Palo Alto Networks (United States)

Modern cybersecurity platforms must process and display high-frequency telemetry such as network logs, endpoint events, alerts, and policy changes in real time. Traditional rendering techniques—based on static pagination or fixed polling intervals—fail under volume conditions exceeding hundreds of thousands of events per second, leading to UI freezes, dropped frames, or stale data. This paper presents an AI-assisted adaptive rendering framework that dynamically regulates visual update frequency, prioritizes semantically relevant events, and selectively aggregates lower-priority data using behavior-driven heuristics and lightweight on-device machine learning models. Experimental validation demonstrates a 45–60% reduction in rendering overhead while maintaining analyst perception of real-time responsiveness [9].

Scanning is a prevalent method used by threat actors to identify vulnerabilities in networks or systems for subsequent exploitation. Prior research has focused on signature or anomaly-based methods for detecting malicious traffic on limited datasets. However, there is a gap in the comprehensive understanding of scanning activity, particularly in the context of the Web. Our scanning detection system, DVader, leverages a unique vantage point that provides visibility over nearly 100,000 networks to monitor scanning patterns. We identify that scanning activity often causes sudden bursts in traffic that are distinct from typical user behavior. To detect scanning in mixed traffic (benign and malicious), we track unusual spikes in volume-based features, such as the total number of requests, and employ a machine learning model. We conduct the first large-scale longitudinal study of the scanning activity leveraging our multi-network approach. By analyzing the detections of our system, we provide insights into scanning activity. We detect 316 million scanning and exploiting requests between May 1, 2023 and May 1, 2024, 58% of which are directed at router vulnerabilities. We show that our system detects malicious URLs embedded in exploit requests before they were detected by VirusTotal vendors. We show that our system effectively detects emerging threats within mixed traffic through case studies of recent and notable vulnerabilities, such as those in Ivanti Connect Secure, Log4j, and Zyxel router Web UI.

Enterprises' IT environments are undergoing a fundamental transformation driven by widespread cloud adoption, an increase in remote and hybrid workforces, and rapid integration of Artificial Intelligence (AI) and Machine learning (ML) into business operations. These changes have exposed critical security flaws in the network environment due to a complex attack surface and introduced new, unanticipated vulnerabilities. Secure Access Service Edge (SASE) [3] solution materialized as a cloud-native framework that combines Software-Defined Wide Area Network (SDWAN) [15] and Secure Service Edge (SSE) [16]. The core components of SASE framework are Zero Trust Network Access (ZTNA) [1], Secure Web Gateway (SWG) [11], Cloud Access Security Broker (CASB) [10], Firewall-as-a-Service (FWaaS) [4], and Data Loss Prevention (DLP) [6]. This paper focuses on understanding how the SASE framework evolved through real-world deployments in many organizations. The paper covers the introduction of the SASE framework, its evolution with modern times, a clear definition of each core component, and the reasons behind its growing necessity. This paper will also delve into each core component of the SASE architecture, examining how they work together to deliver secure, agile, and scalable connectivity in today's digital landscape. This paper also discusses steps to extend the SASE framework to the AI Agents.

In today’s digital age, intrusion detection systems help protect IoT (Internet of Things) systems from harmful activities. This study presents a new method using fuzzy clustering and swarm intelligence to spot hackers in wireless networks. More dependence on internet systems has caused a rise in cybersecurity threats, making it clear that traditional security methods are not enough. Swarm intelligence combined with fuzzy logic in the suggested approach allows the system to create flexible clusters that can spot unusual traffic in a network. With swarm intelligence, finding optimal ways to group data is enhanced and fuzzy logic helps cope with cases where things are unclear or share similar traits. With this method, you see more accurate detection and fewer false alarms which works well in the complicated and various settings of IoT environments. It outlines the design, explains how the algorithm works and shows the outcomes of the simulation, verifying that the approach is successful in early threat detection and responding rapidly which helps make IoT security systems more secure.

Telemedicine systems are exponentially increasing and, therefore, high-quality cybersecurity is inevitable for implementing such systems to secure the private information of the patient from threats that continue to change. In this paper, a new security architecture based on Hybrid Encryption Standard AES-256 and Quantum Key Distribution QKD for telemedicine applications is proposed along with biometric authentication and blockchain technology to ensure integrity of the data. IDS designed in this proposal utilized models based on the Random Forest and SVM approaches for anomaly detection. It obtained an F1 score of 97.1% and an accuracy of 97.3%. The designed framework is particularly suitable for real-time healthcare systems because it offers superior security performance compared to traditional methods while simultaneously reducing latency and increasing precision. The solution ensures the security of data transmission and the control of access while further developing trust in care with patients and matching pace for data protection regulations. It resolves substantial vulnerabilities in telemedicine systems.

