Vedran Dakić

Prompt injection in large language model (LLM)–integrated applications makes forensic readiness necessary when prevention fails. We model execution as a typed provenance multigraph and derive evidence packages by deterministic, idempotent projection from a canonical trace, isolating telemetry effects from model nondeterminism. The model establishes monotonicity of attainable reconstruction and conditional non-identifiability when retained context collapses distinct source-labeled inputs. Seven investigators reconstructed 168 sy1nthetic incidents, yielding 1176 responses across seven assignment arms representing six unique evidence sets; one ablation duplicated L2 and is treated as a consistency arm. The minimum forensic logging profile (MFLP) decision rule, frozen before scoring but after investigator response collection had begun, returned ABSTAIN: at complete telemetry, one-sided 95% lower bounds for frozen exact object attribution, path coverage, and conditional detection recall were 0.123, 0.646, and 0.880, below the 0.90 adequacy floor. With complete telemetry, investigators’ post-incident classification (detection) recall was 0.921 and channel-level attribution was 0.688, whereas exact object attribution was 0.176 (95% confidence interval: 0.113–0.246); the exact score is partly depressed by an object-label mismatch in the instrument, which capped attainable exact attribution at 0.832. Retrieval provenance and tool telemetry contributed differently; we did not establish an incremental value for the environment/network. No empirical minimum profile is identified. The framework is model-agnostic; estimates apply to the evaluated application, corpus, model, and investigator sample.

On multi-homed Kubernetes nodes, the interface carrying node addresses can determine the physical path used by default CNI deployments, potentially obscuring the performance available from a high-speed fabric. We evaluate Antrea, Cilium, Calico, and Flannel across nine Linux tuning profiles on 100 GbE and 100 Gb/s InfiniBand platforms, including pod-level RoCE and IPoIB measurements. On Ethernet, chart-default CNIs shared a 0.908 Gbit/s TCP ceiling, matching the payload rate of the 1 GbE management link carrying node addresses. On InfiniBand, relocating node addresses from 10 GbE management to IPoIB increased peak CNI throughput from 9.1 to 44.4 Gbit/s, approaching the 46 Gbit/s host baseline. Over IPoIB, median throughput was 42.4 Gbit/s for Flannel, 32.9 for Cilium, 32.2 for Antrea, and 7.0 for default IP-in-IP Calico. Flannel minimized pod-to-host TCP latency, although tuning nearly tripled CNI latency. On Ethernet, pod RoCEv2 reached 96.9–97.8 Gbit/s at MTU 9000 with 0.835–2.035 µs of latency. Host and pod RoCE performance was comparable for the measured profile. These results validate node address/data path placement as a primary determinant of observed CNI throughput and support explicitly directing CNI traffic onto the intended high-speed interface while exposing RDMA-capable devices to performance-critical workloads.

Capture-the-flag (CTF) competitions are widely used for cybersecurity training and informal assessment, yet their measurement properties are rarely reported. We evaluated five editions of a national CTF event held between 2018 and 2025 using 94 challenges, 58 teams, 1393 submission attempts, and a 2025 participant survey (n = 38). KR-20 point estimates ranged from 0.72 to 0.82, but were imprecise except in the largest edition; sensitivity analyses treating unattempted items as missing produced weaker, assumption-dependent estimates. Across the corpus, 34% of items had no response variance, and 22% were never attempted. Author-assigned points tracked observed difficulty only weakly (pooled ρ = −0.40, 95% CI [−0.57, −0.19]). Across four coding procedures, technical knowledge was prominent (78–94 items), analytical skills varied substantially (35–70), and ethics, communication, and risk management were absent. A degree-preserving null reproduced an apparent breadth–performance association, indicating a mechanical artifact. Submission precision increased from approximately 0.15 in 2018 to 0.69 in 2025 (Jonckheere–Terpstra z = 6.15, p < 0.001). Overall, reliability alone does not establish validity: CTF scores provide useful but incomplete evidence for broad inferences about cybersecurity competence, particularly with small samples and selective item engagement.

