Hardware-assisted Control-flow Integrity (CFI), such as Intel’s Indirect Branch Tracking (IBT), provides an efficient defense against control-flow hijacking attacks. However, the protection it provides is fundamentally coarse-grained, leaving a large attack surface of valid indirect branch targets that an attacker can (ab)use. Recently, FineIBT introduced a novel, load-time feature called NOPout that aims to reduce this attack surface by removing endbr instructions from unused, exported functions. Unfortunately, NOPout suffers from several design limitations—including insecure fail-safe defaults, performance overhead from excessive code patching and copy-on-write (COW) memory effects, and a cursory design for dynamically loaded libraries—as well as an evaluation narrow in scope. To address the shortcomings of NOPout, we present NOPoutNG: a novel mechanism that reverses NOPout’s insecure model with a secure-by-default approach. It begins by inserting inert nop instructions into exported functions, only promoting them to active endbr "landing pads" when there is concrete evidence—discovered at compile, link, or load time—that a function is actually used (i.e., address-taken). We implement NOPoutNG as a collection of minor modifications to the LLVM toolchain, as well as a load-time shared library, and demonstrate its practicality and security via a comprehensive evaluation where it achieves up to 86% endbr reduction vs. vanilla IBT with minimal overhead.
Measured Boot, a mechanism enabled through Trusted Platform Modules (TPMs), is commonly used for pass-wordless protection of data-at-rest, aiming to protect data when the device is lost or stolen. Microsoft’s standpoint is neutral on which way a TPM should be implemented: Firmware-based TPMs (fTPMs) are viewed as more economical but less secure. Despite the inherent susceptibility to bus sniffing attacks, discrete TPMs (dTPMs) are still seen as the gold standard, as many deliver better on-paper tamper resistance. It is often argued that attacks against the bus can be mitigated by bus encryption and, ideally, mutual authentication between the CPU and TPM.This position paper aims to emphasize another inherent, difficult-to-mitigate attack against dTPMs that was originally shown against a TPM 1.1 over 20 years ago: We demonstrate that even brief physical access to a TPM 2.0 and the ability to boot from an attacker-controlled system enable an attacker to reset and replay arbitrary measurements, thereby allowing an attacker to unseal, for example, a disk encryption key solely protected by the TPM. While there have been attacks against fTPMs, too, we argue that their practical attack surface is fundamentally smaller. Bus protection techniques can be used to protect dTPMs, but only guard against passive attacks. After all, we argue that, from a security standpoint, firmware TPMs, or any TPM internal to the SoC, are superior to discrete (external) ones. Lastly, in order for dTPM-based setups to provide meaningful protection of sealed secrets, configurations must require a user-provided PIN or password along with the Measured Boot configuration.
Retrieval-Augmented Generation (RAG) systems are vulnerable to corpus poisoning where adversaries inject malicious documents to corrupt outputs. We introduce Proof-Carrying Answers (PCA), a protocol requiring cryptographic receipts for every claim before answer release. PCA combines systematic admissibility contracts, Merkle-authenticated vector indexes with Ed25519 signatures, and threat-model-driven evaluation. Experiments on WikiText-103 show PCA reduces poisoned outputs by 47% at 10% corpus poisoning while maintaining 65% answer coverage with only 1.2% overhead. We establish PCA as necessary defense alongside semantic verification.
The growing scale and heterogeneity of Internet of Things (IoT) deployments have amplified the security impact of zero-day attacks. These exploits target previously unknown vulnerabilities, bypassing signature-based intrusion detection systems. Machine learning offers a promising alternative through anomaly detection, but systematic guidance for model selection under real-world constraints remains limited. This paper presents a comprehensive benchmark of ten anomaly detection architectures across four machine learning paradigms on the large-scale CICIoT2023 dataset (46.8 M flows, 33 attack types). All models are trained using benign-only data to emulate zero-day scenarios and evaluated using both detection and efficiency metrics on simulated edge hardware. The results reveal a clear performance–efficiency Pareto frontier. Long Short-Term Memory Autoencoders achieve the highest Receiver Operating Characteristic Area Under the Curve (ROC-AUC) (99.58 %) but incur significant computational cost. Lightweight autoencoders provide near-optimal detection (99.44 %) with orders-of-magnitude lower resource use, while classical tree-based methods offer speed but miss most attacks. These findings establish baselines for IoT zero-day detection and offer evidence-based recommendations for edge, gateway, and cloud deployments.