The contemporary defense supply chain forms an extremely intricate and mission-critical environment, which necessitates an heretofore unseen degree of resilience, promptness, and vision. Enterprise Resources Planning (ERP) systems have, over the years, been used as a backbone in defense logistics and planning, but with Artificial Intelligence (AI) - enabled predictive analytics in play, it has changed the landscape of strategic planning within these systems. The study will examine how predictive analytics using AI will improve the strategic planning of defense supply chains using ERP. The study provided by the synthesis of the case studies, simulation models, and statistics will show that the AI-based predictive modules can considerably help enhance decision-making accuracy, minimize supply risks, and optimize the inventories. The suggested framework uses machine learning algorithms, real-time data feeds, and ERP systems to anticipate fluctuation in the demand, create a schedule for maintenance, and reduce supply chain vulnerabilities. The results lead to the conclusion of measuring up to 35 percent of the increase in operations readiness and 27 percent fewer logistical delays occurring in the tested defense supply ecosystems. A comparative image of the regular ERP systems and the AI-driven ERP models is also examined in the paper. An organized approach, which integrates data-based models, Monte Carlo simulations, and system dynamics modelling, is employed. Findings demonstrate the crucial importance of AI predictive analytics in helping prevent disturbances such as geopolitical crises, cyber threats, and supplier failure. There is a policy implication of the discussions on the stakeholders in defense, such as NATO, the U.S. DoD, and the allies, that should consider implementing AI-based ERP systems. The given study has its academic and practical value, proposing a strategic framework specific to defense logistics and providing recommendations regarding the studies that are yet to be conducted on the topic of secure, explainable, and adaptive AI in ERP systems

Mainstream Continuous Integration (CI) platforms have provided the plugin functionality to accelerate the development of CI pipelines. Unfortunately, CI plugins, which are essentially reusable code snippets, also expose new attack surfaces as plugins might be developed by less trusted users. In this paper, we present an in-depth study to understand potential security risks in existing CI plugins. We conduct a comprehensive analysis of plugin implementations on four mainstream CI platforms (GitHub Actions, GitLab CI, CircleCI, and Azure Pipelines), and investigate several weak links in existing plugin distributions and isolation mechanisms. We investigate seven attack vectors that can enable attackers to hijack plugins and distribute malicious code without plugins users being aware, and further exploit hijacked plugins to manipulate the workflow execution. Additionally, we find that plugin dependency (a plugin references other plugins) might further amplify the attack impact of our disclosed attacks. To evaluate the potential impact, we conduct a large-scale measurement on GitHub and GitLab, covering a total of 1,328,912 repositories using the aforementioned CI platforms. Our measurement results show that a large number of repositories and existing plugins, including many widely used ones, are potentially vulnerable to the proposed attacks. We have duly reported the identified vulnerabilities and received positive responses.

Domain blocklists play an important role in blocking malicious domains reaching users. However, existing blocklists are reactive in nature and slow to react to attacks, by which time the damage is already caused. This is mainly due to the fact that existing blocklists and reputation systems rely on either website content or user interactions with the websites in order to ascertain if a website is malicious. In this work, we explore the possibility of predicting malicious domains proactively, given a seed list of malicious domains from such reactive blocklists. We observe that malicious domains often share the infrastructure utilized for previous attacks, reuse or rotate resources. Leveraging this observation, we selectively crawl passive DNS data to identify domains in the "neighborhood" of seed malicious domains extracted from reactive blocklists. Due to the increased utilization of cloud hosting, not all such domains in the neighborhood are malicious. Further vetting is required to identify unseen malicious domains. Along with the proximity, we identify that hosting and lexical features help distinguish malicious domains from benign ones. We model the infrastructure as a heterogeneous network graph and design a graph neural network to detect malicious domains. Our approach is blocklist-agnostic in that it can work with any blocklist and detect new malicious domains. We demonstrate our approach utilizing 7 month longitudinal data from three popular blocklists, PhishTank, OpenPhish, and VirusTotal. Our experimental results show that, our approach for VirusTotal feed detects 4.7 unseen malicious domains for every seed malicious domain at a very low FPR of 0.059. Further, we observe the concerning trend that 47% of predicted malicious domains that are later flagged in VirusTotal are identified only after more than 3 weeks to months since our model detects them.

This chapter explores the use of edge accessibility computing and blockchain in smart cities. Edge accessibility computing provides seamless access to digital services and information, reducing latency and improving accessibility. This approach is particularly useful in resource-constrained environments. The chapter demonstrates how edge accessibility computing can optimize traffic management and healthcare delivery in smart city operations. Blockchain technology enhances security and efficiency in smart city systems, fostering trust, accountability, and data integrity. The chapter discusses the synergies between edge accessibility computing and blockchain, highlighting their combined application to address challenges in smart city initiatives. The chapter suggests that policymakers, urban planners, and technologists can use these innovative solutions to create smarter, more equitable, and sustainable cities.