Forecasting spare parts demand is challenging due to its intermittent, sparse, and highly irregular nature. Traditional inventory strategies, based on stable demand patterns, often lead to inefficiencies, including excess inventory and poor service performance. This study examines the impact of feature engineering combined with ABC–XYZ inventory segmentation on forecasting accuracy in a real-world industrial context. A biweekly forecasting framework was developed using six years (2019–2024) of transactional data from ERP and Field Service Management (FSM) systems of a forklift service company. Fifteen derived features capturing demand dynamics, intermittency, service behavior, and statistical structure were constructed and evaluated using Random Forest, XGBoost, and Support Vector Regression (SVR) models. The results show that restricting modeling to AY/BY inventory categories substantially improves predictive accuracy, reducing RMSE from >22 to <3 compared to full-SKU modeling. A reduced seven-feature set further lowers XGBoost’s RMSE to 2.51 (MAE = 2.14), achieving the best performance across all tested configurations on the 2024 hold-out period. The best-performing configuration achieves a Predicted-Demand Turnover Index (PDTI) of 44.13, compared with a baseline actual stock turnover of 2.78 (€65,944 actual demand/€23,721 historical average stock). PDTI is a theoretical scenario index; operationalizing it requires inventory-policy simulation under realistic constraints. These findings highlight that forecasting performance in intermittent-demand environments depends more on data representation and segmentation than on model selection alone. The study provides a reproducible, interpretable framework for integrating feature engineering and inventory segmentation into data-driven inventory management.

Modern enterprise breaches are no longer isolated events but coordinated, multi-stage campaigns whose success depends on the defender’s inability to translate detection into timely containment. While existing frameworks—such as attack-lifecycle models, Zero Trust architectures, and detection-driven systems—provide valuable capabilities, they lack a formal mechanism for coupling inferred adversarial state with coordinated, cross-layer enforcement. This paper presents AMNDA, an Adaptive Multi-layer, stage-aware Network Defense Architecture that operationalizes lifecycle-aware defense through explicit state-to-control mapping and executable orchestration. Adversarial progression is modeled as a probabilistic state-transition process, and inferred states are systematically mapped to synchronized controls across edge protection, identity governance, internal segmentation, and behavioral detection. A formally defined orchestration function transforms detection outputs into stage-conditioned policy updates, enforcing monotonic tightening of containment as adversarial capability escalates. AMNDA is implemented and validated in a reproducible Microsoft Azure environment. Empirical results show that stage-aligned enforcement actions execute within 1.0–3.1 s, while detection latency remains the dominant constraint, with a median of 1034 s across the validation corpus. This separation reveals a critical operational insight: in modern cloud environments, the limiting factor in lifecycle defense is not enforcement capability but detection timing. The contribution of AMNDA is therefore not a new detection technique but a formal, deployable architecture that converts attack-stage inference into coordinated, low-latency containment. By bridging lifecycle modeling, Zero Trust principles, and automated orchestration, the proposed approach establishes a practical foundation for state-aware, adaptive cyber defense.

This study presents a systematic empirical evaluation of monolithic and distributed database architectures deployed in Kubernetes environments. As containerized and cloud-native infrastructures become increasingly prevalent, understanding the performance implications of running stateful data systems under orchestration platforms has become critical. We evaluate five widely used database systems—PostgreSQL, MySQL, MongoDB, Redis, and Cassandra—using standardized workload generation frameworks, including pgbench, sysbench, YCSB, redis-benchmark, and cassandra-stress. Controlled experiments were conducted across varying concurrency levels and workload types to measure throughput, latency, and scalability in both single-node and distributed deployments. Redis achieves a maximum throughput of 4.2 million operations per second with sub-millisecond latency. In contrast, Cassandra delivers 214,743 distributed read operations per second at ONE consistency, approaching Redis’s non-pipelined baseline throughput (257,732–262,467 ops/sec) within a Kubernetes cluster. The write throughput of Cassandra decreases by 45.2% when the consistency level is elevated to QUORUM, accompanied by an elevenfold increase in run-to-run variability (CV from 7.1% to 84.7%), indicating that the consistency level is the primary performance determinant in distributed systems. PostgreSQL experiences a 72% decrease in write throughput in Kubernetes (74,072 → 20,805 TPS). In contrast, MySQL PXC anomalously attains a 37.3% increase in write throughput in Kubernetes compared to its monolithic deployment—the sole reversal noted among the five systems. These findings underscore a critical trade-off between vertical efficiency and horizontal scalability, illustrating that hybrid database architecture can be an effective solution for contemporary cloud-native applications compared to either paradigm independently.

