Search Results (17)

Recent cyber incidents have become increasingly sophisticated through Living-off-the-Land (LotL) techniques that exploit legitimate behavior and multi-stage attacks. This requires advanced reasoning capabilities to discern the attack contexts within fragmented large-scale logs. However, closed network environments with physical network separation (air-gapped), such as national critical infrastructures, restrict the use of high-performance cloud large language models (LLMs), thereby limiting the adoption of cutting-edge artificial intelligence (AI)-based analysis technologies. To overcome these constraints, this study proposes a Local LLM-based intrusion analysis framework that operates independently within closed networks. The proposed framework combines (i) an Offline Knowledge Distillation technique that transfers the analytical reasoning process of external high-performance models to the Local LLM after a security review, and (ii) an AI agent orchestration structure that controls the analysis procedure step-by-step and suppresses hallucinations. Experiments and validation using a public dataset (Atomic Red Team) demonstrated that the proposed model achieved a consistently higher detection accuracy (88.4%) and MITRE Adversarial Tactics, Techniques, and Common Knowledge mapping performance (0.91 F1-Score) than existing general-purpose Local LLMs. Furthermore, the proposed model suppressed hallucination rates to 6.2% through an automated verification mechanism and significantly improved analysis efficiency by refining large-scale logs to focus on core events. This study quantitatively demonstrated that AI-based intrusion incident analysis can be automated using a single graphics processing unit server under controlled evaluation conditions. The proposed framework provides a practical prototype for intelligent security monitoring in closed-network environments. However, the operational performance must be validated in real-world deployments. Full article

This study develops a new concept of computer-assisted exercises (CAX) on constructive simulation systems and how the proposed concept affects the strategy and teaching methods. The current state of affairs in the field of defense and security, both in Europe and in the world, requires the acquisition of competencies (European Qualifications Framework—EQF: knowledge, skills, independence, and responsibility), i.e., the education and training of a significantly larger number of personnel in the field of defense and security than has been the case in the last 70 years. In addition, an important specificity of today is that students need to acquire some competencies that were almost unknown until recently. Most of these competencies are the result of the rapid development of technology, which has significantly changed human life in all areas. In order to respond to the modern requirements of conducting operations, where the transfer of information both horizontally and vertically is exponentially accelerated, current concepts of preparation and implementation of education and training, of which exercises are often the most important part, need to be replaced with new concepts, and one such concept is developed in this paper. New information introduced is mostly related to the new weapons that are being introduced (unmanned systems, hypersonic missiles, weapons based on microwaves and lasers, etc.), which all result in necessary changes to the traditional approach to conducting war, i.e., tactics, techniques, and procedures (TTP). This novel exercise concept allows for the simultaneous implementation of training for up to three or four hierarchical levels (e.g., TF Div, brigade, battalion, and company) in one exercise, while in most countries, including the NATO alliance, it is still common for such exercises to be conducted according to a concept that is over 20 years old and, as a rule, is focused on the implementation of exercises for one or two hierarchical levels. This approach allows key personnel from the headquarters of units from four hierarchical levels to be simulated in real time, which is not provided by current concepts for preparing and conducting exercises. The new concept was applied as a multi-level, computer-assisted exercise (CAX) on constructive simulation systems. In addition, significant advantages of the new concept relate to the flexibility and adaptability of the proposed concept to be applied in addition to operational units and in training institutions such as academies and higher education institutions. In addition to the above, the new concept requires a shorter planning period as well as fewer total resources needed for the preparation and implementation of the exercise. The management, organizational, and technological components of the proposed exercise concept are implemented in the CAX model. The hypotheses in this paper will be tested in an applied study, which was evaluated through an external evaluation body. The implemented CAX model was tested in Croatia on the example of using exercises at the Croatian Defense Academy. Full article

