Cybersecurity certification exams have become an important pathway for developing professional competence, yet preparation for exams such as CISA, CRISC, CEH, and CCNA often relies on fragmented materials, costly training programs, and limited individualized feedback. This study introduces CertiGuard, a resource-efficient cybersecurity training framework built on LLaMA-2-7B. The model is adapted through a two-stage process: continued pre-training on a curated cybersecurity corpus, followed by supervised fine-tuning with certification-aligned instructions. To reduce the computational cost of domain adaptation, the framework applies QLoRA-based fine-tuning and organizes model use through beginner, intermediate, and advanced proficiency tiers. Experiments were conducted on four certification-oriented question-answering datasets covering auditing, risk and control, ethical hacking, and networking domains. The base Certibase model achieved an average accuracy of 54.1
A practical searchable symmetric encryption (SSE) should allow users to privately store documents on untrusted servers with the abilities to (1) search with multiple keywords, and (2) add or delete documents dynamically. The oblivious cross tag (OXT) construction from Crypto’13 is the most efficient SSE scheme that allows conjunctive searches, but only for static databases. In NDSS’20, OXT was extended to ODXT supporting dynamic updates. However, ODXT is not forward private. In this work, we identify a commonly used setting for SSE where a document with its associated keywords can be dynamically added to or deleted from the database as a whole, but the keyword set is not modified in between. We call it the non-modifiable document (NMD) setting. In this NMD setting, we propose a generic framework for designing conjunctive dynamic SSE (CD-SSE), supporting conjunctive queries that allow dynamic updates while being forward and backward private at the same time. Our construction uses a generic dynamic single keyword SSE and the OXT scheme as modular black-boxes. Our scheme generalises ODXT. We provide new security definitions of forward and backward privacy for the new NMD setting. Our generic construction (and hence ODXT) achieves forward and BPUP backward privacy in the new setting, even when the underlying single keyword SSE scheme is only WBP backward private. We analyse the precise leakages of our scheme to the adversarial server in the NMD setting. We have instantiated our generic construction with three different single keyword schemes. Experiments show that our schemes are very efficient and practical. Our code is publicly available.
Automated security risk management addresses threats by implementing mitigation and remediation strategies described in public security advisories. These advisories, regularly published by independent Cyber Emergency Response Teams (CERTs), are typically presented as unstructured text and supplemented with additional security-relevant information sources. Using a Large Language Model (LLM) orchestration framework, we generate security playbooks in a standardized meta-model, visualize them with Business Process Modeling and Notation (BPMN) diagrams, and classify them into actionable tasks. We present the theoretical foundations of the framework, describe the underlying meta-model, and conduct an experimental study that produces a dataset of 725 security playbooks. Our subsequent content analysis shows that advisory-based playbooks focus on update tasks, but also include defensive themes like disabling vulnerable policies or restricting network access.
Large Language Models (LLMs) are increasingly applied in cybersecurity, but most existing industry use cases focus on static, one-shot tasks such as classification, entity extraction, or summarization. While effective in narrow contexts, these applications fail to capture the complexity of real-world cybersecurity workflows, which often unfold over time, involve evolving inputs, and require multi-step reasoning. In this paper, we shift the focus toward dynamic cyber tasks—problems that demand context awareness, tool interaction, and adaptive decision-making. Our main goal is to define, analyze, and investigate the role of LLMs in automating these dynamic tasks. To achieve this, we introduce a characterization framework that profiles dynamic cyber tasks along four complementary dimensions: operational goal, knowledge grounding, collaboration mode, and cognitive complexity. We survey recent LLM-based systems across seven core domains: threat intelligence, data privacy and security, vulnerability detection, malware detection, intrusion detection, incident response and red teaming automation. Our analysis shows that current systems remain limited by privacy and deployment constraints, stale or incomplete threat knowledge, weak validation of feedback-driven actions, and insufficient evidence of operational benefit. We identify the need for privacy-aware deployment, timely retrieval and knowledge maintenance for emerging threats, process-level evaluation tied to measurable security outcomes, and human oversight within controlled and hybrid automation workflows. These findings clarify where LLMs can provide practical value and where conventional or hybrid approaches may remain more suitable.
