California Lutheran University
Champlain College Center for Digital Investigation
Singapore Management University
University of Alaska Anchorage
Bridg-Ics: Ai-Grounded Knowledge Graphs For Intelligent Threat Analytics In Industry 5.0 Cyber-Physical Systems,
2026
Edith Cowan University
Bridg-Ics: Ai-Grounded Knowledge Graphs For Intelligent Threat Analytics In Industry 5.0 Cyber-Physical Systems, Padmeswari Nandiya, Ahmad Mohsin, Ahmed Ibrahim, Iqbal H. Sarker, Helge Janicke
Research outputs 2022 to 2026
Industry 5.0’s increasing integration of IT and OT systems is transforming industrial operations but also expanding the cyber–physical attack surface. Industrial Control Systems (ICS) face escalating security challenges as traditional siloed defenses fail to provide coherent, cross-domain threat insights. We present BRIDG-ICS (BRIDge for Industrial Control Systems), an AI-enriched Knowledge Graph (KG) framework for context-aware threat analysis and quantitative assessment of cyber resilience in smart manufacturing environments. BRIDG-ICS fuses heterogeneous industrial and cybersecurity data into an integrated Industrial Security Knowledge Graph linking assets, vulnerabilities, and adversarial behaviors with probabilistic risk metrics (e.g., exploit likelihood, attack cost). This unified graph representation …
Assessor Experiences In Cmmc Level 2 Certification Assessments: An Interpretative Phenomenological Analysis Of Role Expectations,
2026
Dakota State University
Assessor Experiences In Cmmc Level 2 Certification Assessments: An Interpretative Phenomenological Analysis Of Role Expectations, Samuel Heuchert, John Hastings
Research & Publications
The Cybersecurity Maturity Model Certification program requires that third-party assessments be conducted under a non-consultative model. The model is intended to ensure impartiality for organizations seeking certification. While this structure defines expectations for assessor behavior, assessor experiences and interpretations of these constraints remain underexamined. The study examines the lived experiences of CMMC-Certified Assessors and how they navigate role expectations within the non-consultative model. Using Role Conflict Theory as a guiding framework, the study applied Interpretative Phenomenological Analysis (IPA) to semi-structured interviews to explore how assessors make sense of their roles. The analysis identified experiential themes that describe how assessors construct …
The Digital Responsibility Index: Quantifying Perceived Multi-Layered Responsibility In Cybersecurity,
2026
The Technical University of Cluj-Napoca, Romania
The Digital Responsibility Index: Quantifying Perceived Multi-Layered Responsibility In Cybersecurity, Mircea Ţălu
Journal of Cybersecurity Education, Research and Practice
In the evolving digital landscape, cybersecurity responsibility extends beyond technical safeguards to include individual behavior, organizational governance, and societal impact. This study introduces the Digital Responsibility Index (DRI), a novel metric that quantifies multi-layered accountability across four domains: technical, individual, organizational, and societal. Data were collected through scenario-based Likert-scale surveys with 120 cybersecurity professionals, supplemented by semi-structured interviews with senior leaders. Results reveal that while technical and organizational responsibilities are consistently prioritized, individual and societal accountability remain under-recognized. Leadership engagement significantly enhances responsibility scores across all layers. The proposed DRI framework provides a measurable and potentially actionable basis for assessing …
Specification And Internal Assessment Of A Self Reported Protective Application Use Composite Among Computer Science Undergraduates In Enugu State Nigeria,
2026
Federal University of Allied Health Sciences,Enugu, Nigeria
Specification And Internal Assessment Of A Self Reported Protective Application Use Composite Among Computer Science Undergraduates In Enugu State Nigeria, Adesegun Nurudeen Osijirin, Leonard C. Anigbo, Oliver Okechukwu
Journal of Cybersecurity Education, Research and Practice
This study specifies a Protective Application Use Composite restricted to self-reported protective application use. A cross-sectional survey provided 364 complete records from Computer Science undergraduates at four universities in Enugu State, Nigeria, from 393 distributed questionnaires. The score is the equal-weight average of five questionnaire categories: antivirus, firewall, encryption, multi-factor authentication, and virtual private network use. Reanalysis of the author-supplied item records yielded category means from 2.097 to 2.376 and internal-consistency coefficients from 0.958 to 0.971. The composite mean was 2.170, with a standard deviation of 0.469. The first component of the category-score correlation matrix explained 50.98 percent of variance. …
A Narrative-Driven, Socratic Instructional Framework For Teaching Adversarial Cognition In Cybersecurity,
2026
Independent
A Narrative-Driven, Socratic Instructional Framework For Teaching Adversarial Cognition In Cybersecurity, Joshua K. Goossen
Journal of Cybersecurity Education, Research and Practice
