Smart buildings in general, and smart building control systems in particular, are becoming increasingly complex, and their security characteristics need to be assessed through continuous testing. However, problems such as high cost, significant risks, limited resources, and lack of flexibility make it difficult to use real buildings for such assessments. Moreover, current simulation-based approaches have limitations in terms of the scope of the experiment scenarios and the relevance of the results. To address these issues, we have implemented a smart building control system emulation platform, named SBCSE, that was designed and developed based on the architecture and experiment log data of a real smart building. SBCSE makes it possible to conduct security testing in connection with smart building control systems, and the related communication protocols, so that the consequences of various cyberattacks and the effectiveness of possible countermeasures can be objectively assessed. In this paper, we present the design and implementation of SBCSE, as well as two case studies that illustrate the applicability of the platform. Our experiments demonstrate how the effects of cyberattacks can be quantified via emulation experiments, and how potential countermeasure implementations can be validated before deployment in the real world.

Despite the rapid adoption of Large Language Models (LLMs) for automatic code generation, their output often exhibits syntax errors, security vulnerabilities, and functional inconsistencies. To address these issues, we present CodeEnhancer, a two-stage framework that tightly integrates LLMs with static application security testing (SAST) tools and targeted fine-tuning. The goal is to produce more secure and functionally correct Python code. In the first stage, our iterative validation pipeline couples LLM-generated code with tools such as Pylint and Bandit. These tools automatically identify and remediate issues through structured feedback loops. When applied to the GPT-4o model, this process eliminated 82.8% of the initial vulnerabilities and resolved all the detected functional correctness issues when tested on the LLMSecEval dataset. In the second stage, we fine-tune the LLMs using two types of secure code examples: expert-written samples and code refined by our framework. Comparative experiments demonstrate that the framework-tuned model outperforms the baseline and expert-tuned models. The framework-tuned model generates only 18.4% vulnerable code snippets on the LLMSecEval dataset, whereas the baseline and expert-tuned models produce 43.6% and 54.7% vulnerable code snippets, respectively. The framework-tuned model reduces final vulnerability rates to 6.7% on LLMSecEval and 3.5% on the SecurityEval dataset. Our results highlight the synergistic effect of integrating static analysis with feedback-informed fine-tuning. They also reveal limitations in current evaluation metrics and dataset representativeness. These findings suggest a scalable, robust approach to achieving more secure, trustworthy, and practical AI-assisted code generation.

In this paper, we present the AI-based SecureWeaver, a system designed to enhance the generation of secure network architectures. Our approach utilizes an intentbased representation of network service requirements, annotated with security constraints, and employs Design Space Exploration (DSE) augmented with classical machine learning algorithms to optimize system design. The primary input to our system consists of network service requirements and security constraints, while the output is a secure and functional network topology. By integrating AI into the existing SecureWeaver framework, our primary contribution lies in demonstrating significant performance improvements through the application of five wellestablished AI algorithms. Our experimental results show that the AI-based SecureWeaver achieves substantial reductions in the number of iterations and the time required to design secure systems compared to the non-AI baseline. These improvements are validated across various corporate network cases, highlighting the practical benefits of our approach. This work provides insights into the effectiveness of AI algorithms in accelerating secure design.

Vision-guided robot grasping methods based on Deep Neural Networks (DNNs) have achieved remarkable success in handling unknown objects, attributable to their powerful generalizability. However, these methods with this generalizability tend to recognize the human hand and its adjacent objects as graspable targets, compromising safety during Human-Robot Interaction (HRI). In this work, we propose the Quality-focused Active Adversarial Policy (QFAAP) to solve this problem. Specifically, the first part is the Adversarial Quality Patch (AQP), wherein we design the adversarial quality patch loss and leverage the grasp dataset to optimize a patch with high quality scores. Next, we construct the Projected Quality Gradient Descent (PQGD) and integrate it with the AQP, which contains only the hand region within each real-time frame, endowing the AQP with fast adaptability to the human hand shape. Through AQP and PQGD, the hand can be actively adversarial with the surrounding objects, lowering their quality scores. Therefore, further setting the quality score of the hand to zero will reduce the grasping priority of both the hand and its adjacent objects, enabling the robot to grasp other objects away from the hand without emergency stops. We conduct extensive experiments on the benchmark datasets and a cobot, showing the effectiveness of QFAAP. Our code and demo videos are available in the supplementary items.

