Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Detection”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 433 records · Page 24
All sourcesNASA NTRSDOE OSTI
DOE OSTI2020

Total variation vs L1 regularization: a comparison of compressive sensing optimization methods for chemical detection

One of the fundamental assumptions of compressive sensing (CS) is that a signal can be reconstructed from a small number of samples by solving an optimization problem with the appropriate regularization term. Two standard regularization terms are the L1 norm and the total variation (TV) norm. We present a comparison of CS reconstruction results based on these two approaches in the context of chemical detection, and we demonstrate that optimization based on the L1 norm outperforms optimization based on the TV norm. Our comparison is driven by CS sampling, reconstruction, and chemical detection in two real-world datasets: the Physical Sciences Inc. Fabry-Perot interferometer sensor multispectral dataset and the Johns Hopkins Applied Physics Lab FTIR-based longwave infrared sensor hyperspectral dataset. Both datasets contain the release of a chemical simulant such as glacial acetic acid, triethyl phosphate, and sulfur hexafluoride. For chemical detection we use the adaptive coherence estimator (ACE) and bulk coherence, and we propose algorithmic ACE thresholds to define the presence or absence of a chemical of interest in both un-compressed data cubes and reconstructed data cubes. The un-compressed data cubes provide an approximate ground truth. We demonstrate that optimization based on either the L1 norm or TV norm results in successful chemical detection at a compression rate of 90%, but we show that L1 optimization is preferable. We present quantitative comparisons of chemical detection on reconstructions from the two methods, with an emphasis on the number of pixels with an ACE value above the threshold.

Hyperspectral imagery, L1-norm, total variation, A↗
DOE OSTI2020

Reliable cyber-threat detection in rapidly changing environments

In some embodiments, a plurality of monitoring nodes each generate a series of current monitoring node values over time that represent a current operation of the industrial asset. An attack detection computer platform may receive the series of current monitoring node values and generate a set of current feature vectors including a current feature for capturing transients (e.g., local transients and/or global transients). The attack detection computer platform may also access an attack detection model having at least one decision boundary that was created using at least one of a set of normal feature vectors and/or a set of attacked feature vectors. The attack detection model may then be executed such that an attack alert signal is transmitted by the attack detection computer platform, when appropriate, based on the set of current feature vectors (including the current feature to capture transients) and the at least one decision boundary.

Abbaszadeh, Masoud↗
DOE OSTI2021

Hardware intrusion detection system

An apparatus for intrusion detection includes processing circuitry, a switch, signal detection circuitry, and an analog-to-digital converter (“ADC”). The processing circuitry is coupled to send a challenge signal to a device when the device is coupled to the processing circuitry. The switch is coupled to be enabled and disabled by the processing circuitry. The switch is for coupling to the device to receive a response signal in response to the challenge signal sent by the processing circuitry. The signal detection circuitry is coupled to receive the response signal in via the switch, when the processing circuitry enables the switch. The ADC is coupled to take measurements of the signal detection circuitry at a first output. The processing circuitry is coupled to the ADC and configured to analyze whether an intruder is present in the device based on the measurements of the signal detection circuitry.

Edwards, Nathan J.↗
DOE OSTI2021

Studies on the scintillation light detection in the ProtoDUNE Dual Phase liquid-argon TPC and its capability for the supernova trigger in DUNE

