9 papers
A Proposal for an Agentic AI Architecture to Support Multi-Domain Decision-Making in the Brazilian Armed Forces
Gioliano de Oliveira Braga, Sidnei Barbieri, Ágney Lopes Roth Ferraz +2
The growing complexity of multi-domain operational environments (land, aerospace, naval, cyber, and electromagnetic spectrum) has increased the volume and velocity of data reaching…
Auditing AI Investment Recommendations as Executable Actions
Sidnei Barbieri, Wellington Vargas, Ágney Lopes Roth Ferraz
AI systems increasingly produce investment recommendations, yet the usual evaluations ask the wrong question. Realized return is noisy and easy to overfit, and agreement with a ref…
From Production SIEM to Reusable Cybersecurity Artifacts
Sidnei Barbieri, Leonardo Vaz de Meneses, Ágney Lopes Roth Ferraz +2
Operational evidence is not automatically scientific evidence. The most realistic Security Operations Center (SOC) data is production telemetry, yet it remains scientifically inacc…
ARENA: An Architecture for Measuring the Transferability of Autonomous Cyber Defense
Sidnei Barbieri, Ágney Lopes Roth Ferraz, Wagner Comin Sonaglio +3
Operational evidence is not automatically scientific evidence. The most realistic Security Operations Center (SOC) data is production telemetry, yet it remains scientifically inacc…
AutoSUT: The Environment Semantics Gap in Structured CTI for Adversary Emulation
Sidnei Barbieri, Ágney Lopes Roth Ferraz, Lourenço Alves Pereira Júnior
Structured Cyber Threat Intelligence (CTI) increasingly supports adversary emulation, detection evaluation, and cyber range design, yet each workflow still requires a target System…
TopVenues: A Reproducible Corpus and Tooling Substrate for Cybersecurity Literature Reviews
Sidnei Barbieri, Ágney Lopes Roth Ferraz, Lourenço Alves Pereira Júnior
Cybersecurity literature reviews require a reproducible denominator: the set of papers that a protocol includes before screening and synthesis begin. Today, that denominator is oft…
SOCpilot: Verifying Policy Compliance for LLM-Assisted Incident Response
Sidnei Barbieri, Leonardo Vaz de Meneses, Ágney Lopes Roth Ferraz +1
Security operations centers (SOCs) are beginning to use large language models (LLMs) as copilots to draft incident-response plans. These plans may include actions that are valid pe…
PocketAgents: A Manifest-Driven Library of Autonomous Defense Agents
Sidnei Barbieri, Ágney Lopes Roth Ferraz, Lourenço Alves Pereira Júnior
Connecting large language models (LLMs) to defensive enforcement requires more than asking a model whether an attack is happening. A defender must decide which model outputs may ch…
The Procedural Semantics Gap in Structured CTI: A Measurement-Driven STIX Analysis for APT Emulation
Ágney Lopes Roth Ferraz, Sidnei Barbieri, Murray Evangelista de Souza +1
Cyber threat intelligence (CTI) encoded in STIX and structured according to the MITRE ATT&CK framework has become a global reference for describing adversary behavior. However, ATT…