Disertasi / Tesis Viva ~ (Dr) Wan Nur Hidayah, PhD UTM

Disertasi/ Tesis Viva ~ (Dr) Wan Nur Hidayah, PhD UTM

Setinggi-tinggi jutaan TAHNIAH kepada bangsa pascasiswazah yang berjaya menyempurnakan pengajian Master atau PhD. Bagi mereka yang telah menamatkan pengajian PhD kini berjaya menerima gelaran Doktor Falsafah.

Alhamdulillah, seorang lagi ahli platinum Dr Roket telah berjaya melalui pengalaman ‘the real Vivalicious’ di bilik Viva pada 3 Februari 2026 iaitu (Dr) Wan Nur Hidayah.

Jutaan tahniah diucapkan kepada (Dr) Wan Nur Hidayah atas kejayaan beliau membentangkan tesis di bilik Viva. Syukur, beliau telah Viva dengan jayanya.

Berikut adalah ringkasan latar belakang kajian beliau yang dikongsi untuk rujukan umum. Semoga perkongsian ini memberikan manfaat kepada ummah, khususnya kepada pelajar yang akan atau sedang menempuh perjalanan pengajian mereka.

NAMA:

(Dr) Wan Nur Hidayah binti Ibrahim.

BIDANG:

Sains Komputer.

UNIVERSITI:

Universiti Teknologi Malaysia.

NAMA PENYELIA:

1. Prof. Ts. Dr. Ali Selamat (SV)

2. Dr. Syahid Anuar (Co-SV)

TAJUK KAJIAN:

Enhancing Zero-Day Botnet Detection Using Improved-Noise Wasserstein Generative Adversarial Network (WGAN) And Behavior-Based Features.

SEDIKIT LATAR BELAKANG KAJIAN DAN HASIL KAJIAN:

The proliferation of sophisticated botnets poses significant cybersecurity threats, particularly zero-day variants that evade traditional signature-based detection systems. This research addresses critical limitations in current botnet detection approaches by developing an integrated framework that combines advanced behavioral feature engineering with an improved Wasserstein Generative Adversarial Network (IM-WGAN) architecture specifically designed for noisy network environments.

The methodology encompasses three sequential phases: behavioral feature development, synthetic data generation, and comprehensive evaluation. In Phase 1, a novel feature engineering approach transforms raw network traffic into 31 discriminative behavioral indicators through statistical aggregation over optimized time windows. These features capture temporal patterns, communication diversity, and traffic volume characteristics that remain effective despite traffic encryption and concealment techniques.

Phase 2 introduces the primary innovation: an Improved-Noise WGAN (IM-WGAN) that replaces conventional random Gaussian noise (Random Z) with structured, behavior-informed noise vectors (Dataset Z) derived from real network traffic distributions. This methodological advancement addresses fundamental GAN training instabilities including mode collapse while enhancing synthetic data quality for minority class augmentation.

Experimental validation using CTU-13 and NIMS datasets demonstrates superior performance across multiple metrics. The behavioral features achieve 99.02% accuracy on intra-dataset classification and maintain robust generalization with 94.67% accuracy on HTTP botnets and 78.58% on P2P architectures in cross-dataset scenarios. The IM-WGAN framework significantly outperforms traditional approaches, achieving 93.88% detection accuracy with Dataset Z compared to 88.58% using Random Z, representing a statistically significant improvement (p < 0.05).

Clustering analysis validates the unsupervised discriminative power of extracted features, maintaining over 90% accuracy across different temporal granularities and noise conditions. Feature importance analysis confirms that byte-level statistics (median SrcBytes: 12.6%) and temporal characteristics (duration median: 11.3%) provide the strongest discriminative indicators for automated botnet communications.

The research contributions include: (1) a systematic methodology for extracting noise-resistant behavioral features effective at 1-second resolution, (2) the Dataset Z latent sampling technique that transforms network noise into valuable training signals, (3) architectural innovations in WGAN design optimized for cybersecurity applications, and (4) comprehensive empirical benchmarking establishing performance standards for GAN-based botnet detection.

This work advances zero-day botnet detection capabilities while contributing to broader applications in adversarial machine learning and cybersecurity. The framework’s ability to maintain high accuracy under noise conditions and generalize across diverse botnet architectures establishes its practical relevance for operational network security environments.

CADANGAN KEPADA PENGKAJI SETERUSNYA

Future work includes both technical and domain extensions. From a technical perspective, the framework can be deployed in real-time Network Intrusion Detection Systems, enhanced with continuous learning to adapt to evolving traffic while avoiding catastrophic forgetting, and integrated with explainable AI to improve interpretability and analyst trust.

From a domain perspective, the approach can be extended to IoT botnet detection in resource-constrained environments, enriched with advanced latent modeling techniques such as Variational Autoencoders, and adapted to cross-domain applications including fraud and phishing detection. Overall, these directions aim to improve the practicality, adaptability, and broader applicability of the proposed framework.

Terima kasih kepada (Dr) Wan Nur Hidayah atas jasa dan kesudian berkongsi ilmu di atas sebagai panduan dan rujukan ummah dan bangsa ‘Postgraduate’ di luar sana.