Information Security Commons^™

Metarag: Identifying Website Owner Using Meta-Path-Guided Dynamic Graph Retrieval-Augmented Generation, Cheng Tu, Yunshan Ma, Bingyang Guo, Qianyu Li, Yang Li, Min Zhang, Fan Shi, Xiang Wang

Research Collection School Of Computing and Information Systems

Website owner identification aims to link websites to their real-world owners, which is crucial for credibility assessment and information provenance in information retrieval and vital for applications in cybersecurity, Internet governance, and digital regulation. Existing approaches for website owner identification primarily rely on querying infrastructure registration records or analyzing webpage content. However, these methods often fail due to incomplete or outdated registration records and sparse webpage content. We observe that inter-website relationships, derived from shared infrastructure data such as primary domains, IP blocks, and geolocations, can provide valuable but underutilized ownership cues. To exploit this insight, we propose MetaRAG, a …

Bridg-Ics: Ai-Grounded Knowledge Graphs For Intelligent Threat Analytics In Industry 5.0 Cyber-Physical Systems, Padmeswari Nandiya, Ahmad Mohsin, Ahmed Ibrahim, Iqbal H. Sarker, Helge Janicke

Research outputs 2022 to 2026

Industry 5.0’s increasing integration of IT and OT systems is transforming industrial operations but also expanding the cyber–physical attack surface. Industrial Control Systems (ICS) face escalating security challenges as traditional siloed defenses fail to provide coherent, cross-domain threat insights. We present BRIDG-ICS (BRIDge for Industrial Control Systems), an AI-enriched Knowledge Graph (KG) framework for context-aware threat analysis and quantitative assessment of cyber resilience in smart manufacturing environments. BRIDG-ICS fuses heterogeneous industrial and cybersecurity data into an integrated Industrial Security Knowledge Graph linking assets, vulnerabilities, and adversarial behaviors with probabilistic risk metrics (e.g., exploit likelihood, attack cost). This unified graph representation …

Assessor Experiences In Cmmc Level 2 Certification Assessments: An Interpretative Phenomenological Analysis Of Role Expectations, Samuel Heuchert, John Hastings

Research & Publications

The Cybersecurity Maturity Model Certification program requires that third-party assessments be conducted under a non-consultative model. The model is intended to ensure impartiality for organizations seeking certification. While this structure defines expectations for assessor behavior, assessor experiences and interpretations of these constraints remain underexamined. The study examines the lived experiences of CMMC-Certified Assessors and how they navigate role expectations within the non-consultative model. Using Role Conflict Theory as a guiding framework, the study applied Interpretative Phenomenological Analysis (IPA) to semi-structured interviews to explore how assessors make sense of their roles. The analysis identified experiential themes that describe how assessors construct …

The Digital Responsibility Index: Quantifying Perceived Multi-Layered Responsibility In Cybersecurity, Mircea Ţălu

Journal of Cybersecurity Education, Research and Practice

In the evolving digital landscape, cybersecurity responsibility extends beyond technical safeguards to include individual behavior, organizational governance, and societal impact. This study introduces the Digital Responsibility Index (DRI), a novel metric that quantifies multi-layered accountability across four domains: technical, individual, organizational, and societal. Data were collected through scenario-based Likert-scale surveys with 120 cybersecurity professionals, supplemented by semi-structured interviews with senior leaders. Results reveal that while technical and organizational responsibilities are consistently prioritized, individual and societal accountability remain under-recognized. Leadership engagement significantly enhances responsibility scores across all layers. The proposed DRI framework provides a measurable and potentially actionable basis for assessing …

Specification And Internal Assessment Of A Self Reported Protective Application Use Composite Among Computer Science Undergraduates In Enugu State Nigeria, Adesegun Nurudeen Osijirin, Leonard C. Anigbo, Oliver Okechukwu

