Research Appraisals
Evidence-based critical appraisals of the latest medical research, systematically evaluated using Oxford CEBM methodology.
Showing 9 appraisals
Journal of medical Internet research
Blockchain-Enabled Self-Sovereign Identity Applications in Health Care: Scoping Review
BACKGROUND: Self-sovereign identity (SSI) provides a decentralized approach to digital identity management, enabling individuals to control their personal data without reliance on centralized authorities. Blockchain technology offers a tamper-resistant and distributed infrastructure that can support secure and verifiable identity systems. In health care, where identity fragmentation, privacy risks, and interoperability challenges persist, blockchain-enabled SSI (BC-SSI) has been proposed as a potential solution. However, existing research remains heterogeneous, with varying levels of technical maturity and limited evidence of real-world deployment. OBJECTIVE: This study conducts a scoping review to systematically map BC-SSI applications in health care and to analyze their application domains, development stages, study aims, targeted challenges, and technological infrastructures. In addition, this study aims to identify structural gaps in current research and assess the readiness of BC-SSI systems for clinical deployment. METHODS: This review followed the PRISMA-ScR (Preferred Reporting Items for Systematic Reviews and Meta-Analyses Extension for Scoping Reviews) methodology. A comprehensive literature search conducted between September 2024 and August 2025 identified 37 peer-reviewed studies that met predefined inclusion criteria. Data were extracted and synthesized using descriptive and thematic analyses across application areas, system maturity, technological components, and reported challenges. RESULTS: The findings indicate that BC-SSI research in health care remains at an early stage of maturity, with most studies proposing conceptual models or prototype implementations and limited real-world validation. Applications predominantly focus on identity verification, credential management, and privacy-preserving data exchange across domains such as electronic health records, mobile health, and access control systems. Commonly used technologies include decentralized identifiers, verifiable credentials, smart contracts, and privacy-enhancing mechanisms such as zero-knowledge proofs and selective disclosure. Despite rapid technical development, persistent challenges include interoperability limitations, governance gaps, usability concerns, and insufficient integration with health care infrastructures. Notably, a structural gap was identified between technological capability and system-level readiness for clinical deployment. CONCLUSIONS: BC-SSI technologies demonstrate potential for enabling secure, interoperable, and patient-centric identity management in health care. However, current research is predominantly technology-driven and lacks sufficient system-level validation. This study highlights the need for integrated architectural approaches, governance frameworks, and real-world evaluation to bridge the gap between conceptual innovation and clinical implementation. Advancing BC-SSI toward health care adoption will require coordinated progress across technical, organizational, and regulatory dimensions.
28 May 2026
Read appraisal →PloS one
A hybrid machine learning and explainable AI framework for optimizing risk-based authentication
As online platforms continue to grow, the need for strong authentication mechanisms becomes increasingly important to protect sensitive information and networks. Risk-Based Authentication (RBA) is an adaptive approach that dynamically adjusts authentication decisions based on user behavior and contextual information, thereby improving both security and user experience. This study proposes a hybrid RBA framework that integrates machine learning ensemble techniques, fuzzy logic, clustering, and optimization to enhance account takeover detection and dynamic risk assessment. The ensemble classifier, combining Gradient Boosting, SVM, and XGBoost, predicts the probability of account compromise based on login behavior, device attributes, and network information. K-Means clustering is used to generate initial risk thresholds (low, medium, and high), which are further refined using a fuzzy logic system to map probabilities to risk levels. The L-BFGS-B optimization algorithm is employed to fine-tune fuzzy membership boundaries and improve threshold consistency. Experimental results demonstrate strong performance, achieving 97.77% accuracy, 99.41% precision, 98.04% recall, 98.72% F1-score, and an EER of 0.0303. On large-scale datasets ranging from 2M to 30M records, the proposed framework demonstrates consistent improvement in authentication decisions. For the 2M dataset, Allow Login actions increase from 349,432-349,923, while Deny Login actions decrease from 1,462-1,228, along with a slight reduction in additional authentication prompts. Furthermore, the use of Explainable AI techniques, particularly SHAP, enhances the transparency and interpretability of the model, supporting more informed decision-making. Overall, the proposed framework is accurate, adaptive, and suitable for real-world risk-based authentication applications.