Deploying Large Language Models (LLMs) on Maritime Autonomous Surface Ships (MASS) entails a critical trade-off between reasoning depth, inference latency, and hardware constraints. To fill the existing gap, we introduce MARTIAN (Maritime Agent for Real-time Tactical Inference And Navigation), a 14B-parameter decision support agent engineered for edge deployment on standard vessel hardware (e.g., the NVIDIA Jetson AGX Orin). Central to our approach is the Cognitive Core architecture, which utilizes a verified dataset of 21,800 Chain-of-Thought (CoT) instruction–response pairs to align general linguistic capabilities with maritime procedural logic. Empirical evaluations demonstrate that MARTIAN achieves an overall accuracy of 73.23% (SFT only) and 81.16% (SFT + RAG) on the Bilingual Maritime Multiple-Choice Questionnaire (BM-MCQ), a standardized assessment dataset constructed based on Officer of the Watch (OOW) competencies. Notably, the SFT-only configuration attains 78.53% on pure-logic-intensive COLREG tasks—surpassing the 72B-parameter Qwen-2.5 foundation model in this domain—while maintaining a real-time inference latency of 22.4 ms/token. Crucially, our ablation studies support a nuanced Interference Hypothesis: while RAG significantly enhances factual recall in knowledge-intensive domains (boosting total accuracy from 73.23% to 81.16%), it concurrently introduces semantic noise that degrades performance in pure logic reasoning tasks (e.g., COLREG maneuvering accuracy decreases from 78.53% to 77.36%). On the basis of this finding, we identify and empirically motivate a decoupled cognitive design principle that separates procedural reflexes (via SFT) from declarative knowledge (via RAG). While the full implementation of an adaptive routing mechanism is deferred to future work, the ablation results presented herein offer a validated, cost-effective reference architecture for deploying transparent and regulation-compliant AI on resource-constrained merchant vessels. Full article

This study introduces a modular, behaviorally curated malware dataset suite consisting of eight independent sets, each specifically designed to represent a single malware class: Trojan, Mirai (botnet), ransomware, rootkit, worm, spyware, keylogger, and virus. In contrast to earlier approaches that aggregate all malware into large, monolithic collections, this work emphasizes the selection of features unique to each malware type. Feature selection was guided by established domain knowledge and detailed behavioral telemetry obtained through sandbox execution and a subsequent report analysis on the AnyRun platform. The datasets were compiled from two primary sources: (i) the AnyRun platform, which hosts more than two million samples and provides controlled, instrumented sandbox execution for malware, and (ii) publicly available GitHub repositories. To ensure data integrity and prevent cross-contamination of behavioral logs, each sample was executed in complete isolation, allowing for the precise capture of both static attributes and dynamic runtime behavior. Feature construction was informed by operational signatures characteristic of each malware category, ensuring that the datasets accurately represent the tactics, techniques, and procedures distinguishing one class from another. This targeted design enabled the identification of subtle but significant behavioral markers that are frequently overlooked in aggregated datasets. Each dataset was balanced to include benign, suspicious, and malicious samples, thereby supporting the training and evaluation of machine learning models while minimizing bias from disproportionate class representation. Across the full suite, 10,000 samples and 171 carefully curated features were included. This constitutes one of the first dataset collections intentionally developed to capture the behavioral diversity of multiple malware categories within the context of Internet of Things (IoT) security, representing a deliberate effort to bridge the gap between generalized malware corpora and class-specific behavioral modeling. Full article

Aviation operations are increasingly impacted by clear-air turbulence (CAT) encounters, a growing concern in both media and academic circles. Research into CAT focuses on the generation, prediction, detection, and monitoring of the occurring events (thanks to weather-related methodologies and instruments) along with technologies and operational aspects to mitigate their effects, from the perspective of both the flight segment (aircraft and pilot and related onboard systems) and the ground segment (ATM and ATC and related tools). Climate changes have led to more frequent and severe CAT events, highlighting the need for sustainable aviation solutions, aiming to achieve improved theoretical knowledge and technological and operational management advancements. This paper addresses the CAT topic under two main perspectives: the scientific understanding of the phenomena, and the technological management of such occurrence in aviation operations. With reference to the first addressed domain, the paper provides a comprehensive review of the currently used and perspective proposed methodologies and tools for understanding, detecting, and predicting CAT phenomena. With reference to the second addressed domain, then, this paper aimed to analyze the state of the art and trends in the technological and operational management and mitigation of the CAT occurrences at a tactical level (i.e., while in flight) by the aviation, covering the technologies and procedures implemented onboard and in the ground segment. Overall, therefore, this paper assesses the state of the art and identifies the most promising innovations that promote safer, more sustainable future aviation operations, by bridging weather and climate science with aviation engineering, in the presence of CAT events. Full article