The escalating scale and complexity of cybercrime necessitate standardized digital forensic protocols to ensure the integrity and admissibility of digital evidence. This study empirically assesses the use of ISO/IEC 27037 and ISO/IEC 27041 through three real-world digital forensic case studies conducted in organizational settings. A multi-case methodology was employed, encompassing a multinational corporate criminal investigation, an internal employee misbehaviour probe, and an examination into mobile- and cloud-based data leaks. The effect of synchronized standard implementation was evaluated using audit-based and quantitative indicators that measure forensic process quality as a system attribute. The findings demonstrate that the systematic implementation of ISO/IEC 27037 and ISO/IEC 27041 improves investigative traceability, documentation quality, and evidentiary robustness. In the worldwide case study, documentation completeness increased by 18%, and all digital evidence was deemed admissible in judicial proceedings, surpassing the institutional baseline admissibility rate of 82%. In other instances, evidence gathered within the same framework was acknowledged in organizational or disciplinary review processes, resulting in similar enhancements in documentation quality and procedural consistency, notwithstanding technological and organizational limitations. The paper develops and empirically substantiates an integrated procedural validation model that connects evidence-handling practices with method and instrument validation. The results indicate that the synchronized implementation of ISO/IEC forensic standards improves the transparency, dependability, and auditability of digital forensic investigations.

Vehicle-mounted sensing enables high-resolution urban monitoring but remains constrained by heterogeneous multimodal integration, intermittent connectivity, privacy-sensitive visual data, and the absence of enforceable multi-provider governance. This paper introduces a governance-aware private cloud architecture that treats provider isolation, role-based access control, and privacy-by-design as core architectural properties rather than application-layer add-ons. The layered, containerised microservice design supports asynchronous store-and-forward ingestion, modality-specific processing pipelines, and GPU-accelerated object detection for structured metadata extraction. A key innovation is ingestion-time visual abstraction, which structurally separates raw imagery from derived observations and enforces lifecycle-based retention policies, embedding data minimisation directly into the data flow. The fully open-source implementation is validated through a two-month multi-provider pilot with continuous multimodal collection. Results demonstrate stable ingestion without data loss, real-time visual inference (~200 ms per frame), strict provider-level isolation under concurrent access, and up to 95% storage reduction via metadata abstraction. The findings establish a replicable architectural paradigm for scalable, privacy-aware, multi-actor mobile sensing infrastructures suitable for metropolitan-scale smart city deployment.

Malware persistence enables malicious programs to endure reboots and remain operational across sessions, facilitating prolonged system compromise. This study examines three prominent malware families (njRAT, AsyncRAT, and WannaCry) and discerns their unique persistence methods by integrating static, dynamic, and behavioral analysis. The findings indicate that njRAT relies on registry and startup entries, AsyncRAT adapts its techniques based on privilege levels, and WannaCry establishes persistence by creating services. This study presents a secure, modular C# prototype that simulates registry, file-based, and Image File Execution Options (IFEO) hijacking persistence in a controlled setting, transcending traditional analysis. Complementary PowerShell and CMD simulators replicate authentic persistence strategies for defensive testing and educational purposes. This work's scientific contribution is the integration of real malware reverse engineering with the creation of a secure, modular C# simulation prototype that replicates various persistence techniques-file-based, registry-based, and Image File Execution Options (IFEO) hijacking-within a controlled and observable setting. Complementary simulations with PowerShell and CMD emulate prevalent persistence characteristics for defensive research and analyst training without requiring the implementation of actual payloads. The primary findings indicate that layered persistence augments stealth and resilience, that privilege context directly influences persistence efficacy, and that hybrid analytical approaches integrating static, dynamic, and simulated testing markedly boost detection reliability. The resultant paradigm offers a replicable, ethical, and instructive platform for enhancing research on malware persistence and formulating protective strategies.