Liyi Zeng

Security operations centre (SOC) analysts must investigate alerts, correlate threat intelligence and interpret heterogeneous telemetry under tight timing constraints. Although large language models (LLMs) offer strong understanding capabilities, directly applying them to SOC environments remains challenging due to semantic ambiguity in analyst queries, fragmented multisource event data, limited domain‐specific reasoning and reliability concerns associated with unconstrained query generation. We present a task‐driven knowledge‐augmented framework designed to produce verifiable and contextually grounded responses for SOC workflows. The framework integrates four components: (i) contrastive context task recognition that mitigates semantic ambiguity by mapping analyst queries to predefined SOC task types; (ii) expert‐guided knowledge augmentation that fuses dense and sparse retrieval to bridge the semantic gap; (iii) schema‐aligned event retrieval combined with entity‐centric evidence profiling to ensure reliable and secure access to heterogeneous telemetry and (iv) verifiable task‐aware generation that constrains model outputs to retrieved knowledge and security events. To assess the framework, we construct a benchmark of 12,500 validated question–answer pairs derived through semiautomated synthesis over more than 34 million real SOC records. Experiments across multiple foundation models demonstrate consistent improvements in relevance and grounding quality. Our results indicate that the four proposed components substantially enhance LLMs' reliability in practical SOC analysis.

Knowledge distillation (KD) has achieved remarkable success in model compression, yet its extension to cross-architecture scenarios remains a formidable challenge. This difficulty primarily arises from the severe representation gap and distinct inductive biases inherent in heterogeneous architectures. Existing approaches often struggle, as direct intermediate feature alignment suffers from architecture-specific noise, while logit-based distillation inevitably discards crucial structural information. To elegantly bridge this gap without relying on complex auxiliary modules, we propose Reciprocal Correlation Distillation (RCD). RCD innovatively anchors multi-stage student features to the teacher's pre-classifier manifold, a unified semantic space that effectively filters shallow heterogeneous noise. Upon this shared manifold, RCD tackles feature misalignment through a meticulously designed dual-constraint objective. First, it employs a reciprocal alignment mechanism to explicitly decouple feature channels by minimizing off-diagonal cross-correlations, thereby filtering out architecture-specific redundancy. Simultaneously, it enforces topology consistency by aligning inter-channel Gram matrices, compelling the student to faithfully reconstruct the teacher's semantic co-activation patterns and reasoning logic. Extensive experiments demonstrate that RCD establishes new state-of-the-art benchmarks in both homogeneous and heterogeneous settings, achieving remarkable average accuracy gains of 11.62% on CIFAR-100 and 2.34% on ImageNet-1K over student baselines.

As Internet of Things (IoT) ecosystems expand into critical infrastructure, the accurate identification of attack patterns, known as vulnerability-to-tactic and technique (VTT) mapping, becomes a critical requirement for cybersecurity. However, applying VTT mapping to the IoT domain faces problems: the data sparsity, where fragmented vulnerability reports lack standardized descriptions, and the explainability deficit, where “blackbox” predictions pose risks of physical operational disruption. To address these challenges, we propose VDM-IoT, a framework that synergizes knowledge graphs (KGs) with large language models (LLMs). The framework constructs an IoT-enhanced vulnerability KG (VKG) from MITRE database/National Vulnerability Database (NVD). For each target vulnerability, it 1) employs a context-aware similarity mechanism to compensate for information sparsity by retrieving topologically related neighbors; 2) filters explicit reasoning paths to potential targets; and 3) guides the LLM to generate verifiable mappings with natural language justifications. Evaluations on the BRON-based benchmark and our constructed expert-labeled VTT dataset show that VDM-IoT achieves 35.37% Hit@1 in technique mapping and 98.11% accuracy in tactic mapping.

The growing popularity of blockchain technology has underscored the need for robust network security. However, public blockchain networks remain vulnerable to attacks in which adversaries exploit numerous nonfunctional peer connections to disrupt block propagation across the entire network. Inthis article, we propose a practical nontargeted delay attack method and validate its feasibility, scalability, and significant impacts on blockchain networks of varying sizes, including EthereumPoW (ETHW) and premerge Ethereum Mainnet. In the ETHW network with 95 nodes, our adversarial peers introduce delays ranging from 0.33 to 2.8 s for half the nodes, with nearly one-third experiencing delays exceeding 5.9 s, derived from the 90th percentile of delay times. When in the premerge Ethereum network with 5739 nodes, over 80% of peers experience prolonged block propagation, resulting in a 77% increase in delay time, underlining the attacks' scalability and efficacy in large-scale environments. We also optimize the Ethereum client Geth by relaxing certain connection restriction, significantly reducing attack costs. Delving deeper, we analyze the implications of delay attacks on proof-of-work (PoW) and proof-of-stake (PoS) consensus mechanisms, illustrating how attackers can gain extra revenues through such attacks. Specifically, we propose a novel combined strategy to facilitate reorganization attacks under PoS. These findings highlight the urgent need to strengthen network-layer defenses and reinforce peer-to-peer (P2P) network protocol security against real-world delay exploits.

Provenance graphs have emerged as a promising approach for detecting host-based attacks, particularly on Internet of Things (IoT) endpoints where audit logs are available but resources are constrained. Such graphs integrate fine-grained system audit logs and formulate the attack detection process as subgraph matching within the provenance graph. Existing methods relying on exact subgraph matching are computationally intensive and time-consuming, while supervised learning for approximate subgraph matching, although a potential alternative, requires extensive labeled data that is prohibitively costly for annotating provenance graphs at scale. To tackle these problems, we propose ContrastMatcher, a self-supervised adaptive graph contrastive learning (GCL) for provenance subgraph matching, which needs no label for training. ContrastMatcher consists of three modules: reduction, adaptive self-supervised learning, and lightweight detection. By graph reduction (GR) and process-centric ego partitioning, the reduction module identifies likely regions where attacks may occur, substantially reducing computational complexity and runtime. The adaptive self-supervised learning module selects effective augmentations to learn the subgraph representations with a carefully designed self-attention encoder, enabling ContrastMatcher to work without any labels. Finally, the lightweight detection module classifies the attack relations between each query and the candidates from the learned representations automatically, which avoids setting the approximation manually. Experiments on the DARPA Engagement 3 datasets show that ContrastMatcher can reduce irrelevant host-based log events by 80%–90%. In addition, without any label in the provenance graph, it achieves a competitive performance regarding the detection accuracy with only 1% training time compared to the existing supervised learning methods.