Extended Berkeley Packet Filter (eBPF) has emerged as a kernel-level programmable framework enabling dynamic security enforcement in modern operating systems. While eBPF’s potential for cybersecurity applications has attracted significant research attention, existing work remains fragmented across disparate domains, evaluation methodologies, and deployment contexts. This systematic literature review applies PRISMA methodology to identify, categorize, and synthesize peer-reviewed research on eBPF-based cybersecurity mechanisms. Following structured screening of 3735 records from six databases, 54 primary studies published between 2018-2026 were analyzed and organized into a seven-domain taxonomy spanning DDoS mitigation, intrusion detection, Internet-of-Things (IoT) security, container security, microservice protection, networking, and security tools and frameworks. Analysis reveals that eBPF enables low-overhead security enforcement (median 2.4
Phishing attacks via desktops, smartphones and internet of things devices are becoming increasingly sophisticated, posing critical security challenges for digital infrastructures. Defending against these attacks requires AI-based detection models that maintain high accuracy, since false positives or negatives can lead to severe breaches, while remaining lightweight enough to run on resource-constrained client devices. Split Learning (SL) meets these requirements by having clients compute only initial model layers locally and transmit intermediate activations (“smashed data”) to a server for the remaining inference, avoiding direct sharing of raw inputs. However, prior work in the image domain has shown that smashed data can leak original content, suggesting that SL may not be safe for user privacy. Therefore, it is essential to investigate whether these privacy risks also extend to language-model–based SL systems, which have fundamentally different neural network architectures, including attention mechanism. This paper introduces the Semantic Information Reconstruction Attack (SIRA), a novel framework designed to infer sensitive semantic elements directly from smashed data by leveraging the generative capabilities of large language models. In experiments on real-world phishing datasets, SIRA outperforms conventional reconstruction attacks in accurately inferring private webpage information. These findings reveal a potential privacy vulnerability in SL-based language models for security applications and motivate the development of targeted defense strategies.
With lightweight hardware security becoming increasingly critical for Internet of Things devices, Physical Unclonable Functions (PUFs) have emerged as a key enabling technology, providing device authentication, cryptographic key generation, and simplified key management capabilities without requiring dedicated on-chip key storage. While conventional MemPUFs have been extensively studied, they suffer from inherent limitations such as poor non-volatility and low entropy density. In recent years, emerging non-volatile memory PUFs built on Resistive Random Access Memory, Magnetoresistive Random Access Memory, Ferroelectric Random Access Memory, and Phase-Change Random Access Memory have shown tremendous potential. However, there remains a lack of systematic reviews and performance trade-off analyses that cover cutting-edge directions and provide practical guidance for real-world design. To this end, this paper systematically reviews the full technical lineage of MemPUFs and describes different emerging MemPUFs from two dimensions: entropy sources and development trends (including reliability, security, and energy efficiency). By statistically analyzing the performance metrics of representative works on emerging MemPUFs over the past five years, this paper reveals the critical impact of device selection on the overall performance of PUFs. On this basis, it systematically dissects the dual impact of Multi-Level Cell technology on PUF performance and prospectively discusses the "computation-security integration" architecture based on the deep convergence of Computing-in-memory and PUFs. The findings of this paper fill the gap in systematic reviews of emerging NVM PUFs and provide a valuable reference for the design of next generation low-power and high-security hardware security primitives for edge computing.
This survey examines how cyber ranges (CRs) and testbeds (TBs) are implemented in practice by focusing on the technologies used to realise CR/TB use cases and features. Building on a systematic literature review spanning 2020–Aug. 2025, the study includes 199 publications and consolidates extracted application areas, purposes, use cases, infrastructure types, and reported technologies into a structured data repository for analysis. The repository identifies 650 distinct technologies and maps them into a hierarchical structure of 10 technology domains and 81 technology subdomains to support consistent cross-paper comparison despite heterogeneous terminology and architectural representations. The analysis indicates a functional separation in reported deployments, with TBs reported more frequently for experimentation-oriented use cases, whereas CRs are reported more frequently for training, exercises, and education. Across application areas, the data show concentrated profiles and explicit domain/application-area gaps where no technologies are reported for specific combinations, and temporal trends indicate increasing diversification of reported use cases in 2024–2025. Based on these patterns and the discussed challenges of inconsistent terminology and categorization, the paper recommends more systematic reporting of technologies and feature implementations and the use of shared terminology with explicit mappings to reference architectures or taxonomies.
