National Security Agency
FALCON, a framework developed by researchers including those from the National Security Agency, employs agentic large language models and a multi-phase validation pipeline to autonomously generate and validate Intrusion Detection System rules. It achieved 95% average accuracy in automated rule generation and introduced a specialized CTI-Rule Semantic Scorer that outperformed general-purpose models in aligning threat intelligence with rules.
Timestamped relational datasets consisting of records between pairs of entities are ubiquitous in data and network science. For applications like peer-to-peer communication, email, social network interactions, and computer network security, it makes sense to organize these records into groups based on how and when they are occurring. Weighted line graphs offer a natural way to model how records are related in such datasets but for large real-world graph topologies the complexity of building and utilizing the line graph is prohibitive. We present an algorithm to cluster the edges of a dynamic graph via the associated line graph without forming it explicitly. We outline a novel hierarchical dynamic graph edge clustering approach that efficiently breaks massive relational datasets into small sets of edges containing events at various timescales. This is in stark contrast to traditional graph clustering algorithms that prioritize highly connected community structures. Our approach relies on constructing a sufficient subgraph of a weighted line graph and applying a hierarchical agglomerative clustering. This work draws particular inspiration from HDBSCAN. We present a parallel algorithm and show that it is able to break billion-scale dynamic graphs into small sets that correlate in topology and time. The entire clustering process for a graph with O(10 billion)O(10 \text{ billion}) edges takes just a few minutes of run time on 256 nodes of a distributed compute environment. We argue how the output of the edge clustering is useful for a multitude of data visualization and powerful machine learning tasks, both involving the original massive dynamic graph data and/or the non-relational metadata. Finally, we demonstrate its use on a real-world large-scale directed dynamic graph and describe how it can be extended to dynamic hypergraphs and graphs with unstructured data living on vertices and edges.
The flexibility and complexity of IPv6 extension headers allow attackers to create covert channels or bypass security mechanisms, leading to potential data breaches or system compromises. The mature development of machine learning has become the primary detection technology option used to mitigate covert communication threats. However, the complexity of detecting covert communication, evolving injection techniques, and scarcity of data make building machine-learning models challenging. In previous related research, machine learning has shown good performance in detecting covert communications, but oversimplified attack scenario assumptions cannot represent the complexity of modern covert technologies and make it easier for machine learning models to detect covert communications. To bridge this gap, in this study, we analyzed the packet structure and network traffic behavior of IPv6, used encryption algorithms, and performed covert communication injection without changing network packet behavior to get closer to real attack scenarios. In addition to analyzing and injecting methods for covert communications, this study also uses comprehensive machine learning techniques to train the model proposed in this study to detect threats, including traditional decision trees such as random forests and gradient boosting, as well as complex neural network architectures such as CNNs and LSTMs, to achieve detection accuracy of over 90\%. This study details the methods used for dataset augmentation and the comparative performance of the applied models, reinforcing insights into the adaptability and resilience of the machine learning application in IPv6 covert communication. We further introduce a Generative AI-driven script refinement framework, leveraging prompt engineering as a preliminary exploration of how generative agents can assist in covert communication detection and model enhancement.
This paper proposes the use of Large Language Models (LLMs) for translating Request for Comments (RFC) protocol specifications into a format compatible with the Cryptographic Protocol Shapes Analyzer (CPSA). This novel approach aims to reduce the complexities and efforts involved in protocol analysis, by offering an automated method for translating protocol specifications into structured models suitable for CPSA. In this paper we discuss the implementation of an RFC Protocol Translator, its impact on enhancing the accessibility of formal methods analysis, and its potential for improving the security of internet protocols.
This is a general study of twisted Calabi-Yau algebras that are N\mathbb{N}-graded and locally finite-dimensional, with the following major results. We prove that a locally finite graded algebra is twisted Calabi-Yau if and only if it is separable modulo its graded radical and satisfies one of several suitable generalizations of the Artin-Schelter regularity property, adapted from the work of Martinez-Villa as well as Minamoto and Mori. We characterize twisted Calabi-Yau algebras of dimension 0 as separable kk-algebras, and we similarly characterize graded twisted Calabi-Yau algebras of dimension 1 as tensor algebras of certain invertible bimodules over separable algebras. Finally, we prove that a graded twisted Calabi-Yau algebra of dimension 2 is noetherian if and only if it has finite GK dimension.
Let Qn(z)Q_n(z) be the polynomials associated with the Nekrasov-Okounkov formula n1Qn(z)qn:=m=1(1qm)z1.\sum_{n\geq 1} Q_n(z) q^n := \prod_{m = 1}^\infty (1 - q^m)^{-z - 1}. In this paper we partially answer a conjecture of Heim and Neuhauser, which asks if Qn(z)Q_n(z) is unimodal, or stronger, log-concave for all n1n \geq 1. Through a new recursive formula, we show that if An,kA_{n,k} is the coefficient of zkz^k in Qn(z)Q_n(z), then An,kA_{n,k} is log-concave in kk for kn1/6/lognk \ll n^{1/6}/\log n and monotonically decreasing for knlognk \gg \sqrt{n}\log n. We also propose a conjecture that can potentially close the gap.
Reinforcement learning (RL) has been demonstrated suitable to develop agents that play complex games with human-level performance. However, it is not understood how to effectively use RL to perform cybersecurity tasks. To develop such understanding, it is necessary to develop RL agents using simulation and emulation systems allowing researchers to model a broad class of realistic threats and network conditions. Demonstrating that a specific RL algorithm can be effective for defending a network under certain conditions may not necessarily give insight about the performance of the algorithm when the threats, network conditions, and security goals change. This paper introduces a novel approach for network environment design and a software framework to address the fundamental problem that network defense cannot be defined as a single game with a simple set of fixed rules. We show how our approach is necessary to facilitate the development of RL network defenders that are robust against attacks aimed at the agent's learning. Our framework enables the development and simulation of adversaries with sophisticated behavior that includes poisoning and evasion attacks on RL network defenders.
Within 1-2 decades, quantum computers may become powerful enough to break current public-key cryptography, prompting authorities such as the IETF and NIST to push for adopting quantum-resistant cryptography (QRC) in ecosystems like Internet Protocol Security (IPsec). Yet, IPsec struggles to adopt QRC, primarily because Internet Key Exchange Protocol Version 2 (IKEv2), which sets up IPsec sessions, cannot easily tolerate the large public keys and digital signatures of QRC. Many IETF RFCs have been proposed to integrate QRC into IKEv2, but their performance and interplay remain largely untested in practice. In this paper, we measure the performance of these RFCs over constrained links by developing a flexible, reproducible measurement testbed for IPsec with quantum-resistant IKEv2 proposals. Deploying our testbed in lossy wireless links and on the internationally distributed FABRIC testbed for Internet scenarios, we reveal that bottlenecks arise with quantum-resistant IKEv2 under high round-trip times, non-trivial packet loss, or other constraints. Our results, including the revelation of a 400-1000-fold increase in data overhead over high-loss wireless links, expose the shortcomings of today's RFCs and call for further work in this vital area of post-quantum network security.
There have been multiple attempts to demonstrate that quantum annealing and, in particular, quantum annealing on quantum annealing machines, has the potential to outperform current classical optimization algorithms implemented on CMOS technologies. The benchmarking of these devices has been controversial. Initially, random spin-glass problems were used, however, these were quickly shown to be not well suited to detect any quantum speedup. Subsequently, benchmarking shifted to carefully crafted synthetic problems designed to highlight the quantum nature of the hardware while (often) ensuring that classical optimization techniques do not perform well on them. Even worse, to date a true sign of improved scaling with the number of problem variables remains elusive when compared to classical optimization techniques. Here, we analyze the readiness of quantum annealing machines for real-world application problems. These are typically not random and have an underlying structure that is hard to capture in synthetic benchmarks, thus posing unexpected challenges for optimization techniques, both classical and quantum alike. We present a comprehensive computational scaling analysis of fault diagnosis in digital circuits, considering architectures beyond D-wave quantum annealers. We find that the instances generated from real data in multiplier circuits are harder than other representative random spin-glass benchmarks with a comparable number of variables. Although our results show that transverse-field quantum annealing is outperformed by state-of-the-art classical optimization algorithms, these benchmark instances are hard and small in the size of the input, therefore representing the first industrial application ideally suited for testing near-term quantum annealers and other quantum algorithmic strategies for optimization problems.
We consider a version of height on polynomial spaces defined by the integral over the normalized area measure on the unit disk. This natural analog of Mahler's measure arises in connection with extremal problems for Bergman spaces. It inherits many nice properties such as the multiplicative one. However, this height is a lower bound for Mahler's measure, and it can be substantially lower. We discuss some similarities and differences between the two.
Consider a height two ideal, II, which is minimally generated by mm homogeneous forms of degree dd in the polynomial ring R=k[x,y]R=k[x,y]. Suppose that one column in the homogeneous presenting matrix \f\f of II has entries of degree nn and all of the other entries of \f\f are linear. We identify an explicit generating set for the ideal \CalA\Cal A which defines the Rees algebra \CalR=R[It]\Cal R=R[It]; so \CalR=S/\CalA\Cal R=S/\Cal A for the polynomial ring S=R[T1,...,Tm]S=R[T_1,...,T_m]. We resolve \CalR\Cal R as an SS-module and IsI^s as an RR-module, for all powers ss. The proof uses the homogeneous coordinate ring, A=S/HA=S/H, of a rational normal scroll, with H\CalAH\subseteq \Cal A. The ideal \CalAA\Cal AA is isomorphic to the nthn^{\text{th}} symbolic power of a height one prime ideal KK of AA. The ideal K(n)K^{(n)} is generated by monomials. Whenever possible, we study A/K(n)A/K^{(n)} in place of A/\CalAAA/\Cal AA because the generators of K(n)K^{(n)} are much less complicated then the generators of \CalAA\Cal AA. We obtain a filtration of K(n)K^{(n)} in which the factors are polynomial rings, hypersurface rings, or modules resolved by generalized Eagon-Northcott complexes. The generators of II parameterize an algebraic curve \CalC\Cal C in projective m1m-1 space. The defining equations of the special fiber ring \CalR/(x,y)\CalR\Cal R/(x,y)\Cal R yield a solution of the implicitization problem for \CalC\Cal C.
