Jul 2026· Annual International Computer Software and Applications Conference· pp. 267-272· 0 citations· 19 references
Abstract
Logistics Cyber-Physical Systems (LCPS) generate large volumes of regulatory and operational texts that encode early signals of safety risks. Converting short, noisy, and domain-specific records into actionable intelligence is difficult due to industrial semantic drift and the limited auditability of black-box predictors. This paper proposes Neuro-Symbolic Logistics Risk Awareness (NS-LRA), a dual-channel framework that integrates lightweight semantic perception with constraint-aware topological reasoning. NS-LRA first maps raw texts to a standardized schema of $K=20$ risk nodes using a dual-weighted embedding mechanism that combines TF-IDF and Word2Vec to mitigate short-text sparsity. It then constructs a directed risk graph by fusing co-occurrence evidence with a domain constraint mask, and derives hierarchical propagation via ISM level partitioning with deep-driver identification via MICMAC analysis. We evaluate NS-LRA on $N=8,435$ records, validated against an annotated subset $(\mathcal{D}_{\text{ann}}=1,500)$) with Fleiss' $\kappa=0.82$ and an expert-defined gold graph. NS-LRA achieves Micro-$\mathrm{F} \mathrm{1}=\text{0. 8 7 9}$ for risk mapping and approximately $22 \times$ lower perrecord CPU latency than fine-tuned BERT on the same test split under the same environment. For topological inference, NS-LRA reports $\text{E P}=\text{0. 9 2 4}$ and $\text{T C}=\text{0. 9 5}$ against the gold graph. These results indicate that NS-LRA can provide an efficient and traceable pipeline for proactive risk governance in LCPS.
This paper proposes GRAL, which is an AI-driven framework that combines graph neural networks (GNN) for cross-asset temporal alert correlation, retrieval-augmented generation (RAG) for dynamic threat intelligence enrichment, and large language models (LLM) for semantic reasoning and verdict generation.
Deng Zhang, Juan Wang, Hanjun Gao et al.· Symmetry· 0 citations
CyberLLM is presented, a multi-agent, LLM-orchestrated framework that autonomously detects vulnerabilities and executes remediations under a formal, runtime safety guard, and indicates that LLM agents can perform useful autonomous cyber-defense when wrapped in a deterministic, auditable safety envelope.
Nenad Petrovic, Oussama Jeddou, Feres Ben Fraj et al.· 0 citations
Aim/Purpose: The primary objective is to address the structural operational cost crisis in modern SOCs by designing and formally specifying a three-layer agentic AI framework that integrates semantic alert triage, adaptive reinforcement-learning response, and episodic knowledge synthesis into a unified architecture.
Background: Modern SOCs are experiencing an acute operational crisis. Exponential growth in alert volume, high false-positive rates (>40%), and chronic analyst attrition have created a perfect storm. Existing rule-based SIEM and single-agent SOAR approaches only achieve 20–55% alert automation and fail to address the full operational lifecycle.
Methodology: The framework evaluation is based on a structured comparison with seven benchmark systems across four dimensions (threat coverage breadth, integration completeness, cost quantification, and adversarial safeguards), each rated on a five-level ordinal scale using replicable criteria.
Contribution: The paper makes four contributions: (1) a formal algorithmic specification of a three-layer agentic AI architecture including three pseudocode procedures and a PPO state-action-reward formalism; (2) a quantitative operational cost projection framework explicitly distinguishing designed targets from measured performance, with a maximum designed workload reduction of 86%; (3) a systematic four-dimensional comparative analysis against seven benchmark frameworks demonstrating that CyberAgent is the only framework achieving full architectural completeness (integrating all three of semantic triage, adaptive RL response, and episodic knowledge synthesis simultaneously), an architectural claim requiring empirical confirmation; and (4) dual adversarial safeguards (prompt injection mitigation and reasoning consistency verification) absent from all seven benchmark frameworks.
Findings: CyberAgent is a theoretical design-science artefact that has neither been implemented nor empirically evaluated. All quantitative projections are designed to achieve targets grounded in prior work, not verified outcomes: an alert automation rate of 85–90%, an analyst workload reduction of 56–86% (design target 86% under the product-rule independence assumption), an MTTR reduction of 65–75%, and a false-positive reduction of 60–70%. These projections require empirical validation using CybORG and the DARPA OpTC dataset, with this as the primary future work priority.
Recommendations for Practitioners: The PTL’s Chain-of-Thought (CoT) reasoning traces provide human-readable decision narratives that enhance transparency and may support auditability workflows relevant to GDPR Article 33, HIPAA, PCI-DSS, and SOX. However, CoT traces do not automatically satisfy regulatory auditability or compliance requirements; they are one architectural input to a broader compliance process. Formal legal and compliance assessment by qualified professionals is required before deployment in regulated environments. Practitioners should treat CoT output as decision-support documentation, not as regulatory certification.