Journal of Cybersecurity Education, Research and Practice

This study specifies a Protective Application Use Composite restricted to self-reported protective application use. A cross-sectional survey provided 364 complete records from Computer Science undergraduates at four universities in Enugu State, Nigeria, from 393 distributed questionnaires. The score is the equal-weight average of five questionnaire categories: antivirus, firewall, encryption, multi-factor authentication, and virtual private network use. Reanalysis of the author-supplied item records yielded category means from 2.097 to 2.376 and internal-consistency coefficients from 0.958 to 0.971. The composite mean was 2.170, with a standard deviation of 0.469. The first component of the category-score correlation matrix explained 50.98 percent of variance. …

A Narrative-Driven, Socratic Instructional Framework For Teaching Adversarial Cognition In Cybersecurity, Joshua K. Goossen

Journal of Cybersecurity Education, Research and Practice

The Socratic method has demonstrated, in studies across law, medicine, and nursing, that dialectic structured questioning improves expert reasoning. Cybersecurity currently teaches tools and techniques but lacks Socratic dialogic leaving graduates underprepared for novel scenarios requiring cross-domain reasoning. Because law, medicine and nursing cultivate similar reasoning as security there is principled reason to expect reasoning benefits could transfer to security students. This paper argues that the correspondence warrants investigation. Investigation requires a named, teachable reasoning target analogous to clinical reasoning and we specify that target as adversarial cognition, a framework integrating adversary features, system architecture, implementation logic, governance structure, human …

Ai-Generated Phishing Attacks: Emerging Threats And Detection Strategies For Security Operations Centers, Bahzad Khalid

Journal of Cybersecurity Education, Research and Practice

Artificial intelligence (AI) is transforming cybersecurity by strengthening defensive capabilities while simultaneously enabling more sophisticated phishing attacks. AI generated phishing emails increasingly evade traditional detection methods through improved grammar, contextual relevance and realistic communication styles creating significant challenges for Security Operations Centers (SOCs). This study investigates the effectiveness of current email security systems in detecting AI generated phishing emails compared with traditional phishing emails. A mixed method experimental approach was employed using controlled Gmail and Outlook environments to evaluate the detection and classification of multiple phishing scenarios. The results demonstrate that several AI generated phishing emails successfully bypassed initial security …

Designing For Who Actually Shows Up: A Signal Framework For Online Adult Learners In Cybersecurity And Information Technology, Chad Whistle, Mayyada Al-Hammoshi

Journal of Cybersecurity Education, Research and Practice

Online adult learners pursuing cybersecurity and information technology credentials represent one of the fastest-growing student populations in American higher education, yet the frameworks institutions use to support their success were not designed for them. This population, disproportionately drawn from the 41.9 million Americans who hold some college credit but no credential, arrives workforce-embedded, time-constrained, and skeptical of institutional systems that previously failed to serve them. Existing persistence models grounded in traditional student integration theory inadequately account for the behavioral patterns, motivational structures, and credential expectations that define this learner. This paper proposes the SIGNAL Framework (Skills-based credential architecture, Integrated AI-informed …

Rent-A-Rag: Embedding-Space Watermarks For Auditing Third-Party Rag, Alexandr Goultiaev Tolstokorov, Kyriakos Mouratidis, Javad Dogani, Nikolaos Laoutaris

Research Collection School Of Computing and Information Systems

Third-party retrieval-augmented generation (RAG) marketplaces create a new auditing problem: data providers may license corpora to a RAG operator, yet later have no visibility into whether their documents are being reused without compensation. Auditing this misuse is difficult because the operator is non-cooperative, answers are paraphrased by the generator, and one response may combine evidence from many providers. We propose DirBucket, a provider-side semantic watermarking and black-box auditing framework for document-level reuse in multi-provider RAG. DirBucket watermarks documents by meaningpreserving paraphrases whose embeddings are biased toward provider-bucket secret directions, enabling detection from black-box answers while preserving retrieval utility. On a …

Hands-On Ransomware: An Experiential Wannacry Case Study For Undergraduate Cybersecurity Education, Eli Creek Richmond, Thomas R. Devine

Military Cyber Affairs

Ransomware represents one of the most disruptive threats in the cyber landscape, yet hands-on malware analysis remains rare in undergraduate cybersecurity curricula. This paper presents the design, implementation, and evaluation of an experiential learning module centered on the WannaCry ransomware case study, deployed in a senior-level course at West Virginia University. Students performed static and dynamic analysis using industry-standard tools. Pre- and post-module assessments demonstrated measurable gains in self-reported competency across seven technical dimensions. The module's competencies align directly with DoD Cyber Workforce Framework Work Role 212, Cyber Defense Forensics Analyst, supporting education-to-workforce pipeline development.

