ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “efficiency”

147 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllIndustry 1789Vulnerability 1544Policy & legal 966Ransomware 955Data breach 606Malware 600Phishing & fraud 424Exploit / PoC 364AI tools & infra 317Threat actor 304AI research 167AI industry 156AI safety & security 155Research 147
SeverityAllcritical 3604high 1246medium 1140low 2002info 845

Rare Not Random Using Token Efficiency for Secrets Scanning

Researcher proposes token efficiency (string length divided by BPE token count) as a better post-regex filter than entropy for secrets scanning, validated on CredData.

The post explores whether Byte-Pair Encoding tokenization can replace Shannon entropy as the primary filter for candidate secrets captured by regex in tools like Gitleaks. It defines 'token efficiency' as string length divided by token count under the cl100k_base tokenizer; secret-like strings such as GitHub tokens tokenize into many small tokens and score low, while natural text scores high. Evaluating labeled secrets from the CredData dataset shows a usable separation, with roughly 2.5 suggested as a minimum cutoff versus Gitleaks' 3.5 entropy threshold. The technique is positioned as a post-regex filtering step rather than a standalone detector.

Lobsters · security · 4d agoResearch

Windows Malware Detector as a Compound AI System: Trade-Offs in Accuracy, Efficiency, and Adversarial Robustness

Researchers model industrial Windows malware detection as a Compound AI System, quantifying trade-offs between detection accuracy, efficiency, and adversarial robustness under tiered attacker knowledge.

Industrial Windows malware detectors combine rule-based mechanisms with ML-based static and dynamic analyses, but their architectures are rarely publicly disclosed. The authors propose a methodology balancing detection performance, computational cost, and robustness, plus system-level threat models capturing whole-pipeline evasion rather than isolated components. Experiments on real-world data show training time reductions with marginal detection loss, while more knowledgeable attackers craft increasingly effective adversarial examples. The paper derives deployment guidelines from the observed efficiency-robustness trade-off.

arXiv cs.CR · 8d agoResearch

Guppy: Efficient Light Clients via Recursive Zero-Knowledge Proofs

Guppy lets blockchain light clients verify full state via recursive zero-knowledge proofs without validators maintaining state commitments, processing thousands of updates per second.

Guppy is a light-client protocol in which validators commit only to state updates while an off-chain, untrusted service secured by recursive zero-knowledge proofs maintains a verifiable Merkle tree over the full state. A hash-chain commitment moves validator signature verification out of the proving circuit, and a parallel recursive proving pipeline keeps latency growth logarithmic with throughput. A Plonky2-based implementation maintains a tree of size 2^30 while processing thousands of updates per second, adding only 2-4 seconds of latency without increasing block-construction complexity.

arXiv cs.CR · 8d agoResearch

ROSETTA: Efficient and Accurate Privacy-Preserving LLM Decoding via Hybrid CKKS/TFHE Evaluation

ROSETTA is a hybrid CKKS/TFHE homomorphic encryption framework for privacy-preserving LLM decoding, achieving up to 4.8x Softmax and 2.1x end-to-end speedups.

The paper proposes ROSETTA, a hybrid CKKS/TFHE fully homomorphic encryption framework for private inference on generative LLMs, targeting the nonlinear operations that dominate autoregressive decoding cost. It introduces an adaptive segmented lookup-table protocol based on TFHE and a scheme-aware operator-selection framework that assigns each nonlinear operator to CKKS or TFHE to minimize latency. Experiments show up to 4.8x Softmax speedup and 1.5-2.1x end-to-end decoding speedup over the state-of-the-art CacheMir framework.

arXiv cs.CR · 1d agoResearch

Efficient Branch-and-Bound Testing and Verification of zkVMs

ZEBRA verifies zkVM constraint systems via branch-and-bound cardinality counting, finding 11 zero-day bugs across five real-world zkVMs and running 51.5x faster than SMT verification.

