Abstract Generative agents are a novel AI agent architecture developed in 2023 using LLMs that can generate believable human behaviors. They are of significant importance in social simulation and human-computer interaction. However, there is a lack of research on the privacy and security issues that may arise from its subsequent application in society. Based on the Generative Agent framework, this paper reintroduces a personal information system, and a shared database, reconstructing the memory and reflection systems to realize a Lightweight Generative Agent framework (LGA). To fill the research gap in the field of privacy for Generative Agents, this paper simulates three scenarios with five agents to explore potential privacy and security issues. Based on observed privacy leaks, three defensive strategies are proposed: behavior guideline regulation, Multi-Agents cooperation, and step-back prompts. These strategies have reduced privacy leaks by more than 50.00% on average. For some privacy leaks with special simulation scenarios, it has even reduced privacy leaks by more than 80.00%. Additionally, through supplementary experiments, we demonstrate that LGA achieves better cost-effectiveness compared to the original Generative Agent framework. The analysis of privacy and security issues provides a reference for subsequent research on the safety of generative agents.

Abstract As cyber-attacks grow in scale, sophistication, and impact, advanced training and evaluation platforms are essential for cybersecurity readiness. Cyber Ranges (CRs) provide controlled, high-fidelity simulation environments in which professionals can practice defensive strategies under realistic threat scenarios. In such environments, success depends not only on technical skill but also on robust Situational Awareness (SA), the cognitive capacity to perceive events, understand their meaning, and project future developments. Although SA is recognised as critical, existing CR evaluation methods typically focus on overall performance metrics (e.g., task completion rates, response accuracy, mission success). Such assessments often fail to capture the deeper, cognitive aspects of SA, limiting the CR’s ability to evaluate decision-making agility and strategic insight. In response, this work presents the SA Scoring System (SASS), a dynamic, multi-dimensional framework designed to quantify SA in live CR environments. SASS decomposes SA into core dimensions, perception, comprehension, projection, and resolution, then monitors trainee behaviour and scenario interactions in real-time. Each dimension is assessed via weighted metrics: timing of responses, sequence and number of reasoning steps, usage and effectiveness of tools and techniques, hints requested, and decision outcomes. These metrics are aggregated into interpretable scores that reflect both aspects, specific performance and overall SA proficiency. In this study, the SASS is validated in a series of cyber-defence exercises involving participants of differing expertise levels. The results demonstrate that SASS scores correlate strongly with expert evaluations and can discriminate between high and low SA performers with high fidelity. SASS enables instructors to pinpoint cognitive weak spots (e.g. delayed perception or faulty projection) and adapt training on the fly. Ultimately, integrating the SASS into CR platforms enriches the evaluation process, promoting not just technical competence but also the situational agility needed to counter modern cyber threats.

Abstract This work focuses on the validation of attack pattern mining in the context of Industrial Control System (ICS) security. A comprehensive security assessment of an ICS requires the generation of a variety of attack patterns. For this purpose, we have proposed a data-driven technique to generate attack patterns for an ICS. The proposed technique has been used to generate 117,960 attack patterns from data from a water treatment plant. These attack patterns were used to launch attacks on the operational testbed that typically lasted 2 to 4 minutes. Interestingly, some 2-minute attacks impacted the plant, while some attacks of 3 or 4 minutes duration had no observable effect. This suggests that even short-lived attacks can significantly impact operational plants. The proposed technique and the effectiveness of the patterns generated in moving the plant to an anomalous state are valuable when assessing the quality of Intrusion Detection Systems for physical plants. In this work, we present a detailed case study to validate the attack patterns.

Regulatory authorities worldwide are developing cybersecurity standards and data protection regulations related to Internet of Things (IoT) devices to protect user information. As smart IoT technologies evolve, the implementation of such regulations and standards is highly crucial for allowing the secure storage, processing, and transfer of data. Given the ongoing research and development of smart IoT technologies across various domains, we aim to investigate whether critical compliance standards are adequately addressed in existing academic research. Through an in-depth analysis utilizing topic modeling and large language model (LLM) approaches, we identified the top five researched areas and their relationship with relevant regulations. We identified that while substantial progress has been made in addressing the technical challenges associated with IoT privacy, there remains an urgent need for research that bridges these solutions with socio-technical systems and compliance. Our research emphasizes the importance of adopting privacy-by-design at the initial stages of IoT implementation. Additionally, we determined research gaps in existing studies and proposed future research directions emphasizing the development of IoT frameworks that are not only technologically robust but also align with evolving legal compliance standards.

Cyber-physical systems (CPS) combine computational, communication, and physical components to enable real-time monitoring and control in critical infrastructures. Despite their advantages, CPS are highly susceptible to Denial-of-Service (DoS) attacks that disrupt communication and impair state estimation. This study conducted a comprehensive analysis of CPS defense under DoS attacks using learning automata (LA) within a game-theoretic framework. Sensor–attacker interactions were modeled as a two-player zero-sum game, in which the sensor sought to minimize estimation error and communication cost, while the attacker aimed to maximize disruption. Both discrete (DLA) and continuous (CLA) learning automata were employed to adaptively optimize sensor strategies and were integrated with a Kalman filter to achieve accurate state estimation. Simulations in MATLAB/Simulink, including generic CPS and microgrid systems, were performed to evaluate performance under reliable and unreliable channels, as well as under varying attack frequencies and durations. The results demonstrated that CLA achieved smooth convergence and high-accuracy state estimation under stable conditions, whereas DLA adapted more rapidly to abrupt disturbances and dynamic environments. Analyses of attack patterns confirmed the framework’s capacity to maintain system resilience through adaptive strategy allocation. Overall, the study demonstrated that learning automata provided an effective, real-time approach for optimizing CPS defense, balancing estimation accuracy, operational cost, and security, and offered a flexible solution applicable to other cyber threats.

Abstract Cyber threat intelligence (CTI) provides actionable insights into the threat landscape, helping organizations strengthen their defenses. Because commercial CTI is costly, inter-organizational sharing can reduce expenses, yet adoption remains limited. Still, the design of effective incentives for CTI sharing and their embedding in a sharing platform remains underexplored. We conducted 15 semi-structured interviews with security professionals to elicit incentive requirements and design options. We find that organizations prefer to share CTI with known recipients to build trust and support GDPR compliance. They also value mechanisms that lower coordination costs, such as a reputation system and price guidance to help prioritize scarce analyst time. Further, a major barrier is skepticism about the net benefits of sharing. To address this, we propose financial compensation for contributed CTI and a marketing label that signals proactive cybersecurity to partners and customers. We implemented these incentives in a platform prototype and assessed their effects in 14 hands-on sessions with security experts. Participants reported increased willingness to share, suggesting that well-designed incentives can catalyze CTI-sharing ecosystems. Put simply, organizations can share and benefit.

Abstract Critical Infrastructures (CI) are increasingly interdependent, forming complex dependency networks where disruptions can propagate across sectors and amplify systemic risk. Conventional risk assessment methods are limited by evaluating components in isolation and neglecting how interdependencies shape cascading exposure. This paper introduces the Risk Impact Pathway Analysis (RIPA) framework–a dynamic, dependency-aware risk assessment model that explicitly traces and quantifies risk propagation pathways within interdependent CI systems. RIPA incorporates three key propagation factors: Linkage Intensity (LI), measuring dependency strength; Resilience (RE), acting as a risk shield; and Criticality, functioning as a risk amplifier. Unlike traditional methods focused solely on initial risk (R 0 ), RIPA calculates Total Systemic Risk, revealing hidden high-risk nodes and propagation routes. The framework is validated through a multi-sector case study of the LAMAD-LLC integrated infrastructure system, demonstrating its applicability and effectiveness. Results demonstrate that incorporating interdependency criteria into risk assessment reveals significant hidden vulnerabilities, with certain infrastructure components exhibiting risk increases compared to traditional single-point assessments. This amplification effect illustrates how failures or vulnerabilities propagate through interconnected systems, creating compound risks not captured by conventional methods. Sensitivity analysis reveals that resilience enhancement interventions achieve approximately twice the risk reduction compared to equivalent modifications in either criticality scores or linkage intensity parameters. These findings validate RIPA’s capacity to provide a pathway-centric, topology-aware understanding of systemic exposure, enabling more targeted and effective infrastructure risk management strategies than traditional approaches.