Duy The Phan

S-AECR: Word Intelligence and Explanation Strategy for Cyber Threat Intelligence Extraction and Mapping

Cyber Threat Intelligence (CTI) reports are the primary source of actionable threat knowledge; however, most high-value content is published in unstructured text, creating a significant bottleneck for operational threat response. Manual extraction of Indicators of Compromise (IoC), cybersecurity entities, and Tactics, Techniques, and Procedures (TTP) mapped to the MITRE ATT&CK framework is labor-intensive and difficult to scale. This paper presents S-AECR (Split-NER + Semantically-Aware Attack Extraction and Cyber-threat Recognition), a modular end-to-end pipeline that converts raw CTI reports into structured intelligence. S-AECR comprises four stages: multi-format preprocessing, Word Intelligence Collection (regex-based IoC extraction with defanging recovery, Aho-Corasick entity matching, and two-stage Split-NER for nine entity types), binary sentence filtration, and 168-class ATT&CK technique identification. A core contribution is the Explanation Strategy, which enriches each sentence with natural-language prefixes that semantically annotate extracted IoC spans, thereby providing BERT with explicit domain context before classification. Evaluated on 128 real-world CTI reports (28,646 sentences for filtration and 10,146 sentences for identification), S-AECR achieves a Macro F1 of 0.9106 on sentence filtration and 0.4162 on technique identification. It consistently outperforms five recent pipelines (Orbinato, TRAM, TIEF, ALERT, and AECR). Ablation studies confirm that Word Intelligence enrichment is the most impactful component, with its removal causing a 19.3% drop in Macro F1.

Evaluating the Robustness and Transferable Adversarial Example Resistance of Multimodal Learning-based Intrusion Detection Systems against Evasion Attacks

An Empirical Study on the Transferability of Transformer-Based Models for Software Vulnerability Detection

Despite the dominance of Transformer-based models in software vulnerability detection, the extent to which their learned security logic generalizes across different programming languages remains a critical open question. To address this, we propose a comprehensive evaluation framework organized into three phases spanning five distinct experimental scenarios, aiming to rigorously dissect model behaviors from input sensitivity and baseline performance to cross-lingual transferability and decision transparency. We benchmark four representative models (CodeBERT, GraphCodeBERT, UniXcoder, and CodeT5+) using a curated Polyglot Injection Dataset (C/C++ and Java). Our empirical results reveal that extending input context from 128 to 512 tokens yields negligible gains, suggesting a heavy reliance on localized features. While we observe a distinct transfer asymmetry favoring C/C++ sources, the Encoder-Decoder architecture (CodeT5+) demonstrates superior cross-lingual generalization. Crucially, high structural robustness against semantic transformations, combined with quantitative XAI agreement analysis, confirms that these models capture genuine vulnerability logic. These findings suggest that the primary barrier to cross-lingual transfer is vocabulary mismatch rather than a failure in reasoning capabilities.

Active Digital Twin Verification for Robust Federated Learning in IoT Intrusion Detection

Federated Learning has become a practical approach for training intrusion detection models across distributed Internet of Things devices, but it remains exposed to poisoning attacks, non-IID data heterogeneity, and free-rider exploitation. This paper presents DT-Guard, a defense framework that leverages a server-side Digital Twin as a controlled testing environment for actively verifying client model behavior. Each submitted update is deployed in the Digital Twin and evaluated on synthetic challenge data through a four-layer pipeline that examines detection capability, backdoor resistance, parameter deviation, and cross-round stability. A complementary aggregation scheme called DT-Driven Performance Weighting compares client predictions against the current global model, exposing free-riders whose outputs are nearly indistinguishable from the global baseline. We validate DT-Guard on CIC-IoT-2023 under five poisoning strategies. DT-Guard generally outperforms nine existing defenses in accuracy, false positive rate, and contribution fairness.