ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “methodology”

10 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 379Ransomware 281Malware 221Industry 164Data breach 122Policy & legal 109Exploit / PoC 103Threat actor 96Phishing & fraud 65AI research 40Research 36AI safety & security 34AI tools & infra 19Tools 15
SeverityAllcritical 652high 407medium 325low 223info 118

Harnessing LLMs for Automating BOLA Detection

Unit 42's BOLABuster methodology uses LLMs to automate detection of broken object-level authorization vulnerabilities, uncovering flaws in Grafana, Harbor, and Easy!Appointments.

Palo Alto Unit 42 details BOLABuster, a methodology combining large language models with heuristics to automate detection of broken object-level authorization (BOLA) flaws, which traditional fuzzing and static analysis struggle to find. The approach uses LLM reasoning to understand application logic, map endpoint dependency relationships, and generate and interpret test cases. It found CVE-2024-1313 in Grafana, CVE-2024-22278 in Harbor, and 15 CVEs in Easy!Appointments. The team is continuing to hunt for BOLAs in open-source and internal projects.

Palo Alto Unit 42 · Aug 17, 2026ResearchCVE-2024-1313CVE-2024-22278CVE-2023-3285+14 CVEs

Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection

Unit 42 clusters behavior of 40,000+ AWS identities from 125 cloud environments to map functional roles and enable lightweight SQL-based detection.

Palo Alto Unit 42 built an unsupervised behavioral clustering model using UMAP and HDBSCAN on AWS CloudTrail logs to map cloud identities to functional roles such as administrators, backup services, security tooling and DevOps. The study analyzed over 40,000 identities across 125 cloud environments over two months. The researchers show that heuristics extracted from the clustering map can be implemented in standard SQL, enabling role classification at scale without running a continuous ML pipeline. The methodology extends to audit logs from other cloud providers, SaaS and Kubernetes.

Palo Alto Unit 42 · 3d agoResearch

Scaling Verification of Cryptographic Software with Aeneas, Rust, and Lean

Microsoft SymCrypt implementations of SHA-3 and ML-KEM verified in Lean via Aeneas-extracted Rust models, with AI agents writing proofs.

The paper develops a methodology for verifying production Rust cryptographic code by using Aeneas to extract pure models into Lean, avoiding low-level pointer and aliasing reasoning. Applied to Microsoft's SymCrypt, it verifies SHA-3 and ML-KEM implementations ported from C to Rust and extends SymCrypt with FrodoKEM, ML-DSA, and HPKE. A 237 KLOC Lean development establishes safety, panic-freedom, and functional correctness of 16.7 KLOC of Rust supporting post-quantum cipher suites on x86-64 and ARM. AI agents autonomously write formal proofs verified by the Lean kernel, and evaluation shows verified Rust meets SymCrypt's performance and portability requirements.

arXiv cs.CR · 2d agoResearch1

A Graph-Based Approach for Mapping Kernel-Level Telemetry to MITRE ATT&CK

Trace2ATT&CK maps eBPF kernel telemetry to MITRE ATT&CK via provenance graphs and RAG with local open-weights LLMs, validated on 347 Atomic Red Team tests.

Trace2ATT&CK collects kernel-level events via eBPF, correlates attacker commands into a provenance graph, and derives compact graph representations suitable for LLM-based reasoning, mapping behavior to MITRE ATT&CK techniques with ranked candidates and rationales. Mapping uses both pure LLM prompting and retrieval-augmented generation grounded in the ATT&CK knowledge base. It was evaluated on 347 Linux Atomic Red Team tests using locally deployed open-weights LLMs. RAG consistently improved ATT&CK mapping over pure prompting, and provenance graphs substantially outperformed raw telemetry, without compromising data confidentiality.

arXiv cs.CR · 5d agoResearch

Windows Malware Detector as a Compound AI System: Trade-Offs in Accuracy, Efficiency, and Adversarial Robustness

Researchers model industrial Windows malware detection as a Compound AI System, quantifying trade-offs between detection accuracy, efficiency, and adversarial robustness under tiered attacker knowledge.