The Deep Underground Neutrino Experiment (DUNE) is a long-baseline neutrino oscillation experiment that aims at addressing key questions in neutrino physics in the next decades. Its scientific program includes the detection of the neutrino flux from a core-collapse supernova. The DUNE far detector will have four 17-kt mass liquid-argon (LAr) time-projection chamber (TPC) modules. ProtoDUNE Dual Phase (DP), a dual-phase LAr TPC with 300 t of active mass and 6 m of drift distance, was operated with cosmic muons in 2019-2020 as part of an R&D program at the CERN Neutrino Platform to demonstrate the feasibility of the technology at such a large scale. In a LAr TPC, the photon detection system (PDS) provides fun- damental timing information and trigger capabilities. The PDS of ProtoDUNE-DP, which consisted of 36 photomultiplier tubes (PMTs), counted on a dedicated light calibration system (LCS) to monitor the PMT response. In this dissertation, the characterization and validation of the ProtoDUNE-DP PDS and LCS components before their installation will be reviewed, highlighting the results of general interest for experiments that use liquid noble gasses as target medium. The results from the stable performance of both systems in the detector during 15 months will be presented next as well as the studies on the scintillation light detection in ProtoDUNE-DP, where the collection of light produced in LAr at 7 m from the photosensors has been achieved for the first time. It is worth pointing out that the excellent LAr purity and the large size of the detector have enabled to develop a unique data-driven investigation on aspects that are critical for LAr- based experiments but that are not completely understood. The analyses cover the characterization of the low-energy background detected by the PDS, the quantification of the electric field impact on the light yield, the evaluation of the Rayleigh scattering affecting the light propagation, and the analysis of the PMT detection efficiency. The effect of the VUV reflectivity of the detector materials will be also discussed. In addition, the estimation of the cosmic muon flux crossing the TPC and the study of the observed light yield by the PDS will be reported. Finally, the results from the simulation-based study of the supernova burst trigger capability with the PDS of a 12.1-kt active mass dual-phase LAr TPC as the one proposed for DUNE will be summarized. Several configurations of reflective foils installed in the TPC to enhance the light collection will be compared

Gallego-Ros, Ana↗
DOE OSTI2022

Detecting CAN Masquerade Attacks with Signal Clustering Similarity

Vehicular Controller Area Networks (CANs) are susceptible to cyber attacks of different levels of sophistication. Fabrication attacks are the easiest to administer—an adversary simply sends (extra) frames on a CAN—but also the easiest to detect because they disrupt frame frequency. To overcome time-based detection methods, adversaries must administer masquerade attacks by sending frames in lieu of (and therefore at the expected time of) benign frames but with malicious payloads. Research efforts have proven that CAN attacks, and masquerade attacks in particular, can affect vehicle functionality. Examples include causing unintended acceleration, deactivation of vehicle’s brakes, as well as steering the vehicle. We hypothesize that masquerade attacks modify the nuanced correlations of CAN signal time series and how they cluster together. Therefore, changes in cluster assignments should indicate anomalous behavior. We confirm this hypothesis by leveraging our previously developed capability for reverse engineering CAN signals (i.e., CAN-D [Controller Area Network Decoder]) and focus on advancing the state of the art for detecting masquerade attacks by analyzing time series extracted from raw CAN frames. Specifically, we demonstrate that masquerade attacks can be detected by computing time series clustering similarity using hierarchical clustering on the vehicle’s CAN signals (time series) and comparing the clustering similarity across CAN captures with and without attacks. We test our approach in a previously collected CAN dataset with masquerade attacks (i.e., the ROAD dataset) and develop a forensic tool as a proof of concept to demonstrate the potential of the proposed approach for detecting CAN masquerade attacks.

Moriano Salazar, Pablo↗
DOE OSTI2022

CANShield: Signal-based Intrusion Detection for Controller Area Networks

Modern vehicles rely on complex cyber-physical systems made up of hundreds of electronic control units (ECUs) connected through controller area network (CAN) buses. However, the CAN bus attack surface is increasing due to advanced features in automobiles, making it prone to injection attacks. The ordinary injection attacks disrupt the typical timing properties of the CAN data stream, and the rule-based intrusion detection systems (IDS) can easily detect them. However, advanced attackers can inject false data to the signal level, maintaining the regular pattern/frequency of the CAN messages. Such attacks can bypass the rule-based IDS or any anomaly-based IDS built on binary payload data. To make the vehicles robust against such intelligent attacks, we propose CANShield, a signal-based intrusion detection framework for the CAN bus that consists of three modules. A data preprocessing module handles the high-dimensional CAN data stream at the signal level and make them suitable for any machine learning model. A data analyzer module consists of multiple deep autoencoder networks, each analyzing the time series data from a different perspective. Finally, an attack detection module uses an ensemble method to make the final decision. Evaluation results on a standard signal-based dataset show the effectiveness of the CANShield in detecting five advanced attacks.

