threat intelligence correlation

This study addresses a novel Lazarus Group campaign targeting cryptocurrency wallets and financial data, focusing on its persistence mechanisms, C2 communication patterns, and data exfiltration tactics. Method: We systematically map the underlying infrastructure and innovatively integrate Tactics, Techniques, and Procedures (TTPs) with multi-source threat intelligence to construct a threat-hunting hypothesis model aligned with the MITRE ATT&CK framework. The methodology combines static and dynamic reverse engineering, IoC correlation mining, and real-time behavioral anomaly detection. Contribution/Results: We derive actionable detection rules and alert-optimization strategies that bridge tactical analysis with strategic risk forecasting. Experimental evaluation demonstrates over a threefold improvement in threat detection speed, significantly enhancing predictive capability against APT behaviors and strengthening defensive resilience.

Information-stealing trojans (e.g., Aurora) pose significant challenges in identifying infection vectors from screenshots, and scalable, automated analysis methods remain lacking. Method: This paper introduces the first reactive visual analysis framework leveraging a large language model (GPT-4o-mini), integrating multimodal understanding and contextual reasoning to automatically extract indicators of compromise (IoCs)—including malicious URLs, installer filenames, and exploited software topics—from infected screenshots, and to correlate attack activities across samples. Contribution/Results: Evaluated on 1,000 real-world infection screenshots, the method successfully identified 337 actionable URLs and 246 associated files, enabling attribution and confirmation of three distinct attack campaigns. It bridges a critical gap in log-dependent, post-hoc forensic analysis by pioneering end-to-end visual parsing of information-stealing malware artifacts using LLMs, thereby substantially enhancing both the efficiency and scalability of threat intelligence generation.

This work proposes an automated framework for generating high-quality memory corruption vulnerability analysis reports by integrating a multi-agent large language model (LLM) architecture with retrieval-augmented generation (RAG). The framework comprises four collaborative modules—Explorer, RAG Engine, Analyst, and Reporter—and represents the first application of a multi-agent LLM combined with RAG specifically for vulnerability documentation. It further introduces a task-specific LLM-based Judge to enable multidimensional automatic evaluation of the generated reports. Experimental results on 105 samples from the NIST-SARD dataset demonstrate an average report quality score of 54.21%, validating the effectiveness of the approach and significantly advancing the state of the art in automated vulnerability analysis and structured reporting.

Existing behavioral malware detection research heavily relies on sandbox-derived features, leading to severe performance degradation—accuracy drops to 20%–50%, far below the reported >90%—when deployed on real endpoints. This exposes three fundamental challenges: label noise, distribution shift, and spurious feature reliance. To address this, we conduct the first large-scale empirical evaluation on real endpoints and propose a robust end-to-end training framework tailored for endpoint environments. Our approach integrates behavioral trajectory modeling, cross-environment distribution alignment, noise-robust learning, and telemetry-driven training leveraging real-world endpoint telemetry. Experiments demonstrate a 5%–30% relative improvement in detection accuracy over sandbox-trained baselines. Crucially, our work shifts the detection paradigm from sandbox-centric training to direct training on endpoint data. As part of this contribution, we release the first publicly available benchmark dataset comprising authentic endpoint behavioral trajectories, enabling reproducible, realistic evaluation of behavioral malware detection systems.

To address the challenge posed by widespread adoption of Techniques Against Dynamic Analysis (TADA) in malware—which undermines sandboxing efficacy and impedes manual reverse engineering—this paper proposes the first large language model (LLM)-based method for automatic TADA code localization. Our approach integrates semantic understanding and behavioral reasoning without relying on static symbols or runtime traces. It leverages fine-tuned CodeLlama, a novel disassembled instruction sequence encoding scheme, multi-granularity contextual prompting, and cross-sample transfer learning to precisely identify stealthy detection logic. Evaluated on a public dataset, our method achieves an 87.80% localization accuracy and successfully identifies real-world TADA snippets in four prevalent malware families (e.g., Emotet and QakBot), with an average localization error of fewer than three instructions. This significantly enhances dynamic analysis robustness and accelerates reverse-engineering workflows.

This study addresses the critical issue of inconsistent results from open-source software vulnerability scanners, which significantly hinders informed supply chain security decisions. The work proposes a novel conceptual framework that characterizes the information flows and root causes of inconsistency within the open-source vulnerability ecosystem, modeling vulnerability management as a distributed information transformation process encompassing creation, standardization, enrichment, and contextual interpretation. By integrating multiple vulnerability data standards and real-world case studies, the analysis systematically identifies four core challenges—identity modeling, version semantics, temporal evolution, and contextual assessment—that underlie result discrepancies. This framework establishes a theoretical foundation and offers practical guidance for reproducible evaluation, accurate interpretation of scanner outputs, and dynamic vulnerability knowledge management.

Traditional CVSS scores often fail to effectively prioritize vulnerability remediation in real-world attack scenarios. This work proposes a composite Key Risk Indicator (KRI) based on expected loss decomposition, which, for the first time, decouples threat, exposure, and business impact into distinct modeling components to enable risk-informed remediation decisions. The KRI model integrates the Known Exploited Vulnerabilities (KEV) catalog, over 280,000 CVE records, and metrics including EPSS, CVSS, and attack surface exposure. Empirical evaluation demonstrates that KRI achieves a ROC-AUC of 0.927 and an AUPRC of 0.223, significantly outperforming CVSS. Moreover, when prioritizing the top 500 vulnerabilities for remediation, KRI captures 92.3% of impact-weighted value and identifies 1.75 times more critically exploited vulnerabilities than EPSS.

This study addresses the lack of systematic evaluation of mainstream security logging standards in terms of their effectiveness for threat detection. The authors propose a scalable and reproducible assessment methodology based on an automated Security Exploit Telemetry Collection (SETC) framework, which reproduces 50 remote code execution vulnerabilities in containerized environments. Using this approach, they comparatively evaluate the telemetry completeness and attack detectability of widely adopted standards—including Common Information Model (CIM), Open Cybersecurity Schema Framework (OCSF), and Elastic Common Schema (ECS). The experiments quantitatively measure each standard’s detection efficacy, revealing significant disparities in coverage of critical attack indicators and identifying notable gaps. These findings provide empirical guidance for security practitioners in selecting appropriate logging standards to enhance threat detection capabilities.

This work addresses the limitations in evaluating automated vulnerability detection tools, which stem from heterogeneous vulnerability data sources, inconsistent identifiers, and ambiguous version ranges. Leveraging the Open Source Vulnerabilities (OSV) database, we construct a standardized, cross-ecosystem benchmark dataset through precise version mapping and systematic data curation. We propose a reproducible methodology for dataset construction and release an open-source toolkit that enables on-demand reconstruction of historical snapshots, significantly enhancing the transparency and reproducibility of evaluations. Experimental results reveal systematic performance disparities among widely used vulnerability detection tools, underscoring the critical role of high-quality benchmarks in the rigorous assessment of security analysis tools.

Traditional attack graphs struggle to dynamically assess the likelihood of known vulnerabilities being exploited and the risk of compromise at critical nodes. This work proposes a novel approach that integrates Bayesian attack graphs with process mining to enable real-time monitoring of network behavior for malicious traffic detection and dynamic updating of conditional probabilities associated with vulnerability exploitation. By incorporating process mining into the Bayesian attack graph framework for the first time, the method overcomes the limitations of static analysis. Evaluated in a test environment containing multiple CVE-listed vulnerabilities, the approach effectively identifies exploitation activities and significantly improves both the accuracy and timeliness of estimating the probability of system compromise.