The fifth generation (5G) of wireless communication offers gigabit-per-second speeds, ultra-low latency, and massive device connectivity. However, the introduction of network function virtualization (NFV), software-defined networking (SDN), network slicing, and mobile edge computing (MEC) has also created a complex security frontier. Addressing these challenges requires continuous and realistic validation of defenses in controlled experimentation environments. In this paper, we present an open-source, low-cost, fully software-based 5G testbed designed as a cyber range platform for security research and education. Built upon the OpenAirInterface (OAI) framework and commercial off-the-shelf hardware, the testbed supports an end-to-end 5G Stand-Alone (SA) deployment with gNodeB, core network, and user equipment (UE). It enables reproducible experimentation that may demonstrate a broad range of security scenarios, including privacy and tracking-based vulnerabilities like capturing user identifiers, as well as availability attacks such as Denial of Service (DoS) attacks targeting core network functions. The paper outlines our reproducible implementation and shares our experiences in building and operating the platform as a cyber range.
Security tool evaluations and experiments are often hampered by ad-hoc setups, missing telemetry, and fragile infrastructure. We report on a controlled experiment using Crinkle, a novel, interactive network packet provenance debugger that is deployed on the national-scale FABRIC testbed. Participants using Crinkle consistently solved debugging tasks faster and with less effort: two verified correct solutions were completed in under six minutes with as little as one line of code, outperforming advanced non-Crinkle users despite having far less FABRIC experience. Our integrated telemetry stream captured 364 records with negligible overhead and zero loss, enabling real-time detection of user and infrastructure issues and proactive remediation. Over 38 slices and 24 different FABRIC sites, we identified and resolved common platform problems (permissions gaps, SSH key failures, transient site outages). These findings demonstrate that pairing fine-grained telemetry with realistic, federated testbeds yields reproducible, performance-driven security tool evaluations and that Crinkle can serve as both a high-performance debugger and a model for instrumented cybersecurity experimentation.
The integration of automated security testing into continuous delivery pipelines is a topic of high interest in the software development field. Despite its obvious value, automated security testing often suffers from excessive false positives that erode developer trust and delay secure releases. While large language models (LLMs) demonstrate strong code understanding, most LLM security tools operate as single-shot classifiers without communicating decision uncertainty. To address these issues, we present a trust-calibrated architecture that decomposes vulnerability assessment into sequential analytical stages: classification, impact analysis, and deployment action recommendation. Our system employs multi-LLM ensembling with explicit confidence propagation, enabling intelligent routing between automated gates and human review based on model certainty. Evaluation of our system demonstrates strong classification performance with well-calibrated uncertainty estimates, substantially outperforming traditional static analysis while providing transparency unavailable in current approaches. We provide comprehensive validation of vulnerability type classification across diverse weakness categories and severity levels. The confidence-aware design enables organizations to adapt enforcement strictness to prediction reliability, routing uncertain cases to human expertise while automating high-confidence decisions.
This paper presents AutoPwn, an AI-enabled framework for automatic code-reuse exploit generation. AutoPwn leverages agentic large language models to orchestrate the classical stages of exploitation—gadget discovery, semantic analysis, chain construction, and payload integration—within a closed-loop workflow. Our focus is on IoT network management services, where limited defenses make return-oriented programming (ROP) and jump-oriented programming (JOP) attacks particularly relevant. As a case study, we evaluate AutoPwn against ConnMan, a widely deployed Linux connectivity daemon vulnerable to CVE-2017-12865. In controlled experiments, AutoPwn autonomously reproduced exploits under three configurations: unprotected binaries, W⊕X-protected binaries (return-to-libc), and the challenging ASLR+W⊕X setting (NOPIE target). For the ASLR case, the agent successfully executes a two-stage ret2plt2libc attack that first leaks a runtime libc address via system logs, demonstrating sophisticated defense-aware planning. By demonstrating how LLM-driven agents can manage the workflow of code-reuse exploit generation, this work positions AutoPwn as a step toward AI-enabled attacker–defender paradigms in IoT and CPS security.
Public Domain Name System (DNS) resolvers inadvertently reveal cache state via non-recursive (RD=0) queries. This enables the inference of a privacy-preserving lower bound on the number of users who have queried a domain by analyzing Time-to-Live (TTL) values across multiple probes. Prior work has examined DNS cache snooping manually, typically at a single scale and primarily for measurement. In this workshop paper, we present MudHunter, a centrally orchestrated, Internet-scale tool that automates DNS cache snooping to generate actionable Cyber Threat Intelligence (CTI). We developed custom tooling using the CAIDA Scamper library to coordinate 130 globally distributed CAIDA Ark vantage points for running parallel DNS lookups, thereby transcending methods that require per-node deployments. Using MudHunter we conduct our parallel measurements on the 4 popular public DNS providers, namely, Google Public DNS, Cloudflare, Quad9, and OpenDNS. We use MudHunter to detect the caching architecture of the 4 public resolvers across their PoPs around the world, interestingly, our study uncovers fresh details about the updated cache architecture of the resolvers we analyze, which appears not to have been systematically examined since 2020. Furthermore, we demonstrate MudHunter’s practical cybersecurity value through two week-long case studies to track illicit domains pertained to (i) botnet C2 infrastructure and (ii) banking phishing campaigns. Our MudHunter domain activity estimation provide conservative lower bounds on global threat exposure. Across both case studies, for a given domain, domain activity estimations peaks in a small set of regions while most vantage points remain near zero, indicating regionally targeted, short-lived activity rather than uniform global spread. This turns cache observations into actionable, privacy-preserving threat intelligence: timely, geographically resolved signals that drive triage, blocking, and takedown.