An organization’s success depends on its ability to attract and retain skilled personnel. Superintendents play a critical role in overseeing project sites in the construction industry and can adapt to the increasingly complicated requirements of modern construction projects. This study examines traditional and modern personnel selection methods to determine effective tactics, essential competencies, and emerging trends regarding supervisory personnel. The research methodology follows the PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) framework. First, this study examines traditional and modern selection methods used by organizations and engineering firms to provide a comprehensive overview of the topic and assist in selecting appropriate staff recruitment procedures. Second, the Web of Science, Scopus, and Google Scholar databases were reviewed to identify superintendent selection approaches and competencies, over the period January 2000 to September 2024. A total of 22 relevant papers were analyzed. Superintendent selection processes included questionnaires (57%), interviews (26%), literature reviews (14%), and data-driven AI tools (3%). Forty competency criteria were identified, with the top five being knowledge, communication skills, leadership, health and safety expertise, and commitment. As a result, novel approaches employing Industry 4.0 technologies, including virtual reality (VR), wearable sensing devices (WSDs), natural language processing (NLP), blockchain, and computer vision, are recommended. These findings support a better understanding of how best to identify the most qualified supervisory personnel and provides enhanced methods for evaluating job applicants. Full article

The study of declarative and procedural knowledge in sport allows us to assess students’ tactical learning processes. The aim of this study was to analyze and compare the level of declarative and procedural knowledge acquired by students according to the pedagogical model and gender, after the application of two intervention programs for an alternative invasion sport, “Rosquilla”. This study involved 136 students distributed into six groups of Primary Education (fifth and sixth year) and Secondary Education (first year). Each group in the same year participated in a different intervention program, one based on the Game-Centered Model and the other on a hybrid model of the Game-Centered Model and the Sports Education Model. A descriptive analysis was carried out to determine the characteristics of the participants. Subsequently, an independent samples Mann–Whitney U-test was applied to compare the level of knowledge between the models and genders in the pre- and post-test periods. A Linear Mixed Model was used to analyze the level of knowledge of students within each group and compare them according to methodology and gender. The results indicate that both programs generated improvements in declarative and procedural knowledge. Therefore, students learn equally regardless of the methodological perspective and gender. Full article

Security adversaries are rampant on the Internet, constantly seeking vulnerabilities to exploit. The sheer proliferation of these sophisticated threats necessitates innovative and swift defensive measures to protect the vulnerable infrastructure. Tools such as honeypots effectively determine adversary behavior and safeguard critical organizational systems. However, it takes a significant amount of time to analyze these attacks on the honeypots, and by the time actionable intelligence is gathered from the attacker’s tactics, techniques, and procedures (TTPs), it is often too late to prevent potential damage to the organization’s critical systems. This paper contributes to the advancement of cybersecurity practices by presenting a cutting-edge methodology, capitalizing on the synergy between artificial intelligence and threat analysis to combat evolving cyber threats. The current research articulates a novel strategy, outlining a method to analyze large volumes of attacker data from honeypots utilizing large language models (LLMs) to assimilate TTPs and apply this knowledge to identify real-time anomalies in regular user activity. The effectiveness of this model is tested in real-world scenarios, demonstrating a notable reduction in response time for detecting malicious activities in critical infrastructure. Moreover, we delve into the proposed framework’s practical implementation considerations and scalability, underscoring its adaptability in diverse organizational contexts. Full article

Fuel cell technology is at the forefront of sustainable energy solutions, and polyvinyl alcohol (PVA) membranes play an important role in improving performance. This article thoroughly investigates the various varieties of PVA membranes, their production processes, and the numerous modification tactics used to solve inherent problems. Various methods were investigated, including chemical changes, composite blending, and the introduction of nanocomposites. The factors impacting PVA membranes, such as proton conductivity, thermal stability, and selectivity, were investigated to provide comprehensive knowledge. By combining various research threads, this review aims to completely investigate the current state of PVA membranes in fuel cell applications, providing significant insights for both academic researchers and industry practitioners interested in efficient and sustainable energy conversion technologies. The transition from traditional materials such as Nafion to PVA membranes has been prompted by limitations associated with the former, such as complex synthesis procedures, reduced ionic conductivity at elevated temperatures, and prohibitively high costs, which have hampered their widespread adoption. As a result, modern research efforts are increasingly focused on the creation of alternative membranes that can compete with conventional technical efficacy and economic viability in the context of fuel cell technologies. Full article

