Large Language Models (LLMs) have significantly advanced natural language processing (NLP), providing versatile capabilities across various applications. However, their application to complex, domain-specific tasks, such as cyber-security, often faces substantial challenges. In this study, we introduce SecKnowledge and CyberPal.AI to address these challenges and train security-expert LLMs. SecKnowledge is a domain-knowledge-driven cyber-security instruction dataset, meticulously designed using years of accumulated expert knowledge in the domain through a multi-phase generation process. CyberPal.AI refers to a family of LLMs fine-tuned using SecKnowledge, aimed at building security-specialized LLMs capable of answering and following complex security-related instructions. Additionally, we introduce SecKnowledge-Eval, a comprehensive and diverse cyber-security evaluation benchmark, composed of an extensive set of cyber-security tasks we specifically developed to assess LLMs in the field of cyber-security, along with other publicly available security benchmarks. Extensive evaluations demonstrate a significant average improvement of up to 24% over the baseline models, underscoring the benefits of our expert-driven instruction dataset generation process. These findings contribute to the advancement of AI-based cyber-security applications, paving the way for robust security-expert LLMs that can enhance threat-hunting and investigation processes.

We establish an equivalence between two important random ensembles of linear codes: random linear codes (RLCs) and random Reed-Solomon (RS) codes. Specifically, we show that these models exhibit identical behavior with respect to key combinatorial properties—such as list-decodability and list-recoverability—when the alphabet size is sufficiently large. We introduce monotone-decreasing local coordinate-wise linear (LCL) properties, a new class of properties tailored for the large alphabet regime. This class encompasses listdecodability, list-recoverability, and their average-weight variants. We develop a framework for analyzing these properties and prove a threshold theorem for RLCs: for any LCL property $\mathcal{P}$, there exists a threshold rate $R_{\mathcal{P}}$ such that RLCs are likely to satisfy $\mathcal{P}$ when R<$R_{\mathcal{P}}$ and unlikely to do so when $R\gt R_{\mathcal{P}}$. We extend this threshold theorem to random RS codes and show that they share the same threshold $R_{\mathcal{P}}$, thereby establishing the equivalence between the two ensembles and enabling a unified analysis of list-recoverability and related properties. Applying our framework, we compute the threshold rate for list-decodability, proving that both random RS codes and RLCs achieve the generalized Singleton bound. This recovers a recent result of Alrabiah, Guruswami, and Li (2023) via elementary methods. Additionally, we prove an upper bound on the list-recoverability threshold and conjecture that this bound is tight. Our approach suggests a plausible pathway for proving this conjecture and thereby pinpointing the list-recoverability parameters of both models. Indeed, following the release of a prior version of this paper, Li and Shagrithaya (2025) used our equivalence theorem to show that random RS codes are near-optimally list-recoverable.

The vehicular connectivity revolution is fueling the automotive industry's most significant transformation seen in decades. However, as modern vehicles become more connected, they also become much more vulnerable to cyber-attacks. In this paper, a fully working machine learning approach is proposed to protect connected vehicles (fleets and individuals) against such attacks. We present a system that monitors different vehicle interfaces (Network, CAN, and OS), extracts relevant information based on configurable rules, and sends it to a trained generative model to detect deviations from normal behavior. Using a configurable data collector, we provide a higher level of data abstraction as the model is trained based on events instead of raw data, which has a noise-filtering effect and eliminates the need to retrain the model whenever a protocol changes. We present a new approach for detecting anomalies, tailored to the temporal nature of our domain. Adapting a hybrid approach to the fully temporal setting, we first train a Hidden Markov Model to learn normal vehicle behavior, and then a regression model to calibrate the likelihood threshold for anomaly. Using this architecture, our method detects sophisticated and realistic anomalies, which are missed by other existing methods monitoring the CAN bus only. We also demonstrate the superiority of adaptive thresholds over static ones. Furthermore, our approach scales efficiently from monitoring individual cars to serving large fleets. We demonstrate the competitive advantage of our model via encouraging empirical results.