The Socratic method has demonstrated, in studies across law, medicine, and nursing, that dialectic structured questioning improves expert reasoning. Cybersecurity currently teaches tools and techniques but lacks Socratic dialogic leaving graduates underprepared for novel scenarios requiring cross-domain reasoning. Because law, medicine and nursing cultivate similar reasoning as security there is principled reason to expect reasoning benefits could transfer to security students. This paper argues that the correspondence warrants investigation. Investigation requires a named, teachable reasoning target analogous to clinical reasoning and we specify that target as adversarial cognition, a framework integrating adversary features, system architecture, implementation logic, governance structure, human …
Ai-Generated Phishing Attacks: Emerging Threats And Detection Strategies For Security Operations Centers,
2026
Webster University
Ai-Generated Phishing Attacks: Emerging Threats And Detection Strategies For Security Operations Centers, Bahzad Khalid
Journal of Cybersecurity Education, Research and Practice
Artificial intelligence (AI) is transforming cybersecurity by strengthening defensive capabilities while simultaneously enabling more sophisticated phishing attacks. AI generated phishing emails increasingly evade traditional detection methods through improved grammar, contextual relevance and realistic communication styles creating significant challenges for Security Operations Centers (SOCs). This study investigates the effectiveness of current email security systems in detecting AI generated phishing emails compared with traditional phishing emails. A mixed method experimental approach was employed using controlled Gmail and Outlook environments to evaluate the detection and classification of multiple phishing scenarios. The results demonstrate that several AI generated phishing emails successfully bypassed initial security …
Designing For Who Actually Shows Up: A Signal Framework For Online Adult Learners In Cybersecurity And Information Technology,
2026
University of Maryland Global Campus
Designing For Who Actually Shows Up: A Signal Framework For Online Adult Learners In Cybersecurity And Information Technology, Chad Whistle, Mayyada Al-Hammoshi
Journal of Cybersecurity Education, Research and Practice
Online adult learners pursuing cybersecurity and information technology credentials represent one of the fastest-growing student populations in American higher education, yet the frameworks institutions use to support their success were not designed for them. This population, disproportionately drawn from the 41.9 million Americans who hold some college credit but no credential, arrives workforce-embedded, time-constrained, and skeptical of institutional systems that previously failed to serve them. Existing persistence models grounded in traditional student integration theory inadequately account for the behavioral patterns, motivational structures, and credential expectations that define this learner. This paper proposes the SIGNAL Framework (Skills-based credential architecture, Integrated AI-informed …
Rent-A-Rag: Embedding-Space Watermarks For Auditing Third-Party Rag,
2026
Singapore Management University
Rent-A-Rag: Embedding-Space Watermarks For Auditing Third-Party Rag, Alexandr Goultiaev Tolstokorov, Kyriakos Mouratidis, Javad Dogani, Nikolaos Laoutaris
Research Collection School Of Computing and Information Systems
Third-party retrieval-augmented generation (RAG) marketplaces create a new auditing problem: data providers may license corpora to a RAG operator, yet later have no visibility into whether their documents are being reused without compensation. Auditing this misuse is difficult because the operator is non-cooperative, answers are paraphrased by the generator, and one response may combine evidence from many providers. We propose DirBucket, a provider-side semantic watermarking and black-box auditing framework for document-level reuse in multi-provider RAG. DirBucket watermarks documents by meaningpreserving paraphrases whose embeddings are biased toward provider-bucket secret directions, enabling detection from black-box answers while preserving retrieval utility. On a …
Hands-On Ransomware: An Experiential Wannacry Case Study For Undergraduate Cybersecurity Education,
2026
West Virginia University
Hands-On Ransomware: An Experiential Wannacry Case Study For Undergraduate Cybersecurity Education, Eli Creek Richmond, Thomas R. Devine
Military Cyber Affairs
Ransomware represents one of the most disruptive threats in the cyber landscape, yet hands-on malware analysis remains rare in undergraduate cybersecurity curricula. This paper presents the design, implementation, and evaluation of an experiential learning module centered on the WannaCry ransomware case study, deployed in a senior-level course at West Virginia University. Students performed static and dynamic analysis using industry-standard tools. Pre- and post-module assessments demonstrated measurable gains in self-reported competency across seven technical dimensions. The module's competencies align directly with DoD Cyber Workforce Framework Work Role 212, Cyber Defense Forensics Analyst, supporting education-to-workforce pipeline development.
