arXiv subjects

Qian Cui

Publications and source records attributed to Qian Cui.

10 recordsLinked to original sources

arXiv2026

Membership Determination of 45 Open Clusters Beyond 3 kpc

Context. Open clusters (OCs) are fundamental tracers for studying the structure and chemical evolution of the Galactic disc. Reliable identification of cluster members, particularly at the faint end of the main sequence, remains challenging owing to severe field-star contamination and the declining photometric completeness for distant, obscured systems. Aims. We aim to identify and characterise distant OC candidates at heliocentric distances $d \gtrsim 3$ kpc using Gaia DR3 astrometry, with emphasis on improving the recovery of faint candidate members in highly contaminated stellar fields. Methods. We apply a probabilistic membership method based on Gaia DR3 proper motions and parallaxes. Candidate members are selected through combined astrometric criteria and refined via spatial filtering using radial density profiles, with photometric data serving as a consistency check. For clusters affected by significant extinction, near-infrared photometry from 2MASS is incorporated to compensate for the limitations of optical data. Results. We analyse a sample of 45 targets, comprising 30 previously reported OCs and 15 newly identified candidates, all located at $d \gtrsim 3$ kpc. The method yields more compact astrometric distributions and improves the recovery of faint candidate members in several systems. However, residual field contamination remains non-negligible for the most obscured clusters projected against the Galactic plane. Conclusions. Gaia DR3 astrometry provides an effective basis for the exploratory identification and first-order characterisation of distant OC candidates. Dedicated near-infrared follow-up observations will be essential for robust membership assessment in high extincted regions.

astro-ph.GA↗

arXiv2026

BEACON: Behavior-Anchored Cross-Source Knowledge Graph Construction for Cyber Threat Intelligence

Cyber threat intelligence (CTI) is foundational to modern cyber defense, yet much of it resides in unstructured reports whose volume and heterogeneity far exceed manual analysis, motivating research on automatically constructing knowledge graphs from CTI reports. However, existing approaches mainly extract partial information within a single report, leaving the cross-source setting unexplored, where the same threat is given unrelated names. Our key insight is that attack behaviors, once mapped to MITRE ATT&CK (a standardized catalog of attack techniques), can anchor the rest of a report. Attack behaviors are the adversarial actions a report describes, while contextual entities (e.g., threat actors, campaigns, and affected products) and Indicators of Compromise (IoCs; e.g., IP addresses) are their participants and traces. Attaching them to these anchors places every per-report graph in one canonical space. We realize this insight in BEACON, an LLM-driven framework for cross-source CTI knowledge graph construction. Its first stage extracts each report into a graph under a propose-then-verify paradigm, grounding candidates in report evidence and official ATT&CK definitions, to suppress LLM misclassification and hallucination. Its second stage merges these graphs with a hierarchical alignment strategy that applies signals in decreasing order of determinism, from character-level and semantic similarity to overlapping technique neighborhoods, iterating as merges pool neighborhoods. No existing benchmark links entities to technique anchors or provides cross-source alignment ground truth. We therefore construct and release two human-annotated datasets from 34 sources: to our knowledge the largest for report-level CTI extraction (8,395 elements) and the first for cross-source consolidation (3,487). On them, BEACON outperforms all baselines by at least 23% and 9%, respectively.

cs.CR↗

arXiv2026

CTIFoundry: An Agent-Native Corpus Scaffold for Cyber Threat Intelligence

Cyber threat intelligence (CTI) is increasingly consumed not by human analysts but by LLM agents that compose multi-step investigations at query time. The harness side of this shift has matured rapidly (planning loops, tool protocols, context management), but the corpus side has not: threat reports and vulnerability databases are still packaged for retrieval-augmented generation, as opaque chunks behind an embedding index. We argue that this substrate, not model capability, is the bottleneck on agentic CTI investigation, and present CTIFoundry, an agent-native corpus scaffold. At build time, CTIFoundry materializes the latent structure of a CTI corpus: a deterministic ontology graph over four authoritative knowledge bases (CVE, CWE, CAPEC, ATT&CK) whose official cross-references become typed, traversable edges; a span-grounded report layer whose canonical, alias-resolved cross-vendor entities index provenance-carrying chunks; and hybrid dense+lexical retrieval surfaces. At query time this structure is exposed through seven typed tools and three procedural skills mounted on a stock open-source agent harness. On the public CTIConnect benchmark, swapping only the action surface lifts the identically-harnessed agent by +0.19 to +0.28 overall F1 across a four-model, two-provider panel: a small model on CTIFoundry surpasses a flagship on the flat substrate, and the gain is not bought with search effort, since on both Claude models the scaffolded agent is more accurate at roughly half the tool calls. An ablation attributes it: typed structure carries the larger share, procedural skills convert structure into discipline, and the two compose super-additively, because skills bind only to structure that exists.

