Industrial Control Systems (ICS) are pivotal in critical sectors like energy, transportation, and manufacturing. However, their increasing interconnectivity and complex digital environment have amplified cyber threat risks. Ensuring cyber resilience for ICS requires not just the use of current security management tools to address existing threats, but also a forward-thinking approach to anticipating and mitigating future risks. This paper proposes a novel concept: the Attack-Weakness Embedding Bridge (AWEB), which leverages separate graph structures and textual data from MITRE ATT&CK and CWE to create a unified analytical space. AWEB has the potential to discover previously unrecognized relationships between system weaknesses and attack patterns, significantly enhancing cybersecurity defenses. The model has the flexibility of leveraging fine-tuned or pre-trained LLM embeddings to capture the nuances of the two datasets. The experimental results demonstrate that our proposed model effectively brings attack patterns and common weaknesses in a mathematical space, providing valuable insights for cybersecurity practitioners.

The rise in cyberattacks on Industrial Control Systems (ICS) shows the need for enhanced security measures. Integrating diverse cybersecurity datasets is essential to provide a comprehensive view of the threat landscape. This paper presents an approach to automatically connect Common Weakness Enumeration (CWEs) and ICS-specific MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) techniques. We present studies on how embedding-based approaches such as SBERT and BERT and frequency-based approaches such as TF-IDF perform in detecting connections between ICS ATT&CK Techniques and CWEs. Furthermore, we employ advanced analytical methods to identify common attack patterns. We present three case studies to demonstrate the potential of embedding-based approaches for mapping multiple datasets. Our approach holds promise for detecting ICS weaknesses, showing how integrating expert knowledge and domain-specific data can be used for advanced threat analytics.

There is a national need to increase the number of minority students entering STEM fields with essential computing skills. To increase minority students’ interest and engagement in computing, a researcher-practitioner partnership between the University of Texas at El Paso and the El Paso Independent School District, developed and implemented a culturally and linguistically responsive curriculum and pedagogy to introduce computational thinking (CT) in two middle schools across different subject areas in a borderland region. The curriculum leveraged the Sol y Agua game – a bilingual, culturally-responsive game designed to engage students of this region in CT. This paper describes the process and initial findings of this project. The quantitative data from in-game analyses show that students utilized the language change feature to switch from English to Spanish more frequently than the other way – highlighting the need for educational platforms relatable to students through language, environment, and cultural context. Analyses of the qualitative data indicate that while teachers/team members understood CT and translanguaging concepts and taught lesson units that provided opportunities to practice both, CT and translanguaging were largely implicit in the curriculum. In collaborative analyses of these patterns, teachers described additional supports that would help them to make CT instruction and translanguaging strategies more explicit in the content and pedagogy, highlighting the need for systematic, targeted integration of these concepts.

The prevalence of malware on the Internet makes malware detection vital as an early warning system for organizations’ security. This paper presents a novel approach to linking knowledge from heterogeneous and specialized datasets using a sentence embedding approach. This paper also proposes a novel approach to detect malware activity using standardized and specialized datasets and people’s search interest data. We demonstrated the detection capabilities of our approach, assessing our models using four real attack study cases. We found an increase in Google searches and probabilities of our models seven days before and after an attack occurred. In addition, the web search volume and model probabilities time series are characterized by an increase in outliers around 14 days before and after the discovery of the attack. This work should pave the path for integrating domain-specific datasets and user-generated dynamic data for detecting malware activity.

Researchers have worked on modeling and predicting the likelihood of developing chronic diseases, such as diabetes and high blood pressure, using medical data (e.g., heart-rate, blood sugar). However, many of these diseases demonstrate strong links with demographics and socio-economic status (e.g., race, gender, income). It is also less time-consuming to retrieve demographic and socio-economic data, some of which are publicly available through the U.S. Census Bureau, than to conduct medical tests. Hence, such data can give a quicker estimate of the susceptibility of a person to a chronic disease.In this work, we study the effect of using medical vs. demographic data for modeling and predicting two chronic diseases: diabetes and high blood pressure. We proposed an updated deprivation index to build disease models that consider demographic data. Our results indicate demographic data are as good or better indicators for predicting chronic diseases.

Timely detection of an outbreak of any infectious disease is essential to implement timely mitigation strategies. Several approaches have been proposed to model and detect the occurrence of an outbreak. However, many of these approaches rely on health surveillance methods and informal and formal reports of illnesses. This paper proposes a single framework for detecting multiple infectious disease outbreaks by integrating disease-specific domain knowledge and public search trend data. We tested our framework with eleven infectious diseases and compared the results with the Centers for Disease Control and Prevention (CDC) outbreak data. Results show that our framework reaches accuracies greater than 95% in most cases. To our knowledge, this is the first study that uses standardized disease symptoms as main indicators, in combination with web search data, to detect infectious disease outbreaks. This work should pave the path for integrating domain-specific static information with user-generated dynamic data for detecting outbreaks of infectious diseases.

More than 80% of today's data is unstructured in nature, and these unstructured datasets evolve over time. A large part of these datasets are text documents generated by media outlets, scholarly articles in digital libraries, findings from scientific and professional communities, and social media. Vector space models were developed to analyze text data using data mining and machine learning algorithms. While ample vector space models exist for text data, the evolutionary aspect of ever changing text corpora is still missing in vector-based representations. The advent of word embeddings has enabled us to create a contextual vector space, but the embeddings fail to consider the temporal aspects of the feature space successfully. This paper presents an approach to include temporal aspects in feature spaces. The inclusion of the time aspect in the feature space provides vectors for every natural language element, such as words or entities, at every timestamp. Such temporal word vectors allow us to track how the meaning of a word changes over time, by studying the changes in its neighborhood. Moreover, a time-reflective text representation will pave the way to a new set of text analytic abilities involving time series for text collections.In this paper, we present a time-reflective vector space model for temporal text data that is able to capture short and long-term changes in the meaning of words. We compare our approach with the limited literature on dynamic embeddings. We present qualitative and quantitative evaluations using the tracking of semantic evolution as the target application.

As the world approaches a state of greater dependence on technology, many products face increasing threats from malicious attackers who are attempting to take advantage of vulnerabilities in software design. Most of the known vulnerabilities are already aggregated, stored in text format, and are readily accessible to the public, making such an aggregated database a prime corpus for analysis using data mining methods. A multitude of research efforts have been deployed analyzing individual aspects of such cyber-security corpora to create taxonomies, assess vulnerability impact, and even predict future vulnerabilities. However, minimal effort has been committed to analyze cyber-security corpora to explore correlations between vulnerabilities and study the evolution of a vulnerability from its genesis. In this paper, we propose an integrated data mining framework to automatically lay out how vulnerabilities develop over time and detect the evolution of a specific cyber-security threat. We use (1) a Supervised Topical Evolution Model (STEM), which discovers temporal themes from a text corpus and (2) a diffusion-based storytelling technique that sifts through past vulnerability reports to describe how a current threat evolved. The STEM gives a holistic evolution structure of the vulnerabilities, while diffusion-based storytelling provides the precise genealogy of a specific threat. A considerable series of experiments demonstrate that the proposed framework can discover evolutionary patterns in today's most pressing vulnerabilities with a high degree of precision. As case studies, we explore the development of vulnerabilities in certain products, providing a unique insight into the correspondence between seemingly unrelated vulnerabilities and the impact of that correspondence on overall software security.