SR-Fraud: An Outcome-Supervised Reflective LLM Agent Framework for Non-Stationary Payment Fraud Detection

Real-time payment fraud detection is a non-stationary streaming prediction problem: adversaries adapt before supervised labels mature, and localized burst attacks can cause losses before retraining. Production systems typically rely on tabular classifiers and rules, which can struggle to capture...

Confidence-Guided Cross-Modal Knowledge Transfer for Multimodal Anomaly Detection in Microservice Systems

Accurate anomaly detection is essential for reliable and secure operations of microservice systems. While an increasing number of studies have shifted from unimodal modeling to multimodal interaction and fusion, effectively leveraging reliable cross-modal information remains challenging. The...

Reliable Federated TinyML Deployment for IoT Security

The growing deployment of Internet of Things IoT devices has increased the need for privacy-preserving intrusion detection systems that operate directly on resource-constrained hardware. Federated Learning enables collaborative model training without sharing raw data, but conventional federated...

Solidity Meets LLMs: A Transformer-Based Approach to Smart Contract Vulnerability Detection

The growing adoption of blockchain technologies, particularly the Ethereum platform, has amplified the critical role of smart contracts in decentralized applications. However, the increasing complexity and financial value of these contracts make them prime targets for cyber attacks. In this work,...

How It's Made: Uncovering Detection Engineering Processes for Network Intrusion Detection Rules

Many Security Operations Centers rely on signature-based Network Intrusion Detection Systems like Suricata, yet detection rule engineering remains understudied. We investigate this process by introducing SuriCap, a platform for rule engineering exercises, and hosting CTF-style workshops where 60...

Multi-View Fusion for Encrypted C2 Detection: A Leakage-Controlled Measurement Study of Evaluation Pitfalls

Command-and-control C2 traffic increasingly hides within TLS, so defenders now apply machine learning to traffic metadata. Many studies assume that combining two metadata views, namely flow statistics and TLS handshake fingerprints, improves both accuracy and robustness. We tested this assumption...

Toward Responsible AI-Augmented Cyber Defense: Pattern Recognition, Defense-In-Depth, and the Case for Human-AI Collaboration

Cybersecurity literature has extensively documented the operational benefits of artificial intelligence AI for threat detection, incident response, and prevention, while raising qualitative concerns about over-automation, algorithmic bias, and analyst-skill erosion. What remains largely absent is...

Comparative Evaluation of Static Embedding Models for HTTP Request Anomaly Detection

Web applications are increasingly targeted by cyberattacks that exploit HTTP requests to evade security mechanisms. Traditional web application firewalls WAFs rely on rule-based approaches that often exhibit high false positive rates and limited adaptability. Recent studies have explored machine...

COBRA: A Content-Agnostic Framework for Zero-Day Detection of Suspicious Domains

The use of malicious domains is central to cyberattacks such as phishing, malware distribution, impersonation, and fraudulent transactions. Because domains are inexpensive to register and easy to deploy at scale, they remain one of the most common and damaging tools used in cybercrime across...

k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers

The k8saudit plugin's per-container fields ka.req.pod.containers. and the shipped k8sauditrules.yaml evaluated only requestObject.spec.containers. Security-relevant settings on a pod's initContainers or ephemeralContainers were not inspected, so the shipped Create Privileged Pod rule did not fire...

GHSA-JHJP-4C2Q-XMX4 k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers

The k8saudit plugin's per-container fields ka.req.pod.containers. and the shipped k8sauditrules.yaml evaluated only requestObject.spec.containers. Security-relevant settings on a pod's initContainers or ephemeralContainers were not inspected, so the shipped Create Privileged Pod rule did not fire...

CVE-2020-0688

CVE-2020-0688 Scanner This is a little dirty Script to Check for vulnerables Exchange Servers by CVE-2020-0688 It's written ugly and in PHP. Caution: It only checks if you have the actual CU update installed. That doesn't mean that you have installed the bugfix patch! Requirements You need php-cl...

Reverse-Engineering Flock Cameras

Hackers captured a Flock camera and got a look alternate link at the software: While much of the automatic license plate reader's ALPR most sensitive storage remained encrypted and inaccessible, the joint analysis of the recovered data shows that software running on the device explicitly detects...

100DaysofYARA

100 Days of YARA 2026 100 Days of YARAへようこそ！このリポジトリは、この期間に作成されたすべてのYARAアイデアを保存する場所として機能します。作成した楽しいスクリプト、ツール、ルールはすべてこのGitHubリポジトリにコミットできます！当面は、関連するブログ記事、ウォークスルー、その他の考察は別の場所で公開してください : これっていったい何なの？ 簡単に言うと、100DaysofYARA...

Antiphishing v35456910988

Antiphishing — Predictive Phishing Intelligence for Suricata DONATE · DASHBOARD VECTORS · CONTRIBUTING · SUBMIT A VECTOR · REST API CTI · WIKI Predictive Phishing Intelligence for Suricata — Preemptive Defense from Day Zero Antiphishing is an open-source GPLv3 Cyber Threat Intelligence CTI...

Controller-Only False Confirmation in Passive RF UAV Link Detection

Passive radio frequency RF sensing is widely used for counter-unmanned-aerial-vehicle counter-UAV detection. Existing studies commonly report high accuracy against background RF or WiFi/Bluetooth interference, but rarely isolate controller-only operation without a linked aircraft. We present a...

Benchmarking Neural Defend ARCAS 1B: A Foundational Multimodal Deepfake Detection Model

AI-generated imagery evolves faster than benchmark-specific detector evaluations, making a single score an incomplete account of generalization. This paper evaluates Neural Defend ARCAS 1B across benchmark families without benchmark-specific parameter updates. We retain native aggregation and...

webanalyze v0.4.6

webanalyze This is a port of Wappalyzer in Go. This tool is designed to be performant and allows to test huge lists of hosts. !NOTE Because Wappalyzer removed the public access to their app definitions, webanalyze currently loads definitions from enthec. Installation and usage Precompiled release...

rustinel v1.8.0-rc.1

Rustinel Open-source endpoint detection. Three platforms. Your rules. Run Sigma, YARA, and IOC detections on native Windows, Linux, and macOS telemetry. Written in Rust, with local alerts and no cloud account required. Download | Documentation | Detection packs | Website Why Rustinel? Use Sigma a...

CVE-2026-93984 OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret

OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters...