arXiv subjects

John Bianchi

Publications and source records attributed to John Bianchi.

5 recordsLinked to original sources

arXiv2026

Automated Compliance Mapping in Cloud Security with Domain-Adapted Sentence Transformers

Mapping cloud security controls to technical metrics is currently a manual process. This paper proposes domain adaptation of Sentence Transformer models to automate it. We build a training corpus of 3,499 semantic pairs from five European security standards and a set of technical metrics, then expand it via back-translation and LLM-based paraphrasing to up to 13,996 samples across four scenarios. We fine-tune five architectures and evaluate their performance on two independent tasks: control-to-metric and cross-standard controls association. All fine-tuned models outperform their zero-shot baselines. On the control-to-metric task, the best model gains up to 23 nDCG@10 points, while on the cross-standard control task, \textit{multi-qa-mpnet-dot-v1} under back-translation reaches 0.870 nDCG@10. The results show that in-domain training data is a primary driver of performance for the considered case studies.

cs.CL↗

arXiv2025

Automatic Association of Cloud Security Controls and Quantifiable Metrics for Certification

The draft candidate European Cybersecurity Certification Scheme for Cloud Services (EUCS) defines security controls that must be associated with measurable metrics to assess compliance. This association process is currently manual, time-consuming, and prone to inconsistencies. In this paper, we propose an automated approach based on Sentence Transformers to associate cloud security controls with quantifiable metrics by leveraging semantic similarity between their textual descriptions. We evaluate our method on a dataset of 70 controls derived from the EUCS framework. The proposed approach outperforms a FastText-based baseline, achieving a conditional Normalized Discounted Cumulative Gain at rank 10 score of 0.640 (+0.146) and improving the standard nDCG@10 score from 0.275 to 0.504. These results demonstrate that contextual embedding models significantly enhance both the likelihood of retrieving relevant metrics and their ranking quality. Our findings highlight the potential of transformer-based methods to support automated, scalable, and more reliable compliance processes in cloud cybersecurity certification.

cs.CR↗

arXiv2024

Evaluation of Reliability Criteria for News Publishers with Large Language Models

In this study, we investigate the use of a large language model to assist in the evaluation of the reliability of the vast number of existing online news publishers, addressing the impracticality of relying solely on human expert annotators for this task. In the context of the Italian news media market, we first task the model with evaluating expert-designed reliability criteria using a representative sample of news articles. We then compare the model's answers with those of human experts. The dataset consists of 340 news articles, each annotated by two human experts and the LLM. Six criteria are taken into account, for a total of 6,120 annotations. We observe good agreement between LLM and human annotators in three of the six evaluated criteria, including the critical ability to detect instances where a text negatively targets an entity or individual. For two additional criteria, such as the detection of sensational language and the recognition of bias in news content, LLMs generate fair annotations, albeit with certain trade-offs. Furthermore, we show that the LLM is able to help resolve disagreements among human experts, especially in tasks such as identifying cases of negative targeting.

cs.SI↗

arXiv2024

Weaponizing Disinformation Against Critical Infrastructures

For nearly a decade, disinformation has dominated social debates, with its harmful impacts growing more evident. Episodes like the January 6 United States Capitol attack and the Rohingya genocide exemplify how this phenomenon has been weaponized. While considerable attention has been paid to its impact on societal discourse and minority persecution, there remains a gap in analyzing its role as a malicious hybrid tool targeting critical infrastructures. This article addresses this gap by presenting three case studies: a hypothetical scenario involving the electric grid, an attack on traffic management, and XZ Utils backdoor. Additionally, the study undertakes a criminological analysis to comprehend the criminal profiles driving such attacks, while also assessing their implications from a human rights perspective. The research findings highlight the necessity for comprehensive mitigation strategies encompassing technical solutions and crime prevention measures in order to safeguard critical infrastructures against these emerging threats.

cs.CR↗

arXiv2024

Evaluating Trustworthiness of Online News Publishers via Article Classification

The proliferation of low-quality online information in today's era has underscored the need for robust and automatic mechanisms to evaluate the trustworthiness of online news publishers. In this paper, we analyse the trustworthiness of online news media outlets by leveraging a dataset of 4033 news stories from 40 different sources. We aim to infer the trustworthiness level of the source based on the classification of individual articles' content. The trust labels are obtained from NewsGuard, a journalistic organization that evaluates news sources using well-established editorial and publishing criteria. The results indicate that the classification model is highly effective in classifying the trustworthiness levels of the news articles. This research has practical applications in alerting readers to potentially untrustworthy news sources, assisting journalistic organizations in evaluating new or unfamiliar media outlets and supporting the selection of articles for their trustworthiness assessment.

cs.IR↗