Cybersecurity

arXiv

PreprintarXiv · Computer Security·Oct 27, 2026

Structured Security Explanations for Learning-Based Vulnerability Detection

Software vulnerability detection remains difficult because existing approaches rely on predefined analysis rules, learn vulnerability patterns implicitly from code and labels, or use large language models (LLMs) to make the final security judgment. It remains unclear whether structured descriptions of security-relevant program behavior can improve supervised detection. We present VulnLens, an explanation-augmented framework for binary C/C++ vulnerability detection that separates program-behavior analysis from the final decision. A label-blind LLM-based Explainer examines each function from seven fixed perspectives: data flow, memory access, object lifetime, arithmetic and type behavior, control flow, shared state, and external-resource access. Without receiving vulnerability labels or CWE information, it generates structured explanations. A supervised Detector combines source code and explanations through sequential cross-attention. We evaluate VulnLens on a PrimeVul-derived dataset covering ten CWE categories and test transfer to SecVulEval without retraining. On the 526-function PrimeVul test set, VulnLens achieves 75.5% accuracy and 77.2% F1, exceeding DeepSeek V4 Pro by 4.2 percentage points in accuracy and Gemini 2.5 Pro by 2.2 points in F1. Matched explanations improve F1 by 7.3 points over a separately trained code-only detector. On SecVulEval, VulnLens achieves 66.4% accuracy and 65.8% F1, outperforming DeepSeek V4 Pro by 7.6 points in accuracy and 20.0 points in F1, and Gemini 2.5 Pro by 16.6 points in accuracy and 7.8 points in F1.

OA

PaperOpenAlex·Oct 28, 2026

Threat Detection on UNSW-NB15: Decision Tree, SVM and Random Forest (Bachelor Thesis Experiment Code)

Experiment code for the bachelor thesis “AI-Based Threat Detection in Cloud Environments: An Analysis of Machine Learning Approaches for Identifying Security Breaches in Computer Systems” (Vidhya Patel, B.Sc. Computer Science, IU International University of Applied Sciences, 2026). The Python script compares Decision Tree, Support Vector Machine and Random Forest classifiers on the UNSW-NB15 dataset (binary classification), with default and tuned settings over five random seeds (the deterministic default SVM is run once), and reports accuracy, precision, recall, F1-score, specificity, AUC-ROC, and training and prediction times. results.zip contains the unchanged output of the run reported in the thesis. The dataset is not included; see README.md for how to download it and run the code.

OA

PaperOpenAlex·Oct 28, 2026

EL-RAKHAWI UNIFIED FRAMEWORK FOR SEAMLESS AIRPORT SECURITY: BIOMETRIC BEHAVIORAL AI AND ELECTROMAGNETIC INTERFERENCE ISOLATION

The El-Rakhawi Unified Framework for Seamless Airport Security (DOI: 10.5281/zenodo.23736280) transforms aviation security through two synergistic pathways that eliminate intrusive checkpoints and electromagnetic interference. Pathway 1 introduces Smart Security Corridors using remote photoplethysmography (rPPG) and Physics-Informed Blind Source Separation (PI-BSS) to extract vital signs and micro-expressions from walking passengers without stopping. The Modified Beer-Lambert Law constrains the optical signal extraction, while the Biometric Behavioral Confidence Index (BBCI) quantifies threat detection reliability: BBCI = (S_signal_quality * S_behavioral_normalcy) / (1 + S_environmental_noise + S_privacy_risk) A BBCI > 0.90 enables seamless passage; < 0.30 triggers secondary verification. Pathway 2 employs Deep Reinforcement Learning for Adaptive Spectral Isolation, dynamically nullifying 5G/6G electromagnetic interference that threatens aviation navigation and security scanners. The dimensionally homogeneous reward function optimizes Signal-to-Interference-plus-Noise Ratio in real-time. The Electromagnetic Spectral Purity Index (ESPI) exceeds 0.98, guaranteeing mathematical certainty in scanner operation. Key innovations:- Continuous biometric flow replacing static checkpoints- Federated Learning ensuring privacy protection- 70% reduction in passenger processing time- Zero false negatives for behavioral anomalies- Deterministic safe mode fallback for AI failures Commercial licensing: Three tiers (Aviation Infrastructure 5-15M USD + 3-5% royalty, Technology Integrator 10-25M + 1.5-3%, Sovereign 20-50M + 5-8%). 24-month implementation roadmap from algorithmic development to global standardization, establishing BBCI and ESPI as new international security metrics. This framework creates an invisible, intelligent shield protecting human life while respecting dignity, powered by applied mathematics and physics.

