Browsing by Author "Wijesooriya, A"

Now showing 1 - 7 of 7

Embargo
AgriSense LK: Weekly Automated Machine Learning for Sri Lankan Produce Prices with Business Continuity Plan, Market Opportunity Ranking, Cultivation Targeting, and Yield Quality Valuation
(Institute of Electrical and Electronics Engineers Inc., 2026-05-22) Matharaarachchi, Charaka J.; Samarasinghe, Ravindu T; Vidyasarani G.G.T.; Fasnas, M; Siriwardana, D; Wijesooriya, A
In Sri Lanka, agricultural decision-making remains largely traditional: decisions are often based on historical practices, informal consultation, and heuristic judgment. The primary barrier is that market price data is difficult to interpret without analytical expertise, resulting in unpredictable price volatility and suboptimal farmer income. AgriSense LK is a machine learning platform that converts historical price records into actionable recommendations for farmers and traders. The system comprises four components: business strategy classification, market opportunity ranking, cultivation targeting, and smartphone-based produce quality grading. The platform was trained on 123,985 real price records sourced from the Central Bank of Sri Lanka (CBSL), spanning 2017 to 2025. Key results include a MAPE of 0.7% and MAE of Rs. 1.86 on weekly price forecasting (a 98.1% improvement over the naive baseline), a ROC-AUC of 0.9056 on cultivation targeting, and 91.49% crop classification accuracy with 89.84% quality grade accuracy in the computer vision component. Direct price regression over a seven-day horizon proved unreliable; a binary profitability classifier was adopted instead and substantially outperformed the regression approach. While results are promising, further validation under real-world deployment conditions is required.
Embargo
An Approach to detect Advanced Persistent Threats using Machine Learning Techniques
(Institute of Electrical and Electronics Engineers Inc., 2025-12-09) Bary A.A; Wijerupa W.D.O.D; Padukka P.V.G.G; Atapattu A.L.V.J.; Pandithage, D; Wijesooriya, A
Advanced Persistent Threats (APTs) pose significant risks to organizations due to their stealthy, prolonged nature and ability to evade traditional detection mechanisms. Traditional solutions often analyze separate data elements, such as network traffic or endpoint activity, limiting their effectiveness against sophisticated APT campaigns. This research proposes a holistic machine learning (ML)-driven approach to detect APTs by integrating three critical data dimensions: user behavior anomalies, endpoint activity monitoring, and network traffic analysis. The system further incorporates Tactics, Techniques, and Procedures (TTP) analysis using the MITRE ATT&CK framework to provide actionable intelligence. A real-time dashboard visualizes the threat detection results, TTP mappings, and mitigation strategies, enabling cybersecurity teams to respond proactively. The integration of multiple ML models enhances detection accuracy while bridging the gap between threat identification and contextual understanding. Experimental validation demonstrates the system's capability to detect APT indicators across diverse attack vectors and prioritize high-risk TTPs. This work contributes to advancing APT detection methodologies by offering a scalable, multi-dimensional solution tailored for modern cybersecurity operations.
Embargo
Intelligent Detection of Corporate Targeted Phishing Emails - A Hybrid Approach Combining Deep Learning Models with Domain Anomaly Detection
(Institute of Electrical and Electronics Engineers Inc., 2025) Seethawaka, R; Chathurya N.E.G; Chandrasiri D.K.W.G.G.T; Kavithma K.A.S; Fernando, H; Wijesooriya, A
This paper introduces a system designed to detect corporate-targeted phishing emails by combining two key strategies: advanced email content analysis and domain similarity analysis. The system first examines the text of emails using a hybrid deep learning model that merges modern language understanding techniques with sequential pattern recognition, achieving high accuracy in identifying phishing intent. Two models were tested - a standalone Bi-LSTM sequential model and a hybrid version(BERT - Bi-LSTM) with the hybrid model proving superior, scoring an F1 score of 0.97 compared to 0.93 for the standalone model. Second, the system verifies sender domains to detect spoofing attempts, such as subtle typos, homograph attacks or TLD/subdomain spoofing. This domain check reduces reliance on text analysis alone, helping analysts prioritize threats more effectively. Tested against a mix of legitimate and malicious domains, the domain module achieved near-perfect accuracy, minimizing false alarms. By integrating these approaches, the system addresses a critical gap in existing methods, which often focus on only one aspect of phishing (e.g., email content or URL features). This dual strategy ensures a more comprehensive defense, particularly against sophisticated attacks that use convincing language paired with fake domains. The combined model not only improves detection accuracy but also supports security teams by providing clear, actionable insights, making it practical for real-world corporate environments.
