Industrial Control Systems (ICS) are increasingly targeted by sophisticated cyber-attacks that can disrupt physical processes, compromise safety, and cause substantial operational and environmental damage. Traditional intrusion detection systems (IDS) for ICS often rely on centralized monitoring architectures, which introduce latency, create single points of failure, and hinder precise localization of compromised components. To address these limitations, we propose CUTIE, a component-specific distributed IDS that deploys lightweight detection modules directly at each Programmable Logic Controller (PLC). Each module is trained in an unsupervised manner on the normal behavior of its corresponding network traffic, enabling the detection of localized anomalies without requiring labeled attack data. CUTIE leverages bidirectional flow representations and timing-based aggregation to balance early detection with meaningful traffic abstraction, while maintaining low computational and memory overhead suitable for resource-constrained industrial environments. Extensive evaluation on the SWaT dataset demonstrates that CUTIE achieves high detection accuracy and robust performance across multiple lightweight model architectures.

Abstract Named Entity Recognition (NER) in specialized domains like biomedicine suffers from acute data scarcity, requiring expensive expert annotations. While data augmentation offers a promising solution, it inevitably introduces noisy and mislabeled samples that can degrade model performance. This problem is amplified in few-shot scenarios where every training example matters. We introduce PALAUNER (Policy-based Active Learning to Augment Named Entity Recognition), a reinforcement learning framework that learns to select high-quality samples from augmented data pools. Using a deep Q-network, our agent evaluates samples based on content features and model predictions, deciding which examples will improve NER performance. Experiments across five BioNER benchmarks demonstrate that PALAUNER consistently enhances diverse augmentation methods, from simple perturbations to GPT-based generation. Average F1 improvements are of 0.5−7.1 points in few-shot settings. PALAUNER’s modular design enables seamless integration with emerging augmentation techniques, providing a generalizable solution for training data quality enhancement. We publicly release our code on GitHub: ( https://github.com/picuslab/palauner ).

In this paper, we present a stock market forecasting framework that integrates sentiment analysis of news headlines associated with individual stocks performed by Large Language Models (LLMs) with economic indicators. Specifically, we infer multi-class labels and continuous polarity scores by using LLMs (i.e., Llama, Vicuna, and Mistral) under zero-shot settings from news content. These sentiment signals are combined with historical price data and economic indicators and fed as input to different deep learning models (i.e., Long Short-Term Memory (LSTM) networks, Generative Adversarial Networks (GANs), and Transformers) for predicting stock closing prices. We evaluate the proposed framework on a dataset comprising historical financial time series and 8652 news articles related to 47 meme stocks listed on major stock exchanges, covering the period from January 2019 to December 2021. While Vicuna delivers the quickest sentiment processing (around faster than Llama), it achieves the greatest hallucination rate ( ). Among the forecasting models, Transformer architectures offer improved Mean Absolute Percentage Error (MAPE) scores ( – ) while LSTM requires minimal computational resources for training (up to ).

Designing and testing modern network systems is a complex and costly process, particularly during the testing phase, where time constraints and unpredictability often lead to inflated development efforts. In this paper, we propose a novel methodology that leverages natural language comments from developer commits to optimize test execution. By extracting meaningful insights from comments, we construct a prioritized task list, focusing on those tasks that are most likely to fail. This approach streamlines the testing workflow, accelerates execution, and reduces overall development costs. Our pipeline combines transformer-based models for semantic understanding with unsupervised anomaly detection methods, including clustering algorithms, autoencoders (AE), and variational autoencoders (VAE), to identify failure-prone scenarios without requiring labeled data. Applied to a real-world industrial dataset, the AE model achieves an F1score of 0.838, and the VAE follows closely with 0.805, significantly outperforming traditional clustering approaches. These results highlight the effectiveness of leveraging commit metadata for intelligent test prioritization and demonstrate the potential for scalable improvements in continuous integration pipelines.

Integrating physical and cyber realms, Cyber–Physical Systems (CPSs) expand the potential attack surface for intruders. Given their deployment in critical infrastructures like Industrial Control Systems (ICSs), ensuring robust security is imperative. Current research has developed various Intrusion Detection techniques to identify and counter malicious activities. However, traditional methods often encounter challenges in detecting several attack types due to reliance on a single data source such as time series data from sensors and actuators. In this study, we meticulously design advanced Deep Learning (DL) anomaly-based techniques trained on either sensor/actuator data or network traffic statistics in an unsupervised setting. We evaluate these techniques on network and physical data collected concurrently from a real-world CPS. Through meticulous hyperparameter tuning, we identify the optimal parameters for each model and compare their efficiency and effectiveness in detecting different types of attacks. In addition to demonstrating superior performance compared to various baselines, we showcase the best model for each data source. Eventually, we show how utilizing diverse data sources can enhance cyber-threat detection, recognizing different kinds of attacks. • We design DL anomaly-based techniques trained on either sensor or network data. • We evaluate techniques on different data sources collected from a real-world CPS. • After hyperparameter tuning, we compare the models’ attack detection ability. • We demonstrate superior performance compared to state-of-the-art base-lines. • We show how utilizing diverse data sources can enhance cyber-threat detection.