27 May 2026
Read appraisal →PloS one
Design and evaluation of a resilient IBN architecture: Integrating post-quantum cryptography with adaptive threat detection using machine learning
As the domain of network security keeps on evolving rapidly, especially in sensitive areas such as healthcare systems, the demand for reliable device verification, controlling access, and spotting threats is growing sharply. This paper presents the design, implementation, and systematic evaluation of an improved Intent-Based Networking (IBN) system that integrates post-quantum cryptography, certificate-based identity management, and machine learning-based anomaly detection within a unified framework. The system incorporates SPHINCS+ post-quantum digital signatures for quantum-resilient authentication, X.509 certificate lifecycle management for establishing device trust, and hardware-aware cryptographic operations to maintain efficiency. It further enforces fine-grained access policies using Role-Based Access Control (RBAC) augmented with Multi-Factor Authentication (MFA), ensuring strong access governance across network segments. For early threat detection, machine learning models such as Isolation Forest and MiniBatch KMeans are employed to learn communication patterns and detect anomalous device behavior. Additionally, event logs are maintained using asynchronous, hash-chained logging mechanisms inspired by blockchain principles, ensuring auditability and data integrity. To address evaluation transparency and rigor, the framework is assessed using a controlled prototype testbed with explicitly defined traffic features and reproducible experimental settings. The evaluation considers cryptographic correctness, access control performance, anomaly detection capability, and scalability under increasing workloads. Experimental results demonstrate 100% success in post-quantum signature generation and verification, effective anomaly detection with no observed false negatives in the evaluated scenarios, and stable log-processing throughput as the number of events grows. Importantly, this work does not claim novelty in individual components, but contributes through the system-level integration and empirical evaluation of a quantum-safe, ML-assisted IBN security architecture. The findings highlight key trade-offs between security enforcement and usability, while also identifying limitations such as certificate expiry handling gaps, conservative policy behavior, and lack of large-scale statistical validation. These observations establish a reproducible baseline and motivate future work toward statistically rigorous validation, real-world deployment, and adaptive policy optimization.
17 May 2026
Read appraisal →PloS one
Distributed denial of service detection and mitigation in software-defined networking-enabled software-defined wide area networks
Software-defined wide area networks (SD-WAN), empowered by software-defined networking (SDN) technology, offer unparalleled flexibility and efficiency in wireless communication. However, their integration introduces new security challenges, particularly in mitigating distributed denial of service (DDoS) attacks. In this paper, we propose an advanced security framework tailored to SDN-enabled SD-WAN. A dataset collected during experiments was used for training and testing the model's performance. Our framework leverages machine learning algorithms to detect and classify DDoS attacks targeting SD-WAN controllers, considering the environment's unique characteristics. We develop adaptive machine learning model capable of accurately discerning high-rate and low-rate DDoS attacks, enhancing the network's resilience against sophisticated threats. Results from controlled experiments show promise for real-world deployment, though further validation is needed. Our results highlight the framework's ability to adapt to dynamic network conditions and provide robust security for SDN-enabled SD-WAN. Our adaptive model integrates RF and DT explicitly for SD-WAN contexts, achieving 99.97% accuracy for high-rate attacks and 99.96% for low-rate attacks. Our QT-PCA preprocessing pipeline reduces dimensionality while preserving performance, and PACKET_IN event-triggered mitigation enables dynamic response. This method significantly enhances security solutions' accuracy, ensuring robust DDoS attack detection in SD-WAN environments. Additionally, by leveraging the SD-WAN architecture's efficiency, our approach optimizes network performance, underscoring its efficacy and practicality in enhancing security and efficiency.
