Large language models (LLMs) like ChatGPT are increasingly leveraged in diverse applications. This study explores the integration of ChatGPT with machine learning models (LLM + m) to develop dual-model systems for intrusion detection-covering host-based (HIDS) and network-based (NIDS) systems-and image classification. By employing ChatGPT for data preprocessing and model generation, we evaluated the systems' robustness against a range of adversarial attacks, including hypnotic attacks targeting the LLM, traditional adversarial attacks on ML models, and combined attacks affecting both. To counter these threats, we implemented adversarial training, ensemble models, and robustness prompts, significantly enhancing system resilience. Experimental results showed that combined attacks caused F1 score drops of up to 50 %, exposing critical vulnerabilities in dual-model systems. However, the proposed defenses reduced these losses to approximately 5 %, demonstrating their effectiveness in securing LLM-based dual-model systems against increasingly sophisticated adversarial threats.

The Internet of Things (IoT) produces vast amounts of data, and integrating AI improves recognition efficiency, giving rise to artificial intelligence of things (AIoT). To reduce development and maintenance costs, service providers now offer AIoT as a service (AIoTaS). However, AIoTaS faces two key challenges: automating accurate AI model configuration and optimizing resource allocation with fast task assignment. To address these, we propose Auto-AIoTaS, which automates model setup using neural architecture search (NAS) and Bayesian optimization, and employs reinforcement learning (RL) to manage capacity and task allocation efficiently. Experimental results demonstrate that our automated AI model configuration approach significantly improves classification and regression performance. In the classification task on the CIFAR-100 dataset, the accuracy increases from 68.8% with VGG19 and 72.8% with ResNet18 to 81.1%. Furthermore, employing RL for capacity allocation reduces decision-making time from 113 s to 0.1 ms, compared to the traditional simulated annealing (SA) algorithm. These findings highlight the effectiveness of Auto-AIoTaS in enhancing both model performance and resource efficiency, making it a scalable and adaptive solution for AIoTaS service providers.

The growing sophistication of cyberattacks, accelerated by large language models (LLMs), highlights the limitations of traditional honeypots, which often lack realism, require heavy maintenance, and rely on static deception strategies. Recent LLM-based honeypots generate fluent, context-aware responses but cannot adapt to evolving attacker behavior, limiting long-term effectiveness. This work presents an adaptive honeypot that integrates reinforcement learning (RL) with LLM-generated deception, aligning state, reward, and action spaces with the MITRE ATT&CK and MITRE Engage frameworks. A finetuned LLM infers attacker tactics, techniques, and procedures (TTPs) from live command sequences, providing semantically rich states for the RL agent, which then selects context-sensitive actions from Engage’s Affect strategies to guide adversaries toward deeper and higher-value engagement. Evaluated on Linux and Windows testbeds, the system achieved a 23% increase in cumulative engagement reward on Windows over a non-RL baseline (p < 0.001). Ablation over five random seeds shows that replacing the learned policy with random action selection over the same action space collapses attack depth from 9.52 to 4.25 on Linux (p < 0.001), confirming that the learned policy, not the action space alone, drives engagement. Intent analysis accuracy improved by 55 percentage points relative to a rule-based baseline (Wazuh), and LLM-generated responses fell within 10 percentage points of a real system, a substantially smaller gap than Cowrie, an ordering confirmed by an independent cross-family judge. These results demonstrate that RL-driven adaptation, combined with LLM realism and standardized engagement frameworks, enables honeypots that sustain realistic, intelligence-rich interactions and enhance threat analysis without compromising system safety.

This article presents COMAT, a cybersecurity ontology based on the MITRE ATT&CK framework for enhanced knowledge access and analysis. COMAT derives inference paths to identify adversarial techniques and includes forward- and backward-query modules for efficient, comprehensive Cyber Threat Intelligence (CTI) analysis.

Traditional honeypots in Industrial Control Systems (ICS) often fail to sustain attacker engagement, exposing their deception after a few predictable responses and limiting visibility to early reconnaissance. This weakness reduces their value for defenders seeking insight into later stages of the kill chain. To address this, we propose an adaptive honeypot that embeds reinforcement learning (RL) into an ICS honeypot, enabling it to shape responses in real time based on attacker behavior. Guided by the MITRE ATT&CK for ICS framework, each network interaction is mapped to a tactic, and the RL agent applies tabular Q-learning to select deception strategies such as delaying, modifying, or blocking ICS protocol messages to drive sessions deeper into the attack chain. We evaluated the system using scripted Metasploit-based attacks derived from MITRE Campaigns across three honeypot configurations: Static0 (default ICS honeypot), Static1 (modified Modbus handler to support uncommon but valid function codes), and Dynamic (RL-driven honeypot). Results show that while static honeypots stall at tactic levels 4 and 7, the RL-driven honeypot reaches the latest tactic within 700 attack–response cycles and more than doubles the average engagement time. Even in the first 400 sessions, a small portion of attacks already reach the final tactic, providing early threat intelligence. These findings show that an RL-enhanced honeypot can adapt autonomously, extract deeper threat intelligence, and give defenders broader visibility across ICS tactics.

