Cyberattack investigations are crucial for understanding the Tactics, Techniques, and Procedures of adversaries, but they face increasing challenges due to the complexity, scale, and volume of modern cyber incidents. Current approaches, such as heuristic-based and learning-based methods, struggle with scalability and reliance on labeled data, leading to difficulties in adapting to new threats. In this paper, we present Clouseau,a hierarchical multi-agent approach that leverages the reasoning capabilities of Large Language Models (LLMs) to autonomously investigate cyberattacks from a single Point-Of-Interest while requiring neither prior training nor predefined heuristics. We evaluated Clouseauon 21 diverse attack scenarios, including complex cases from DARPA's OpTC engagements and Advanced Persistent Threat (APT) attack scenarios from the ATLAS dataset. In single-host settings, Clouseauachieves an average F1 score of 99.78%, surpassing strong baselines by more than 33%. To demonstrate its broad applicability, we tested Clouseau with both proprietary and open-weight LLMs, achieving strong performance in both cases, thereby enabling deployment in private environments where access to proprietary models is restricted.

Deep learning approaches have achieved remarkable performance in malware classification and detection. However, their success relies on the availability of large, accurately labeled datasets: a critical yet challenging requirement in the malware domain. In practice, most malware datasets are automatically labeled using outputs from antivirus engines, a process that often introduces significant label noise. Such imperfections can severely degrade the performance and generalizability of deep learning models.

Deep learning techniques are increasingly being incorporated into NIDS. However, the evaluation of such deep learning models often assumes static data distributions and overlooks the effects of randomness and environmental variation. As a result, the reported performance may not reflect the NIDS behaviour during real-world deployment. This paper investigates the impact of stochastic and environmental factors on the evaluation of deep learning models for NIDS, with a focus on shift-aware models that detect and adapt to data shift, representing state-of-the-art systems for long-term deployment. We examine two baselines under controlled variations to analyse the impact of each factor on the reproducibility and fairness of the results, revealing that the F1 score can vary largely due to these, even minor, variations. All of the explored factors affect the reproducibility of the results, and some can significantly skew performance. Based on our findings, we provide practical recommendations to support reproducible and fair evaluations of deep learning-based NIDS systems.

Chat applications are available on many computer platforms. We present a novel chat application on a bare Internet using bare PCs. In a bare Internet, which is overlaid on and coexists with the Internet, all computing devices are bare, meaning they have no operating system and no persistent storage. We describe the design and implementation of the chat application and use it to conduct preliminary tests on the Internet. The results show the feasibility of a bare Internet. Our contributions include a simple chat design, a closed system approach, a bare Internet architecture, context-based user authentication, security by design, server-controlled chat sessions, and extensibility to other application domains. This work lays a foundation to build other domain-specific applications on a bare Internet.

This paper presents a methodology called Rigorous Analysis Template Process (RATP) for analysing the behaviours and interactions of multiple components in a Self-Driving Vehicle (SDV) to ensure its system safety, especially when a human driver is involved as a fallback option for handling hazardous events. RATP uses Systems-Theoretic Processes Analysis (STPA) and Event-B formal method to gradually identify safety requirements and build their rigours models. The output of RATP is a set of safety requirements that guide the development of a rigorous model to maintain the system safety against identified hazardous states at different levels of abstraction. The main advantage of RATP is to allow the behaviours of a system to be analysed from a high-abstraction layer to a more detailed concrete layer.

A self-driving vehicle (SDV) brings a novel idea to the automotive industry as it aims to replace the human driver; however, the human driver is still involved in the loop of an SDV's life cycle. Although the human driver plays a major role in ensuring the high-level safety property of the system, incorrect interactions between a human driver and an SDV might lead to a serious accident. Our paper aims to develop a rigorous analysis template that emphasises the system component interactions between an SDV and a human driver, especially if the SDV assumes the human driver to be a fallback option for dealing with hazardous events. Our approach combine Systems-Theoretic Processes Analysis (STPA) in order to identify the high-level safety requirements, and the Event-B formal method to provide the assurance about the consistency of the safety requirements obtained from STPA.