We consider the problem of counting 4-cycles (C4C_4) in an undirected graph GG of nn vertices and mm edges (in bipartite graphs, 4-cycles are also often referred to as butterflies\textit{butterflies}). Most recently, Wang et al. (2019, 2022) developed algorithms for this problem based on hash tables and sorting the graph by degree. Their algorithm takes O(mδˉ)O(m\bar\delta) expected time and O(m)O(m) space, where δˉO(m)\bar \delta \leq O(\sqrt{m}) is the average degeneracy\textit{average degeneracy} parameter introduced by Burkhardt, Faber \& Harris (2020). We develop a streamlined version of this algorithm requiring O(mδˉ)O(m\bar\delta) time and precisely nn words of space. It has several practical improvements and optimizations; for example, it is fully deterministic, does not require any auxiliary storage or sorting of the input graph, and uses only addition and array access in its inner loops. Our algorithm is very simple and easily adapted to count 4-cycles incident to each vertex and edge. Empirical tests demonstrate that our array-based approach is 4×4\times -- 7×7\times faster on average compared to popular hash table implementations.
We present a new structure theorem for finite fields of odd order that relates multiplicative and additive structure in an interesting way. This theorem has several applications, including an improved understanding of Dickson and Chebyshev polynomials and some formulas with a number-theoretic flavor. This paper is an abridged version of two math arXiv articles by the author [arXiv:1707.06870, arXiv:1707.06877].
There has arisen in recent years a substantial theory of "multiplier ideals'' in commutative rings. These are integrally closed ideals with properties that lend themselves to highly interesting applications. But how special are they among integrally closed ideals in general? We show that in a two-dimensional regular local ring with algebraically closed residue field, there is in fact no difference between "multiplier" and "integrally closed" (or "complete.") However, among multiplier ideals arising from an integer multiplying constant (also known as adjoint ideals) the only simple complete ones primary for the maximal ideal are those of order one.
Inspired by a question of Sarnak, we introduce the notion of a prime component in an Apollonian circle packing: a maximal tangency-connected subset having all prime curvatures. We also consider thickened prime components, which are augmented by all circles immediately tangent to the prime component. In both cases, we ask about the curvatures which appear. We consider the residue classes attained by the set of curvatures, the number of circles in such components, the number of distinct integers occurring as curvatures, and the number of prime components in a packing. As part of our investigation, we computed and analysed example components up to around curvature 101310^{13}; software is available.
Nonlocal games with synchronous correlations are a natural generalization of functions between two finite sets. In this work we examine analogues of Bell's inequalities for such correlations, and derive a synchronous device-independent quantum key distribution protocol. This protocol has the advantage of symmetry between the two users and self-testing while generating shared secret key without requiring a preshared secret. We show that, unlike general correlations and the CHSH inequality, there can be no quantum Bell violation among synchronous correlations with two measurement settings. However we exhibit explicit analogues of Bell's inequalities for synchronous correlations with three measurement settings and two outputs, provide an analogue of Tsirl'son's bound in this setting, and prove existence and rigidity of quantum correlations that saturate this bound. We conclude by posing a security assumption that bypasses the locality, or causality, loophole and examine the protocol's robustness against measurement error and depolarization noise.
We provide an algorithmic method for constructing projective resolutions of modules over quotients of path algebras. This algorithm is modified to construct minimal projective resolutions of linear modules over Koszul algebras.
3
We prove that every distinct covering system has a modulus divisible by either 2 or 3.
In this paper we prove equivalences of categories relating the derived category of a block of the category of representations of a connected reductive algebraic group over an algebraically closed field of characteristic pp bigger than the Coxeter number and a derived category of equivariant coherent sheaves on the Springer resolution (or a parabolic counterpart). In the case of the principal block, combined with previous results, this provides a modular version of celebrated constructions due to Arkhipov-Bezrukavnikov-Ginzburg for Lusztig's quantum groups at a root of unity. As an application, we prove a "graded version" of a conjecture of Finkelberg-Mirkovi\'c describing the principal block in terms of mixed perverse sheaves on the dual affine Grassmannian.
It has long been known that every quasi-homogeneous normal complex surface singularity with Q-homology sphere link has universal abelian cover a Brieskorn complete intersection singularity. We describe a broad generalization: First, one has a class of complete intersection normal complex surface singularities called "splice type singularities", which generalize Brieskorn complete intersections. Second, these arise as universal abelian covers of a class of normal surface singularities with Q-homology sphere links, called "splice-quotient singularities". According to the Main Theorem, splice-quotients realize a large portion of the possible topologies of singularities with Q-homology sphere links. As quotients of complete intersections, they are necessarily Q-Gorenstein, and many Q-Gorenstein singularities with Q-homology sphere links are of this type. We conjecture that rational singularities and minimally elliptic singularities with Q-homology sphere links are splice-quotients. A recent preprint of T Okuma presents confirmation of this conjecture.
There are no more papers matching your filters at the moment.