Аңдатпа
The rapid expansion of Internet of Things networks in smart city environments creates fragmented attack surfaces that conventional security architectures cannot adequately monitor. Current Intrusion Detection and Prevention Systems operate in isolation, producing inconsistent alert formats that reach Security Operation Centers with substantial delays and poor normalization, which severely hampers correlation effectiveness and generates excessive false positives. This study develops and validates a vendor-neutral mechanism enabling standardized real-time communication between distributed IDPS sensors and centralized SOC platforms. Our methodology combines analytical review of standards including STIX, TAXII, and ISO/IEC 27001 with prototype implementation using Suricata and Zeek sensors,Abstract. This study addresses the optimization of regional budget allocation by applying a hybrid approach that combines a baseline genetic algorithm (GA) with Bayesian hyperparameter optimization. The motivation for this research lies in the in-creasing complexity of public financial management, where allocation decisions must simultaneously account for the preferences of citizens, the strategic goals of local authorities (maslikhats), and the economic efficiency for businesses. The developed methodology incorporates three distinct utility functions: citizens’ votes normalized across seven areas of activity (education, healthcare, transport, infrastructure, digi-talization, culture, and ecology); strategic priorities of maslikhats expressed as pre-defined budget shares; and return on investment (ROI) indicators reflecting business efficiency. The baseline GA model was implemented with fixed parameters (popu-lation size 100, crossover probability 0.5, mutation probability 0.2, 50 generations). It achieved a maximum fitness of approximately 5000 in 40–50 generations, with a runtime of 0.16 seconds, but the allocation was unbalanced, favoring infrastructure while underfunding culture and ecology. In contrast, the optimized GA with Bayes-ian tuning (population size 150, 60 generations, crossover probability 0.6, mutation probability 0.3) demonstrated superior results. It reached a maximum fitness of 5200–7779 (depending on scaling), converged faster (30–40 generations), and produced a more balanced allocation, particularly increasing funding for healthcare (80 million Apache Kafka message bus, and Elastic SIEM integration. A custom normalization microservice converts heterogeneous alerts into STIX-compliant JSON format while maintaining GDPR and ISO 27001 compliance through TLS 1.3 encryption. Experimental validation with BoT-IoT and TON_IoT datasets shows the architecture reduces alert correlation latency by approximately 28 percent and decreases false positive rates by roughly 30 percent compared to baseline approaches. The bidirectional feedback mechanism allows SOC analysts to propagate updated detection rules to edge sensors, enabling adaptive threat response. Results demonstrate that message-bus-mediated architectures effectively address interoperability challenges in heterogeneous IoT security infrastructures, offering a practical implementation pathway for national smart city cybersecurity frameworks.