ZEBRA reduces zkVM correctness to a solution-set cardinality problem requiring that each constraint system admit exactly one valid execution trace, eliminating redundancies like null-row padding and non-deterministic permutations before counting. It lifts analysis from finite-field witnesses to an integer interval lattice, exploiting that constraints across 5 real-world zkVMs use only 14.0% of theoretical connectivity capacity on average, enabling tight interval propagation. A parallel branch-and-bound search produces concrete counterexamples or certifies absence of violations within a bounded region. ZEBRA discovers 11 zero-day bugs (6 independently confirmed, 3 fixed), is 51.5x faster than SMT-based verification, and verifies 16.5 percentage points more instances.

arXiv cs.CR · 2d agoResearch

Atlas: Efficient Verifiable Semantic Search

Atlas delivers zero-knowledge proofs for HNSW semantic search, verifying RAG retrieval in under a second on SIFT1M and 2.0 seconds at 100M vectors.

Atlas lets a search provider prove that a query was answered correctly against a committed HNSW index without revealing the index, addressing provider deviations like truncation or bias. It combines offline preprocessing, a fixed-size-state restructuring of HNSW with a correctness proof, and timestep-tagged batching of per-step arguments. The system proves queries in under a second on SIFT1M and 2.0 seconds at 100 million vectors while preserving plaintext HNSW recall, and proven retrieval maintains end-to-end RAG answer quality at lower cost than prior verifiable retrieval systems.

arXiv cs.CR · 6d agoResearch1

CHERI-D Reincarnate: efficient multicore CHERI temporal memory safety through allocation reincarnation (draft version)

CHERI-D Reincarnate adds allocation reincarnation to CHERI, quarantining generation IDs instead of memory to cut temporal memory-safety overheads on multicore systems.

The proposal extends CHERI-D temporal memory safety by quarantining exhausted generation IDs rather than memory slots, allowing freed memory immediate reuse through allocation reincarnation. It adds coherent ID caching and multicore support connecting physical coherence events to the virtually addressed ObjID buffer. The design was implemented as a hardware-software co-design across CHERI-Toooba FPGA softcore, QEMU, LLVM/Clang, and CheriBSD. Across evaluated workloads it substantially reduces memory-sweep frequency and quarantine overhead with low performance and hardware cost.

arXiv cs.CR · 6d agoResearch

HYDRA: Quantifying Botnet Resource Thresholds for Efficient Link-Flooding Attacks on LEO Satellite Networks

HYDRA models link-flooding attacks on LEO satellite constellations as botnet minimization, matching prior disruption with 34% fewer bots and 23% less traffic.

HYDRA formulates link-flooding attack variants against LEO constellations such as Starlink and Kuiper as botnet minimization problems, quantifying the smallest bot subset and traffic allocation needed to disrupt communications between targeted geographic areas. Under matched stealth constraints it matches the ICARUS attack's disruption using 34% fewer bots and 23% less aggregate traffic, sustaining over 97% attack success as topology evolves. The framework also evaluates five mitigations, including routing diversification, ingress policing, distance-based constraints, source throttling, and botnet attrition.

arXiv cs.CR · 2d agoResearch

Towards Scalable and Cost-Efficient Vulnerability Detection: A Study on Automatic Query Generation

A study finds LLM-synthesized CodeQL queries improve average F1-score by 82% over baseline queries, offering scalable vulnerability detection versus direct LLM scanning.

Researchers conducted an empirical study evaluating whether LLMs can synthesize executable CodeQL queries from National Vulnerability Database vulnerability data. LLM-generated queries significantly enhanced baseline CodeQL suites, yielding an 82% improvement in average F1-score across a diverse set of real-world vulnerabilities. A cost-benefit analysis shows direct LLM-based scanning of entire repositories is often computationally and financially prohibitive, while LLM query synthesis offers a scalable and cost-effective alternative for large-scale vulnerability detection.

arXiv cs.CR · 7d agoResearch1

Memory-Efficient Designs for Word-Wise Universal Fully Homomorphic Encryption

BXT framework mitigates FHE memory bottlenecks via ciphertext compression, serialization, delayed seeding, and digit pruning, achieving up to 3.8x CNN inference speedup.