From Framework To Toolchain: Implementing Zero Trust Architecture In Cloud-Native Environments For Dow Compliance, Shelby C. Snyder

Military Cyber Affairs

Federal agencies face a fiscal year 2027 target for enterprise-wide Zero Trust deployment, but NIST SP 800-207A defines logical components without identifying the Kubernetes technologies that implement them. This paper proposes a three-tier mapping of the Policy Engine, Policy Administrator, and Policy Enforcement Point to service mesh, microsegmentation, and perimeter tooling, stating the criteria by which each component is classified. It then applies a defined rubric to six Zero Trust vendors across component alignment, Kubernetes capability, federal authorization posture, and evidence quality, finding that no single vendor covers all three tiers. The mapping is a testable architectural proposition; a Stage …

Characterizing Advanced Persistent Threats With Cyber Attack Flow Metrics, Tyler Miller, Caleb Chang, Shouhuai Xu

Military Cyber Affairs

Cyber attack campaigns vary not only in scale but in structure, yet conventional characterizations often reduce them to a single dimension such as technique count or impact severity. In this paper we extend the concept of cyber attack flows by defining three new metrics, novelty, technique complexity and flow complexity. Then we characterize the attack flows of three advanced persistent threat campaigns using these metrics and draw insights regarding their capabilities. Our findings include that low novelty does not equate to low attack capabilities and that exploitation of an internet-facing appliance is a common initial attack vector.

Semantic Shields: Automating Critical Infrastructure Defense Via Nlp-Driven Ransomware Profiling, Henry Trowbridge, Ian Zalcberg, Ryan Schley, Carter Yagemann, Natasha Phan, Srikar Maduposu, Vimal Buck

Military Cyber Affairs

Ransomware poses a growing threat to critical infrastructure, where successful attacks can disrupt operational technology (OT) and industrial control systems (ICS) with significant public safety consequences. However, attributing ransomware incidents to specific threat actors remains challenging due to ransomware-as-a-service ecosystems, actor rebranding, and the obfuscation of traditional indicators of compromise. This paper presents Semantic Shields, an NLP-driven attribution framework that leverages BERT-generated semantic embeddings and DBSCAN clustering to profile ransomware actors through the linguistic characteristics of ransom notes. Using a dataset of 295 ransom notes from 189 distinct threat groups, the framework achieved an 87.2% true positive clustering rate and …

From Dissertation To Deployment: A Unified Software Platform Operationalizing Clinical-Prediction And Sequential-Security Ai For Healthcare, Olsi Shehu, Damiana Teliti, Jasmin Kevrić, Bekir Karlik

Communications of the IIMA

Advances in machine learning for healthcare are abundant, yet most validated models remain confined to research notebooks and never reach secure, usable clinical software. This paper addresses that deployment gap by presenting a unified, security-hardened software platform that operationalizes two complementary streams of doctoral research inside a single, role-based hospital information system. The first stream contributes a clinical-prediction capability: an ultra-hybrid ensemble that couples a quantum-inspired feature transformation, particle-swarm feature selection, and calibrated soft voting for cancer-outcome prediction (96.41% accuracy, AUC-ROC 0.983 on TCGA-BRCA), survival stratification, multi-cancer generalization, and pharmacogenomic drug-response classification (89.31% mean accuracy across 25 compounds). The second …

Bayesian And Multi-Objective Decision Support For Incident Mitigation In Cyber-Physical Systems, Shaofei Huang, Christopher M. Poskitt, Lwin Khin Shar

Research Collection School of Computing and Information Systems

Cyber-physical systems increasingly rely on interconnected physical and digital systems whose security incidents can escalate rapidly into safety and operational failures. Existing decision-support approaches struggle to support incident response because they rely on static assumptions, incomplete vulnerability data, and single-objective risk models that do not adequately capture trade-offs between attack success likelihood, impact severity, and system availability. This paper proposes an adaptive decision-support framework for incident mitigation in cyber-physical systems that integrates hierarchical Bayesian Network modelling, confidence-calibrated exposure estimation, and multi-objective optimisation into a unified, adaptive pipeline. The framework constructs probabilistic models from system architecture and vulnerability data, incorporating complementary …

