arXiv subjects

Mustafa S. Aljumaily

Publications and source records attributed to Mustafa S. Aljumaily.

5 recordsLinked to original sources

arXiv2026

PVBRF-ID: Private, Verifiable and Byzantine-Robust Federated Intrusion Detection for Oilfield Enterprise Networks

Federated learning allows dispersed oilfield sites to train a shared intrusion detector without pooling network traffic, yet its aggregation step forces a choice between privacy and robustness. Byzantine-robust rules must read each update in the clear, whereas secure aggregation hides updates from the checks that detect poisoning. We present PVBRF-ID, a two-server protocol in which sites secret-share their updates and the servers jointly test each update's norm and its cosine similarity to a reference computed on a small clean root set, revealing one accept bit per site. Commitments, Merkle roots and a homomorphic audit make the inclusion of accepted updates publicly verifiable. On a 15-class Edge-IIoTset task with ten sites holding differently distributed data and ten random seeds, PVBRF-ID matched FedAvg on clean data (macro-F1 0.708 vs. 0.706) and withstood sign-flip attacks (0.696 vs. 0.091). Against an adaptive attacker controlling 30% of sites, PVBRF-ID with secure clipping reached 0.641, whereas FedAvg fell to 0.046; plaintext multi-Krum remained higher by 0.052. An update-inference attacker recovered each site's class mix from plaintext updates (Spearman correlation 0.81) but not from one server's view. Backdoors passed the filter, and noise-based mitigation gave only heuristic protection. The implementation uses Python 3.13, NumPy 2.3, 30 rounds and 10 seeds.

cs.CR↗

arXiv2026

Attributing Sensor Deviations to Degradation, Weather, or Attack in Oilfield Digital Twins: A Simulation Study of Probabilistic Attribution and Cost-Based Decisions

When an oilfield digital twin disagrees with its instruments, the operator must decide whether the cause is hardware degradation, harsh-weather effects, or malicious data manipulation. Existing digital-twin work appears to treat these causes separately: sensor-validation architectures target faults, and attack-focused twins have been evaluated on water-sector testbeds. We study joint cause attribution on a simulated four-well wellpad with 15 coupled instruments, legitimate operating transients, and weather. A physics-informed twin, identified from normal data only, produces analytical-redundancy residuals; windowed features feed a gradient-boosted classifier whose posterior drives an alarm gate with a fixed false-alarm rate and a cost-based decision rule that may defer to an analyst. On three independently generated sites, the classifier reaches macro-F1 of 0.818 on windows where the injected deviation is observable (0.723 when latent post-onset windows are included at the primary site). The physics twin accounts for essentially all of this: removing the data-driven twin changes macro-F1 by less than 0.01, whereas removing all twins drops it to about 0.58. Attacks are detected quickly (median 1.7 h) but attributed correctly at alarm time only 42% of the time, rising to 73% six hours later. A cost-aware policy that defers ambiguous cases had the lowest expected cost among all policies in every one of 144 cost and prior settings tested, sometimes by a small margin; the result depends on illustrative costs and on analysts resolving deferred cases. A twin-aware attacker was detected in 45% of episodes yet almost never attributed to attack. These results are conditional on the simulator's generative assumptions and have not been validated on field data.

cs.CR↗

arXiv2026

Toward Responsible AI-Augmented Cyber Defense: Pattern Recognition, Defense-in-Depth, and the Case for Human-AI Collaboration

