Ying-Dar Lin

Inferring causal relationships between entities and events is essential for accelerating root cause analysis in cybersecurity incidents. This capability is particularly critical in cyber threat intelligence, where identifying which entities trigger events and which are affected enables rapid and effective responses. However, most existing causal inference research primarily focuses on event-to-event causality, overlooking the relationships between entities and individual events. To bridge this gap, we constructed a specialized dataset designed to analyze causal relationships between entities and cyber threat events. We then proposed a causal inference model based on a BERT-based multi-layer stacked architecture (MLSA) and trained it using the constructed dataset. To assess its effectiveness, we compared its performance with that of large language models (LLMs) for causal inference. Experimental results demonstrate that the proposed MLSA model outperforms the state-of-the-art GPT-4o, achieving an average F1-score improvement of approximately 38%. Additionally, MLSA achieves a competitive F1-score in causal inference compared to GPT o3-mini while delivering an 11% improvement in effect relation inference. These findings highlight the effectiveness of our approach, introducing a novel and robust model for event-entity causality analysis in cyber threat intelligence.

Traditional honeypots in Industrial Control Systems (ICS) often fail to sustain attacker engagement, exposing their deception after a few predictable responses and limiting visibility to early reconnaissance. This weakness reduces their value for defenders seeking insight into later stages of the kill chain. To address this, we propose an adaptive honeypot that embeds reinforcement learning (RL) into an ICS honeypot, enabling it to shape responses in real time based on attacker behavior. Guided by the MITRE ATT&CK for ICS framework, each network interaction is mapped to a tactic, and the RL agent applies tabular Q-learning to select deception strategies such as delaying, modifying, or blocking ICS protocol messages to drive sessions deeper into the attack chain. We evaluated the system using scripted Metasploit-based attacks derived from MITRE Campaigns across three honeypot configurations: Static0 (default ICS honeypot), Static1 (modified Modbus handler to support uncommon but valid function codes), and Dynamic (RL-driven honeypot). Results show that while static honeypots stall at tactic levels 4 and 7, the RL-driven honeypot reaches the latest tactic within 700 attack–response cycles and more than doubles the average engagement time. Even in the first 400 sessions, a small portion of attacks already reach the final tactic, providing early threat intelligence. These findings show that an RL-enhanced honeypot can adapt autonomously, extract deeper threat intelligence, and give defenders broader visibility across ICS tactics.

The Internet of Things (IoT) produces vast amounts of data, and integrating AI improves recognition efficiency, giving rise to artificial intelligence of things (AIoT). To reduce development and maintenance costs, service providers now offer AIoT as a service (AIoTaS). However, AIoTaS faces two key challenges: automating accurate AI model configuration and optimizing resource allocation with fast task assignment. To address these, we propose Auto-AIoTaS, which automates model setup using neural architecture search (NAS) and Bayesian optimization, and employs reinforcement learning (RL) to manage capacity and task allocation efficiently. Experimental results demonstrate that our automated AI model configuration approach significantly improves classification and regression performance. In the classification task on the CIFAR-100 dataset, the accuracy increases from 68.8% with VGG19 and 72.8% with ResNet18 to 81.1%. Furthermore, employing RL for capacity allocation reduces decision-making time from 113 s to 0.1 ms, compared to the traditional simulated annealing (SA) algorithm. These findings highlight the effectiveness of Auto-AIoTaS in enhancing both model performance and resource efficiency, making it a scalable and adaptive solution for AIoTaS service providers.

In the realm of cybersecurity, the extraction of Cyber Threat Intelligence (CTI) is vital for acquiring accurate Tactics, Techniques, and Procedures (TTPs) and Indicators of Compromise (IoC) from reputable sources. The extracted CTI must be evaluated to ensure high quality, and different CTI platforms, such as VirusTotal, AlienVault, and MetaDefender, often yield varying evaluations. A robust method is required that automatically extracts CTI, evaluates it, and provides a verdict on IoCs, determining whether they are malicious, while also evaluating IoC information across multiple platforms. In this work, we propose an automated mechanism that first extracts TTPs and IoCs from reputable threat reports, submits the extracted CTI to multiple platforms, evaluates the platform responses using four key metrics —accuracy, freshness, completeness, and relevance, and provides weighted verdicts for IoCs. We tested 600 IoCs in February 2025, and the weighted verdict matched those of VirusTotal for 79.4%, AlienVault for 87.4%, and MetaDefender for 39.6% of the IoCs. The results also show that VirusTotal provides a consistent evaluation of various types of IoCs in terms of freshness, completeness, and relevance of information, whereas AlienVault shows inconsistencies across all IoC types, and MetaDefender shows inconsistency for some. VirusTotal also outperforms the other two when it comes to providing fresher and more complete intelligence, while AlienVault provides the most relevant information in terms of Structured Threat Information eXpression (STIX) 2.1 objects.