Malware is a type of software designed to intentionally disrupt or gain unauthorized access to a computer system. As technology progresses, new variants of malware continue to emerge. In the domain of image-based Windows PE malware family classification, modern deep learning models are highly susceptible to adversarial attacks, leading to biased learning between clean and adversarial samples, suboptimal retraining, and reduced capability to capture family-specific discriminative features. Existing attack generation methods rely heavily on cybersecurity expertise, making them complex and difficult to scale. Additionally, retraining often overfits adversarial samples or loses sensitivity to clean data and weakening defenses. To address these issues, this paper proposes a systematic framework to enhance adversarial robustness, validated on the Malimg dataset. Firstly, malware binaries are converted into grayscale images, enabling image-based deep learning analysis. Secondly, a multi-stage oversampling strategy is applied before and after generating adversarial samples to reduce bias and improve data diversity. Thirdly, a novel feature mask is introduced, combining Convolutional Neural Network (CNN) derived gradients, structural masks from PE parsers, and unused null byte positions. This mask selectively alters non-critical regions, preserving malware functionality while reducing adversarial noise. Finally, to address long-range dependencies, adversarial samples are tested against Vision Transformers (ViTs) in a black-box environment, ensuring transferability and improving detection across various models. Detailed analysis of the results reveals the achievement of the 81
User control, privacy, interoperability, and governance remain persistent challenges in Health Information Exchange (HIE), despite the growing demand for secure and patient-centric data sharing. Blockchain-enabled Self-Sovereign Identity (BC–SSI) has emerged as a promising paradigm; however, existing implementations remain heterogeneous, tightly coupled to specific infrastructures, and lack reusable healthcare-oriented architectural guidance. This study derives a modular reference architecture for BC–SSI-enabled healthcare systems using a Design Science Research Methodology approach. First, healthcare-driven requirements (R1–R16) are identified through the synthesis of literature, regulatory frameworks, expert insights, and patient-oriented studies. Second, two representative BC–SSI frameworks (Walt.id and Hyperledger Indy/Aries) are comparatively examined through proof-of-concept (PoC) implementations based on a Norwegian electronic prescription workflow. The evaluation applies a 3+1 architectural view model adapted from the 4+1 approach to identify recurring runtime interaction patterns, structural dependencies, capability gaps, and healthcare-specific architectural limitations. The findings indicate that while both frameworks support core SSI credential lifecycle capabilities, neither fully addresses healthcare-specific requirements such as policy-based consent enforcement, identity binding, interoperability orchestration, data minimization, runtime standards validation, and coordinated trust management. In response, this study proposes a framework-agnostic three-layer conceptual architecture comprising Access Trust, Privacy Policy, and Validation Integration layers. The proposed architecture is evaluated at the design level through structural traceability analysis, comparative feasibility assessment, runtime interaction modeling, and architectural threat analysis. While operational deployment and empirical performance validation remain future work, the study establishes a reusable architectural foundation for interoperable, policy-aware, and security-oriented BC–SSI-enabled HIE systems.
Crypto ransomware poses an escalating threat to individuals and organizations, yet existing defenses remain fundamentally reactive. Anti-ransomware tools, such as CryptoDrop, R-Locker, CryptoStopper, and Cybereason RansomFree, are constrained by reliance on user intervention, vulnerability to slow-encryption and obfuscation evasion techniques, and the risk of volatile memory loss through forced system shutdowns. The growing adoption of double-extortion tactics, wherein ransomware operators both encrypt victim data and threaten public disclosure of exfiltrated information, further exposes critical gaps in current defenses. This paper introduces the Ransomware Prevention Toolkit (RPTK), a proactive hybrid solution that addresses these limitations by turning ransomware own behavioral tendencies against it. RPTK’s core novelty lies in its camouflage mechanism, which disguises critical files as system files through metadata alterations, signature modifications, and extension changes, exploiting the well-documented ransomware convention of sparing system files to maintain host operability. This prevents encryption and mitigates data exfiltration risk. A complementary monitoring service, disguised as a legitimate system process, autonomously detects and terminates ransomware in real time, enhancing resilience against ransomware-initiated termination attempts. RPTK requires no kernel modifications, no internet connection, and no additional backup storage, ensuring broad compatibility and deployment simplicity. Empirical evaluation against 50 representative samples from the most prevalent crypto-ransomware families yields a 100
Honeytokens, decoy digital assets planted to detect and attribute unauthorised access, are a well-established primitive in cyber deception. Existing generation tools produce static, template-based tokens that lack organisational specificity and are identifiable by statistical, syntactic, and semantic analysis. We introduce PHANTOM (polymorphic honeytoken adaptation with narrative-tailored organisational mimicry), a framework that generates contextually convincing honeytokens by encoding organisation-specific knowledge—domain names, service naming conventions, technology-stack idioms, and realistic secret-value distributions—into a multi-component generation pipeline. We formalise honeytoken quality through a four-component Believability Score that captures syntactic validity, semantic coherence, statistical plausibility, and human acceptance. We use this metric to evaluate PHANTOM across 8 token types and 4 organisational contexts against a template-based baseline. PHANTOM achieves B = 0.778 ± 0.057 versus B = 0.576 ± 0.058 for templates ( Δ = +0.203 , t = 14.07 , p < 0.001 , Cohen’s d = 3.52 ). A heuristic human-acceptance proxy rises from 6.2% to 100% under a rule-based scoring threshold rather than an actual human-subjects study, and detection resistance (DR = 1 - P_d ) improves from 0.609 to 0.870 across three simulated scanner models (regex, entropy analysis, and ML classifier), each with p < 0.001 . The semantic coherence gap ( Δ S_c = +0.309 , d = 4.52 ) is the dominant driver, confirming the hypothesis that organisational context is the critical missing ingredient in current approaches. All results are reproduced without external API calls, making the pipeline fully deployable in air-gapped environments. The current evaluation is based on n=32 tokens per method (8 types × 4 organisational profiles, one instance per type—organisation pair); future work will extend this to larger, independently-replicated cohorts, real human-subject studies, and adversarial LLM-based scanners.
