Despite the rapid adoption of Large Language Models (LLMs) for automatic code generation, their output often exhibits syntax errors, security vulnerabilities, and functional inconsistencies. To address these issues, we present CodeEnhancer, a two-stage framework that tightly integrates LLMs with static application security testing (SAST) tools and targeted fine-tuning. The goal is to produce more secure and functionally correct Python code. In the first stage, our iterative validation pipeline couples LLM-generated code with tools such as Pylint and Bandit. These tools automatically identify and remediate issues through structured feedback loops. When applied to the GPT-4o model, this process eliminated 82.8% of the initial vulnerabilities and resolved all the detected functional correctness issues when tested on the LLMSecEval dataset. In the second stage, we fine-tune the LLMs using two types of secure code examples: expert-written samples and code refined by our framework. Comparative experiments demonstrate that the framework-tuned model outperforms the baseline and expert-tuned models. The framework-tuned model generates only 18.4% vulnerable code snippets on the LLMSecEval dataset, whereas the baseline and expert-tuned models produce 43.6% and 54.7% vulnerable code snippets, respectively. The framework-tuned model reduces final vulnerability rates to 6.7% on LLMSecEval and 3.5% on the SecurityEval dataset. Our results highlight the synergistic effect of integrating static analysis with feedback-informed fine-tuning. They also reveal limitations in current evaluation metrics and dataset representativeness. These findings suggest a scalable, robust approach to achieving more secure, trustworthy, and practical AI-assisted code generation. • Combines language models with SAST Tools to enhance Syntax, security and functional correctness Python code. • First approach to address syntax, security, and functional correctness in LLM-generated code. • Automated feedback and learning process helps LLMs generate more secure, correct code. • Fine-tuning on framework-refined code leads to better security than training on expert-written code. • Scalable approach enables robust and trustworthy AI-assisted code generation and refinement with minimal manual effort.

An attack graph is a method used to enumerate the possible paths that an attacker can take in the organizational network. MulVAL is a known open-source framework used to automatically generate attack graphs. MulVAL's default modeling has two main shortcomings. First, it lacks the ability to represent network protocol vulnerabilities, and thus it cannot be used to model common network attacks, such as ARP poisoning. Second, it does not support advanced types of communication, such as wireless and bus communication, and thus it cannot be used to model cyber-attacks on networks that include IoT devices or industrial components. In this article, we present an extended network security model for MulVAL that: (1) considers the physical network topology, (2) supports short-range communication protocols, (3) models vulnerabilities in the design of network protocols, and (4) models specific industrial communication architectures. Using the proposed extensions, we were able to model multiple attack techniques including: spoofing, man-in-the-middle, and denial of service attacks, as well as attacks on advanced types of communication. We demonstrate the proposed model in a testbed which implements a simplified network architecture comprised of both IT and industrial components.

Selecting the optimal set of countermeasures to secure a network is a challenging task, since it involves various considerations and trade-offs, such as prioritizing the risks to mitigate given the mitigation costs. Previously suggested approaches are based on limited and largely manual risk assessment procedures, provide recommendations for a specific event, or don't consider the organization's constraints (e.g., limited budget). In this paper, we present an improved attack graph-based risk assessment process and apply heuristic search to select an optimal countermeasure plan for a given network and budget. The risk assessment process represents the risk in the system in such a way that incorporates the quantitative risk factors and relevant countermeasures; this allows us to assess the risk in the system under different countermeasure plans during the search, without the need to regenerate the attack graph. We also provide a detailed description of countermeasure modeling and discuss how the countermeasures can be automatically matched to the security issues discovered in the network.

Attack graphs are one of the main techniques used to automate the cybersecurity risk assessment process. In order to derive a relevant attack graph, up-to-date information on known cyber attack techniques should be represented as interaction rules. However, designing and creating new interaction rules is a time consuming task performed manually by security experts. We present a novel, end-to-end, automated framework for modeling new attack techniques from the textual description of security vulnerabilities. Given a description of a security vulnerability, the proposed framework first extracts the relevant attack entities required to model the attack, completes missing information on the vulnerability, and derives a new interaction rule that models the attack; this new rule is then integrated within the MulVal attack graph tool. The proposed framework implements a novel data science pipeline that includes a dedicated cybersecurity linguistic model trained on the NVD repository, a recurrent neural network model used for attack entity extraction, a logistic regression model used for completing the missing information, and a transition probability matrix for automatically generating new interaction rule. We evaluated the performance of each of the individual algorithms, as well as the complete framework, and demonstrated its effectiveness.

