Research Appraisals
Evidence-based critical appraisals of the latest medical research, systematically evaluated using Oxford CEBM methodology.
Showing 3 appraisals
PloS one
A hybrid machine learning and explainable AI framework for optimizing risk-based authentication
As online platforms continue to grow, the need for strong authentication mechanisms becomes increasingly important to protect sensitive information and networks. Risk-Based Authentication (RBA) is an adaptive approach that dynamically adjusts authentication decisions based on user behavior and contextual information, thereby improving both security and user experience. This study proposes a hybrid RBA framework that integrates machine learning ensemble techniques, fuzzy logic, clustering, and optimization to enhance account takeover detection and dynamic risk assessment. The ensemble classifier, combining Gradient Boosting, SVM, and XGBoost, predicts the probability of account compromise based on login behavior, device attributes, and network information. K-Means clustering is used to generate initial risk thresholds (low, medium, and high), which are further refined using a fuzzy logic system to map probabilities to risk levels. The L-BFGS-B optimization algorithm is employed to fine-tune fuzzy membership boundaries and improve threshold consistency. Experimental results demonstrate strong performance, achieving 97.77% accuracy, 99.41% precision, 98.04% recall, 98.72% F1-score, and an EER of 0.0303. On large-scale datasets ranging from 2M to 30M records, the proposed framework demonstrates consistent improvement in authentication decisions. For the 2M dataset, Allow Login actions increase from 349,432-349,923, while Deny Login actions decrease from 1,462-1,228, along with a slight reduction in additional authentication prompts. Furthermore, the use of Explainable AI techniques, particularly SHAP, enhances the transparency and interpretability of the model, supporting more informed decision-making. Overall, the proposed framework is accurate, adaptive, and suitable for real-world risk-based authentication applications.
27 May 2026
Read appraisal →PloS one
Design and evaluation of a resilient IBN architecture: Integrating post-quantum cryptography with adaptive threat detection using machine learning
As the domain of network security keeps on evolving rapidly, especially in sensitive areas such as healthcare systems, the demand for reliable device verification, controlling access, and spotting threats is growing sharply. This paper presents the design, implementation, and systematic evaluation of an improved Intent-Based Networking (IBN) system that integrates post-quantum cryptography, certificate-based identity management, and machine learning-based anomaly detection within a unified framework. The system incorporates SPHINCS+ post-quantum digital signatures for quantum-resilient authentication, X.509 certificate lifecycle management for establishing device trust, and hardware-aware cryptographic operations to maintain efficiency. It further enforces fine-grained access policies using Role-Based Access Control (RBAC) augmented with Multi-Factor Authentication (MFA), ensuring strong access governance across network segments. For early threat detection, machine learning models such as Isolation Forest and MiniBatch KMeans are employed to learn communication patterns and detect anomalous device behavior. Additionally, event logs are maintained using asynchronous, hash-chained logging mechanisms inspired by blockchain principles, ensuring auditability and data integrity. To address evaluation transparency and rigor, the framework is assessed using a controlled prototype testbed with explicitly defined traffic features and reproducible experimental settings. The evaluation considers cryptographic correctness, access control performance, anomaly detection capability, and scalability under increasing workloads. Experimental results demonstrate 100% success in post-quantum signature generation and verification, effective anomaly detection with no observed false negatives in the evaluated scenarios, and stable log-processing throughput as the number of events grows. Importantly, this work does not claim novelty in individual components, but contributes through the system-level integration and empirical evaluation of a quantum-safe, ML-assisted IBN security architecture. The findings highlight key trade-offs between security enforcement and usability, while also identifying limitations such as certificate expiry handling gaps, conservative policy behavior, and lack of large-scale statistical validation. These observations establish a reproducible baseline and motivate future work toward statistically rigorous validation, real-world deployment, and adaptive policy optimization.
17 May 2026
Read appraisal →PloS one
Privacy-preserving multimodal federated learning pipeline for cyber-resilient healthcare systems
The integration of Internet of Things (IoT) devices and electronic medical records (EMRs) has transformed healthcare delivery but has also created new vulnerabilities to cyberattacks that threaten both data confidentiality and patient safety. Conventional centralized machine learning approaches for intrusion detection are impractical in this domain due to strict privacy regulations, heterogeneous data sources, and the risk of single points of failure. To address these challenges, we propose a secure distributed machine learning pipeline for cyber-resilient healthcare systems. The framework combines federated optimization with split learning for sensitive EMR data, robust aggregation to mitigate poisoned updates, and differential privacy with secure aggregation to protect against inference attacks. Multimodal fusion is enabled through temporal consistency regularization for IoT traffic and cross-layer contrastive alignment to link EMR representations, ensuring improved anomaly detection across diverse healthcare environments. Experiments conducted on representative IoT and EMR datasets demonstrate that the proposed pipeline achieves accuracy of 0.942 on IoT data, 0.931 on EMR data, and 0.953 in the combined setting, with corresponding F1-scores of 0.921, 0.908, and 0.932. Ranking metrics further confirm superiority with AUROC up to 0.961 and AUPRC up to 0.947, outperforming deep baselines by margins of +0.025 to +0.033. Robustness analysis shows graceful degradation under client poisoning ([Formula: see text] at 30% malicious clients) and resilience under severe communication constraints (accuracy [Formula: see text] at 90% update sparsification). Detection latency is reduced to an average of 5.9 time steps, compared to 7.8 for the strongest deep baseline. These results highlight that secure distributed pipelines can deliver both strong detection capabilities and regulatory compliance, providing a practical path toward safeguarding next-generation healthcare infrastructures against evolving cyber threats.
12 Apr 2026
Read appraisal →