Embargo
ML-Based System to Detect GPS Spoofing and Signal Jamming via Signal Logs
(Institute of Electrical and Electronics Engineers Inc., 2026-08-04) Harshani S.U.E; Wickramasinghe V.D.A; Muthukuda M.A.D.H.N; Siriwardhane H.H.D.V.; Siriwardana, D; Wijesooriya, A
This paper describes the design, implementation, and analysis of a machine learning-based and forensic-grade desktop system to detect GPS spoofing attacks and signal jamming attacks. The system processes telemetry logs collected from Unmanned Aerial Vehicles (UAVs) and other GNSS-enabled systems to detect any malicious signal manipulations and disruptions. It utilizes a pipeline comprising modules: GPS logging, feature extraction, and an unsupervised machine learning detection engine based on Isolation Forest, One-Class SVM, and LSTM Autoencoder models. The system learns the normal behavioral patterns and is trained on actual GPS data, therefore, identifying the previously unknown attacks. One of the contributions is that forensic concepts, such as hash-SHA-256, chain-of-custody logging, and read-only processing, are factored into the human process, thus supporting evidence integrity and traceability. The system generates elaborate visual and textual reports, giving a user-friendly timeline of the attack with severity ratings. Through the experiment with real and synthetic interfered datasets, the system is found to be effective in predictably distinguishing between spoofing (jumping coordinates and unrealistic kinematics) and jamming (significantly lost signal and large drift variance) with substantial detection. This tool offers an essential feature to cybersecurity forensic investigators, drone operators, and other critical infrastructure defenders to diagnose and record GNSS susceptibility.
Embargo
Platform Independent Browser Forensic Tool for Advanced Analysis of Artifacts and Case Management
(IEEE, 2021-12-09) Dissanayake, D; Rajakaruna, S; Ranasinghe, D; Wijesooriya, A; Jayakody, A; Rajapaksha, S. K
A web browser is a major attack vector which cyber-criminals utilize to land in an environment. The evidence related to the malicious browsing activities can be found in the host which gives valuable information related to the case. These digital footprints involve history, cookies, bookmarks, saved credentials and downloads etc. This paper presents a sophisticated tool aiding the conventional manual investigation process from evidence collection to the final v e rdict b y a u tomating h u man dependent functions, resulting a fast and unbiased analysis of browser forensic artifacts. This tool states its unique value over the existing tools by working operating systems independently, collecting all browsing evidence including deleted artifacts and encrypted saved credentials, automatically analysing the reputation of the extracted evidence, integrating evidence collected from different web browsers into a single timeline, and correlating the adjacent distrustful events inside and outside the host. Eventually, this tool calculates a browsing reputation scorecard and creates a profile for the host, condensing the findings g a thered t h roughout the investigation. The paper presents another important methodology to predict the future browsing reputation score based on the past browsing patterns. Furthermore, multiple cases management feature and dashboard provide a concise overview of overall findings to the forensic investigator.
Embargo
Platform Independent Browser Forensic Tool for Advanced Analysis of Artifacts and Case Management
(IEEE, 2021-12-09) Dissanayake, D; Rajakaruna, S; Ranasinghe, D; Wijesooriya, A; Jayakody, A; Rajapaksha, S
A web browser is a major attack vector which cyber-criminals utilize to land in an environment. The evidence related to the malicious browsing activities can be found in the host which gives valuable information related to the case. These digital footprints involve history, cookies, bookmarks, saved credentials and downloads etc. This paper presents a sophisticated tool aiding the conventional manual investigation process from evidence collection to the final v e rdict b y a u tomating h u man dependent functions, resulting a fast and unbiased analysis of browser forensic artifacts. This tool states its unique value over the existing tools by working operating systems independently, collecting all browsing evidence including deleted artifacts and encrypted saved credentials, automatically analysing the reputation of the extracted evidence, integrating evidence collected from different web browsers into a single timeline, and correlating the adjacent distrustful events inside and outside the host. Eventually, this tool calculates a browsing reputation scorecard and creates a profile for the host, condensing the findings g a thered t h roughout the investigation. The paper presents another important methodology to predict the future browsing reputation score based on the past browsing patterns. Furthermore, multiple cases management feature and dashboard provide a concise overview of overall findings to the forensic investigator.
Embargo
Stealth Eye: Behavioral Analysis for Fileless Malware Detection
(Institute of Electrical and Electronics Engineers Inc., 2025) Bandara H.M.H.M; Ayeshani K.M.N; Kumari M.M.P.M; Wijerathna D.M.S.T; Abeywardena, K.Y; Wijesooriya, A
Fileless malware is a significant cybersecurity threat as it is entirely present in system memory and evades traditional signature-based detection methods. This paper introduces STEALTH EYE, an endpoint behavioral analysis framework for detecting fileless malware, such as ransomware, spyware, trojans, and RedLine Stealer, in real time. The framework utilizes an endpoint agent that monitors system activity in real time and captures snapshots of behavior every 60 seconds for real- time threat analysis. These captures track memory injections, DLL loading and execution, file and handle operations, service activity, process and thread behavior, registry modifications, network communications, cryptographic function usage, keystroke logging, and clipboard access. The data that is collected is analyzed through supervised machine learning mechanisms to detect patterns that indicate fileless malware activity. In contrast to traditional post-infection forensic approaches, STEALTH EYE provides real-time monitoring, notification, and active response with enhanced cybersecurity resilience against the widespread fileless attacks.