Shahriar, Md Hasan↗
DOE OSTI2022

Automated Shift Detection in Sensor-Based PV Power and Irradiance Time Series

PV power and irradiance sensor-based measurements are prone to error, resulting in issues such as time series data shifts. In this research, a changepoint detection (CPD) algorithm that automatically detects data shifts in sensor-based time series is introduced. Data shift periods in 101 daily PV power and irradiance time series were labeled manually by two solar experts. These data streams represent sensor-based measurements, and display a variety of data shift behaviors. A changepoint detection algorithm was tuned using the 101 labeled data streams, with each model configuration's ability to detect labeled changepoints benchmarked using metrics such as F1-score, recall, and Rand Index. Best performing models on seasonality-corrected data streams include the Pruned Exact Linear (PELT) method, the Binary Segmentation method, and the Bottom-Up method, all scoring an average F1-score of 0.76 or greater at detecting labeled changepoints within a 30-day window across the labeled data sets. Pending approval, we plan to release the labeled data sets for this research on NREL's DuraMAT Data Hub, and the associated algorithm in the Python PVAnalytics package. By supplying the training sets and algorithm, we hope to encourage further development in this research space.

data shift↗
DOE OSTI2022

A Review on the State of the Art of Machine Learning and Satellite Imaging: Detecting Scene Changes in Selected Nuclear Fuel Cycle Datasets

The timely detection of clandestine nuclear facilities is one of the greatest challenges faced by the International Atomic Energy Agency’s (IAEA). Idaho National Laboratory is currently applying machine learning (ML) to existing satellite imagery (SI) datasets to find facilities within the nuclear fuel life cycle, with primary focus placed on identifying critical predecessor (i.e., fuel fabrication and fuel enrichment) and successor (i.e., nuclear power plants) facilities. This could provide a satellite image methodology that the IAEA could leverage to discover clandestine facilities. The work presented in this paper describes the evolution of a workflow developed by this team for object detection related to critical infrastructure by expanding that workflow for the purpose of identifying nuclear fuel cycle components and automating dependency assessments. This will be done using two methods housed within a single pipeline. The first method involves implementing a DenseNet161 convolutional neural network to classify the images and explain the results using Local Interpretable Model-Agnostic Explanations (LIME). The second method implements You Only Look Once version 5 (YoloV5), to detect objects within images, provide a probability for the detection, and provide a bounding box that corresponds to the object of interest. The results of this work are anticipated to provide a clear picture of this portion of the nuclear fuel cycle and perform as a stand-alone tool for image assessment that can be expanded to additional fuel cycle components and implemented in international safeguards and national security domains. This capability addresses the IAEA’s need to detect undeclared nuclear materials and activities within a state while encompassing the entire nuclear fuel cycle.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Power System Event Detection Using the Energy Detector: A Performance Analysis

As the grid becomes smarter, the need to accurately detect, predict, and classify waveform phenomena is growing. When it comes to detecting high-frequency behaviors, i.e. transients, it is especially important to employ an event detection system that is able to accurately uncover these types of disturbances that would otherwise be lost with traditional hardware. In this paper, we first present the energy detector; a waveform event detection system that adaptively monitors a signal's energy and picks out high-frequency events that deviate from the nominal state. Secondly, we evaluate the performance of this detector against waveform data that have been corrupted by sensor irregularities. Using Oak Ridge National Laboratory's sensor testbed, we are able to show the results of the detector's performance against events that have been corrupted by three distinct sensor types, and examine how these results change with multiple trials. The results show excellent performance when detecting the beginning of an anomalous event with an average of less than 1% error.

Ekti, Ali Riza↗
DOE OSTI2022

Cyber risk assessment and investment optimization using game theory and ML-based anomaly detection and mitigation for wide-area control in smart grids