A new paper proposes BXT, an optimization framework for word-wise Universal Fully Homomorphic Encryption that targets the memory bottleneck rather than compute. It combines four techniques: ciphertext compression via seed regeneration, bit-packed ciphertext serialization for L2-to-L1 transfers, delayed PRNG-heavy offline seed generation across aggregated operations, and fault-aware ciphertext digit pruning. On CNN inference, the BXT-CSO50 configuration achieves up to 3.8x speedup over a 100x GPU baseline with under 1% accuracy loss at 50% comparison precision.

arXiv cs.CR · 12d agoResearch

A Cyber Range Evaluation of Autonomous Network Incident Response Agents

Cyber range evaluation shows reinforcement learning incident response agents defend emulated networks more efficiently than heuristic policies, depending heavily on adversary behavior.

The paper evaluates agents for automated network intrusion response in a cyber range designed for human operator training, featuring variable topology, red-team emulation, and simulated users. Alerts are generated by a SIEM platform and mapped to a data modeling language used by the agents, with reinforcement learning policies optimized to minimize combined defense and availability costs using a cyber attack simulator. Reinforcement learning agents defended the system more efficiently than heuristic policies, with performance highly dependent on the adversary policy and simulated user behavior.

arXiv cs.CR · 1d agoResearch

Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection

Unit 42 clusters behavior of 40,000+ AWS identities from 125 cloud environments to map functional roles and enable lightweight SQL-based detection.

Palo Alto Unit 42 built an unsupervised behavioral clustering model using UMAP and HDBSCAN on AWS CloudTrail logs to map cloud identities to functional roles such as administrators, backup services, security tooling and DevOps. The study analyzed over 40,000 identities across 125 cloud environments over two months. The researchers show that heuristics extracted from the clustering map can be implemented in standard SQL, enabling role classification at scale without running a continuous ML pipeline. The methodology extends to audit logs from other cloud providers, SaaS and Kubernetes.

Palo Alto Unit 42 · 2d agoResearch

Autoencoder Is All You Need: Profiling and Detecting Malicious DNS Traffic

Palo Alto Unit 42 details an autoencoder-based method that profiles DNS traffic to detect C2 and malicious domains, blocking ~374,000 malicious DNS requests daily.

Unit 42 built an RNN-based autoencoder that compresses DNS traffic time series into fixed-dimensional 'DNS profiles' for each domain and device. Downstream classification, clustering, and anomaly detection modules flag suspicious domains, capturing 170 emerging suspicious domains in May 2024. Signatures block roughly 374,000 malicious DNS requests daily and run in the Advanced DNS Security service, with detections shared to Advanced URL Filtering. Case studies link DNS traffic patterns to C2 beaconing, dynamic DNS abuse, and DNS tunneling for data exfiltration.

Palo Alto Unit 42 · Aug 17, 2026Research

Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0 (1999)

Seminal 1999 USENIX study finds most novice users cannot correctly sign and encrypt email with PGP 5.0 in 90 minutes.

Whitten and Tygar's USENIX Security Symposium paper evaluates whether cryptography novices can use PGP 5.0 effectively, using cognitive walkthrough analysis and a laboratory user test. The majority of test participants failed to successfully sign and encrypt a message within 90 minutes, despite PGP 5.0 having a well-regarded graphical interface. The authors argue that security requires usability standards beyond those of general consumer software and propose domain-specific UI design principles for security. The paper is a foundational reference in usable security research.

Lobsters · security · 7d agoResearch

LLM-Based Penetration Testing in the Presence of Honeypots

Studies honeypot-aware budget allocation for LLM attack agents, showing detector-guided policies let agents skip deception and compromise real hosts efficiently.

The paper formalizes LLM attacker behavior against honeypots as a budgeted decision process, where agents choose to continue or skip targets when honeypot suspicion arises. A detector-guided policy lets LLM agents allocate execution budget effectively across a mixed host pool in a controlled testbed. Findings show LLM-driven attackers can reason about heterogeneous artifacts and use honeypot suspicion to guide target selection, challenging traditional deception defenses that rely on realism and obscurity against human or script-driven attackers.

arXiv cs.CR · 8d agoResearch