Prune: A Patching Based Repair Framework For Certifiable And Privacy-Robust Unlearning Of Neural Networks, Xuran Li, Jingyi Wang, Xiaohan Yuan, Peixin Zhang

Research Collection School Of Computing and Information Systems

Machine unlearning has emerged as a key mechanism for enabling the “right to be forgotten” in neural network models, allowing the selective removal of specific training data upon request. Existing approaches typically rely on retraining models with the remaining data, which is computationally expensive and difficult to verify, especially when deployed models are distributed or resource-constrained. To address this challenge, our prior conference work introduced PRUNE, a patching-based framework that formulates unlearning as a neural network repair problem. PRUNE achieves targeted forgetting by learning lightweight patch networks that redirect model predictions on the data to be unlearned while preserving performance …

Clinic-In-A-Box: A Portable, Software-Defined Cyber Range For Realistic, Scenario-Based Cybersecurity Training, Ethan Chumley, Aaron Nair, Royce Yaezenko, Joshua Payne, Veronika Kyles, Paul Wagner, Robert J. Honomichl, Ryan Straight, Shengjie Xu

Journal of Cybersecurity Education, Research and Practice

Realistic, hands-on cybersecurity training has traditionally depended on fixed infrastructure such as dedicated lab hardware, cloud subscriptions, or permanent network connectivity, limiting where and how often it can be delivered. This paper presents the design and implementation of a portable, scenario-based cybersecurity training platform housed in a single travel case and built from commodity hardware, type-1 hypervisor virtualization, containerized service orchestration, and software-defined networking. The platform clones, isolates, and resets complete lab environments on demand, allowing the same physical system to support repeated classroom, workshop, or field deployments with minimal manual reconfiguration. Training scenarios are grounded in generated organizational profiles …

Between Digital Transformation And Regulatory Vacuum: Cybersecurity Of Public Services In Mozambique, Faztudo Languisse Eng.

Journal of Cybersecurity Education, Research and Practice

The rapid expansion of digital public services in Mozambique—including e-government platforms, digital health systems, and electronic tax administration—has outpaced the development of a coherent legal framework for cybersecurity. While Law No. 3/2017 (Electronic Transactions Law) of 9 January 2017 introduced foundational data-protection principles, Mozambique long lacked a dedicated cybersecurity regulatory authority, mandatory security standards, and formal incident-notification mechanisms. This regulatory vacuum exposed critical public services to escalating cyber risks as digital transformation was actively promoted as a development priority. This article examines the legal and institutional gaps in Mozambique's cybersecurity governance framework prior to the 2026 Cybersecurity and Cybercrime Laws, …

Self Efficacy And Instructional Support Predict Cyber Deception Acceptance In Ics And Ot Cybersecurity, Daniel Ward

Journal of Cybersecurity Education, Research and Practice

Cyber deception can produce high-confidence evidence of unauthorized activity in industrial control systems (ICS) and operational technology (OT), but practitioners must consider the technology useful, safe, understandable, and supported before they will use it. This study reports a secondary quantitative analysis of a deidentified survey of United States-based ICS and OT professionals to determine whether psychological and instructional factors predict adoption readiness and effective utilization beyond education, experience, and sector. Hierarchical ordinary least squares regression with HC3 robust standard errors was conducted on 262 complete cases. The demographics-only model was not significant and explained 2.8 percent of outcome variance. Adding …

Opengrcrmf: A Vendor-Neutral Framework For Teaching And Modeling Rmf Automation, Continuous Authorization, And Zero Trust Governance, Anand Janjal

Journal of Cybersecurity Education, Research and Practice

Abstract—Federal and regulated organizations continue to rely on document-centric Authorization to Operate (ATO) processes even as the NIST Risk Management Framework (RMF), continuous monitoring guidance, Zero Trust Architecture (ZTA), and continuous authorization initiatives require more continuous, evidence-driven risk management [1]-[3], [13], [15]. Manual System Security Plan (SSP) updates, spreadsheet-based Plan of Action and Milestones (POA&M) tracking, and disconnected assessment evidence create governance latency: the delay between operational security events and authorization-ready governance response. This paper presents OpenGRCRMF, a proposed open, vendor-neutral reference framework that models RMF lifecycle activities as workflow states, treats authorization artifacts as structured governance objects, and …

Personal Authenticity For Engagement And Transfer In Introductory Cybersecurity Education, Daniel T. Hickey, Ronald J. Kantor

Journal of Cybersecurity Education, Research and Practice

Abstract—This conceptual/theoretical paper explores how personal authenticity might promote generative learning in introductory cybersecurity courses. Generative learning transfers confidently to future educational, professional, personal, and testing situations. This cycle of design-based research addresses the concern that more typical professionally authentic contexts (e.g., hospitals, banks, etc.) may be alien and overwhelming to many students, particularly those in introductory courses and/or from non-professional families and communities. If so, this leads to “inert” knowledge that does not transfer. Personal authenticity is rooted in expansive framing, a modern theory of learning transfer. We reframe expansive framing as personal authenticity to make it …

A Return On Investment (Roi) Evaluation Tool For Quantifying The Value Of Cybersecurity Certifications, Nicolas Meysmans, Kelly Hughes

Journal of Cybersecurity Education, Research and Practice

The growing reliance on cybersecurity certifications has increased the financial and professional stakes associated with certification decision-making for cybersecurity professionals. Despite their widespread use in hiring and career advancement, there is limited objective guidance available to help individuals evaluate the return on investment (ROI) of specific certifications. This gap has created uncertainty regarding which credentials provide the greatest value relative to their cost and market impact. This study presents a data-driven, design science–based tool that supports cybersecurity professionals in evaluating certification ROI using practitioner survey data combined with certification cost and labor-market demand indicators. The paper also demonstrates how such …

From Disruption To Replacement: The 2026 Cae Cybersecurity Community Symposium And The Emerging Federal-Academic Compact For An Ai Workforce, Sunday Oludare Ogunlana

Journal of Cybersecurity Education, Research and Practice

The cybersecurity workforce gap in the United States is estimated at several hundred thousand unfilled positions, and the rapid integration of artificial intelligence into adversary tradecraft and federal cyber operations is widening that gap qualitatively as well as quantitatively, threatening national security and the operational readiness of graduates entering the field. This perspective article synthesizes the principal arguments advanced by five federal and academic speakers at the 2026 CAE Cybersecurity Community Symposium, using verbatim session transcripts, a structured thematic extraction process, and triangulation against published workforce policy and peer-reviewed literature. Findings document a unified speaker thesis that artificial intelligence now …

Lightweight End-To-End Cryptographic Framework With Semantic Qos For Ar-Based Telesurgery, Pavan Kumar Satram

Masters Theses

This thesis presents the design, implementation, and evaluation of a lightweight end-to-end cryptographic framework integrated with a semantic quality-of-service classification system for augmented reality based telesurgery. Telesurgery can deliver expert surgical care to underserved populations, but adoption has been limited by unresolved cybersecurity, network performance, and resilience challenges. The core tension is that strong encryption adds latency that may exceed the clinical safety threshold, while unencrypted systems remain vulnerable to attacks that could endanger patients during live procedures.

The framework addresses this tension through a dual-edge security middlebox that performs per-flow encryption using semantically selected ciphers: AES-128-GCM for latency-critical haptic …

Navigating Enhanced Exploration Assistance (Nexa), Azhari Abbas, Caleb Fakunle, Ryan Powell, Donovan Livingston

Discovery Day - Daytona Beach

NEXA is an artificial intelligence software platform developed to enhance residential security and property monitoring through seamless integration with autonomous drone systems. This research application of advanced AI in surveillance aims to create a standalone solution capable of real-time threat detection and intelligent alert management. By processing visual and sensory data, NEXA facilitates autonomous drone operation with minimal human intervention. Secure communication channels ensure that instant alerts are delivered to property owners and, potentially, law enforcement, improving response times in security incidents, search-and-rescue operations, and perimeter surveillance. Additionally, NEXA is capable of interfacing with commercially available drone platforms and presents …