14 May 2026
Read appraisal →PloS one
An explainable multi-head attention network for healthcare IoT threat detection based on the MedDefender-MHAN framework
The rapid proliferation of Internet of Medical Things (IoMT) devices in healthcare environments has created critical cybersecurity vulnerabilities that demand both accurate and interpretable intrusion detection solutions. Existing deep learning-based intrusion detection systems (IDS) achieve high detection accuracy but lack inherent explainability, limiting their clinical adoption under regulatory frameworks such as GDPR and FDA guidelines. This paper presents MedDefender-MHAN, an explainable multi-head attention network specifically designed for healthcare IoT threat detection. The proposed framework introduces a novel dual-stream architecture that combines convolutional neural networks for local spatial feature extraction with transformer-based encoders for long-range temporal dependency modeling. Unlike existing approaches that apply explainability as a post-hoc process, MedDefender-MHAN embeds interpretability directly into the multi-head attention mechanism, enabling real-time gradient-weighted explanation generation without external XAI pipelines. Evaluated on CICIDS2017 and TON_IoT benchmark datasets, MedDefender-MHAN achieves detection accuracies of 99.47% and 98.92% respectively, with sub-3ms inference latency and a throughput of 435 samples per second. Explainability evaluation demonstrates 94.6% alignment with expert-annotated attack signatures and 91.9% temporal accuracy, outperforming post-hoc methods such as SHAP and Integrated Gradients. These results confirm that MedDefender-MHAN provides a clinically viable, regulatory-compliant security solution for real-world healthcare IoT infrastructure. The proposed framework addresses the dual imperatives of methodological transparency and clinical impact, directly responding to the growing need for trustworthy AI-driven security solutions in regulated healthcare IoMT environments.
20 Apr 2026
Read appraisal →PloS one
A deep reinforcement based echo state network for network intrusion classification
Network intrusion classification referred to the process of monitoring and analyzing network traffic to identify suspicious activities or attacks. In this work, author proposed a novel approach to classify network intrusion by utilizing deep reinforcement learning (DRL), integrating a reservoir computing approach Echo State Network (ESN). A DRL-based approach improved upon traditional deep learning by adapting dynamically to novel/unknown and evolving attack patterns. Unlike static models, DRL continuously learned optimal strategies through interaction with the environment, allowing for better detection of previously unseen threats in real-time. To address the class imbalance often encountered in network intrusion datasets, we evaluated the performance of several advanced data balancing techniques, including Borderline-SMOTE, SMOTE-ENN, ADYSN, and K-means SMOTE. The findings demonstrated that the K-means-based data balancing method outperformed other techniques, resulting in the most robust performance across various metrics. Author conducted multi-dataset validation on benchmark datasets like NF-BoT-IoT, NF-UNSW-NB15, NF-ToN-IoT, NF-ToN-IoT-v2, NF-CSE-CIC-IDS2018 and NF-UNSW-NB15-v3 to ensure robustness across different network flow data. For adaptive modeling testing, author excluded some attack types from training data and included them in testing data (e.g., DoS, Backdoor attacks were excluded from the training data but included in the testing data (see Table 3)). The proposed approach enhanced the accuracy and reliability of intrusion detection, making it a viable solution for securing modern network infrastructures. The source code of this work is available in this Github repository (https://github.com/codewithkhurshed/DRLZDNIDS).
18 Apr 2026
Read appraisal →PloS one
Privacy-preserving multimodal federated learning pipeline for cyber-resilient healthcare systems
The integration of Internet of Things (IoT) devices and electronic medical records (EMRs) has transformed healthcare delivery but has also created new vulnerabilities to cyberattacks that threaten both data confidentiality and patient safety. Conventional centralized machine learning approaches for intrusion detection are impractical in this domain due to strict privacy regulations, heterogeneous data sources, and the risk of single points of failure. To address these challenges, we propose a secure distributed machine learning pipeline for cyber-resilient healthcare systems. The framework combines federated optimization with split learning for sensitive EMR data, robust aggregation to mitigate poisoned updates, and differential privacy with secure aggregation to protect against inference attacks. Multimodal fusion is enabled through temporal consistency regularization for IoT traffic and cross-layer contrastive alignment to link EMR representations, ensuring improved anomaly detection across diverse healthcare environments. Experiments conducted on representative IoT and EMR datasets demonstrate that the proposed pipeline achieves accuracy of 0.942 on IoT data, 0.931 on EMR data, and 0.953 in the combined setting, with corresponding F1-scores of 0.921, 0.908, and 0.932. Ranking metrics further confirm superiority with AUROC up to 0.961 and AUPRC up to 0.947, outperforming deep baselines by margins of +0.025 to +0.033. Robustness analysis shows graceful degradation under client poisoning ([Formula: see text] at 30% malicious clients) and resilience under severe communication constraints (accuracy [Formula: see text] at 90% update sparsification). Detection latency is reduced to an average of 5.9 time steps, compared to 7.8 for the strongest deep baseline. These results highlight that secure distributed pipelines can deliver both strong detection capabilities and regulatory compliance, providing a practical path toward safeguarding next-generation healthcare infrastructures against evolving cyber threats.