Recently, the seamless construction and operation of natural gas pipelines has become even more critical, while the oil and gas industry’s capability to operate effectively with acceptable risks and hazardous situations is mainly dependent on safety. As a result, it is very important to have a wide knowledge of effective management tactics for enhancing implementation of safety regulations and procedures. The problem of assuring workers’ health and safety in the workplace is a crucial component in the endeavor to raise the productivity of labor and the level of competitiveness of building projects. To promote the health, safety, and well-being of workers, issues that are embedded within the concept of sustainability, we propose in this study a safety risk-assessment process that uses the analytical hierarchy process for assigning priorities to risks on construction worksites. This process uses a popular multicriteria method. The success of this strategy was shown by its application to the building of a natural gas compressor plant in Greece. The main contribution of this study is the application of a well-known multicriteria method for assessing risks in a natural gas compressor station construction project and prioritizing hazards to allocate budget for risk-mitigation measures. Full article

This practitioner paper is based on the need to make sense of UN Agenda 2030 and Sustainable Development Goals (SDGs) at the city level and in an urban context. We examine the need to explain how to utilise the SDGs in strategic, tactical and operative urban development. We find that there are knowledge and practise gaps in how to localise SDGs in the urban context. This need and the lack of existing tools has led to the development of a strategic sensemaking process, which has been tested and developed with municipal and other practitioners, locally and globally. The paper presents findings from this process of development and from implementation pilots, including an SDG Sensemaking Tool (SST), a step by step iterative procedure to address these gaps. The main focus of this paper is the SDG Sensemaking process, which relies on analysing SDGs in relation to any given phenomena or project within or outside a city. The first results in this work-in-progress show that it contributes to an understanding on the complexity of how SDGs are related to the analysed phenomena, and catalyses the SDG localisation process, which helps make sense of how to navigate and measure progress in such complex environments. More research and applications are, however, needed, so as to further understand how urban governance can meet holistic, sustainable-development needs. Future work will, firstly, comprise further integrating SDGs into city-level strategies with a focus on the local, regional, national, and global impact on sustainable development and the actualisation of SDGs, and secondly, on further developing SST so that it can serve these purposes. Full article

The use of instruments for the evaluation of a player’s procedural tactical knowledge (PTK) in sociomotor sports, such as football, is a line of research of growing interest since it allows a pertinent description of the player’s football competence. The aim of this study is to configure and validate an ad-hoc observational tool that allows evaluating the player’s PTK, understood as football competence, from the observation, coding and recording of the roles, the actions of the acquired subroles and the operational and specific principles of football in the attack and defense phases. Based on the Delphi method, a field format coding instrument was designed and validated where each criterion is a system of categories, exhaustive and mutually exclusive. The results showed excellent content validity (9.02 out of 10), and high values of intra-observer stability (k = 0.747) and inter-observer agreement (k = 0.665). Generalizability analysis showed an excellent reliability (G = 0.99). Additionally, the construct validity of the tool was calculated through a small-sided game Gk + 4v4 + Gk, using two independent samples: semi-professional and amateur players. The results reflected significant differences (α < 0.05) between both samples in the variables total score, offensive score and defensive score. Therefore, this study provides a valid and reliable instrument that allows data collection in a rigorous and pertinent way, as well as their analysis and evaluation in attack and defense according to the roles of the players and based on the motor behaviors that they perform using the subroles that they acquired, associated with the technical dimension, along with the principles that they develop in parallel, in support of the tactical dimension. Full article

