arXiv:2606. 31557v1 Announce Type: cross Abstract: In the evolving threat landscape, adversaries exploit software vulnerabilities to launch sophisticated attacks, challenging traditional defenses.
arXiv:2607. 19742v1 Announce Type: cross Abstract: Cyber Threat Intelligence (CTI) reports richly describe real-world attack processes, but their unstructured narratives cannot be directly used for automated attack-path reasoning.
arXiv:2608.28394v1 Announce Type: cross Abstract: Cyber threat intelligence (CTI) is foundational to modern cyber defense, yet much of it resides in unstructured reports whose volume and heterogeneit...
arXiv:2604. 04977v2 Announce Type: replace-cross Abstract: Software supply chain security compromises often stem from cascaded interactions of vulnerabilities, for example, between multiple vulnerable components.
arXiv:2607. 05001v1 Announce Type: cross Abstract: Cyber Threat Intelligence (CTI) reports are predominantly unstructured, heterogeneous, and noisy, which limits their direct usability for automated analysis and reasoning.
Athena is a graph-based system that identifies affected libraries for software vulnerabilities by modeling vulnerability databases as a knowledge graph and applying knowledge graph completion. It integrates CVEs, libraries, CWE types, CPE products, and software ecosystems, then predicts missing affected libraries using link prediction and refines results with a fine‑tuned LLM that incorporates graph embeddings. Experiments on the VulLib dataset show Athena outperforms four state‑of‑the‑art baselines, achieving a 32% higher average F1 score and demonstrating that a smaller KGC backbone can surpass larger LLM‑only approaches.
The paper introduces AUTOSIGMA, an automated system that converts unstructured cyber threat intelligence reports into Sigma detection rules. It enriches input data with a structured knowledge base, matches it against existing Sigma rule repositories, and uses a large language model as a judge to validate the generated rules. Experiments on real-world APT reports and security blogs show that AUTOSIGMA outperforms other methods in rule validity, relevancy, MITRE ATT&CK coverage, and robustness to input quality.
arXiv:2510. 11974v2 Announce Type: replace-cross Abstract: Cyber Threat Intelligence (CTI) is foundational to modern cybersecurity, enabling organizations to proactively defend against evolving threats.
arXiv:2509. 10482v2 Announce Type: replace-cross Abstract: The increasing sophistication of technology systems makes traditional threat modeling hard to scale, especially for small organizations with limited resources.
arXiv:2510. 26307v3 Announce Type: replace-cross Abstract: Anomaly detection is a critical task in cybersecurity, where identifying insider threats, access violations, and coordinated attacks is essential for ensuring system resilience.
arXiv:2608.23181v1 Announce Type: cross Abstract: As large language models (LLMs) continue to advance in coding capabilities, their potential in cybersecurity has drawn increasing research attention,...
The paper introduces AHLERT, a system that automatically extracts environment-aware hunt leads from Cyber Threat Intelligence reports. It combines a hybrid retriever—dense vector search plus multi-hop knowledge‑graph traversal seeded with MITRE ATT&CK—with ontology‑grounded retrieval‑augmented generation to constrain leads to a defender’s assets. Evaluations on public CTI reports show that AHLERT doubles mean F1 scores and achieves an effectiveness score of ~86.95% compared to off‑the‑shelf LLM models.
arXiv:2607. 16175v1 Announce Type: cross Abstract: Connected and Autonomous Vehicles (CAVs) rely on interconnected software and hardware components, including sensors, Electronic Control Units, in-vehicle infotainment systems, and telematics units, where vulnerabilities can compromise assets, users, and vehicle operations.