OA

PaperOpenAlex·Oct 28, 2026

Security Risks in AI Systems

The fraud alert came through on a Thursday afternoon. A member had reported a series of transactions she had not allowed; small purchases at unfamiliar retailers, each just below the threshold that would have triggered the credit union's fraud detection system automatically. The pattern was deliberate: someone had tested the AI fraud model's detection boundary and was exploiting it systematically.

arXiv

PreprintarXiv · Computer Security·Oct 27, 2026

When POST Becomes GET: Investigating HTTP Method Interchangeability and Its Security Implications

HTTP method semantics are a common boundary between safe retrieval and state-changing operations; however, deployed web applications do not always enforce this boundary consistently. In this paper, we study HTTP method interchangeability, a behavior where a POST request can be rewritten as a GET request to the same endpoint, with POST body parameters moved into the query string, while preserving an equivalent observed response. We present Method Interchange Detection Engine (MIDE), an automated pipeline that crawls web applications in a browser, records POST requests generated by page loads and user-interface interactions, converts supported POST bodies into GET candidates, and compares replayed responses with the original POST response. To avoid counting generic or parameter-independent responses as interchangeable, MIDE also sends a no-query GET baseline. We treat as high-confidence evidence of interchangeability only the cases where the converted GET matches the POST, while the baseline does not. We perform a large-scale unauthenticated experiment on the Tranco top 10k. We find high-confidence interchangeable requests on 407 of 10,000 tested sites (4.1%), 407 of 3,200 sites with captured POSTs (12.7%), and 407 of 2,734 sites with replayed POSTs (14.9%). A targeted Cross-Site Request Forgery (CSRF) token-replay check finds cases where invalid tokens are rejected for POST but accepted for the equivalent GET. We also observe Web Cache Deception (WCD) conditions and cacheable GET responses for interchangeable request instances. These results demonstrate that method interchangeability is observable in real web applications and can expose method-scoped defense gaps.

OA

PaperOpenAlex·Oct 29, 2026

Digital resilience of an organization in risk management

Objectives The study aimed to assess how implemented protection and monitoring measures in an ICT environment strengthen organisational resilience in security science terms - namely the ability to maintain operational continuity, reduce vulnerabilities and disruption impacts, and improve early detection and assessment of security-threatening events. Material and methods This study used a practical approach, combining an in-depth case analysis with a hands-on simulation. The team designed an ICT environment featuring separate zones with different trust levels and specific access-control rules. They then tested the setup by simulating system failures, assessing the effectiveness of zone separation and access controls, and running realistic scenarios involving attempts at unauthorised access and privilege escalation. Data included connectivity continuity metrics (latency, packet loss) and SIEM-registered events and alerts. Results The organisation demonstrated greater effectiveness in handling disruptions and threats. When failures occurred, only a brief dip in connectivity was observed (about 8% packet loss), and the system’s access controls and network segmentation prevented all unauthorised communication attempts from reaching the network during testing. At the same time, the monitoring tools helped the team quickly spot and categorise events that could lead to security incidents. This made it easier to stay aware of what was happening and to respond quickly when needed. Conclusions In conclusion, the steps taken created a strong security system that reduced risks, prevented problems from worsening, and helped spot threats earlier. Because of these measures, the organisation is better prepared to keep its services running, control access, and handle incidents, which means fewer disruptions and less damage to its reputation.

arXiv

PreprintarXiv · Computer Security·Oct 28, 2026

Adversarial Process Disturbances at a Deployable Alarm Budget: Detector Evaluation on a Simulator and a Real Plant