12 Apr 2026
Read appraisal →PloS one
Enhancing intrusion detection in encrypted DoH traffic through a robust ensemble learning framework
The DNS over HTTPS (DoH) protocol enhances user privacy by encrypting DNS queries and responses within HTTPS. However, this encryption enables attackers to tunnel malicious traffic through covert DoH channels and make detection difficult for network security and enterprises. In this study, we propose a stacked ensemble approach that employs four sequential base learners' - two Long Short-Term Memory (LSTM) and two Gated Recurrent Unit (GRU) neural networks as base classifier networks with varied hyperparameters and XGBoost (eXtreme Gradient Boosting) as the meta-learner. An XGBoost model trained on out-of-fold predictions generated by base learners supported through stratified 5-fold cross validation. We also applied Recursive Feature Elimination (RFE) with XGBoost for cross-validated feature selection and decreased high-dimensional feature spaces from 29 to 13 and 20 features on the CIRA-CIC-DoHBrw-2020 and DoH-Tunnel-Traffic-HKD datasets respectively. The proposed framework was evaluated on the CIRA-CIC-DoHBrw-2020 and DoH-Tunnel-Traffic-HKD datasets achieved 0.9996 recall, 0.9999 F1-score and 1.0000 AUC-PR on CIC-DoH dataset and 0.9998 recall, 0.9999 F1-score, and 1.0000 for both AUC-ROC and AUC-PR on HKD-DoH dataset. The proposed model outperforms all individual base classifiers, evaluated ML models, and existing state-of-the-art approaches. The proposed XGBoost meta-model needs only 1.26 seconds for training and 0.129 seconds for inference on HKD-DoH dataset, thus making the proposed framework both highly accurate and computationally efficient for real-world intrusion detection in encrypted DoH traffic.The preprocessed data and the source code supporting the findings of this study are available at: https://github.com/soreettihussein/Stacked-ensemble-meta-learning-IDS-for-DoH-network-traffic/tree/main.
10 Apr 2026
Read appraisal →PloS one
Attention and residual mechanism-based CNN architecture (ARC-Net) with enhanced fairness generalization for deepfake facial image detection.
Deepfake (DF) content poses a major challenge to digital media authentication, that can mimic facial movements, creating realistic replicas that risk spreading misinformation and enabling harassment, as can be seen in Bangladesh. Previous studies applied residual convolutional blocks or attention mechanisms for DF detection; however, these approaches often treat these components in isolation and lack explicit consideration of fairness, out-of-distribution generalization, statistical analysis or artifact-focused detection. Our study introduces an approach, called ARC-Net, which uses a combination of attention and residual convolutional layers along with the EfficientNet B0 base, the attention mechanism of which allows the model to pay more attention to details that could resemble the ones seen in non-perfectly executed DF, which enhances the model's potential to distinguish them, addressing limitations in pre-trained and also advanced DL models. A dataset of 500 real images from Bangladesh combined with a 140k real and fake faces dataset was used to train and test our model alongside four pre-trained DL models. ARC-Net performed much better than the other traditional and state of art methods with 99% accuracy, 1.0 precision, 0.97 recall and 0.98 F1 score, reaching the highest level of reliability in spotting DF images. To assess the external reliability and generalizability of ARC-Net, the model was evaluated on the Deepfake Dataset and the Deepfake Database datasets, achieving consistently high and balanced performance across different scales. Three out-of-distribution (OOD) experiments were conducted, where the first one evaluated South Asian images, showing that incorporating fewer than one percent real Bangladeshi images reduced the false positive rate by more than half and improved probability calibration, while the remaining two cross-dataset experiments demonstrated strong transferability. An ablation study further showed the impact of different components within a model by systematically removing or modifying them and statistical significance between competing classifiers was assessed using McNemar's Statistical test. In addition, we've applied Explainable AI (XAI) techniques, Grad-CAM and LIME to offer transparency of the results, as giving attention to the facial region is also important for DF detection. This study will help advance DF detection by integrating ARC-Net's attention-residual mechanisms and XAI, offering insights for developing models in security and media forensics.
7 Apr 2026
Read appraisal →