Large Language Models (LLMs), through their strong capabilities in code generation, reasoning, and tool use, have demonstrated promising results in security tasks involving vulnerability discovery and exploitation. However, evaluating their offensive potential in automating penetration testing—a more complex and multi-stage process—remains a critical research challenge. While existing evaluation frameworks effectively demonstrate LLM capabilities in isolated or simplified scenarios, they often do not extend toward the complexity of interconnected attack chains characteristic of real-world adversarial operations. In this analytical study, we examine the challenge of assessing the feasibility of LLM-powered automation across the full adversarial pipeline within realistic environments. We contribute an analysis of current benchmarks and associated environments, and highlight opportunities for methodological enhancements that would strengthen alignment between academic evaluations and operational realities.
Consumer smart doorbells are internet connected devices that are increasing in popularity. Amongst other things, they provide video surveillance features and enable homeowners to communicate with visitors, even when they are away from home. While these devices may enhance physical security at residential addresses, they may also introduce new risks due to vulnerabilities in their cybersecurity. This study provides a systematic evaluation of different security attacks on nine consumer smart doorbells, selected using rigorous procedures and identified as the most popular devices sold in the UK across different price ranges. We found that all of the doorbells tested were vulnerable to some of the attacks and that none were compliant with all of the current regulatory requirements in the UK. Where possible (4 of 9 doorbells), the manufacturers were contacted to report a responsible disclosure – two out of the three manufacturers contacted were responsive. Recommendations for approaches to address the vulnerabilities identified and avenues for future research are discussed. In addition to the recommendations, the proposed systematic evaluation of security attacks provides a transferable framework that can be applied to other IoT devices.
Security professionals, researchers, and analysts identify attacks and produce cyber-threat intelligence feeds by analyzing network and system data. This process is time-consuming and requires specialized skills. We propose leveraging artificial intelligence and large language models to perform the unsupervised triage and taxonomy of raw cyber-threat intelligence data. Our approach clusters malicious shell-scripts using both direct and LLM generated semantic embeddings. These clusters are then automatically re-summarized using an LLM to produce an analyst facing overview of the entire corpus. We evaluate our approach on adversary shell-scripts collected from a seven-month honeypot deployment. Our results demonstrate normalized mutual information (NMI) scores ranging from 0.83 to 0.92, showing our approach reliably recovers ground-truth categories, enabling the automatic creation of high-quality attack taxonomies.
Network intrusion detection systems produce large amounts of alerts that demand rapid and effective response. However, translating alerts into concrete defense rules remains largely manual, delaying mitigation and increasing risks. In this paper, we propose AgentNIRS, an LLM-driven agent that automates intrusion response by converting alerts into actionable firewall updates. Our proposed agent leverages on-premises, open-weights LLMs to generate and validate iptables rules through a guarded workflow. The workflow comprises three evaluation criteria for rules to ensure validity, safety, and effectiveness. We assess AgentNIRS on the UNSW-NB15 dataset using different open-weights models, comparing execution time and efficacy of the generated rules. Experimental results show that AgentNIRS produces valid and effective rules with minimal impact on regular network traffic, outperforming baseline response systems. More specifically, the best performing LLM (Llama 3.1) managed to correctly block over 92% of the malicious network flows while blocking less than 2% of the benign flows as a side effect.
Cyber Threat Intelligence (CTI) relies on finding the most relevant and reliable evidence from a vast and often noisy information space. To make retrieval more accurate, we propose a trust-adaptive, domain-aware multi-agent retrieval-augmented generation framework that learns and applies agent trust during the retrieval process itself. In this architecture, each agent maintains a Domain Weight Profile containing source priorities and domain-specific retrieval settings. A Relevancy Matching Unit then combines semantic similarity, domain weighting, and a learnable trust score (Ta) to calculate a Confidence Score for each data chunk. A dynamic threshold decides which chunks are relevant enough for the LLM, while an Agent Trust Score Unit continuously updates each agent’s trust score based on how often its retrieved chunks are used in final responses. We extend this framework for CTI tasks by adding recency, provenance, and duplication factors to improve data quality. A lightweight evaluation setup using common metrics, nDCG@10, Precision@5, Recall@50, provenance coverage, freshness, and duplication rate, shows that the proposed retrieval layer improves ranking quality, increases the share of credible and up-to-date evidence, and reduces duplicate context. This demonstrates a practical path toward safer and more accurate LLM-driven CTI workflows.
