We propose a two-stage large language model (LLM) framework for zero-shot detection of insider threats and advanced persistent threats (APTs) from heterogeneous security logs. The framework models user activity as chronological timelines and incorporates retrieval-augmented generation (RAG) to provide personalised behavioural context from each user's historical activity. Rather than performing end-to-end classification directly from raw logs, it first generates structured, interpretable sets of threat-specific risk indicators, which are then classified jointly across temporal sequences to capture attack patterns spanning multiple windows.The framework is evaluated on two benchmark datasets, CERT r5.2 for insider threat detection and PicoDomain for APT detection, using four combinations of two open-weight LLMs under both retrieval and non-retrieval settings. All configurations outperform the previous state-of-the-art LLM-based framework (GABM), with the best configuration improving the F1-score by 11.40 percentage points on CERT r5.2 and 31.50 percentage points on PicoDomain. Results further show that retrieval mainly benefits weaker LLMs by generating more discriminative risk indicators, whereas stronger models achieve comparable performance without retrieved context. The most effective assignment of LLMs to the two stages depends on the dataset. These findings show that the quality of the generated risk indicators is the main driver of zero-shot cyber threat detection performance.
A. Al-Ghamdi, S. Layeghy, Marius Portmann· 0 citations
Image steganography hides secret data within digital media, such as images, without detection. Traditional stenographic methods struggle with three major problems including limited data capacity, susceptibility to attacks, and compromised visual quality. In this work, we propose a new framework, based on the BossBase dataset, that combines hybrid encryption with saliency-based adaptive embedding to select the most effective regions for data concealment in cover images. We encrypt the secret image in the first step using a hybrid encryption approach, Advanced Encryption Standard (AES) and Rivest-Shamir-Adleman (RSA) algorithm, where AES is first used to encrypt the secret image and the AES key is then RSA-encrypted for dual layer encryption. Bitwise triplication technique and majority voting are incorporated to protect the encrypted key from bit errors. Then, we generate a hybrid histogram equalization (HE) map from the cover image's saliency map to embed the secret image. During the embedding process, we use the Least Significant Bit (LSB) technique, which selects areas in the hybrid map derived from the cover image with low visual sensitivity for embedding data. The system evaluation includes multiple performance metrics, including Peak-to-Signal Ratio (PSNR), Structural Similarity Index Measure (SSIM), Mean Squared Error (MSE), Bit Error Rate (BER), payload capacity, and execution time. The experimental results show excellent imperceptibility for all secret image sizes (64×64, 128×128, 192×192) with PSNR values above 58 dB and SSIM values above 0. 9995.The system succeeded in reconstructing completely imperceptible content with BER = 0. The reconstructed contents had infinite PSNR and SSIM = 1.0000 against any image Perturbation including noise, blurring, compression, and cropping. All the conventional steganalysis and the deep-learning-based steganalysis (RS, CRM, Xu-Net, Ye-Net) failed to detect the embedded signals.
A. Al-Ghamdi, Rana Alrawashdeh· Journal of Cyber Security an...· 0 citations