Abstract Extracting Chinese Cyber Threat Intelligence (CTI) under increasingly complex advanced persistent threat scenarios is crucial, yet challenging due to domain-specific term ambiguity and frequent long, nested entities. To address polysemy, nested-label conflicts, and cross-sentence semantic discontinuity, we propose an enhanced Transformer-based entity recognition method formulated as a pointer network. On the encoder side, we build a RoBERTa model with Rotary Positional Embeddings. To handle complex positions and boundaries of heterogeneous entity types, we introduce tokenization compensation and positional-parameter compression to sharpen boundary sensitivity. In the decoder, we refine GlobalPointer and model recognition as 2D head–tail span matching, enabling direct detection of overlapping and nested entities. To mitigate long-tail bias, we introduce an entity-frequency-aware dynamic threshold and a reweighted zero-boundary log-loss to improve recall for rare entities. Experiments demonstrate an overall F1 improvement of 6.32% over baselines on Chinese CTI datasets, with absolute gains reaching 19.7% specifically on nested and long entities. These results validate the model’s effectiveness in Chinese-specific named entity recognition and its utility for high-accuracy automated CTI analysis.

Path planning constitutes a critical component of penetration testing for 5G-ICPS networks. The diversity of interfaces and protocols necessitates deep analysis of vulnerability exploitation methods and cross-protocol combination strategies, significantly increasing attack path planning complexity. Furthermore, dynamic network slice configurations and physical-information coupling effects drive continuous topological evolution, causing state-space explosion and challenging path planning under uncertainty with incomplete information. To address these issues, we construct a temporal attack graph modeling 5G-ICPS attack processes, and design a GraphSAGE-based environment representation encoder. This encoder undergoes multi-tiered self-supervised pre-training, employing node-level and graph-level training to encode diverse reinforcement learning environments across attack scenarios into fixed-dimensional vector representations. This achieves decoupling from underlying topology, vulnerability specifics, and security configurations, effectively mitigating state-space explosion in large-scale networks. Subsequently, we cluster highly similar vulnerabilities and filter invalid attack actions using three typical 5G-ICPS attack constraints, compressing the agent’s exploration space. Especially, we design a customized reward function that dynamically incentivizes/penalizes actions based on compromised assets. Experimental results demonstrate significant improvements: penetration testing invalid action rates decrease from 22.3% to 7.5%, while average steps to achieve attack targets reduce by >54%. These advancements effectively reduce penetration testing costs and increase attack success rates.

While virtualization and resource pooling empower cloud networks with structural flexibility and elastic scalability, they inevitably expand the attack surface and challenge cyber resilience. Reinforcement Learning (RL)-based defense strategies have been developed to optimize resource deployment and isolation policies under adversarial conditions, aiming to enhance system resilience by maintaining and restoring network availability. However, existing approaches lack robustness as they require retraining to adapt to dynamic changes in network structure, node scale, attack strategies, and attack intensity. Furthermore, the lack of Human-in-the-Loop (HITL) support limits interpretability and flexibility. To address these limitations, we propose CyberOps-Bots, a hierarchical multi agent reinforcement learning framework empowered by Large Language Models (LLMs). Inspired by MITRE ATT&CK's “Tactics-Techniques” model, CyberOps-Bots features a two-layer architecture: (1) An upper-level LLM agent with four mod ules—ReAct planning, IPDRR-based perception, long-short term memory, and action/tool integration—performs global awareness, human intent recognition, and tactical planning; (2) Lower-level RL agents, developed via heterogeneous separated pre-training, execute atomic defense actions within localized network regions. This synergy preserves LLM adaptability and interpretability while ensuring reliable RL execution. Experiments on real cloud datasets show that, compared to state-of-the-art algorithms, CyberOps-Bots maintains network availability 68.5% higher and achieves a 34.7% jumpstart performance gain when shifting the scenarios without retraining. To our knowledge, this is the first study to establish a robust LLM-RL framework with HITL support for cloud defense.