Insider threats are prevalent security issues for organisations. While attribute-based access control (ABAC) systems manage sensitive data, they are not fully effective against insider threats. We propose integrating moving target defence (MTD) into ABAC systems to mitigate these threats. Our approach enhances the ABAC system with three modules: 1) a correlated attribute generator to estimate correlations among attribute-value pairs; 2) a policy sensitivity estimator to determine sensitivity levels of policy rules; 3) a mutation engine to dynamically mutate sensitive policy rules using correlated attributes. We evaluated our framework using a real-world dataset from an educational system, assessing the efficiency of the attribute generator, efficiency of the sensitivity estimator, overhead from the MTD components, and the framework's overall performance. Our results show that with a dataset of 200,000 records and 13 policy rules, the framework identified five sensitive rules and achieved a 100% mitigation rate without excessive overhead.

Large Language Models (LLMs) have revolutionized natural language processing, yet remain vulnerable to jailbreak attacks-particularly multi-turn jailbreaks that distribute malicious intent across benign exchanges, thereby bypassing alignment mechanisms.Existing approaches often suffer from limited exploration of the adversarial space, rely on hand-crafted heuristics, or lack systematic query refinement.We propose NEXUS (Network Exploration for eXploiting Unsafe Sequences), a modular framework for constructing, refining, and executing optimized multi-turn attacks.NEXUS comprises: (1) ThoughtNet, which hierarchically expands a harmful intent into a structured semantic network of topics, entities, and query chains;(2) a feedback-driven Simulator that iteratively refines and prunes these chains through attacker-victim-judge LLM collaboration using harmfulness and semantic-similarity benchmarks; and (3) a Network Traverser that adaptively navigates the refined query space for real-time attacks.This pipeline systematically uncovers stealthy, high-success adversarial paths across LLMs.Our experimental results on several closed-source and open-source LLMs show that NEXUS can achieve a higher attack success rate, between 2.1% and 19.4%, compared to state-of-the-art approaches.Our source code is available at github.com/inspire-lab/NEXUS.

Abstract With the rapid size and complexity growth of computer networks, network supervisors are now facing a new problem, which is to analyze and manage the large amounts of security alerts that can be generated by security devices. Alert correlation systems attempt to solve this problem by finding the similarity and causality relationships between raw alerts and providing high‐level view of the network under surveillance. Several alert correlation methods have been proposed recently to detect known attack scenarios. This paper focuses on how to develop an intrusion‐alert correlation system according to the information existed in the raw alerts without using any predefined knowledge. For this purpose, first, we define the concept of alert partial entropy to find the alert clusters with the same information. Then, we represent the alert clusters by an intelligible notation called hyper‐alerts. The network supervisor can reduce the number of hyper‐alerts based on the principle of maximum entropy or by using the concept of hyper‐alerts partial entropy. For more visualization, we define the hyper‐alerts graph, which provides a global view of intrusion alerts. Our results show that the proposed entropy‐based alert correlation system (E‐correlator) can simplify the analysis of large number of alerts. We achieved the promising reduction ratio of 99.98% in LLS_DDOS_1.0 attack scenario in DARPA2000 dataset while the constructed hyper‐alerts have enough information to discover the attacker, the victim, and the attack scenario. Copyright © 2014 John Wiley & Sons, Ltd.