Analysing declarative and procedural knowledge in sport makes it possible to evaluate the students’ acquisitions in the learning process. This study aimed to compare the acquisition of declarative and procedural knowledge after the implementation of several intervention programmes in school basketball, according to the methodology and prior experience of the students. A total of 55 students from the sixth year of primary education took part in the study, distributed into three groups. Each group participated in a different intervention programme: tactical games approach (TGA), direct instruction (DI) or service teacher’s basketball unit (STBU). The level of knowledge was measured using the Test of Declarative and Procedural Knowledge in Basketball (TDPKB). A descriptive analysis was performed to determine the participants’ characteristics. A factorial ANOVA was subsequently applied in two phases (pre-test and post-test) for independent samples to compare the level of knowledge among the different groups, and a t-test for related samples was performed to compare the pre–post knowledge level within each group. Then, a factorial ANOVA and a test of repeated measures were carried out to determine the effect of the methodology and experience on the students’ knowledge. The results indicate that the TGA, DI and STBU intervention programmes induced improvements in the levels of declarative and procedural knowledge in all the groups, with the students who participated in the TGA programme achieving higher levels of declarative knowledge. Finally, the effect of the absence of practical experience was identified as a determining factor for improvement. The students who had not previously practised basketball achieved higher levels of knowledge with the TGA intervention programme. Full article

The MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) Framework provides a rich and actionable repository of adversarial tactics, techniques, and procedures. Its innovative approach has been broadly welcomed by both vendors and enterprise customers in the industry. Its usage extends from adversary emulation, red teaming, behavioral analytics development to a defensive gap and SOC (Security Operations Center) maturity assessment. While extensive research has been done on analyzing specific attacks or specific organizational culture and human behavior factors leading to such attacks, a holistic view on the association of both is currently missing. In this paper, we present our research results on associating a comprehensive set of organizational and individual culture factors (as described on our developed cyber-security culture framework) with security vulnerabilities mapped to specific adversary behavior and patterns utilizing the MITRE ATT&CK framework. Thus, exploiting MITRE ATT&CK’s possibilities towards a scientific direction that has not yet been explored: security assessment and defensive design, a step prior to its current application domain. The suggested cyber-security culture framework was originally designed to aim at critical infrastructures and, more specifically, the energy sector. Organizations of these domains exhibit a co-existence and strong interaction of the IT (Information Technology) and OT (Operational Technology) networks. As a result, we emphasize our scientific effort on the hybrid MITRE ATT&CK for Enterprise and ICS (Industrial Control Systems) model as a broader and more holistic approach. The results of our research can be utilized in an extensive set of applications, including the efficient organization of security procedures as well as enhancing security readiness evaluation results by providing more insights into imminent threats and security risks. Full article

Target localization plays a vital role in ocean sensor networks (OSNs), in which accurate position information is not only a critical need of ocean observation but a necessary condition for the implementation of ocean engineering. Compared with other range-based localization technologies in OSNs, the received signal strength (RSS)-based localization technique has attracted widespread attention due to its low cost and synchronization-free nature. However, maintaining relatively good accuracy in an environment as dynamic and complex as the ocean remains challenging. One of the most damaging factors that degrade the localization accuracy is the uncertainty in transmission power. Besides the equipment loss, the uncertain factors in the fickle ocean environment may result in a significant deviation between the standard rated transmission power and the usable transmission power. The difference between the rated and actual transmission power would lead to an extra error when it comes to the localization in OSNs. In this case, a method that can locate the target without needing prior knowledge of the transmission power is proposed. The method relies on a two-phase procedure in which the location information and the transmission power are jointly estimated. First, the original nonconvex localization problem is transformed into an alternating non-negativity-constrained least square framework with the unknown transmission power (UT-ANLS). Under this framework, a two-stage optimization method based on interior point method (IPM) and majorization-minimization tactic (MMT) is proposed to search for the optimal solution. In the first stage, the barrier function method is used to limit the optimization scope to find an approximate solution to the problem. However, it is infeasible to approach the constraint boundary due to its intrinsic error. Then, in the second stage, the original objective is converted into a surrogate function consisting of a convex quadratic and concave term. The solution obtained by IPM is considered the initial guess of MMT to jointly estimate both the location and transmission power in the iteration. In addition, in order to evaluate the performance of IPM-MM, the Cramer Rao lower bound (CRLB) is derived. Numerical simulation results demonstrate that IPM-MM achieves better performance than the others in different scenarios. Full article