Papers for

cybersecurity training providers

Papers whose findings have a practical use for this group, as judged from the abstract. Open a paper to read what it means in practice.

Rule engineering for network intrusion detection works regardless of experience

How It's Made: Uncovering Detection Engineering Processes for Network Intrusion Detection Rules

Abstract: Many Security Operations Centers rely on signature-based Network Intrusion Detection Systems like Suricata, yet detection rule engineering remains understudied. We investigate this process by introducing SuriCap, a platform for rule engineering exercises, and hosting CTF-style workshops where 60 participants, trained MSc students, and experienced SOC professionals, created rules for four scenarios. Participants produced 3146 valid rules, enabling analysis of their methods, performance, and iteration patterns. Surprisingly, prior experience had limited impact on rule quality, suggesting that less experienced engineers can produce rules comparable to experts. We also observed challenges in generalizing rules beyond available tests, underscoring the need for sufficient labeled data. From our study, we identify three phases and a common pattern in rule engineering, offering SOC managers insights to improve their processes and expectations of engineer expertise.

Tue 22 SeptCryptography and SecurityHuman-Computer Interaction

The gist

Detecting harmful activity on networks often uses rules in tools like Suricata, but how these rules are created isn’t well understood. The authors built a platform called SuriCap and ran workshops where experts and students wrote detection rules for different scenarios. They found that experience made little difference in rule quality, meaning even newcomers can write effective rules. They also saw that rules don’t always work well outside their test data, highlighting a need for more examples to train from. The study outlines common steps in making these rules to help security teams improve their process.

Open → 2609.25901v1

Reinforcement learning improves automated network defense efficiency

A Cyber Range Evaluation of Autonomous Network Incident Response Agents

Abstract: We test the performance of agents for automated network intrusion response in a cyber range intended for human operator training. The range implements an emulated networking environment with a variable network topology, red-team emulation and simulated user agents. The goal of the defensive agents is to prevent hosts in the network from being accessed by the red-team agent, while minimizing the availability costs induced from defensive measures. Alerts are generated using a SIEM platform and mapped to a data modeling language used by the agents. We test a combination of heuristic agents and policies learned using reinforcement learning. The learned policies are optimized to minimize the combined cost using a cyber attack simulator modeling the network. We found that the reinforcement learning agents were overall more efficient at defending the system than the heuristic policy, and that the performance depends highly on the policy of the adversary in combination with the simulated users.

Tue 15 SeptCryptography and SecurityArtificial Intelligence

The gist

Protecting computer networks against attacks is hard because defenders must block attackers without disrupting normal users. This paper tests automated agents designed to watch for attacks and respond quickly and smartly. The researchers used a realistic testing environment where attackers and users are simulated. They found that agents trained with reinforcement learning do better at blocking attacks while keeping the network running smoothly compared to simple rule-based agents. How well these agents do depends a lot on the attack methods and regular user activity.

Open → 2609.16541v1

ChatGPT usage diversity linked to better security assignment scores

Exploring the Role of Security Experience and ChatGPT Usage Strategies on Secure Software Engineering Education

Abstract: The rapid adoption of Large Language Models (LLMs) is reshaping software engineering education, but their role in secure software engineering education remains underexplored. We report an exploratory empirical study of how 26 graduate students in a part-time MSc Cybersecurity programme used ChatGPT during a vulnerability-fixing assignment. To characterise ChatGPT use, we analysed students' ChatGPT interaction logs using a structured double-coding procedure and examined whether usage patterns and prior cybersecurity expertise were associated with assignment performance. The results show that students with varying levels of cybersecurity expertise used broadly similar ChatGPT strategies. Individual usage patterns showed descriptive differences by grade, but none remained statistically significant after correcting for multiple comparisons. In contrast, diversity of ChatGPT usage, i.e., the number of distinct usage patterns adopted, was positively associated with performance, even after controlling for cybersecurity expertise. These exploratory findings suggest that the way students engage with ChatGPT may be more informative than whether they use it, and motivate future controlled studies to guide students toward effective LLM use in secure software engineering education.

Thu 10 SeptSoftware Engineering

The gist

Using ChatGPT is becoming common in software education, but how it helps with security tasks is not fully known. The authors studied 26 cybersecurity students using ChatGPT to fix code problems. They found that it wasn’t just whether students used ChatGPT that mattered, but how many different ways they used it. Students who used a wider variety of ChatGPT strategies tended to get better grades, regardless of their prior experience. This suggests teaching students to interact with AI tools in different ways might improve learning about secure coding.

Open → 2609.11303v1