A Survey On Machine Learning Applications For Operating System Fingerprinting, Siri Siqveland

Discovery Day - Daytona Beach

In the modern age of computers and interconnected networks, cybersecurity and cyber-attackers are evolving in tandem to exploit each other’s vulnerabilities. One technique used by both parties is Operating System Fingerprinting (OSF): with the knowledge of what Operating System a target system is running, innate vulnerabilities can be identified and patched or exploited. Historically, OSF utilizes two main methods: passive and active—the former trades accuracy with undetectability while the latter is generally more detectable but more accurate. However, recent work has combined OSF with Machine Learning (ML) to improve accurate identification. The work presented here is a survey for the …

Closing The Awareness–Behavior Gap: A Role-Based Phishing Training Framework For Higher Education, Ranylene O. Olaybal, Ryan A. Olaybal

Journal of Cybersecurity Education, Research and Practice

Phishing remains one of the most persistent cybersecurity threats facing higher education institutions, where diverse user populations and highly connected digital environments increase exposure to social engineering attacks. Although cybersecurity awareness initiatives are widely implemented, high awareness does not always translate into secure behavior. This study examined phishing awareness, phishing-related practices, phishing susceptibility, and phishing experiences among college students, teaching faculty, and administrative staff in a private higher education institution in the Philippines. Using a quantitative cross-sectional design, data were collected from 553 respondents through a validated survey instrument and analyzed using descriptive statistics, one-way analysis of variance, Tukey's honestly …

Efficient And Universal Watermarking For Llm-Generated Code Detection, Boquan Li, Zirui Fu, Mengdi Zhang, Peixin Zhang, Jun Sun, Xingmei Wang

Research Collection School Of Computing and Information Systems

Large language models (LLMs) have significantly enhanced the usability of AI-generated code, providing effective assistance to programmers. This advancement also raises ethical and legal concerns, such as academic dishonesty and the generation of malicious code. For accountability, it is imperative to detect whether a piece of code is AI-generated. Watermarking is broadly considered a promising solution and has been successfully applied to identify LLM-generated text. However, existing efforts on code are far from ideal, suffering from limited universality and excessive time and memory consumption. In this work, we propose a plugand- play watermarking approach for AI-generated code detection, named ACW …

Audeter: A Large-Scale Dataset For Deepfake Audio Detection In Open Worlds, Qizhou Wang, Hanxun Huang, Guansong Pang, Sarah Erfani, Christopher Leckie

Research Collection School Of Computing and Information Systems

Speech synthesis systems can now produce highly realistic vocalisations that pose significant authenticity challenges. Despite substantial progress in deepfake detection models, their real-world effectiveness is often undermined by evolving distribution shifts between training and test data, driven by the complexity of human speech and the rapid evolution of synthesis systems. Existing datasets suffer from limited real speech diversity, insufficient coverage of recent synthesis systems, and heterogeneous mixtures of deepfake sources, which hinder systematic evaluation and open-world model training. To address these issues, we introduce AUDETER (AUdio DEepfake TEst Range), a large-scale and highly diverse deepfake audio dataset comprising over 4,500 …

Technique-Level Normalization For Cybersecurity Intelligence: An Empirical Evaluation Of Att&Ck Attribution From Hids Alerts Using Fine-Tuned Transformers And Metadata Re-Ranking, Emad Sherif

International Journal of Cybersecurity Intelligence & Cybercrime

Cybercrime investigations increasingly depend on the ability to interpret large volumes of automated security events. For organizations without dedicated security operations centres, a situation common among small and medium enterprises, the manual translation of raw alerts into structured threat intelligence represents a critical bottleneck that slows investigative triage and limits cross-case comparability. This paper evaluates an automated enrichment pipeline designed to address this bottleneck by mapping security events to standardised adversary behaviour labels drawn from the MITRE ATT&CK framework, supporting both operational response and cybercrime investigation workflows. We compare three pipeline configurations, a general-purpose encoder model, a cybersecurity domain-adapted variant, …