Cyber security assessment is an essential activity for understanding the security risks in an enterprise environment. While many tools have been developed in order to evaluate the security risks for individual hosts, it is still a challenge to identify multi-hop cyber security risks in a large-scale environment. An attack graph, which provides a comprehensive view of attacks, assists in identifying high-risk attack paths and efficiently deploying countermeasures. Several frameworks which generate an attack graph from system information and knowledge base have also been developed in the past. Although these tools are widely adopted, their expression capabilities are insufficient. The expansion of knowledge base is needed to handle comprehensive attack scenario. In this research, we developed an attack graph generation system by extending the MulVAL framework which is widely adopted due to its high extensibility. We designed and implemented knowledge base (also known as "interaction rules" in the MulVAL framework) for practical attack graph generation. A structured design procedure is necessary to construct a knowledge base that enables comprehensive analysis, which is highly important for actual risk assessment. We describe the design procedure, design considerations and implementation of our rule set. Additionally, we demonstrate the improvement to the generated attack graph by the implemented rules in a case study.

In the aftermath of natural disasters (e.g., earthquakes and hurricanes), information dissemination to and from citizens and authorities often involves the use of mobile network services. They may do so to seek help, distribute critical information, and possibly to confirm the safety of relatives and friends. The traffic on the cellular network typically increases substantially in the aftermath of such disasters. The situation is further compounded by disruptions caused by damage to the network infrastructure and the non-availability of power. Networks are fragmented, and communication is intermittent and disruption prone. In this paper, we propose a name-based many-to-many communication service for such fragmented networks. The key feature of this service is an integration of several communication methods, such as push-based and pull-based. The service effectively supports a variety of network situations by leveraging the features of information-centric networks.

Network traffic for sharing contents is significantly increasing. The cache network is a desirable architecture to reduce traffic and to improve reliability of contents retrieval. “Breadcrumbs” is one of the promising techniques to find cached contents in a distributed manner. Thanks to Breadcrumbs, users can retrieve a content without managing where the cache exists. This demo shows a contents sharing application among mobile users in the Breadcrumbs-enabled cache network.

Most wireless networks consist of heterogeneous nodes with diverse characteristics. These heterogeneous nodes have various moving characteristics such as speed and direction. Since conventional wireless routing schemes are designed for networks with homogeneous mobility, they have to cope with the routing difficulties between heterogeneous nodes by careful tuning of routing parameters. Because optimally tuning to such parameters is difficult, this tuning tends to result in higher control overhead and to degrade communication quality, e.g., lower packet reachability and higher packet delay. This paper proposes efficient extensions of a proactive routing protocol to achieve sufficient communication quality in heterogeneous mobile networks. Simulation results reveal that the proposed scheme can achieve higher packet reachability and lower delay with low control overhead compared with existing routing schemes.

The 3G mobile network IMT-2000, was launched some years ago and multimedia traffic in the mobile Internet has been increasing with the growth of wireless access links. Next-generation networks need to efficiently transport huge volumes of multimedia traffic with high-quality mobility management. We have proposed an IP-based IMT network platform (IP/sup 2/) for the next-generation mobile network architecture and have studied its mobility management scheme, IP/sup 2/ mobility management protocol (IP/sup 2/MM). IP/sup 2/MM is a network-controlled mobility protocol that deploys mobility functions inside the network and conceals IP mobility from the mobile node. It is also designed to satisfy the requirements of mobile operators. In this paper, we introduce an overview of IP/sup 2/MM and show the comparative evaluation results with mobile IPv6. For the evaluation, we implemented both in our experimental system and compared their performance. The results show that IP/sup 2/MM provides better mobility performance than mobile IPv6, and we conclude that IP/sup 2/MM is an effective and feasible mobility protocol for the next-generation networks of mobile operators.