Financial vision technique, which converts one-dimensional (1D) stock time-series data into two-dimensional (2D) images to capture latent patterns and temporal relationships in the market, has shown excellent performance in stock prediction. However, previous financial vision research has yet to incorporate news data even previous studies proved that news data can enhance prediction accuracy. Consequently, effectively integrating market data and news data within financial vision to improve stock trend prediction remains a significant challenge. This paper proposes the Integrated Market data and news Sentiment (IMS) method, which first uses a Large Language Model (LLM) to extract sentiment scores from financial news. All features including market data and news sentiment are individually transformed into 2D images and integrated into an overall image, which serves as input for training a Convolutional Neural Network. Experiments conducted on Taiwan Semiconductor Manufacturing Company (TSMC) stock show that the IMS method outperforms LSTM, which accounts for time series but does not incorporate financial vision techniques, by 4.75%, and is 30.08% better than approaches that apply financial vision but consider only market data. Also using the stack layout to combine market data images and news sentiment images achieves the best performance, reaching an accuracy of 51.16%.

The increasing deployment of Edge–IoT networks intensifies the need for robust and privacy-preserving malware detection solutions. However, such environments are characterized by highly heterogeneous and non-independent and identically distributed (non-IID) data distributions, limited computational resources, and strict privacy constraints, which collectively hinder the effectiveness of conventional centralized and federated learning (FL) approaches. Although transformer models and FL have independently shown promise for intrusion detection, their joint potential under statistical heterogeneity remains insufficiently explored. This work proposes a Personalized Transformer-based Federated Transfer Learning (PTFTL) framework designed for efficient and adaptable malware detection in Edge–IoT environments. The proposed model introduces a lightweight projection layer that enables effective attention over raw traffic data while reducing computational burden. Personalization is achieved by keeping selected model components local to each device, thereby improving robustness under heterogeneous data distributions. Experimental results demonstrate that PTFTL substantially improves stability and detection performance under severe non-IID conditions. Specifically, the inclusion of the projection layer enhances resilience to model collapse by up to 38%, whereas replacing it with a traditional embedding reduces stability by at least 10%, highlighting the critical role of the projection design in federated transformer models.

Inferring causal relationships between entities and events is essential for accelerating root cause analysis in cybersecurity incidents. This capability is particularly critical in cyber threat intelligence, where identifying which entities trigger events and which are affected enables rapid and effective responses. However, most existing causal inference research primarily focuses on event-to-event causality, overlooking the relationships between entities and individual events. To bridge this gap, we constructed a specialized dataset designed to analyze causal relationships between entities and cyber threat events. We then proposed a causal inference model based on a BERT-based multi-layer stacked architecture (MLSA) and trained it using the constructed dataset. To assess its effectiveness, we compared its performance with that of large language models (LLMs) for causal inference. Experimental results demonstrate that the proposed MLSA model outperforms the state-of-the-art GPT-4o, achieving an average F1-score improvement of approximately 38%. Additionally, MLSA achieves a competitive F1-score in causal inference compared to GPT o3-mini while delivering an 11% improvement in effect relation inference. These findings highlight the effectiveness of our approach, introducing a novel and robust model for event-entity causality analysis in cyber threat intelligence.

The rise of AI solutions has driven the emergence of AI as a Service (AIaaS), offering cost-effective and scalable solutions by outsourcing AI functionalities to specialized providers. Within AIaaS, three key components are essential: segmenting AI services into preprocessing, training, and inference tasks; utilizing GPU-CPU heterogeneous systems where GPUs handle parallel processing and CPUs manage sequential tasks; and minimizing latency in a distributed architecture consisting of cloud, edge, and fog computing. Efficient task scheduling is crucial to optimize performance across these components. In order to enhance task scheduling in AIaaS, we propose a user-experience-and-performance-balanced reinforcement learning (UXP-RL) algorithm. The UXP-RL algorithm considers 11 factors, including queuing task information. It then estimates resource release times and observes previous action outcomes, to select the optimal AI task for execution on either a GPU or CPU. This method effectively reduces the average turnaround time, particularly for rapid inference tasks. Our experimental findings show that the proposed RL-based scheduling algorithm reduces average turnaround time by 27.66% to 57.81% compared to the heuristic approaches such as SJF and FCFS. In a distributed architecture, utilizing distributed RL schedulers reduces the average turnaround time by 89.07% compared to a centralized scheduler.