Database security remains fundamentally constrained by static defenses: fixed data locations and long-lived encryption keys give attackers a stationary target once perimeter defenses are breached. This paper makes three contributions toward an alternative, motion-based paradigm. First, we introduce the Database in Motion Chaos Encryption (DaChE) algorithm, in which AES-256-encrypted data shards are bound to balls that move through a Bunimovich stadium billiard, with decryption released only when a ball collides with a matching key-holding obstacle; a MapReduce-style pipeline aggregates the resulting partial query results. Second, we provide a proof-of-concept implementation and empirically validate the algorithm’s core chaotic-dynamics assumption, measuring a positive Lyapunov exponent ( λ = 0.47 ± 0.17 across 10 independent trials) and a corresponding key-sensitivity effect in which near-identical initial conditions rapidly diverge into unrelated collision sequences. Third, we report a transparent performance evaluation showing 22–100 × execution-time overhead relative to static AES-256 encryption for small configurations (3–5 shards) with only 50
In serverless architectures, applications are executed in environments where resources are dynamically allocated according to demand. Instead of having dedicated servers, functions are executed in response to specific events, allowing for high scalability and simplified infrastructure management. However, the lack of resources to monitor and protect these architectures makes them a ripe target for attackers. Denial of Wallet (DoW) attack is a term used to describe a situation in which an organization incurs financial losses by exceeding the service quota limits contracted with a cloud platform. The objective of this study is to detect Denial of Wallet (DoW) attacks using the concept of entropy. Entropy refers to the measure of uncertainty in a dataset and can be used as a metric to identify anomalous patterns. In this context, this study proposes an approach based on calculating the entropy of various features of executing serverless functions, including the number of invocations, and memory and CPU consumption. By applying this approach, it is expected to improve early detection of DoW attacks and reduce false negatives. By leveraging entropy as a measure of randomness in serverless function call data, an additional tool is provided to strengthen network security and mitigate the negative effects of denial-of-service and denial-of-wallet (DoW) attacks.
In recent years, cyber threats have become more complex and frequent. These threats compromise the confidentiality of users, the integrity of transactions, and the availability of services offered by organizations in different sectors. To defend against threat actors, organizations employ Red and Blue teams. Red teams conduct offensive security while blue teams commit to defensive efforts. However, the shortage of cybersecurity professionals and the increasing complexity of malicious activities reinforce the need for continuous improvement in threat defense. One possible direction to address these challenges is threat defense automation. This new paradigm empowers analysts to evaluate incidents at scale, enables continuous infrastructure monitoring, accelerates the training of new team members, and establishes standard defense methods that can be shared among multiple organizations. In this regard, Machine Learning (ML) is vital to threat defense automation and leverages organizational resources to generate insights and enable informed decisions. The main goal of this research is to conduct a survey on different solutions for threat defense automation using ML techniques. We focus on the operational functions adopted by red and blue teams in several application areas. We categorize existing efforts into these functions and also review datasets, knowledge graphs, simulation platforms, and Reinforcement Learning (RL) environments for threat defense automation solutions. In total, we analyze 138 research works, of which 35 present resources relevant to automated threat defense, 60 present automated red teaming solutions, and 43 present automated blue teaming solutions. Finally, we highlight critical research gaps and identify future directions in the automation of cyber threat defense.
The widespread global use of short message service (SMS) has heightened the importance of reliable spam detection, as spam messages are not only disruptive but can also facilitate phishing and identity theft. While extensive prior research has explored SMS spam detection using traditional machine learning (ML), deep learning (DL), and transformer-based encoder models, the recent rapid advances in large language models (LLMs) with strong natural language understanding capabilities motivate a fresh, systematic evaluation. In this study, we investigate how effectively LLMs detect SMS spam using both English and Korean datasets. We benchmark representative prior approaches on recent SMS spam corpora and compare them against LLM-based classifiers. Our experiments cover both commercial black-box LLMs and locally deployable white-box models and examine multiple prompting strategies, including zero-shot, few-shot, and chain-of-thought (CoT) prompting. Furthermore, to reflect adversarial characteristics commonly used to evade detection, we evaluate robustness under concept drift and adversarial attack settings. Experimental results on English and Korean SMS datasets indicate that LLMs are highly robust for spam detection and can provide interpretable rationales by leveraging their language understanding capabilities, suggesting that LLMs are a highly effective and practical option for modern SMS spam filtering.
