Soumik, MD Shadman and Rony, MD Mahababul Alam and Afrin, Mehenaz and Sarkar, Mrinmoy and Hossain, Md Rajib and Joy, Pranto Saha and Babu, Rasel Hossain (2026) A Dung Beetle Optimizer-Enhanced Kolmogorov Arnold Network with Scalable Data Engineering and Explainable Analytics for Zero Day Cyberattack Detection in Healthcare Networks. Power System Technology, 50 (4). pp. 688-704. ISSN 1000-3673

Text A+Dung+Beetle+Optimizer-Enhanced.pdf Download (673kB)

Abstract

Healthcare networks connect infusion pumps, imaging archives, electronic health record (EHR) servers, and wearable gateways, so a single successful intrusion can interrupt patient care as well as expose protected data. Signature-based defenses cannot recognize zero-day attacks, which exploit vulnerabilities for which no signature yet exists. This article proposes DBO-KAN, a detection framework that couples a Kolmogorov–Arnold Network (KAN) with the Dung Beetle Optimizer (DBO) for hyperparameter search, a scalable data-engineering pipeline for flow-level features, and Shapley-based explanations for security analysts. The pipeline partitions network flows, selects 24 of 78 candidate features by mutual information, and rebalances rare classes through synthetic minority oversampling. The KAN replaces fixed activation functions with learnable univariate spline functions on its edges, and DBO tunes grid size, spline order, learning rate, regularization strength, and hidden width against a composite fitness that rewards validation F1 and penalizes model size. Under a leave-attack-family-out protocol that withholds four attack families from training, the framework reached an accuracy of 0.974, an F1 score of 0.936, and a false positive rate of 0.014 on a zero-day test set. These results exceed those of random forest, support vector machine, multilayer perceptron, long short-term memory, and untuned KAN baselines. Ablation shows that removing the spline layer causes the largest loss, and Shapley analysis identifies byte rate and packet-length variance as the dominant drivers of alerts. Parallel processing on eight workers produced a 6.49-fold speedup. The findings indicate that an optimized, interpretable KAN is a practical candidate for zero-day detection in clinical environments.

Item Type:	Article
Uncontrolled Keywords:	zero day attack, Kolmogorov Arnold Network, dung beetle optimizer, healthcare cybersecurity, explainable artificial intelligence, intrusion detection
Subjects:	A General Works > AI Indexes (General)
Depositing User:	admin eprints
Date Deposited:	27 Oct 2026 09:29
Last Modified:	27 Oct 2026 09:29
URI:	http://eprints.umsida.ac.id/id/eprint/17283

Actions (login required)

View Item