The electric power grid is increasingly becoming susceptible to cyber attacks that exploit vulnerabilities in the smart grid control, information, and physical layers. Successful cyber attacks can have catastrophic impacts on the social and economic well-being of any nation all over the globe. It has, thus, become imperative to secure the smart grid against such adversarial actions to ensure stable, secure, and reliable operation of the grid. The existing research and industry practices prove to be inadequate in terms of providing pragmatic and effective defense methodologies and measures for long-term cybersecurity planning and real-time cybersecurity for grid operation. For example, existing works lack models that incorporate uncertain behavior of cyber-attackers and pragmatic defense measures for cyber risk assessment and cybersecurity investment optimization which often provide unreliable and strictly qualitative solutions to these problems. At the same time, with the growing number of cyber incidents in the grid, there still exists a need to develop attack-resilient algorithms for wide-area monitoring, protection, and control (WAMPAC) applications like the wide-area voltage control systems (WAVCS) for Flexible AC Transmissions Systems (FACTS) that lack in scalable and feasible solutions from the cybersecurity perspective. This dissertation proposes novel models and methodologies for: (1) Cybersecurity planning, and (2) Cybersecurity for system operation. The cybersecurity planning is achieved through cyber risk assessment and cybersecurity resource investment optimization for long-term cybersecurity of the grid using game theory and attack-defense trees. Cybersecurity for system operation consists of development of cyber anomaly detection and mitigation algorithms for flexible AC transmission system (FACTS) controller-based wide-area voltage control systems (WAVCS) using machine learning (ML), and software defined networking-based moving target defense network routing for achieving real-time cyber-physical security for grid operations. This is followed by hardware-in-the-loop (HIL) implementation and evaluation of these attack prevention, detection, and mitigation algorithms and methodologies showcasing their feasibility in a close to real-world environment. For cybersecurity planning, a novel approach involving a combination of game theory and attack defense trees (ADT) for optimal cybersecurity resource allocation in the smart grid is proposed. This methodology involves modeling of the cyber-physical smart grid substations as ADTs, defining attacker costs, defense costs, and attack probabilities for attack access points. Using game theoretical formulation, optimal defense strategies for the defender of the system to invest cybersecurity resources in the grid are obtained. Additionally, a game-theoretic framework is developed for quantitative cyber-physical risk assessment of the grid under a dynamically changing cyber threat space and uncertain behavior of cyber attackers which is further used to optimize investments in the smart grid's cybersecurity resources. The attacker, defender, and the smart grid system are modeled while incorporating attacker-stochasticity and federal guidelines for smart grid cybersecurity. This allows quantification of threat, vulnerabilities, and attack impact of the grid for quantitative risk assessment. The defender's budget to invest in the security resources in the grid is optimized based on the strategies leading to minimum system risk. The evaluation of the proposed solutions highlight the feasibility for practical implementation of these methodologies and algorithms in the smart grid, while taking the federal requirements and guidelines for smart grid security into consideration. For achieving cybersecurity for system operation, attack prevention, detection, and mitigation algorithms and methodologies are developed specifically for FACTS-based WAVCS. Anomaly detection and mitigation in the WAVCS are achieved using algorithms based on machine learning which involves offline training and testing of ML models with CPS datasets incorporating physics-based features that allow accurate distinction between system faults and cyber attacks. For attack prevention, a methodology based on software defined network (SDN)-based moving target defense (MTD) network routing is proposed that enables prevention of Denial of Service (DoS) type attacks on the smart grid communication system. Subsequently, these methodologies and algorithms are implemented and evaluated on an HIL testbed that allows for real-time attack prevention, detection, and mitigation of emulated cyber attacks on the WAVCS in a close to real-world environment. The results show highly accurate and efficient performance of the implemented algorithms and methodologies with the smart grid system operating within the NERC's system operation limits even in the presence of DoS and data integrity cyber attacks. This work opens up future research opportunities in other directions such as (1) Expanding cybersecurity planning methodologies to real-time cyber contingency analysis with different game formulations; and (2) Applying the cybersecurity for system operation algorithms to broader categories of wide-area control applications.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2023

Systems and methods for global cyber-attack or fault detection model

An industrial asset may have monitoring nodes that generate current monitoring node values representing a current operation of the industrial asset. An abnormality detection computer may detect when a monitoring node is currently being attacked or experiencing a fault based on a current feature vector, calculated in accordance with current monitoring node values, and a detection model that includes a decision boundary. A model updater (e.g., a continuous learning model updater) may determine an update time-frame (e.g., short-term, mid-term, long-term, etc.) associated with the system based on trigger occurrence detection (e.g., associated with a time-based trigger, a performance-based trigger, an event-based trigger, etc.). The model updater may then update the detection model in accordance with the determined update time-frame (and, in some embodiments, continuous learning).

