140 citations · 600 across the 36 of their papers we have counts for
37 papers
VulnGym: Evaluating Vulnerability Management Strategies against Advanced Persistent Threats
Sofia Della Penna, Lorenzo Parracino, Luciano Pianese +2
Enterprise networks are continuously targeted by Advanced Persistent Threats (APTs), attack campaigns exploiting software vulnerabilities to compromise critical assets over time. A…
AI-Generated PowerShell Malware: An Experimental Framework and Dataset
Luciano Pianese, Vittorio Orbinato, Pietro Liguori +1
Generative AI has emerged as a significant cybersecurity threat, with several recent attack campaigns leveraging LLMs to generate code for malicious purposes via scripting language…
Elevating Cyber Threat Intelligence against Disinformation Campaigns with LLM-based Concept Extraction and the FakeCTI Dataset
Domenico Cotroneo, Roberto Natella, Vittorio Orbinato
The swift spread of fake news and disinformation campaigns poses a significant threat to public trust, political stability, and cybersecurity. Traditional Cyber Threat Intelligence…
CTI-HAL: A Human-Annotated Dataset for Cyber Threat Intelligence Analysis
Sofia Della Penna, Roberto Natella, Vittorio Orbinato +2
Organizations are increasingly targeted by Advanced Persistent Threats (APTs), which involve complex, multi-stage tactics and diverse techniques. Cyber Threat Intelligence (CTI) so…
Can Neural Decompilation Assist Vulnerability Prediction on Binary Code?
D. Cotroneo, F. C. Grasso, R. Natella +1
Vulnerability prediction is valuable in identifying security issues efficiently, even though it requires the source code of the target software system, which is a restrictive hypot…
Enhancing AI-based Generation of Software Exploits with Contextual Information
Pietro Liguori, Cristina Improta, Roberto Natella +2
This practical experience report explores Neural Machine Translation (NMT) models' capability to generate offensive security code from natural language (NL) descriptions, highlight…
The Power of Words: Generating PowerShell Attacks from Natural Language
Pietro Liguori, Christian Marescalco, Roberto Natella +2
As the Windows OS stands out as one of the most targeted systems, the PowerShell language has become a key tool for malicious actors and cybersecurity professionals (e.g., for pene…
AI Code Generators for Security: Friend or Foe?
Roberto Natella, Pietro Liguori, Cristina Improta +2
Recent advances of artificial intelligence (AI) code generators are opening new opportunities in software security research, including misuse by malicious actors. We review use cas…
Laccolith: Hypervisor-Based Adversary Emulation with Anti-Detection
Vittorio Orbinato, Marco Carlo Feliciano, Domenico Cotroneo +1
Advanced Persistent Threats (APTs) represent the most threatening form of attack nowadays since they can stay undetected for a long time. Adversary emulation is a proactive approac…
Automating the Correctness Assessment of AI-generated Code for Security Contexts
Domenico Cotroneo, Alessio Foggia, Cristina Improta +2
Evaluating the correctness of code generated by AI is a challenging open problem. In this paper, we propose a fully automated method, named ACCA, to evaluate the correctness of AI-…
Vulnerabilities in AI Code Generators: Exploring Targeted Data Poisoning Attacks
Domenico Cotroneo, Cristina Improta, Pietro Liguori +1
AI-based code generators have become pivotal in assisting developers in writing software starting from natural language (NL). However, they are trained on large amounts of data, of…
Enhancing Robustness of AI Offensive Code Generators via Data Augmentation
Cristina Improta, Pietro Liguori, Roberto Natella +2
Since manually writing software exploits for offensive security is time-consuming and requires expert knowledge, AI-base code generators are an attractive solution to enhance secur…
Run-time Failure Detection via Non-intrusive Event Analysis in a Large-Scale Cloud Computing Platform
Domenico Cotroneo, Luigi De Simone, Pietro Liguori +1
Cloud computing systems fail in complex and unforeseen ways due to unexpected combinations of events and interactions among hardware and software components. These failures are esp…
Who Evaluates the Evaluators? On Automatic Metrics for Assessing AI-based Offensive Code Generators
Pietro Liguori, Cristina Improta, Roberto Natella +2
AI-based code generators are an emerging solution for automatically writing programs starting from descriptions in natural language, by using deep neural networks (Neural Machine T…
On Temporal Isolation Assessment in Virtualized Railway Signaling as a Service Systems
Domenico Cotroneo, Luigi De Simone, Roberto Natella
Railway signaling systems provide numerous critical functions at different safety level, to correctly implement the entire transport ecosystem. Today, we are witnessing the increas…
A Latency-driven Availability Assessment for Multi-Tenant Service Chains
Luigi De Simone, Mario Di Mauro, Roberto Natella +1
Nowadays, most telecommunication services adhere to the Service Function Chain (SFC) paradigm, where network functions are implemented via software. In particular, container virtua…
Automatic Mapping of Unstructured Cyber Threat Intelligence: An Experimental Study
Vittorio Orbinato, Mariarosaria Barbaraci, Roberto Natella +1
Proactive approaches to security, such as adversary emulation, leverage information about threat actors and their techniques (Cyber Threat Intelligence, CTI). However, most CTI sti…
Can NMT Understand Me? Towards Perturbation-based Evaluation of NMT Models for Code Generation
Pietro Liguori, Cristina Improta, Simona De Vivo +3
Neural Machine Translation (NMT) has reached a level of maturity to be recognized as the premier method for the translation between different languages and aroused interest in diff…
Can We Generate Shellcodes via Natural Language? An Empirical Study
Pietro Liguori, Erfan Al-Hossami, Domenico Cotroneo +3
Writing software exploits is an important practice for offensive security analysts to investigate and prevent attacks. In particular, shellcodes are especially time-consuming and a…
ThorFI: A Novel Approach for Network Fault Injection as a Service
Domenico Cotroneo, Luigi De Simone, Roberto Natella
In this work, we present a novel fault injection solution (ThorFI) for virtual networks in cloud computing infrastructures. ThorFI is designed to provide non-intrusive fault inject…
Software Micro-Rejuvenation for Android Mobile Systems
Domenico Cotroneo, Luigi De Simone, Roberto Natella +2
Software aging -- the phenomenon affecting many long-running systems, causing performance degradation or an increasing failure rate over mission time, and eventually leading to fai…
StateAFL: Greybox Fuzzing for Stateful Network Servers
Roberto Natella
Fuzzing network servers is a technical challenge, since the behavior of the target server depends on its state over a sequence of multiple messages. Existing solutions are costly a…
EVIL: Exploiting Software via Natural Language
Pietro Liguori, Erfan Al-Hossami, Vittorio Orbinato +4
Writing exploits for security assessment is a challenging task. The writer needs to master programming and obfuscation techniques to develop a successful exploit. To make the task…
Enhancing the Analysis of Software Failures in Cloud Computing Systems with Deep Learning
Domenico Cotroneo, Luigi De Simone, Pietro Liguori +1
Identifying the failure modes of cloud computing systems is a difficult and time-consuming task, due to the growing complexity of such systems, and the large volume and noisiness o…