Selected work

Representative Papers

COntExt: Towards Context-Aware Ontology Extension from Operational Metrics

Jul 31, 2026

This study addresses the high cost and low efficiency of current ontology extension practices, which heavily rely on manual effort due to the underutilization of domain knowledge implicitly embedded in operational metrics. To overcome this limitation, the work proposes the first context-aware ontology extension framework that systematically leverages structured operational metrics as a source of contextual information. The framework formulates ontology extension as three subtasks: parent class prediction, relationship type prediction, and data property assignment, and integrates natural language processing with knowledge graph techniques to generate automated suggestions. Experimental evaluation on four cybersecurity ontologies demonstrates that the proposed approach significantly outperforms baseline methods relying solely on ontology-internal context, particularly in relationship type prediction and data property assignment, thereby effectively reducing the cost of ontology maintenance.

0 citationsRead paper

The Watermark Shortcut: How Provenance Marking Sabotages Audio Deepfake Detection

Jun 22, 2026

This study addresses the vulnerability of current audio deepfake detectors that inadvertently rely on provenance watermarks embedded in synthetic speech as shortcut cues, leading to degraded generalization, evasion via watermark removal, and false positives on genuine speech. The work systematically uncovers, for the first time, a tripartite failure mechanism induced by such watermarks and proposes a mitigation strategy that decouples the spurious correlation between watermarks and forgery labels by uniformly applying watermarks to both real and fake utterances during training. Leveraging white-box controlled experiments, black-box evaluations on commercial APIs, and adversarial watermark manipulations, the authors construct the paired corpus WASP. Empirical results demonstrate that this approach reduces the watermark-induced equal error rate from 75% to 16%, substantially restoring detection robustness. The WASP dataset is publicly released to foster further research.

0 citationsRead paper

Eroding Trust in Real Speech: A Large-Scale Study of Human Audio Deepfake Perception

May 21, 2026

This study investigates the impact of increasingly realistic audio deepfakes on human ability to identify genuine speech and on trust in authentic audio. Through a large-scale listening experiment involving 1,768 participants and 35,532 judgments, the authors systematically evaluated deepfake audio generated by 138 diverse speech synthesis systems, including commercial platforms, autoregressive models, sequence-to-sequence architectures, and flow-matching approaches. The work reveals a novel “suspicion shift” phenomenon: while detection accuracy for fake audio remains stable at approximately 72%, trust in real audio significantly declines, with identification accuracy dropping from 72.7% to 64.1%. These findings suggest that the primary societal threat of deepfakes lies not in evading detection but in eroding confidence in genuine audio content. Integrating human subjective assessments with high-accuracy machine detectors (>94.5%), this research provides critical empirical evidence for understanding the broader social implications of audio deepfakes.

0 citationsRead paper

Architecture-Derived CBOMs for Cryptographic Migration: A Security-Aware Architecture Tradeoff Method

Mar 23, 2026

This work addresses the limitations of existing cryptographic bill-of-materials (CBOMs), which lack architectural intent and security context, thereby hindering effective cryptographic migration planning. To overcome this gap, the authors propose the Security-Aware Trade-off Analysis Method (SATAM)—a novel approach that uniquely integrates architectural decisions with CBOM construction. By synthesizing established methods including ATAM, arc42, STRIDE, Architecture Decision Records (ADRs), and CARAF, SATAM produces an architecture-driven CBOM that embeds explicit security intent and migration-critical metadata. Leveraging design science research principles and an extension of the CycloneDX standard, the resulting CBOM demonstrably outperforms conventional asset inventory approaches, offering richer contextual information and more comprehensive support for cryptographic agility and informed migration decision-making.

0 citationsRead paper

Detecting Cryptographically Relevant Software Packages with Collaborative LLMs

Mar 07, 2026Proceedings of the 12th International Conference on Information Systems Security and Privacy

This work addresses the critical challenge of efficiently identifying cryptography-related software packages in heterogeneous IT environments—a key prerequisite for achieving cryptographic agility and enabling migration to post-quantum cryptography (PQC). The authors propose an automated preliminary screening framework that leverages locally deployed large language models (LLMs) in a collaborative manner. By aggregating predictions from multiple LLMs on package metadata through a majority voting mechanism, the approach enhances generalization and reliability across diverse software ecosystems while preserving data privacy. Experimental evaluation on over 65,000 Fedora packages demonstrates that the method substantially reduces manual auditing effort, offering a scalable and efficient tool for cryptographic asset discovery to support PQC transition initiatives.