With the increasing role of Machine Learning (ML) and Deep Learning (DL) in various domains, their application in enhancing Network Intrusion Detection Systems (NIDS) has gained significant attention. Traditional NIDS approaches often rely on correlation-based detection, which may lead to misleading or fake correlations, failing to align with real-world use cases. Addressing this issue requires additional features, new datasets, and the development of new solutions. However, the rapid advancements in ML and DL pose challenges for timely deployment, as training, testing, and evaluating new models against existing solutions can be time-consuming. The large size of real-world datasets also contributes to high computational costs and extended training times, limiting the practical use of ML-based NIDS in dynamic environments. To tackle these challenges, this paper contributes to the field of NIDS in three key aspects: employing Reinforcement Learning (RL) to accelerate and optimize the model tuning process; introducing an efficient data preprocessing pipeline specifically designed for NIDS, which enhances data quality and feature representation; and proposing a novel sampling strategy that determines an optimal dataset size both in terms of total records and class-level balance. By integrating model tuning with the proposed method on dataset sampling, this research uses a smaller sampling size of 3,898 records and achieves a higher F1 score of 93.20, compared to the state-of-the-art statistical sampling method on the same NIDS dataset.

Information sharing is a key practice in cybersecurity for coping with the ever-changing cyberattacks that are targeting computer systems. Thus, when cyber incidents happen, cyber threat intelligence (CTI) reports are prepared and shared among cybersecurity practitioners to help them get up-to-date information about those incidents. However, reading and analyzing the report text to comprehend the included information is a cumbersome process. Although techniques based on deep learning were proposed to speed up report analysis in order to obtain the enclosed essential information, such as attack path, training data insufficiency makes these methods inefficient in practical circumstances.This paper presents RAF-AG, a report analysis framework for attack path generation. To analyze CTI reports, RAF-AG utilizes the sentence dependency tree for entity and relation extraction, and a weak supervision approach for entity labeling. This is followed by graph building and graph alignment for generating the attack paths. Our approach resolves the data insufficiency problem in the cybersecurity domain by lowering the need for expert involvement. We evaluated RAF-AG by comparing the generated attack paths with those produced by AttacKG, a state-of-the-art automatic report analysis framework. RAF-AG was able to identify cyberattack steps by matching their appearance order inside the report, and link them with techniques from the MITRE ATT&CK knowledge base with an improved F1 score compared to AttacKG (0.708 versus 0.393).

This paper proposes a novel federated learning approach for improving IoT network intrusion detection. The rise of IoT has expanded the cyber attack surface, making traditional centralized machine learning methods insufficient due to concerns about data availability, computational resources, transfer costs, and especially privacy preservation. A semi-supervised federated learning model was developed to overcome these issues, combining the Shrink Autoencoder and Centroid one-class classifier (SAE-CEN). This approach enhances the performance of intrusion detection by effectively representing normal network data and accurately identifying anomalies in the decentralized strategy. Additionally, a mean square error-based aggregation algorithm (MSEAvg) was introduced to improve global model performance by prioritizing more accurate local models. The results obtained in our experimental setup, which uses various settings relying on the N-BaIoT dataset and Dirichlet distribution, demonstrate significant improvements in real-world heterogeneous IoT networks in detection accuracy from 93.98 ± 2.90 to 97.30 ± 0.49, reduced learning costs when requiring only 50% of gateways participating in the training process, and robustness in large-scale networks.

Penetration testing, or pentesting, refers to assessing network system security by trying to identify and exploit any existing vulnerabilities. Reinforcement Learning (RL) has recently become an effective method for creating autonomous pentesting agents. However, RL agents are typically trained in a simulated network environment. This can be challenging when deploying them in a real network infrastructure due to the lack of realism of the simulation-trained agents.In this paper, we present PenGym, a framework for training pentesting RL agents in realistic network environments. The most significant features of PenGym are its support for real pentesting actions, full automation of the network environment creation, and good execution performance. The results of our experiments demonstrated the advantages and effectiveness of using PenGym as a realistic training environment in comparison with a simulation approach (NASim). For the largest scenario, agents trained in the original NASim environment behaved poorly when tested in a real environment, having a high failure rate. In contrast, agents trained in PenGym successfully reached the pentesting goal in all our trials. Even after fixing logical modeling issues in simulation to create the revised version NASim(rev.), experiment results with the largest scenario indicated that agents trained in PenGym slightly outperformed, and were more stable, than those trained in NASim(rev.). Thus, the average number of steps required to reach the pentesting goal was 1.4 to 8 steps better for PenGym. Consequently, PenGym provides a reliable and realistic training environment for pentesting RL agents, eliminating the need to model agent actions via simulation.

Voice assistants (VAs), such as Amazon Alexa, are integrated with numerous smart home devices to process user requests using apps called skills. With their growing popularity, VAs also pose serious privacy concerns. Sensitive user data captured by VAs may be transmitted to third-party skills without users’ consent or knowledge about how their data is handled. Privacy policies are a standard medium to inform the users of the skills’ data practices. However, privacy policy compliance verification of such skills is challenging, since the source code is controlled by the skill developers, who can make arbitrary changes to the behaviors of the skill without being audited; hence, conventional defense mechanisms using static/dynamic code analysis can be easily evaded. In this paper, we present Eunomia, the first real-time privacy compliance firewall for Alexa skills. As the skills interact with the users, Eunomia hijacks and examines their communications from the skills to the users, and validates them against the published privacy policies that are parsed using a BERT-based policy analysis module. When non-compliant skill behaviors are detected, Eunomia stops the interaction and warns the user about the non-compliance. We evaluate Eunomia with 55,898 skills on Amazon skills store to demonstrate its effectiveness and to provide a privacy compliance landscape of Alexa skills.

