient packet classification algorithm using multiple layered trees in software defined networks

EPC: An ensemble packet classification framework for efficient and stable performance

Efficient Hierarchical Hash-Based Multi-Field Packet Classification With Fast Update for Software Switches

PartitionFilter: A Fast Packet Classification Algorithm Based on Adaptive Partition and Filter

At present, the method of using rule set partitioning technology to assist in constructing multiple decision trees for packet classification has been widely recognized. Rule set partitioning demonstrates a unique symmetry-breaking mechanism, systematically transforming the initial overlapping rule space into a more structured and balanced configuration. By separating overlapping rules in the initial stage, this method significantly reduces rule replication within trees, thereby improving the algorithm’s classification performance. The asymmetric characteristics of this partitioning process are particularly noteworthy: through the strategic disruption of the initial rule set’s symmetric distribution, it creates asymmetric subspaces with enhanced computational efficiency. However, existing research lacks standardized metrics for evaluating the effectiveness of rule set partitioning schemes. The purpose of this paper is to investigate the impact of partitioning on algorithm performance. Based on community structure theory, we construct a weighted graph model for rule sets and propose a disassortative modularity metric to evaluate the effectiveness of rule set partitioning. This metric not only examines intra-community connections but also emphasizes the asymmetric connections between communities. By quantifying these structural features, it provides a novel perspective on rule set partitioning strategies. The experimental results demonstrate a significant positive correlation between disassortative modularity and classification throughput. This metric offers valuable guidance for packet classification partitioning techniques, highlighting the practical significance of symmetry and asymmetry in algorithm design.

Internet of Things (IoT) devices are ubiquitous in various applications, such as smart homes, asset and people tracking, and city management systems. However, their deployment in adverse conditions, including unstable internet connectivity and power sources, present new cybersecurity challenges through new attack vectors. The LoRaWAN protocol, with its open and distributed network architecture, has gained prominence as a leading LPWAN solution, presenting novel security challenges. This paper proposes the implementation of machine learning algorithms, specifically the K-Nearest Neighbours (KNN) algorithm, within an Intrusion Detection System (IDS) for LoRaWAN networks. Through behavioural analysis based on previously observed packet patterns, the system can detect potential intrusions that may disrupt critical tracking services. Initial simulated packet classification attained over 90% accuracy. By integrating the Suricata IDS and extending it through a custom toolset, sophisticated rule sets are incorporated to generate confidence metrics to classify packets as either presenting an abnormal or normal behaviour. The current work uses third-party multi-vendor sensor data obtained in the city of Lisbon for training and validating the models. The results show the efficacy of the proposed technique in evaluating received packets, logging relevant parameters in the database, and accurately identifying intrusions or expected device behaviours. We considered two use cases for evaluating our work: one with a more traditional approach where the devices and network are static, and another where we assume that both the devices and the network are mobile; for example, when we need to report data back from sensors on a rail infrastructure to a mobile LoRaWAN gateway onboard a train.

DBTable: Leveraging Discriminative Bitsets for High-Performance Packet Classification

The network traffic classification is essential in identifying and categorizing the network traffic data packets in the network transmission. The network traffic transmission is effectively managed and prioritized using Quality of Service (QoS). The Differential Services Code Point within the Differentiated Service (DiffServ) field is primarily used inside the Layer 3 encapsulated network IP packets. Since the user generated data is growing rapidly with variety in data such as, streaming, VoIP, online gaming etc. There is a need to have effective prioritization and classification of IP packets for routers to enable the forwarding of such packets including packets having critical data efficiently and with a lower drop rate. This study develops and analyze using neural network-based models for effective classification of data packets using the DSCP header field. The data was gathered using real-time packet capturing tools which were then processed and moved with model development using different deep learning algorithms such as, LSTM, MLP, RNN and Autoencoders. Most of the algorithms got promising results and classify packets based on DSCP accurately. This study will help to advance network packet classification within the network transmission by network administrators to monitor network more efficiently and to avoid malicious activities within the network environment.

ML-based intrusion detection system for precise APT cyber-clustering

The advent of 5G heralds unprecedented connectivity with high throughput and low latency for network users. Software-defined networking (SDN) plays a significant role in fulfilling these requirements. However, it poses substantial security challenges due to its inherent centralized management strategy. Moreover, SDN confronts limitations in handling malicious traffic under 5G’s extensive data flow. To deal with these issues, this paper presents a novel intrusion detection system (IDS) designed for 5G SDN networks, leveraging the advanced capabilities of binarized deep spiking capsule fire hawk neural networks (BSHNN) and blockchain technology, which operates across multiple layers. Initially, the lightweight encryption algorithm (LEA) is used at the data acquisition layer to authenticate mobile users via trusted third parties. Followed by optimal switch selection using the mud-ring algorithm in the switch layer, and the data flow rules are secured by employing blockchain technology incorporating searchable encryption algorithms within the blockchain plane. The domain controller layer utilizes binarized deep spiking capsule fire hawk neural network (BSHNN) for real-time data packet classification, while the smart controller layer uses enhanced adapting hidden attribute-weighted naive bayes (EAWNB) to identify suspicious packets during data transmission. The experimental results show that the proposed technique outperforms the state-of-the-art approaches in terms of accuracy (98.02%), precision (96.40%), detection rate (96.41%), authentication time (16.2 s), throughput, delay, and packet loss ratio.