0 citationsRead paper

Recent publications

Latest Papers

COntExt: Towards Context-Aware Ontology Extension from Operational Metrics

Jul 31, 2026

This study addresses the high cost and low efficiency of current ontology extension practices, which heavily rely on manual effort due to the underutilization of domain knowledge implicitly embedded in operational metrics. To overcome this limitation, the work proposes the first context-aware ontology extension framework that systematically leverages structured operational metrics as a source of contextual information. The framework formulates ontology extension as three subtasks: parent class prediction, relationship type prediction, and data property assignment, and integrates natural language processing with knowledge graph techniques to generate automated suggestions. Experimental evaluation on four cybersecurity ontologies demonstrates that the proposed approach significantly outperforms baseline methods relying solely on ontology-internal context, particularly in relationship type prediction and data property assignment, thereby effectively reducing the cost of ontology maintenance.

0 citationsRead paper

The Watermark Shortcut: How Provenance Marking Sabotages Audio Deepfake Detection

Jun 22, 2026

This study addresses the vulnerability of current audio deepfake detectors that inadvertently rely on provenance watermarks embedded in synthetic speech as shortcut cues, leading to degraded generalization, evasion via watermark removal, and false positives on genuine speech. The work systematically uncovers, for the first time, a tripartite failure mechanism induced by such watermarks and proposes a mitigation strategy that decouples the spurious correlation between watermarks and forgery labels by uniformly applying watermarks to both real and fake utterances during training. Leveraging white-box controlled experiments, black-box evaluations on commercial APIs, and adversarial watermark manipulations, the authors construct the paired corpus WASP. Empirical results demonstrate that this approach reduces the watermark-induced equal error rate from 75% to 16%, substantially restoring detection robustness. The WASP dataset is publicly released to foster further research.

0 citationsRead paper

Eroding Trust in Real Speech: A Large-Scale Study of Human Audio Deepfake Perception

May 21, 2026

This study investigates the impact of increasingly realistic audio deepfakes on human ability to identify genuine speech and on trust in authentic audio. Through a large-scale listening experiment involving 1,768 participants and 35,532 judgments, the authors systematically evaluated deepfake audio generated by 138 diverse speech synthesis systems, including commercial platforms, autoregressive models, sequence-to-sequence architectures, and flow-matching approaches. The work reveals a novel “suspicion shift” phenomenon: while detection accuracy for fake audio remains stable at approximately 72%, trust in real audio significantly declines, with identification accuracy dropping from 72.7% to 64.1%. These findings suggest that the primary societal threat of deepfakes lies not in evading detection but in eroding confidence in genuine audio content. Integrating human subjective assessments with high-accuracy machine detectors (>94.5%), this research provides critical empirical evidence for understanding the broader social implications of audio deepfakes.

0 citationsRead paper

Architecture-Derived CBOMs for Cryptographic Migration: A Security-Aware Architecture Tradeoff Method

Mar 23, 2026

This work addresses the limitations of existing cryptographic bill-of-materials (CBOMs), which lack architectural intent and security context, thereby hindering effective cryptographic migration planning. To overcome this gap, the authors propose the Security-Aware Trade-off Analysis Method (SATAM)—a novel approach that uniquely integrates architectural decisions with CBOM construction. By synthesizing established methods including ATAM, arc42, STRIDE, Architecture Decision Records (ADRs), and CARAF, SATAM produces an architecture-driven CBOM that embeds explicit security intent and migration-critical metadata. Leveraging design science research principles and an extension of the CycloneDX standard, the resulting CBOM demonstrably outperforms conventional asset inventory approaches, offering richer contextual information and more comprehensive support for cryptographic agility and informed migration decision-making.

0 citationsRead paper

Detecting Cryptographically Relevant Software Packages with Collaborative LLMs

Mar 07, 2026Proceedings of the 12th International Conference on Information Systems Security and Privacy

This work addresses the critical challenge of efficiently identifying cryptography-related software packages in heterogeneous IT environments—a key prerequisite for achieving cryptographic agility and enabling migration to post-quantum cryptography (PQC). The authors propose an automated preliminary screening framework that leverages locally deployed large language models (LLMs) in a collaborative manner. By aggregating predictions from multiple LLMs on package metadata through a majority voting mechanism, the approach enhances generalization and reliability across diverse software ecosystems while preserving data privacy. Experimental evaluation on over 65,000 Fedora packages demonstrates that the method substantially reduces manual auditing effort, offering a scalable and efficient tool for cryptographic asset discovery to support PQC transition initiatives.

0 citationsRead paper