Present era of massive use of the internet has brought us enormous access to information and knowledge, yet has exposed us to such cybersecurity threats as personal information fraudulency and theft. Therefore, to safely and beneficially use cyberspace’s information services, it is necessary and inevitable to raise awareness of cybersecurity. Aiming at building an environment to support cyberspace users in focusing and strengthening such awareness, we think that providing users with self-regulated learning courses about cybersecurity topics will be a practical approach. With that purpose in mind, in this paper, we introduce a framework for developing a gamification-based cybersecurity awareness course on the Moodle learning management system.

Design and management of networked systems, such as Information Technology/Network (IT/NW) or IoT systems, are inherently complex. Moreover, the need to adhere to security requirements adds even more complexity, as the manual audit and security mitigation of system design are time, skill, and labour intensive. In this paper, we present SecureWeaver, a secure system designer that generates a system design which meets functional, quantitative and security service requirements. SecureWeaver is based on the intent-based designer for IT/NW services named Weaver, and security support was implemented by improving the Weaver design stage via a threat mitigation knowledge base, specific refinement rules, and a security verification mechanism. A case study on video surveillance service requirements is used to illustrate the security threats and their mitigation during the automatic design process. Our results show that SecureWeaver is able to mitigate and verify the solutions from a security perspective without incurring a significant overhead: in our experiments, average overhead is 0.04% for systems with more than 100 elements. We also present a feature comparison with three other related systems that emphasizes the practical advantages of SecureWeaver.

Cybersecurity training is a key endeavour for ensuring that the IT workforce possess the knowledge and practical skills required to counter the ever-increasing cybersecurity threats that our society is faced with. While some related systems, such as Capture The Flag platforms, have been available for almost one decade, platforms that support full-fledged cybersecurity training exercises have only been released as open source in recent years. Given the complexity of such cybersecurity training platforms, the question that arises is how to meaningfully evaluate and compare their capabilities in order to identify the most suitable solution for a given type of organization and/or training activity. In this paper, we introduce a capability assessment methodology for cybersecurity training platforms that focuses on the three key aspects of training: content representation, environment management, and training facilitation. The assessment tool that we developed is used to evaluate two open-source cybersecurity training platforms, CyTrONE and KYPO. We then conduct a comparative analysis of these two platforms based on our first-hand developer experience with them, and discuss the lessons learned from implementing, deploying and using these platforms. The assessment tool and the detailed technical comparative analysis that we conducted are intended as instruments and references for anyone who plans to deploy or develop cybersecurity training platforms.

Opportunities, as well as challenges, accompany the development of new technologies, and the Internet of Things (IoT) is no exception. While most companies tout the benefits of IoT, challenges are often overlooked. Thus, IoT devices come in a variety of shapes, from small sensors to home routers and factory equipment, each with specific characteristics. While many of us own IoT devices, some may not even recognize them as such, let alone be able to manage them. This lead to a series of significant security incidents, such as the much-publicized Mirai botnet distributed denial-of-service cyberattack. The solution is to develop safer and more secure IoT systems, and in this paper we discuss first the methodology needed to train the developers of such systems for this purpose. We then present two training platforms that we designed and implemented following this methodology: IoTrain-Sim, which is based on the Cooja network simulator, and IoTrain-Lab, which uses the FIT IoT-LAB testbed as infrastructure. The two platforms include training content in the form of tutorials and predefined scenarios, both for fundamental and security IoT training, that the trainees can follow to gain an in-depth understanding of IoT via hands-on practice. The evaluation we conducted from functionality, performance and user perspectives demonstrates that our systems have several advantages compared to other approaches in terms of learner support, availability, extensibility, flexibility and scalability.

The smart grid is one of the core technologies that enable sustainable economic and social developments. In recent years, various cyber attacks have targeted smart grid systems, which have led to severe, harmful consequences. It would be challenging to build a real smart grid system for cybersecurity experimentation and validation purposes. Hence, analytical techniques, with simulations, can be considered as a practical solution to make smart grid cybersecurity experimentation possible. This paper first provides a literature review on the current state-of-the-art in smart grid attack analysis. We then apply graphical security modeling techniques to design and implement a Cyber Attack Analysis Framework for Smart Grids, named GridAttackAnalyzer. A case study with various attack scenarios involving Internet of Things (IoT) devices is conducted to validate the proposed framework and demonstrate its use. The functionality and user evaluations of GridAttackAnalyzer are also carried out, and the evaluation results show that users have a satisfying experience with the usability of GridAttackAnalyzer. Our modular and extensible framework can serve multiple purposes for research, cybersecurity training, and security evaluation in smart grids.