arXiv subjects

Sumit Kumar Tetarave

Publications and source records attributed to Sumit Kumar Tetarave.

4 recordsLinked to original sources

arXiv2026

Explainable Machine Learning for Phishing Detection on Heterogeneous Datasets with MCP-Enabled Deployment

With the growth in digital transformation and Internet usage, the Social Engineering techniques such as Phishing have become a major concern for the users and the organizations. Phishing attacks involve deceptive techniques to trick users into revealing confidential information that causes financial loss and reputation damage to organizations. According to report of Verizon, 36% of all data breaches involved phishing, highlighting the need for intelligent, adaptive, and explainable security mechanisms. This paper examines the efficiency of different machine learning algorithms in phishing detection on heterogeneous phishing datasets that include a publicly available UCI dataset, our generated datasets using tools such as EvilGinx and Zphisher, and AI generated datasets. Moreover, this work incorporates explainable AI (XAI) techniques such as Information Gain, SHAP (SHapley Additive Explanations), and LIME (Local Interpretable Model-Agnostic Explanations) to examine the most influential features impacting classification outcomes. To support practical deployment, this work also incorporates an MCP-based phishing URL detection system that offers real-time URL analysis, feature extraction, confidence-based classification, and AI-assisted security interpretation. The experimental results demonstrate that among classical models the highest accuracy is obtained by Logistic Regression at 92.44%, among ensemble models CatBoost achieved the highest accuracy at 95.01%, among neural network CNN achieved an accuracy of 94.02%, and among transformer-based models, DistilBERT got the highest accuracy at 99.78%

cs.CR↗

arXiv2026

Policy-Guided Threat Hunting: An LLM enabled Framework with Splunk SOC Triage

With frequently evolving Advanced Persistent Threats (APTs) in cyberspace, traditional security solutions approaches have become inadequate for threat hunting for organizations. Moreover, SOC (Security Operation Centers) analysts are often overwhelmed and struggle to analyze the huge volume of logs received from diverse devices in organizations. To address these challenges, we propose an automated and dynamic threat hunting framework for monitoring evolving threats, adapting to changing network conditions, and performing risk-based prioritization for the mitigation of suspicious and malicious traffic. By integrating Agentic AI with Splunk, an established SIEM platform, we developed a unique threat hunting framework. The framework systematically and seamlessly integrates different threat hunting modules together, ranging from traffic ingestion to anomaly assessment using a reconstruction-based autoencoder, deep reinforcement learning (DRL) with two layers for initial triage, and a large language model (LLM) for contextual analysis. We evaluated the framework against a publicly available benchmark dataset, as well as against a simulated dataset. The experimental results show that the framework can effectively adapt to different SOC objectives autonomously and identify suspicious and malicious traffic. The framework enhances operational effectiveness by supporting SOC analysts in their decision-making to block, allow, or monitor network traffic. This study thus enhances cybersecurity and threat hunting literature by presenting the novel threat hunting framework for security decision-making, as well as promoting cumulative research efforts to develop more effective frameworks to battle continuously evolving cyber threats.

cs.CR↗

arXiv2019

Robust Node ID Assignment for Mobile P2P Networks

The advancement of portable mobile wireless devices such as smart-phones, PDA, etc., brought mobile peer-to-peer (P2P) as an extension of traditional P2P networks to provide efficient, low-cost communication among them in a cellular network. It is challenging to assign a unique identifier to each user, as an adversary can target to disrupt the P2P system, by carefully selecting user IDs or obtaining many pseudo-IDs. This work proposes a robust node-ID assignment mechanism for secure peer joining in mobile P2P system called PJ-Sec. PJ-Sec facilitates to generate nodeID for a joining peer by a collaborative effort of an existing peer (within the vicinity) and pre-selected vicinity head. PJ-Sec is formally analyzed using AVISPA model checker and found to be attack resistant.

cs.CR↗

arXiv2019

Enhancing Quality of Experience using DHT Overlay on Device-to-Device Communications in LTE-A Networks

In [1], we proposed a two-tier model for creating and maintaining a distributed hash table (DHT) overlay of smartphones. The purpose was to reduce Internet usage and increase D2D content sharing over LTE-A/5G network. However, the real challenge is not in creating a two-tier model, but to evolve an efficient overlay that offers enhanced opportunities for device-to-device (D2D) content sharing over the existing model. In this paper, we formulated the selection of tier-1 devices as finding P-medians in a distribution network and solved it using Lagrangian relaxation method. Tier-2 devices become clients seeking content sharing services from tier-1 devices. A strong motivation in this work is to raise a user's perception of the grade of service known as Quality of Experience (QoE). We analyzed the QoE assessment challenge for resource-constrained smartphones under the proposed model of enhanced D2D communication. Our focus is to establish a framework to assess QoE for apps and services over LTE-A/5G networks with an improved level of D2D communication. The simulation and the experimental results validate the claim that substantial improvements in QoE are indeed possible with the proposed mathematical model for selection and placement of tier-1 mobile devices and maintaining a DHT for D2D communication.

cs.DC↗