From Framework To Toolchain: Implementing Zero Trust Architecture In Cloud-Native Environments For Dow Compliance,
2026
Northeastern University
From Framework To Toolchain: Implementing Zero Trust Architecture In Cloud-Native Environments For Dow Compliance, Shelby C. Snyder
Military Cyber Affairs
Federal agencies face a fiscal year 2027 target for enterprise-wide Zero Trust deployment, but NIST SP 800-207A defines logical components without identifying the Kubernetes technologies that implement them. This paper proposes a three-tier mapping of the Policy Engine, Policy Administrator, and Policy Enforcement Point to service mesh, microsegmentation, and perimeter tooling, stating the criteria by which each component is classified. It then applies a defined rubric to six Zero Trust vendors across component alignment, Kubernetes capability, federal authorization posture, and evidence quality, finding that no single vendor covers all three tiers. The mapping is a testable architectural proposition; a Stage …
Characterizing Advanced Persistent Threats With Cyber Attack Flow Metrics,
2026
Pikes Peak State College
Characterizing Advanced Persistent Threats With Cyber Attack Flow Metrics, Tyler Miller, Caleb Chang, Shouhuai Xu
Military Cyber Affairs
Cyber attack campaigns vary not only in scale but in structure, yet conventional characterizations often reduce them to a single dimension such as technique count or impact severity. In this paper we extend the concept of cyber attack flows by defining three new metrics, novelty, technique complexity and flow complexity. Then we characterize the attack flows of three advanced persistent threat campaigns using these metrics and draw insights regarding their capabilities. Our findings include that low novelty does not equate to low attack capabilities and that exploitation of an internet-facing appliance is a common initial attack vector.