Cybersecurity literature has extensively documented the operational benefits of artificial intelligence (AI) for threat detection, incident response, and prevention, while raising qualitative concerns about over-automation, algorithmic bias, and analyst-skill erosion. What remains largely absent is a formal, falsifiable model connecting three constructs that recur across this literature: Defense-in-Depth Theory, the Artificial Intelligence Theory of Pattern Recognition, and human-AI collaboration in security operations. This paper develops such a model. We formalize layered defense as a Bernoulli detection cascade in which AI augmentation enters multiplicatively across layers; we formalize each layer's pattern-recognition behavior as a Neyman-Pearson/Bayesian detector with a derived closed-form optimal threshold; and we formalize human-AI triage as a capacity-constrained cascade with an explicit, quantifiable trade-off between detection probability and false-alarm ("alert fatigue") rate. A Monte Carlo/analytical simulation evaluated at illustrative but realistic operating points shows that (i) AI augmentation compounds across defense layers, delivering its largest marginal gains exactly where traditional layering saturates, and (ii) full human review of AI-flagged alerts is not optimal: increasing analyst capacity toward 100% coverage cuts false alarms by roughly 20-fold but simultaneously lowers system-level detection probability, because imperfect analyst accuracy is then applied to every alert rather than a filtered subset. These results give the widely repeated qualitative recommendation of "balanced human-AI collaboration" a precise, testable form and suggest an interior-optimum capacity ratio as a concrete design target for security operations centers (SOCs), including those securing IT/OT-converged critical infrastructure.

cs.CR↗

arXiv2026

Mizan: A National Benchmark for Evaluating Large Language Models on Iraqi Arabic and the Iraqi Civic Context

Arabic large-language-model (LLM) evaluation has matured around Modern Standard Arabic (MSA): aggregated leaderboards such as the Open Arabic LLM Leaderboard (OALL), HELM Arabic, and BALSAM rank models across dozens of MSA tasks, and frontier systems increasingly saturate them. Dialectal Arabic, the language Iraqis actually speak, remains nearly invisible to this infrastructure. We introduce Mizan ("the balance"), Iraq's national benchmark for evaluating LLMs on Iraqi Arabic and the Iraqi civic context: an MSA baseline track paired with an Iraqi track across six axes (dialect comprehension, dialect generation, bidirectional MSA-Iraqi translation, Iraq-specific knowledge, official-document field extraction, and safety), built from 340 originally authored, dually reviewed items with statistically audited answer positions and Wilson intervals on every published score. A pilot evaluation of 27 systems, spanning closed frontier models three days after release, open weights across size tiers, and an Arabic trio of commercial, open-specialized, and sovereign systems, yields four findings. The MSA track saturates while the Iraqi track discriminates, with a consistent 14-18-point per-model gap and statistically tied leaders. Official-document extraction confines every system to 32-56. Arabic-focused specialization behaves as MSA specialization: two dedicated Arabic models score below a size-matched generalist on the Iraqi track. And the safety-hardened tier of the newest model family deterministically refuses innocuous dialect-comprehension items as policy violations, an over-refusal mode invisible to MSA benchmarks. The platform enforces an integrity protocol of immutable snapshots, verification certificates, a human publication gate, and public retraction, all exercised during this study. Code and the public development set accompany the paper.

cs.CL↗

arXiv2018

Routing Protocols Performance in Mobile Ad-Hoc Networks Using Millimeter Wave

Self-Organized networks (SONs) have been studied for many years, and have attracted many researchers due to their substantial applications. Although the performance of such networks in the lower band networks (sub-6 GHz band frequencies) has been well studied, there are only sparse studies on SON in higher frequency bands, such as the millimeter wave (mmWave) band ranges between 28GHz and 300GHz. mmWave frequencies have attracted many researchers in the past few years because of its unique features and are now considered as an important part of the next generation of wireless communications namely (5G).In this paper, we study the performance of some well-known routing protocols in the case of mmWave Mobile Ad hoc Networks (MANET) using the ns-3 mmwave module that was developed recently. SONs are within the goals for the next release of the 3GPP New Radio (NR) standardization process (Release-16) for the 5G, which makes the study of the behavior of such frequency bands for these networks an important activity towards achieving such goal. Mathematical and simulation results show a great improvement in the routing protocols delivery rates and power consumption when using mmWave compared to the sub6GHz band frequencies.

cs.NI↗