Recommendation for Researchers: Future work should also develop federated DRL training protocols to ensure policy convergence under data-scarce conditions and rigorously test the adversarial robustness of the PTL’s consistency-checking mechanism against novel prompt-injection strategies.
Impact on Society: If empirically validated, CyberAgent could make enterprise-grade cyber defence more accessible to mid-market organisations that cannot afford 24/7 SOC analyst staffing, by substantially reducing the alert-triage workload. All such impact claims are conditional on validation results.
Future Research: Priority directions include: (1) empirical implementation and red-team validation across diverse enterprise environments; (2) federated DRL training to address the data sharing constraints that limit policy learning in regulated sectors; (3) extension of the KSL to support cross-organizational threat intelligence sharing; and (4) longitudinal studies measuring analyst skill development and human-AI trust calibration under progressively increasing levels of CyberAgent autonomy.
S. Meeampol, Narongsak Sukma· Interdisciplinary Journal of...· 0 citations
Cold chain logistics has advanced technologically, yet most deployed systems remain reactive monitors, not decision-making agents: thresholds trigger alerts, but nothing relates violations to cumulative product degradation or converts degradation signals into logistics decisions. We address this gap with a Quality-Aware Decision Intelligence (QADI) framework combining three capabilities: a structured quality state representation, $S_q = [L, Q, U, R]$ -- remaining shelf life, degradation rate, estimation uncertainty, and operational risk, all derived and computable from the framework equations; a hybrid quality modeling layer combining physics-based microbial kinetics with a data-driven correction term; and a reasoning layer built on Microsoft Phi-4~\cite{Phi4} with retrieval-augmented generation over a structured domain knowledge base. We benchmark against five baselines -- threshold monitoring, physics-only, physics-plus-noise, optimisation-based decisions, and a rule-based expert system -- across eight cold chain scenarios, using pasteurised milk as the primary case, with ground truth shelf-life drawn from published dairy studies~\cite{Singh1994, Smigic2015} independent of our model. Comparisons use Wilcoxon signed-rank tests with Holm correction. Across milk and broccoli scenarios, the framework attains mean absolute shelf-life error of 7.2 hours (versus 30.9 hours, physics-only; $p<0.001$), spoilage rate of 14.5% (versus 16.6%, physics-only and rule-based; p=0.08), and oracle-optimal decisions in 99.5% of scenarios. Removing the LLM reasoning component drops optimality to 45.5% ($p<0.001$). Expert-rated explanation quality reaches 83% ($\kappa = 0.71$). Ablations show hybrid modeling and LLM reasoning contribute distinct gains, while RAG retrieval mainly drives explanation quality. Code: https://bit.ly/4d6t44C.
Smart-city airspace is transforming Uncrewed Aerial Vehicles (UAVs) from passive sensing platforms into cyber-physical decision makers that must follow operational rules under degraded observations and ambiguous language. Existing UAV and multimodal benchmarks evaluate perception, navigation, collaboration, and reasoning, but few assess whether physical evidence, protocol constraints, and action risk remain coupled during critical decisions. We introduce MulRobBench, an offline, protocol-conditioned benchmark for Vision-Language-Action (VLA) UAV agents in smart-city environments. MulRobBench integrates real UAV multimodal observations, protocol-level security policies, and action-level cyber-physical safety into a unified evaluation framework. The benchmark contains 3,024 samples spanning 17 task taxonomy nodes and 12 scoring dimensions across four stages: operational context understanding, multimodal evidence arbitration, degradation-aware reasoning, and risk-aware action planning. Evaluation combines semantic scoring with structural diagnostics, including policy compliance, format compliance, unsafe actions, parsing failures, and dimension-level validity. Across 17 multimodal models, the best semantic protocol-decision score reaches only 0.5141, while the best strict mean scoring-dimension accuracy is 0.1599. A controlled 20-anchor modality-ablation study changes 4-15 action selections per model, confirming that both visual and textual inputs influence decisions. Analysis identifies modality-trust selection, constraint extraction, glare, missing data, and operator shorthand as the primary causes of decision instability. MulRobBench provides a reproducible benchmark for trustworthy multimodal UAV decision making under realistic operational constraints.
B. Alsinglawi, Weizheng Wang, Junyi Wu et al.· 0 citations
The findings show that LLMs can approximate structured cybersecurity reasoning under controlled representations, but do not apply it robustly, which has important implications for the design and evaluation of AI-assisted security decision-support systems.