Semantic Shields: Automating Critical Infrastructure Defense Via Nlp-Driven Ransomware Profiling,
2026
The Ohio State University
Semantic Shields: Automating Critical Infrastructure Defense Via Nlp-Driven Ransomware Profiling, Henry Trowbridge, Ian Zalcberg, Ryan Schley, Carter Yagemann, Natasha Phan, Srikar Maduposu, Vimal Buck
Military Cyber Affairs
Ransomware poses a growing threat to critical infrastructure, where successful attacks can disrupt operational technology (OT) and industrial control systems (ICS) with significant public safety consequences. However, attributing ransomware incidents to specific threat actors remains challenging due to ransomware-as-a-service ecosystems, actor rebranding, and the obfuscation of traditional indicators of compromise. This paper presents Semantic Shields, an NLP-driven attribution framework that leverages BERT-generated semantic embeddings and DBSCAN clustering to profile ransomware actors through the linguistic characteristics of ransom notes. Using a dataset of 295 ransom notes from 189 distinct threat groups, the framework achieved an 87.2% true positive clustering rate and …
From Dissertation To Deployment: A Unified Software Platform Operationalizing Clinical-Prediction And Sequential-Security Ai For Healthcare,
2026
International Burch University, Sarajevo
From Dissertation To Deployment: A Unified Software Platform Operationalizing Clinical-Prediction And Sequential-Security Ai For Healthcare, Olsi Shehu, Damiana Teliti, Jasmin Kevrić, Bekir Karlik
Communications of the IIMA
Advances in machine learning for healthcare are abundant, yet most validated models remain confined to research notebooks and never reach secure, usable clinical software. This paper addresses that deployment gap by presenting a unified, security-hardened software platform that operationalizes two complementary streams of doctoral research inside a single, role-based hospital information system. The first stream contributes a clinical-prediction capability: an ultra-hybrid ensemble that couples a quantum-inspired feature transformation, particle-swarm feature selection, and calibrated soft voting for cancer-outcome prediction (96.41% accuracy, AUC-ROC 0.983 on TCGA-BRCA), survival stratification, multi-cancer generalization, and pharmacogenomic drug-response classification (89.31% mean accuracy across 25 compounds). The second …
Bayesian And Multi-Objective Decision Support For Incident Mitigation In Cyber-Physical Systems,
2026
Singapore Management University
Bayesian And Multi-Objective Decision Support For Incident Mitigation In Cyber-Physical Systems, Shaofei Huang, Christopher M. Poskitt, Lwin Khin Shar
Research Collection School of Computing and Information Systems
Cyber-physical systems increasingly rely on interconnected physical and digital systems whose security incidents can escalate rapidly into safety and operational failures. Existing decision-support approaches struggle to support incident response because they rely on static assumptions, incomplete vulnerability data, and single-objective risk models that do not adequately capture trade-offs between attack success likelihood, impact severity, and system availability. This paper proposes an adaptive decision-support framework for incident mitigation in cyber-physical systems that integrates hierarchical Bayesian Network modelling, confidence-calibrated exposure estimation, and multi-objective optimisation into a unified, adaptive pipeline. The framework constructs probabilistic models from system architecture and vulnerability data, incorporating complementary …
Prune: A Patching Based Repair Framework For Certifiable And Privacy-Robust Unlearning Of Neural Networks,
2026
Singapore Management University
Prune: A Patching Based Repair Framework For Certifiable And Privacy-Robust Unlearning Of Neural Networks, Xuran Li, Jingyi Wang, Xiaohan Yuan, Peixin Zhang
Research Collection School Of Computing and Information Systems
Machine unlearning has emerged as a key mechanism for enabling the “right to be forgotten” in neural network models, allowing the selective removal of specific training data upon request. Existing approaches typically rely on retraining models with the remaining data, which is computationally expensive and difficult to verify, especially when deployed models are distributed or resource-constrained. To address this challenge, our prior conference work introduced PRUNE, a patching-based framework that formulates unlearning as a neural network repair problem. PRUNE achieves targeted forgetting by learning lightweight patch networks that redirect model predictions on the data to be unlearned while preserving performance …
Clinic-In-A-Box: A Portable, Software-Defined Cyber Range For Realistic, Scenario-Based Cybersecurity Training,
2026
University of Arizona
Clinic-In-A-Box: A Portable, Software-Defined Cyber Range For Realistic, Scenario-Based Cybersecurity Training, Ethan Chumley, Aaron Nair, Royce Yaezenko, Joshua Payne, Veronika Kyles, Paul Wagner, Robert J. Honomichl, Ryan Straight, Shengjie Xu
Journal of Cybersecurity Education, Research and Practice
Realistic, hands-on cybersecurity training has traditionally depended on fixed infrastructure such as dedicated lab hardware, cloud subscriptions, or permanent network connectivity, limiting where and how often it can be delivered. This paper presents the design and implementation of a portable, scenario-based cybersecurity training platform housed in a single travel case and built from commodity hardware, type-1 hypervisor virtualization, containerized service orchestration, and software-defined networking. The platform clones, isolates, and resets complete lab environments on demand, allowing the same physical system to support repeated classroom, workshop, or field deployments with minimal manual reconfiguration. Training scenarios are grounded in generated organizational profiles …
Between Digital Transformation And Regulatory Vacuum: Cybersecurity Of Public Services In Mozambique,
2026
Instituto Superior Politécnico de Tete
Between Digital Transformation And Regulatory Vacuum: Cybersecurity Of Public Services In Mozambique, Faztudo Languisse Eng.