The protection of Cyber–Physical Systems (CPSs) from cybersecurity threats is essential to ensure the resilience and safety of critical infrastructures. Anomaly detection approaches for CPSs proposed in the literature use either network data or data from sensors/actuators as inputs, often failing to detect attacks that affect only specific components. In this paper, we propose a novel two-stage framework for threat detection in CPSs. This framework integrates anomaly detection models that operate on both network and physical data, by leveraging a decision fusion technique to combine the outputs into a coherent decision. To assess the effectiveness of the framework, we employ an unlabeled release of a real-world dataset, integrating network traffic with sensors/actuators data. Additionally, we offer explicit labeling rules to ensure reproducibility. The results demonstrate that our approach substantially improves CPSs security, efficiently identifying subtle attacks that can evade traditional methods relying on a single data source. In particular, we show that integrating both physical and network data improves the F1 score by approximately 10% compared to using just network data, and by nearly 30% compared to using just physical data. • We propose a framework for CPS threat detection using both network and physical data. • We integrate diverse deep learning models to analyze each data source independently. • We design a decision fusion technique to integrate network and sensor readings. • We achieve a 10% F1 improvement over network data and a 30% over sensor data. • Our method detects threats in 2–3 s, enabling quick response to CPS attacks.

Chronicles of the last few years show that industrial Cyber-Physical Systems are the target of dangerous cyber-attacks and face multiple threats. It is important to react as promptly as possible to such attacks and take proper countermeasures. Anomaly detection is a key activity in a Cyber-Physical System’s defense strategy. It involves analyzing sensor data, modeled as a Multivariate Time Series, to identify deviations from expected behavior, that may indicate potential cyber threats or attacks. In this paper, we design a novel framework integrating spatial and temporal modules to unveil spatio-temporal dependencies within sensor data in Cyber-Physical Systems to detect possible intrusions. We propose a novel strategy based on time series correlation to build a graph minimizing the number of sensors’ connections to unveil spatial dependencies between multimodal time series. The prediction and reconstruction losses are then leveraged to detect anomalies. The proposed framework has been evaluated on a real-world Cyber-Physical System, on which we evaluated both the efficacy and efficiency with respect to different competing approaches. The experimental analysis shows that the proposed framework outperforms eight state-of-the-art ones by increasing the precision of 0.59% while reducing both the training time (21.05%) for each epoch and memory occupation (77.8%) with respect to the best competitor in the literature. These characteristics make it particularly suitable for industrial environments that need periodic reconfigurations.

Context: In recent years, the code translation task has arisen as one of the major software issues in maintaining software quality during migration over complex infrastructure. This task involves human subjects with different background knowledge and could introduce errors due to the semantic gap between the programming languages and the complexity of the task. Generative Artificial Intelligence (AI) showed good capabilities in code generation, albeit this is highly dependent on the human factor . Objective: This paper investigates, from the human perspective, the use of three Generative AI tools (ChatGPT, Google Bard, and GitHub Copilot) in the context of translation tasks from code written in query languages to code written in framework-specific code languages, specifically focused on SQL dialects and PySpark. This translation is especially crucial during the migration from centralized architectures to cloud-based architectures. Methods: We evaluate the usefulness of these tools, the quality of the generated code, and their impact on performance. The models are tested with queries of various type in three different SQL dialects considering three usage scenarios of increasing complexity. It involves 15 participants with diverse programming backgrounds, who aim to solve tasks by interacting multiple times with the tools and manually changing the code. Results: The findings show a positive performance, demonstrating their reliability in generating coherent translations, achieving 100% precision in most tasks with a slight decrease in more complex scenarios, and producing well-documented code, with a response time of under 2 min, with Google Bard responding 50% faster than the others. Conclusion: In conclusion, this paper establishes a methodology and both quantitative and qualitative metrics for evaluating how generative AI tools streamline code translation, shifting the emphasis from production to refinement. It underscores the importance of continuously improving these tools to integrate them into developers’ workflows and to provide guidelines for intelligent use.

Conducting a maturity assessment allows companies to measure their readiness in implementing novel technologies. However, this task is challenging due to the multidimensional, complex, unpredictable, and non-linear nature of innovation. In this paper, we introduce an innovative approach to maturity assessment that enables both intra- and inter-company analysis. Our approach evaluates a company’s absolute maturity score concerning a specific technology or area. By leveraging a Natural Language Processing pipeline applied to a semi-structured questionnaire we extract popular concepts from the answers and present them to a human expert for analysis. The expert can refine the analysis by adding or removing concepts as needed. Subsequently, we compute a similarity metric for each answer to determine a company’s maturity in specific concepts. The output of our analysis is presented through human-readable plots, offering clear insights into the internal maturity level of the company and allowing for a comparison with competitors across the chosen concepts. To demonstrate the capabilities of our method, we provide a running example showcasing both quantitative and qualitative results of the analysis. Our approach demonstrates efficiency, with preprocessing completed in 1.967±0.758 s, and information extraction in 0.074±0.017 s on average, excluding human intervention time, and requiring low hardware resources.