arXiv subjects

Dirk Van Bruggen

Publications and source records attributed to Dirk Van Bruggen.

3 recordsLinked to original sources

arXiv2026

BlueSTAR: Tiered Agentic Architecture for Autonomous Cyber Defense

Cyber attacks are increasingly automated, narrowing the time available for human analysts to detect, reason about, and respond to intrusions. Large language models (LLMs) offer a promising foundation for autonomous cyber defense because they can correlate heterogeneous evidence and reason about previously unseen threats. However, directly applying LLMs to operational security telemetry is impractical: raw logs arrive faster than current models can process them, individual events are often ambiguous, and unconstrained LLM actions can introduce significant operational risk. We present BlueSTAR, a tiered agentic architecture for autonomous cyber defense in enterprise IT/OT networks. BlueSTAR first transforms high-volume security telemetry into compact indicators of compromise. We further introduce a resilience metric that jointly captures attacker reach, impact on mission-critical assets, and disruption caused by defensive actions. We evaluate BlueSTAR on two live enterprise IT/OT cyber ranges using seven attack chains based on real-world intrusion techniques. Across attack chains, BlueSTAR retains the fast containment of deterministic response for known threats while successfully defending against attacks requiring contextual and cross-cycle reasoning, including credential theft, repeated compromise, concurrent attackers, and attacks against physical processes.

cs.CR↗

arXiv2026

Retrieval-Augmented LLMs for Security Incident Analysis

Investigating cybersecurity incidents requires collecting and analyzing evidence from multiple log sources, including intrusion detection alerts, network traffic records, and authentication events. This process is labor-intensive: analysts must sift through large volumes of data to identify relevant indicators and piece together what happened. We present a RAG-based system that performs security incident analysis through targeted query-based filtering and LLM semantic reasoning. The system uses a query library with associated MITRE ATT&CK techniques to extract indicators from raw logs, then retrieves relevant context to answer forensic questions and reconstruct attack sequences. We evaluate the system with eight LLM configurations on malware traffic incidents and a multi-stage Active Directory attack. We find that LLMs have different performance and tradeoffs, with Claude Sonnet 4 achieving 94% and DeepSeek V3 achieving 89% average recall across 17 malware scenarios, while DeepSeek costs 15$\times$ less than Claude per analysis, and locally-deployed Llama 3.1:70b achieves 81% recall at zero per-query cost. Attack step detection on the Active Directory scenario reaches 100% precision and up to 96% recall with an enumeration prompt. These results demonstrate that combining targeted query-based filtering with RAG-based retrieval -- confirmed essential by ablation studies -- enables accurate, cost-effective security analysis within LLM context limits.

cs.CR↗

arXiv2015

Is There WiFi Yet? How Aggressive WiFi Probe Requests Deteriorate Energy and Throughput

WiFi offloading has emerged as a key component of cellular operator strategy to meet the data needs of rich, mobile devices. As such, mobile devices tend to aggressively seek out WiFi in order to provide improved user Quality of Experience (QoE) and cellular capacity relief. For home and work environments, aggressive WiFi scans can significantly improve the speed on which mobile nodes join the WiFi network. Unfortunately, the same aggressive behavior that excels in the home environment incurs considerable side effects across crowded wireless environments. In this paper, we show through empirical studies at both large (stadium) and small (laboratory) scales how aggressive WiFi scans can have significant implications for energy and throughput, both for the mobile nodes scanning and other nearby mobile nodes. We close with several thoughts on the disjoint incentives for properly balancing WiFi discovery speed and ultra-dense network interactions.

cs.NI↗