An Intrusion Detection System (IDS) employing machine learning (ML) solutions is crucial for identifying network intrusions. To minimize operational expenses and enhance performance, enterprises have begun outsourcing IDS management to service providers, giving rise to the concept of Intrusion Detection as a Service (IDaS). Earlier research primarily aimed at enhancing the accuracy of ML-based IDS models or expediting their computational process. However, from the service provider's perspective, an optimal architecture ensuring minimal computation cost and processing delay is crucial to increasing revenue. This study evaluates the performance of IDaS in a multi-tier architecture, utilizing traffic split offloading to enhance performance by mapping three in-sequence ML-based IDS tasks (pre-processing, binary detection, multi-class classification) to the architectures as the offloading destinations. We employ a simulated annealing-based traffic offloading and cost allocation (SA-TOCA) algorithm to determine the offloading ratio for each traffic path and the cost requirements for each tier. The results indicate that the edge-cloud architecture is 15% and four times more cost-effective compared to the fog-edge and fog-cloud architectures, respectively, and it demonstrates superior performance in minimizing processing delays. Offloading the majority of traffic to the edge and the remainder to the cloud proves to be an efficient strategy, reducing both computation costs and average delays.

Control Area Networks (CAN) face serious security threats recently due to their inherent vulnerabilities and the increasing sophistication of cyberattacks targeting automotive and industrial systems. This paper focuses on enhancing the security of CAN, which currently lack adequate defense mechanisms. We propose integrating Machine Learning-based Intrusion Detection Systems (ML-based IDS) into the network to address this vulnerability. However, ML systems are susceptible to adversarial attacks, leading to misclassification of data. We introduce three defense combination methods to mitigate this risk: adversarial training, ensemble learning, and distance-based optimization. Additionally, we employ a simulated annealing algorithm in distance-based optimization to optimize the distance moved in feature space, aiming to minimize intra-class distance and maximize the inter-class distance. Our results show that the ZOO attack is the most potent adversarial attack, significantly impacting model performance. In terms of model, the basic models achieve an F1 score of 0.99, with CNN being the most robust against adversarial attacks. Under known adversarial attacks, the average F1 score decreases to 0.56. Adversarial training with triplet loss does not perform well, achieving only 0.64, while our defense method attains the highest F1 score of 0.97. For unknown adversarial attacks, the F1 score drops to 0.24, with adversarial training with triplet loss scoring 0.47. Our defense method still achieves the highest score of 0.61. These results demonstrate our method’s excellent performance against known and unknown adversarial attacks.

Cyber Threat Intelligence (CTI) reports provide valuable insights into cybersecurity attack techniques, which are essential for understanding threat execution. Identifying the root causes of these techniques is crucial for developing effective defense mechanisms. However, the unstructured nature and inconsistent terminology of CTI reports pose significant challenges in extracting causal factors, such as Common Weakness Enumerations (CWEs) and vulnerable data components, limiting proactive responses and the understanding of attack interdependencies. To address these challenges, we propose TRACE, a novel framework that extracts causal factors linked to adversarial techniques and generates comprehensive causal graphs revealing interdependencies within CTI reports. TRACE combines pattern extraction and tagging methods to address the limitations of existing approaches. Utilizing Sentence-based Bidirectional Encoder Representations from Transformers (SBERT) embeddings enhanced with knowledge mappings and deep learning techniques, TRACE discovers and models causal relationships between attack techniques within the reports. By bridging the gap between attack techniques and their underlying vulnerabilities, TRACE provides actionable insights to enhance cybersecurity defenses. Evaluated on 710 CTI reports, TRACE achieved an F1 score of 0.87, demonstrating its accuracy in extracting causal factors and its potential to advance automated causal analysis in cybersecurity.