Xu, Rui↗
DOE OSTI2021

Self-Supervised Anomaly Detection via Neural Autoregressive Flows with Active Learning

Many self-supervised methods have been proposed with the target of image anomaly detection. These methods often rely on the paradigm of data augmentation with predefined transformations such as flipping, cropping, and rotations. However, it is not straightforward to apply these techniques for non-image data, such as time series or tabular data, while the performance of the existing deep approaches has been under our expectation on tasks beyond images. In this work, we propose a novel active learning (AL) scheme that relied on neural autoregressive flows (NAF) for self-supervised anomaly detection, specifically on small-scale data. Unlike other generative models such as GANs or VAEs, flow-based models allow to explicitly learn the probability density and thus can assign accurate likelihoods to normal data which makes it usable to detect anomalies. The proposed NAF-AL method is achieved by efficiently generating random samples from latent space and transforming them into feature space along with likelihoods via invertible mapping. The samples with lower likelihoods are selected and further checked by outlier detection using Mahalanobis distance. The augmented samples incorporating with normal samples are used for training a better detector so as to approach decision boundaries. Compared with random transformations, NAF-AL can be interpreted as a likelihood-oriented data augmentation that is more efficient and robust. Extensive experiments show that our approach outperforms existing baselines on multiple time series and tabular datasets, and a real-world application in advanced manufacturing, with significant improvement on anomaly detection accuracy and robustness over the state-of-the-art.

Zhang, Jiaxin↗
DOE OSTI2024

SVM-Based Synchronized Fault Detection for 100% Renewable Microgrids: Preprint

Traditional protection schemes face significant challenges when applied to microgrids with high penetrations of renewables with inverter-based resources (IBRs). The proliferation of advanced sensing and communication technologies has generated copious data, offering an opportunity to overcome these limitations using data-driven machine learning approaches. This work proposes a novel approach based on a support vector machine (SVM) for detecting faults within a 100% renewable microgrid. The approach encompasses a systematic offline training stage for the development of a linear SVM-based fault detection algorithm. This process covers offline data collection from the microgrid under study, the extraction of features such as positive- and negative-sequence components and the total harmonic distortion of the voltage and current measurements of the relays, and the design of the linear SVM-based classifier. During the online implementation, however, different classifiers can exhibit asynchronicity in detecting the fault inception at different subcycle-to-cycle period-level delays. To circumvent this asynchronicity issue, a separate algorithm is developed for each relay to estimate the fault inception time as close to the real fault time. The performance of the proposed SVM-based synchronized fault detection method is evaluated using online time-domain simulation studies on a microgrid test system. The results corroborate the reliability of the fault detection scheme when tested under various fault cases (fault types, locations, and impedances) and non-fault cases during both grid-tied and islanded operation modes.

100% microgrid↗
DOE OSTI2024

Entanglement-Enhanced Neyman-Pearson Target Detection

Quantum illumination (QI) provides entanglement-enabled target-detection enhancement, despite operating in an entanglement-breaking environment. Existing experimental studies of QI have utilized a Bayesian approach, assuming that the target is equally likely to be present or absent before detection, to demonstrate an advantage over classical target detection. However, such a premise breaks down in practical operational scenarios in which the prior probability is unknown, thereby hindering QI's applicability to real-world target-detection scenarios. In this work, we adopt the Neyman-Pearson criterion in lieu of the error probability for equally likely target absence or presence as our figure of merit for QI. We demonstrate an unconditional quantum advantage over the optimal classical-illumination protocol as benchmarked by the receiver operating characteristic, which examines detection probability versus false-alarm probability without resorting to known prior probabilities. Our work represents a critical advancement in adapting quantum-enhanced sensing to practical operational settings.

Ward, William↗
DOE OSTI2024

System and method for neutron and gamma radiation detection using non-homogeneous material scintillator

The present disclosure relates to a method for detecting incoming radiation having a plurality of differing properties including at least one of differing types, differing energies or differing incoming directions. The method involves using a scintillator structure formed from first and second dissimilar scintillator materials, where the first and second dissimilar scintillator materials emit first and second different colors of light in response to the incoming radiation. A first light detector is used for detecting light having the first color, and a second light detector is used for detecting light having the second color. A first output signal is generated in response to the detection of light having the first color, and a second output signal is generated in response to detecting light having the second color. The first and second output signals are then analyzed to determine at least one property of the incoming radiation.