Industrial Windows malware detectors combine rule-based mechanisms with ML-based static and dynamic analyses, but their architectures are rarely publicly disclosed. The authors propose a methodology balancing detection performance, computational cost, and robustness, plus system-level threat models capturing whole-pipeline evasion rather than isolated components. Experiments on real-world data show training time reductions with marginal detection loss, while more knowledgeable attackers craft increasingly effective adversarial examples. The paper derives deployment guidelines from the observed efficiency-robustness trade-off.

arXiv cs.CR · 9d agoResearch1

A GAN-Based Framework for Robust DDoS Attack Detection

WGAN-GP-generated adversarial DDoS traffic augments training data, improving detection resilience against evasion attempts.

Researchers built a DDoS detection framework combining Random Forests, deep neural ensembles, and Transformer-based models trained on CICDDoS2019 with synthetic adversarial flows generated by a Wasserstein GAN with gradient penalty. Hybrid datasets of benign, malicious, and generated traffic taught models more generalizable decision boundaries. Experiments showed improved accuracy and resilience against unseen adversarial traffic, validated on real-world generated flows.

arXiv cs.CR · 1d agoResearch

From Specs to Apps: Verifying and Monitoring Models of Signal and WhatsApp

Researchers use the SpecMon runtime monitor to verify WhatsApp Web and Signal Desktop against formal Signal protocol models, finding undocumented libsignal fork differences.

The paper applies SpecMon, a runtime monitoring tool, to check whether executions of WhatsApp Web and Signal Desktop conform to formal models of the Signal protocol. The authors instrument both applications and build Tamarin-compatible multiset-rewrite models, including the first model of WhatsApp Web's implementation and the most detailed model to date of Signal's original protocol. They verify authentication and secrecy properties for core Signal protocol components, show monitoring detects deliberately injected faults with low overhead, and identify previously undocumented behavioral differences between the original libsignal library and WhatsApp's fork.

arXiv cs.CR · 6d agoResearch

You Get What You Sample: Evaluating Sampling Strategies for Web Security Measurements

Evaluation of 500k Tranco and 24.8M Common Crawl hosts shows Top-N domain sampling biases web security measurements; probability sampling yields unbiased estimates.

The study is the first comprehensive investigation of how sampling strategies affect web security measurement conclusions, comparing datasets and strategies across 500k Tranco domains and 24.8M Common Crawl hosts. It shows Top-N selection does not reflect the overall web distribution and may bias observed vulnerability rates, while probability-based strategies yield stable, unbiased prevalence and impact estimates. Hybrid sampling offers no advantage because its deterministic prefix consistently hurts accuracy, and the authors propose an adaptive probability-based strategy effective even when target prevalence is unknown.

arXiv cs.CR · 7d agoResearch1

Quantifying IIoT Sensor Node Criticality by Fusing its Data Criticality and Security Vulnerability

Researchers propose a Dempster–Shafer framework fusing IIoT sensor data criticality with CVSS 4.0/3.1 vulnerability scores to rank node criticality.

The paper introduces a framework that evaluates Industrial IoT sensor node criticality by fusing data criticality and cybersecurity vulnerability scores using Dempster–Shafer (D-S) theory. It was validated on a dataset from red wine production and is claimed to generalize to other industrial settings with minimal modification. Results show criticality rankings derived from CVSS 4.0 scores differ significantly from those derived from CVSS 3.1, underscoring how vulnerability scoring methodology affects security prioritization.

arXiv cs.CR · 8d agoResearch

Introducing Unit 42’s Attribution Framework

Unit 42 releases its Attribution Framework, a systematic method using Diamond Model and Admiralty scores to attribute activity clusters to named threat actors.

Palo Alto Networks' Unit 42 introduced a structured framework for threat actor attribution built on the Diamond Model of Intrusion Analysis and Admiralty reliability/credibility scoring. The framework tracks activity at three levels: activity clusters (named CL-STA, CL-CRI, CL-UNK, or CL-MIX), temporary threat groups, and named threat actors using the constellation naming schema. Analysts score evidence across TTPs, tooling, malware code, OPSEC, infrastructure, timelines, and victimology to decide when to merge or elevate clusters, avoiding premature group naming.

Palo Alto Unit 42 · Aug 17, 2026Research