P4 programmable switches typically consist of multiple computation stages, each capable of independently executing flow rules to achieve the desired network function (NF). A network function chain (NFC) can be implemented to provide a network service by concatenating a set of NFs. This paper focuses on studying the stage-to-NF assignment problem in multistage P4 switches. We propose a greedy-based stage assignment algorithm that has been proven to optimally solve such resource allocation problems. The algorithm's key feature is its ability to address load imbalances among the NFs by considering both the packet arrival and service rates of the NFs. During each iteration of the algorithm's execution, a set of stage assignments needs to be evaluated. To efficiently determine the average packet delay for each assignment, we have developed a queuing model and derive an analytical solution. The analytical results are verified through simulation, and the gap between them is found to be negligible. Additionally, the simulation results demonstrate the algorithm's superiority in handling load imbalances among NFs. The algorithm efficiently assigns stages such that, for a set of NFCs with a constant total input rate, altering the distribution of arrival rates among the NFCs results in similar average delays. The experimental instances indicate that the variation in delay remains within 8% after altering the arrival rate distribution among the NFCs. Furthermore, we implemented a benchmark named "Equal Stage Assignment" in which each NF is assigned an equal number of stages. Compared to the Equal Stage Assignment algorithm, the proposed stage assignment algorithm can reduce the average delay by more than 20%, particularly in cases where the loads between NFs are imbalanced.

Software-defined Networking (SDN) is making its mark in the operator networks. The latest generation of SDN switches supporting paradigms such as P4, are paving the way for complete data plane programmability. Though P4 switches enable some newer applications, they do not provide the same agility and scalability offered through fully programmable softwarized data planes of Virtual Network Functions (VNFs). This paper argues that to achieve substantial performance benefits, an operator can take advantage of deploying P4 switches alongside VNFs. The idea is to use the P4 switch as a default packet handler, whereas traffic can be offloaded to an off-site VNF when queues at the switch start to build. To this end, this paper first models the queuing behavior of a networked system with a P4 switch and a VNF to determine the queuing delay induced by such a hybrid architecture. While doing so, the paper considers two different cases of homogeneous and heterogeneous traffic patterns. Subsequently, the paper proposes algorithms for finding optimal traffic offloading, leading to overall delay minimization. The paper showcases significant performance gains of optimally offloading traffic from a P4 switch to a VNF amidst changes in disparate traffic and network parameters through simulations and analytical results. For instance, at moderate loads of homogeneous traffic, optimal offloading yields performance gains of up to 76.44% over a scenario where a P4 switch handles all the packets. For heterogeneous traffic patterns, the results show that the dominant flow’s workload and average packet size can significantly impact the offloading performance.

Machine Learning-based Intrusion Detection Systems (ML-IDS) rely on high-quality datasets with structured labels to effectively identify complex and evolving cyber threats. However, most existing IDS datasets rely on single data sources and coarse labels, which restrict their ability to accurately model multi-stage adversarial behavior. To address these issues, we proposed AR-MANO (Attack Reproduction with Management and Orchestration), a modular framework for orchestrating synchronized attack reproduction and data collection from various sources, including accounting, Syslog, and traffic. AR-MANO enables the creation of the CREMEv3 dataset, a scalable, multi-source IDS dataset labeled with MITRE ATT&CK techniques and the attack lifecycle. We evaluated CREMEv3 using eight machine learning classifiers and obtained average F1-scores of 0.6483 for technique classification and 0.5410 for lifecycle classification without feature selection. After applying feature selection, these scores improved to 0.9572 and 0.8317, respectively. CREMEv3 outperformed CIC-IDS2017, CSE-CIC-IDS2018, and UNSW-NB15, with a class imbalance ratio of about 0.1, class entropy of 0.56, and a Gini coefficient of approximately 1.0. CREMEv3 provides a robust and scalable foundation for the development and evaluation of ML-based IDS.

Non-rigid deformation presents a significant challenge in image processing, as most existing techniques excel only under affine transformations but perform poorly when handling complex deformations, such as stretching, bending, or other irregular distortions. This paper addresses this challenge by introducing a robust pipeline for precise image comparison under non-rigid deformation. We combine image simplification, connectivity recovery, and thinning to preserve structural integrity. The preprocessing phase reduces noise and enhances edges, while the Douglas-Peucker algorithm simplifies the data. AKAZE descriptors and FLANN-based matching, optimized with Lowe's ratio test, are used for accurate feature matching.

The integration of artificial intelligence (AI) with the Internet of Things (IoT) marks a significant advancement in sixth-generation (6G) networks. The complexity of these AIoT services has promoted an as-a-service model, where service providers offer tailored architectures to meet varied application needs. Despite the critical importance of optimizing both training and inference in service architectures, this aspect remains under-explored. Our study introduces service scenarios such as ’no shared (NS)’, where tenants manage their data and models independently’, data shared (DS)’, where tenants provide data for collective training, and ’parameter sharing (PS)’, where only model parameters are shared. We utilize a tandem queue model to simulate the communication and computing demands across cloud-edge-fog architectures. Our proposed Cost and Delay Resource Allocation (CDRA) method significantly reduces costs, with edge and fog-based training and inference lowering costs by up to 44% compared to cloud setups. The evaluation shows that the NS scenario is resource-intensive but offers high privacy, DS is cost-effective and improves model accuracy, and PS balances privacy with longer wait times. These findings provide service providers with a comprehensive comparison of service scenarios and architectures, offering guidance for strategic and economically sound decisions in the ever-evolving landscape of AIoT.