Journal of Cybersecurity Education, Research and Practice
The rapid expansion of digital public services in Mozambique—including e-government platforms, digital health systems, and electronic tax administration—has outpaced the development of a coherent legal framework for cybersecurity. While Law No. 3/2017 (Electronic Transactions Law) of 9 January 2017 introduced foundational data-protection principles, Mozambique long lacked a dedicated cybersecurity regulatory authority, mandatory security standards, and formal incident-notification mechanisms. This regulatory vacuum exposed critical public services to escalating cyber risks as digital transformation was actively promoted as a development priority. This article examines the legal and institutional gaps in Mozambique's cybersecurity governance framework prior to the 2026 Cybersecurity and Cybercrime Laws, …
Self Efficacy And Instructional Support Predict Cyber Deception Acceptance In Ics And Ot Cybersecurity,
2026
Southern New Hampshire University
Self Efficacy And Instructional Support Predict Cyber Deception Acceptance In Ics And Ot Cybersecurity, Daniel Ward
Journal of Cybersecurity Education, Research and Practice
Cyber deception can produce high-confidence evidence of unauthorized activity in industrial control systems (ICS) and operational technology (OT), but practitioners must consider the technology useful, safe, understandable, and supported before they will use it. This study reports a secondary quantitative analysis of a deidentified survey of United States-based ICS and OT professionals to determine whether psychological and instructional factors predict adoption readiness and effective utilization beyond education, experience, and sector. Hierarchical ordinary least squares regression with HC3 robust standard errors was conducted on 262 complete cases. The demographics-only model was not significant and explained 2.8 percent of outcome variance. Adding …
Opengrcrmf: A Vendor-Neutral Framework For Teaching And Modeling Rmf Automation, Continuous Authorization, And Zero Trust Governance,
2026
CyberSecurity Subject Matter Expert
Opengrcrmf: A Vendor-Neutral Framework For Teaching And Modeling Rmf Automation, Continuous Authorization, And Zero Trust Governance, Anand Janjal
Journal of Cybersecurity Education, Research and Practice
Abstract—Federal and regulated organizations continue to rely on document-centric Authorization to Operate (ATO) processes even as the NIST Risk Management Framework (RMF), continuous monitoring guidance, Zero Trust Architecture (ZTA), and continuous authorization initiatives require more continuous, evidence-driven risk management [1]-[3], [13], [15]. Manual System Security Plan (SSP) updates, spreadsheet-based Plan of Action and Milestones (POA&M) tracking, and disconnected assessment evidence create governance latency: the delay between operational security events and authorization-ready governance response. This paper presents OpenGRCRMF, a proposed open, vendor-neutral reference framework that models RMF lifecycle activities as workflow states, treats authorization artifacts as structured governance objects, and …
Personal Authenticity For Engagement And Transfer In Introductory Cybersecurity Education,
2026
Indiana University - Bloomington
Personal Authenticity For Engagement And Transfer In Introductory Cybersecurity Education, Daniel T. Hickey, Ronald J. Kantor
Journal of Cybersecurity Education, Research and Practice
Abstract—This conceptual/theoretical paper explores how personal authenticity might promote generative learning in introductory cybersecurity courses. Generative learning transfers confidently to future educational, professional, personal, and testing situations. This cycle of design-based research addresses the concern that more typical professionally authentic contexts (e.g., hospitals, banks, etc.) may be alien and overwhelming to many students, particularly those in introductory courses and/or from non-professional families and communities. If so, this leads to “inert” knowledge that does not transfer. Personal authenticity is rooted in expansive framing, a modern theory of learning transfer. We reframe expansive framing as personal authenticity to make it …