A cyber threat intelligence (CTI) item is audit material when it is relevant to the risk of material misstatement (RMM). We evaluate this in this paper using an LLM pipeline comprising Audit Scoping, Cyber Extraction, Audit Reasoning, and a final gate with explicit guardrails. The motivation for this paper is the practical audit question: when do CTI events plausibly affect internal control over financial reporting (ICFR) and therefore the financial statements, which are distinct from general cyber risk? This is an architecture paper with illustrative examples; empirical evaluation is deferred to future work. The Audit Scoping LLM restricts evidence to ICFR systems and controls. The Cyber Extraction LLM normalizes risks using ATT&CK, STIX, and CVE and captures warrant spans. The Audit Reasoning LLM maps risks to financial assertions and control families and computes ImpactFR = M × L, gated by a materiality threshold τ with qualitative overrides for fraud and management override.
The U.S. Food and Drug Administration’s (FDA) premarket cybersecurity guidance emphasizes the inclusion of a Software Bill of Materials (SBOM) as part of medical device submissions. Although the guidance does not prescribe a specific SBOM standard, it requires manufacturers to provide component data aligned with the National Telecommunications and Information Administration (NTIA) baseline attributes, along with end-of-support dates and support level descriptions. This flexibility is intended to accommodate varying development practices, but can leave critical gaps in risk visibility.In this paper, we present a case study of an anonymized medical device SBOM that technically complies with FDA expectations but omits third-party components and dependencies deeply embedded in the software architecture. We also investigate how excluding hardware components exposes devices to overlooked risks. In particular, our analysis shows that expanding an SBOM to include hardware and third-party components increased vulnerability visibility by 18%, finding an additional four critical CVEs in the system. While medical devices may achieve regulatory compliance with an SBOM that includes only the attributes above, such an SBOM does not inherently ensure meaningful cybersecurity risk management.
With advancements in AI, conversational agents are increasingly being used in healthcare and could be employed aptly in counseling psychology and mental health support. However, ensuring the reliability and trustworthiness of these agents is crucial for safe, effective patient interactions. In this paper, we present methods for enhancing the reliability of conversational agents through source tagging, which enables users to assess information transparently and preemptive user metadata enrichment for providing emotion-sensitive responses. Additionally, we address security challenges such as prompt injection attacks, by proposing prompt engineering strategies to mitigate these vulnerabilities. By systematically integrating confidence metrics and fortified prompts, our approach ensures conversational agents provide secure and trustworthy responses in sensitive healthcare environments.
This article addresses the challenges of using the DARPA OpTC dataset for intrusion detection system (IDS) research. While the dataset offers a rich combination of network and host data, its usability is hindered by a lack of an official event labeling and errors in logs data. We propose a two-fold solution: first, we identify and correct errors in the dataset, and second, we design and implement a comprehensive labeling methodology for attack-related events at both the network and host levels. Our corrected dataset, along with the labeling scripts, will be made publicly available to support reproducibility and further research. Additionally, we assess the impact of these labels and corrections on the effectiveness of graph-based machine learning IDS methods.
Early-stage ransomware investigations often hinge on the first minutes after execution, yet most empirical studies aggregate multi-hour traces or analyze single hosts in isolation. This paper presents a reproducible dataset and an analysis of ransomware behavior in Active Directory (AD) environments during these critical stages. Using a controlled AD testbed, we executed over one hundred samples from eight families Akira, BlackMatter, BlackCat, Black Basta, Conti, DarkSide, LockBit and MedusaLocker, and collected approximately 341,000 labeled Windows Event Log entries across both victim and server (Domain Controller) rolesResults show that (i) lead-lag distributions vary by family, with Akira/MedusaLocker/DarkSide/Black Basta showing victim activity seconds before domain controller events, while Conti/LockBit/BlackMatter align near-simultaneous; (ii) stage orderings are invariant across runs (Privilege Escalation before Persistence, Credential Access before Cryptographic Operations); and (iii) family templates separate behaviors more reliably on victim logs (macro AUC ≈ 0.71) than server logs (macro AUC ≈0.62). By releasing the dataset and analysis pipeline, we provide the community with an artifact for reproducible experimentation and operational insights into the earliest actions of ransomware in AD environments.