Insurance serves as a critical financial planning tool and a safeguard against unexpected events in modern society. However, insurance policies are often complex and lack transparency, making it challenging even for close family members to access clear and accurate information. In situations where a family member experiences a sudden illness or passes away, relatives frequently encounter difficulties in quickly obtaining the relevant policy details. This information gap can lead to unawareness of the policy's existence or misunderstanding of its terms, potentially resulting in the loss of rightful benefits and entitlements. This paper introduces a novel family insurance policy inquiry system leveraging blockchain technology and smart contracts. The proposed system called “ChainSure” addresses critical challenges in traditional insurance policy management, including lack of transparency, limited accessibility, and potential data tampering. By storing insurance policies on a decentralized blockchain, the system ensures data immutability and enhances trust among family members. Smart contracts are employed to automate policy verification and query processes, enabling secure and efficient information retrieval. Family members can seamlessly access policy details while maintaining strict data privacy through role-based permissions. This study outlines the system's design, implementation, and potential to revolutionize the way insurance policies are managed and accessed within a family context. The results highlight its scalability, security, and practicality for real-world adoption, demonstrating its capacity to improve transparency and foster trust in family insurance management.

Traffic offloading is crucial for reducing computing latency in distributed edge systems such as vehicle-to-everything (V2X) networks, which use roadside units (RSUs) and access network mobile edge computing (AN-MEC) with ML agents. Traffic offloading is part of the control plane problem, which requires fast decision-making in complex V2X systems. This study presents a novel ratio-based offloading strategy using the twin delayed deep deterministic policy gradient (TD3) algorithm to optimize offloading ratios in a two-tier V2X system, enabling computation at both RSUs and the edge. The offloading optimization covers both vertical and horizontal offloading, introducing a continuous search space that needs fast decision-making to accommodate fluctuating traffic in complex V2X systems. We developed a V2X environment to evaluate the performance of the offloading agent, incorporating latency models, state and action definitions, and reward structures. A comparative analysis with metaheuristic simulated annealing (SA) is conducted, and the impact of single versus multiple offloading agents with deployment options at a centralized central office (CO) is examined. Evaluation results indicate that TD3's decision time is five orders of magnitude faster than SA. For 10 and 50 sites, SA takes 602 and 20,421 seconds, respectively, while single-agent TD3 requires 4 to 24 milliseconds and multi-agent TD3 takes 1 to 3 milliseconds. The average latency for SA ranges from 0.18 to 0.32 milliseconds, single-agent TD3 from 0.26 to 0.5 milliseconds, and multi-agent TD3 from 0.22 to 0.45 milliseconds, demonstrating that TD3 approximates SA performance with initial training.

Existing Intrusion Detection System (IDS) relies on pre-trained models that struggle to keep pace with the evolving nature of network threats, as they cannot detect new types of network attacks until updated. Cyber Threat Intelligence (CTI) is analyzed by professional teams and shared among organizations for collective defense. However, due to its diverse forms, existing research often only analyzes reports and extracts Indicators of Compromise (IoC) to create an IoC Database for configuring blocklists, a method that attackers can easily circumvent. Our study introduces a unified solution named Dynamic IDS with CTI Integrated (DICI), which focuses on enhancing IDS capabilities by integrating continuously updated CTI. This approach involves two key AI models: the first serves as the IDS Model, detecting network traffic, while the second, the CTI Transfer Model, analyzes and transforms CTI into actionable training data. The CTI Transfer Model continuously converts CTI information into training data for IDS, enabling dynamic model updates that improve and adapt to emerging threats dynamically. Our experimental results show that DICI significantly enhances detection capabilities. Integrating the IDS Model with CTI in DICI improved the F1 score by 9.29% compared to the system without CTI, allowing for more effective detection of complex threats such as port obfuscation and port hopping attacks. Furthermore, within the CTI Transfer Model, involving the ML method led to a 30.92% F1 score improvement over heuristic methods. These results confirm that continuously integrating CTI within DICI substantially boosts its ability to detect and respond to new types of cyber attacks.