Brodsky, Jason Philip↗
DOE OSTI2021

Studies on the scintillation light detection in the ProtoDUNE Dual Phase liquid-argon TPC and its capability for the supernova trigger in DUNE

The Deep Underground Neutrino Experiment (DUNE) is a long-baseline neutrino oscillation experiment that aims at addressing key questions in neutrino physics in the next decades. Its scientific program includes the detection of the neutrino flux from a core-collapse supernova. The DUNE far detector will have four 17-kt mass liquid-argon (LAr) time-projection chamber (TPC) modules. ProtoDUNE Dual Phase (DP), a dual-phase LAr TPC with 300 t of active mass and 6 m of drift distance, was operated with cosmic muons in 2019-2020 as part of an R&D program at the CERN Neutrino Platform to demonstrate the feasibility of the technology at such a large scale. In a LAr TPC, the photon detection system (PDS) provides fundamental timing information and trigger capabilities. The PDS of ProtoDUNE-DP, which consisted of 36 photomultiplier tubes (PMTs), counted on a dedicated light calibration system (LCS) to monitor the PMT response. In this dissertation, the characterization and validation of the ProtoDUNE-DP PDS and LCS components before their installation will be reviewed, highlighting the results of general interest for experiments that use liquid noble gasses as target medium. The results from the stable performance of both systems in the detector during 15 months will be presented next as well as the studies on the scintillation light detection in ProtoDUNE-DP, where the collection of light produced in LAr at 7 m from the photosensors has been achieved for the first time. It is worth pointing out that the excellent LAr purity and the large size of the detector have enabled to develop a unique data-driven investigation on aspects that are critical for LAr-based experiments but that are not completely understood. The analyses cover the characterization of the low-energy background detected by the PDS, the quantification of the electric field impact on the light yield, the evaluation of the Rayleigh scattering affecting the light propagation, and the analysis of the PMT detection efficiency. The effect of the VUV reflectivity of the detector materials will be also discussed. In addition, the estimation of the cosmic muon flux crossing the TPC and the study of the observed light yield by the PDS will be reported. Finally, the results from the simulation-based study of the supernova burst trigger capability with the PDS of a 12.1-kt active mass dual-phase LAr TPC as the one proposed for DUNE will be summarized. Several configurations of reflective foils installed in the TPC to enhance the light collection will be compared.

Gallego Ros, Ana↗
DOE OSTI2025

Towards Content Authenticity: Multimodal Fake News Detection and AI-Generated Text Identification

In today’s digital world, the spread of fake news and the rise of AI-generated text have become major threats to content authenticity and public trust. This thesis addresses both challenges through two complementary research directions: detecting fake news using multimodal features, and identifying AI-generated text using semantic and structural reasoning. The first part of the work focuses on fake news detection by introducing a novel model that combines text and image features through a unique rotational attention mechanism. Unlike traditional attention methods, this approach rotates the roles of query, key, and value across modalities to capture deeper interactions. Additionally, the model incorporates external domain information by linking news posts to top-ranked websites from Google search results, which helps assess the credibility of content based on its broader web context. This results in a more reliable and accurate fake news detection system that outperforms existing state-of-the-art methods. The second part presents SGG-ATD, a new framework for detecting AI-generated text. It uses masked language modeling to measure sentence coherence, followed by constructing a graph where keywords—both original and predicted—are connected based on semantic and contextual similarity. A Graph Convolutional Network (GCN) is then used to learn structural relationships within the text for final classification. Experimental results demonstrate that SGG-ATD achieves high F1-scores and consistently outperforms strong baselines. This method contributes to robust AI text detection, supporting accountability and resilience against AI-driven misinformation.

Gupta, Nidhi↗
DOE OSTI2025

A Dynamic Hierarchical Attention Framework for Multimodal Malware Detection

The increasing use of Android in the worldwide mobile ecosystem has come along with a significant increase in advanced malware, highlighting the critical necessity for efficient, scalable, and adaptable detection systems. Despite recent advancements in machine learning improving malware detection, the majority of current solutions are limited to one, two, or three data modalities, hence neglecting the comprehensive behavioral spectrum of contemporary multi-vector threats. This thesis presents the first comprehensive multimodal framework for Android malware detection, which combines textual, time-series (temporal), graph-based (structural), and visual information using an innovative hierarchical attention mechanism and Dynamic Fusion Controller (DFC). Our methodology consistently classifies and processes modalities as either sequential or structural, facilitating content-adaptive weighting and resilient cross-modal representation learning. We advance the implementation of cutting-edge time series techniques, such as MiniRocket, for malware detection, hence creating new opportunities for temporal analysis in cybersecurity. Comprehensive experimental assessment shows that our framework performs exceptionally well, with 99.46% classification accuracy and 97.15% detection accuracy, significantly outperforming existing approaches through effective multimodal integration and hierarchical attention mechanisms.

Nazmin, Tamanna↗