Content Addressable Memories (CAMs) are high-speed hardware lookup tables that are crucial in routing, packet classification, search, and other fast look-up applications. Despite having the advantage of high speed, they have limitations due to their power hungriness. This paper addresses the limitations of existing CAMs with two novel modifications in the proposed Search Line Pre-Charge-Free Low-Power-Content Addressable Memory (SLPFCAM) structure. The first novelty is their gated evaluation matching circuit and the second is a match line pre-charge controller. The proposed design reduces the energy consumption and improves the speed of the CAM by eliminating the SLprecharge phase in the CAM operation. The pre-charge controller prevents the attempt of match line pre-charge when it is not required. The design has been implemented using Cadence Virtuoso in a 90-nm CMOS technology with 1-V supply, and the post-layout simulation results show that the SLPFCAM makes significant improvements with a minimum of 83% less power consumption, a 91% less search delay, and the average energy consumption being 0.765 fJ/bit/search.

The intrusion detection of IoT devices through the classification of malicious traffic packets have become more complex and resource intensive as algorithm design and the scope of the problems have changed. In this research, we compare the cost of a traditional supervised pattern recognition algorithm (k-Nearest Neighbor (KNN)), with the cost of a current deep learning (DL) unsupervised algorithm (Convolutional Neural Network (CNN)) in their simplest forms. The classifier costs are calculated based on the attributes of design, computation, scope, training, use, and retirement. We find that the DL algorithm is applicable to a wider range of problem-solving tasks, but it costs more to implement and operate than a traditional classifier. This research proposes an economic classifier model for deploying suitable AI-based intrusion detection classifiers in IoT environments. The model was empirically validated on the IoT-23 dataset using KNN and CNN. This study closes a gap in prior research that mostly concentrated on technical elements by incorporating economic factors into the evaluation of AI algorithms for IoT intrusion detection. This research thus evaluated the economic implications of deploying AI-based intrusion detection systems in IoT environments, considering performance metrics, implementation costs, and the cost of classifier discrimination choices. Researchers and practitioners should focus on the cost–benefit trade-offs of any artificial intelligence application for intrusion detection, recommending an economic evaluation and task fit assessment before adopting automated solutions or classifiers for IoT intrusion detection, particularly in large-scale industrial settings that involve active attacks.

The publisher has retracted this article in agreement with the Editor-in-Chief. The article was submitted to be part of a guest-edited issue. An investigation by the publisher found a number of articles, including this one, with a number of concerns, including but not limited to compromised editorial handling and peer-review process, inappropriate or irrelevant references or not being in scope of the journal or guest-edited issue. Based on the investigation's findings, the publisher no longer has confidence in the results and conclusions of this article. Publisher's note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

LearningTuple: A packet classification scheme with high classification and high update

Firewall packet classification is a critical component of network security, demanding precise and reliable methods to ensure optimal functionality. This study introduces an advanced approach that combines Artificial Neural Networks (ANNs) with various data balancing techniques, including the Synthetic Minority Over-sampling Technique (SMOTE), ADASYN, and BorderlineSMOTE, to enhance the classification of firewall packets into four distinct classes: ‘allow’, ‘deny’, ‘drop’, and ‘reset-both’. Initial experiments without data balancing revealed that while the ANN model achieved perfect precision, recall, and F1-Scores for the ‘allow’, ‘deny’, and ‘drop’ classes, it struggled to accurately classify the ‘reset-both’ class. To address this, we applied SMOTE, ADASYN, and BorderlineSMOTE to mitigate class imbalance, which led to significant improvements in overall classification performance. Among the techniques, the ANN combined with BorderlineSMOTE demonstrated superior efficacy, achieving a 97% overall accuracy and consistently high performance across all classes, particularly in the accurate classification of minority classes. In contrast, while SMOTE and ADASYN also improved the model’s performance, the results with BorderlineSMOTE were notably more balanced and reliable. This study provides a comparative analysis with existing machine learning models, highlighting the effectiveness of the proposed approach in firewall packet classification. The synthesized results validate the potential of integrating ANNs with advanced data balancing techniques to enhance the robustness and reliability of network security systems. The findings underscore the importance of addressing class imbalance in machine learning models, particularly in security-critical applications, and offer valuable insights for the design and improvement of future network security infrastructures.