Industrial anomaly detection is evaluated largely on simulators, and recent work reports large drops, with unstable rankings, on real plant data. We ask whether that extends to the security case. We evaluate eleven detectors across classical, neural, dependency and causal families on a simulated chemical process and a sodium thermal-hydraulic facility: different processes sharing no equipment, but both continuous, at steady state, and perturbed only through temperature, pressure, flow and valve, never composition. Three conditions prior work does not cover: disturbances authored against a threat model rather than native faults; one construction applied to both processes; and detection read at a declared false-alarm budget. The drop persists throughout. The simulator panel looks deployable, neural matching classical; on plant telemetry detection collapses and the neural family trails, a gap that in-sample thresholds likely understate. Which detector wins transfers between the two processes; how often it fires does not. Two results hold on both. Sequential valve manipulation defeats the whole panel: at tier 2 no detector flags more than 0.17 of its perturbed samples, against 0.89 or better for most disturbances. And the plant's collapse is not merely that its disturbances are weaker, though they are by about twelvefold; matched on measured strength, the plant is never the better detected.

OA

PaperOpenAlex·Oct 28, 2026

Arabic-CT-Phish: A Proactive Domain-Level Dataset with Certificate Transparency and Regional Arabic Similarity Attributes

Dataset Summary:The Arabic-CT-Phish dataset is a curated, domain-level benchmark designed for early-stage proactive phishing detection. Derived from raw uniform resource locators (URLs) and real-time Certificate Transparency (CT) log streams, this dataset shifts detection focus to the pre-attack infrastructure setup phase at the point of SSL/TLS certificate issuance.Key Features & Contents:The dataset comprises apex domain records enriched with a multi-dimensional feature suite spanning:Certificate Transparency Metadata: TLS/SSL certificate attributes, issuer dynamics, lifetime duration, and SAN counts.Structural & Lexical Properties: Subdomain counts, Shannon entropy, character lengths, special character ratios, and hyphenation patterns.Regional Arabic Similarity Features: Specialized string distance and lexical similarity metrics evaluating domain alignment against legitimate regional and Arabic-language web services to identify localized brand impersonation and targeted typos-quatting.Use Cases:Suitable for evaluating supervised machine learning, ensemble classifiers (e.g., Random Forest, XGBoost), anomaly detection, and early-warning security operations center (SOC) integration models targeted at regional cyber threat ecosystems.

OA

PaperOpenAlex·Oct 28, 2026

Cyber Threat Intelligence and Incident Reporting

Safeguarding critical infrastructures (CIs) from cyber threats requires the ability to transform diverse security data into timely, actionable intelligence that supports both rapid incident response and the continuity of essential services. In highly interconnected sectors such as energy, telecommunications, healthcare, and transport, this capability must balance operational relevance, privacy preservation, and compliance with evolving regulations. This chapter presents CTI4BC, a privacy-aware, operator-centric cyber threat intelligence (CTI) and information sharing platform developed within the DYNABIC framework to address these needs. CTI4BC integrates alerts from detection tools, risk assessment results, incident response data, and external CTI feeds into a unified MISP-based format, applying configurable privacy-preserving transformations before dissemination. Evaluation results show that CTI4BC meets demanding operational targets, while maintaining compliance with the NIS2 Directive. By enriching intelligence with risk profiles and cascading effect analysis, the platform bridges the gap between detection and decision-making, enabling collaborative defense among stakeholders and reducing the likelihood of service disruption. The chapter details CTI4BC’s architecture, implementation, and compliance assessment, concluding with future directions including full automation, expanded interoperability, and advanced anonymization for unstructured data.

OA

PaperOpenAlex·Oct 28, 2026

Evolving Cyber Threats, Cyber Frauds, and Attacks: Strategies for Mitigation

Rapid digitalization has increased reliance on interconnected systems, exposing sectors to cyber threats and fraud involving software vulnerabilities, credential theft, social engineering, ransomware, cloud misconfigurations, thirdparty risks, and AI-generated deception.This narrative review examines emerging threats, their impacts, and a layered defense framework integrating identity security, patching, monitoring, data protection, user awareness, incident response, and recovery.It also considers responsible AI-based threat detection and associated adversarial and privacy risks.Drawing on public guidance and threat reports.This paper presents overview of cybersecurity, cybersecurity threats/attacks cyber frauds, the presents the related work, then describes the Evolution of Cybersecurity, Cyber Threats and Cybercrimes: From 1960 to the Present, Current Cyber Threats and Cyber Frauds, Impact of Cyber Incidents, and along with Strategies for Mitigation.