cs.AI↗

arXiv2026

TTPrint: Evidence-Grounded TTP Extraction via Diverge-then-Converge Verification

Extracting MITRE ATT&CK techniques from cyber threat intelligence (CTI) reports is an open-set, multi-label problem requiring both high recall (not missing techniques) and high precision (not hallucinating unsupported ones). Existing methods--rule-based, supervised, and LLM-based--struggle to achieve both: rule-based and supervised approaches lack generalizability across diverse attack descriptions, while LLM-based approaches that couple candidate generation and validation within a single inference step suffer from limited recall and precision simultaneously. We propose TTPrint, which addresses this challenge through a diverge-then-converge design inspired by how human analysts work: first extracting broadly, then verifying rigorously. In the divergent phase, reports are decomposed into atomic behaviors and candidate techniques are proposed broadly. A deterministic span localization stage then anchors each candidate to a specific evidence window in the source text. A convergent verification stage retains only candidates supported by both the localized evidence and the authoritative MITRE definition. We contribute two evaluation resources--a cleaned TRAM benchmark (TRAM-Clean) and a new annotated dataset (TTPrint-Bench)--to address known annotation noise in existing benchmarks and elevate the task to document-level TTP extraction. On TRAM-Clean and TTPrint-Bench, TTPrint achieves 76.48% and 87.39% macro-F1 respectively, outperforming the leading baseline by 63.5% and 29.4%. A multi-backbone analysis across six LLMs and a threshold sensitivity study further demonstrate generalizability across model choices and provide practical guidance for parameter selection.

cs.CR↗

arXiv2026

Star formation in the circumgalactic high-velocity cloud Complex H

The accretion of metal-poor gas sustains galactic star formation. In the Milky Way, this process is fueled by high-velocity clouds (HVCs), yet their fundamental properties have remained elusive in the absence of stellar tracers. Here we report a binary open cluster within HVC Complex H. With an age of 11.2 +- 0.6 Myr and a subsolar metallicity of 0.05(+0.05-0.02) Zsun, the clusters provide a direct stellar distance anchor to the cloud at 13.8 +- 0.6 kpc. Their proper motions indicate Complex H is on a prograde, south-to-north orbit through the outer Galactic disk. The resulting interaction produces a 'slow-fast-slow' velocity gradient, with the cloud's outer layers decelerating as they merge into the disk. Orbit integration suggests the clusters formed from an internal cloud-cloud collision. This triggering mechanism implies other HVCs could similarly produce high-velocity stars. The scarcity of previous stellar detections in HVCs is explained by the rapid escape of young stars (< 20 Myr), while CO non-detections may stem from weak emission due to low metallicity and gas dispersal. This work reveals that the circumgalactic medium can sustain star formation, offering a tangible laboratory to probe the physical conditions of accreting gas before it merges with the Galactic disk.

astro-ph.GA↗

arXiv2025

Gaia DR3 Open Cluster Cepheids: A Unified Catalog with Calibrated Period-Age and Period-Wesenheit Relations

Classical Cepheids (CCs) in Galactic open clusters (OCs) provide essential observational constraints for calibrating the period-age relation (PAR) and the period-Wesenheit relation (PWR) of CCs. However, distant and long-period OC Cepheids remain limited, while the confirmed samples still require more precise determinations of their physical properties, such as ages and extinctions. In this work, we present a comprehensive census of OC Cepheids based on an extensive sample of distant OCs from Gaia Data Release 3 (DR3). By combining astrometric and photometric membership analyses, we identified 110 CCs associated with 102 OCs, of which 41 CCs across 37 OCs were classified as OC Cepheids, while the remaining cases were considered candidate or rejected associations. Our results are consistent with previous studies, while 4 of the 41 OC Cepheids are newly reported here. Using updated cluster parameters derived from manual isochrone fitting, we primarily refined the PAR to log Age = (-0.595 $\pm$ 0.044) log P + (8.430 $\pm$ 0.042) and recalibrated the PWR to WG = (-3.615 $\pm$ 0.083) log P + (-2.379 $\pm$ 0.096). This study expands the sample of confirmed and candidate OC Cepheids. The newly longest-period confirmed OC Cepheid is BM Per (CWNU 3123) with log P = 1.36, and two newly discovered OC Cepheid candidates have distances exceeding 6 kpc. Moreover, the PAR and PWR are improved by incorporating refined OC ages and updated parallaxes, respectively.

astro-ph.SR↗

arXiv2025

Contextual Learning for Anomaly Detection in Tabular Data

Anomaly detection is critical in domains such as cybersecurity and finance, especially when working with large-scale tabular data. Yet, unsupervised anomaly detection-where no labeled anomalies are available-remains challenging because traditional deep learning methods model a single global distribution, assuming all samples follow the same behavior. In contrast, real-world data often contain heterogeneous contexts (e.g., different users, accounts, or devices), where globally rare events may be normal within specific conditions. We introduce a contextual learning framework that explicitly models how normal behavior varies across contexts by learning conditional data distributions $P(\mathbf{Y} \mid \mathbf{C})$ rather than a global joint distribution $P(\mathbf{X})$. The framework encompasses (1) a probabilistic formulation for context-conditioned learning, (2) a principled bilevel optimization strategy for automatically selecting informative context features using early validation loss, and (3) theoretical grounding through variance decomposition and discriminative learning principles. We instantiate this framework using a novel conditional Wasserstein autoencoder as a simple yet effective model for tabular anomaly detection. Extensive experiments across eight benchmark datasets demonstrate that contextual learning consistently outperforms global approaches-even when the optimal context is not intuitively obvious-establishing a new foundation for anomaly detection in heterogeneous tabular data.

cs.LG↗

arXiv2025

Census of Blue Straggler Stars in Distant Open Clusters and Maximum Fractional Mass Excess of OC BSS

We identified blue straggler stars (BSSs) in 53 open clusters utilizing data from Gaia DR3. Most of these clusters are situated in the outer regions of the Galactic disc, encompassing structures such as the warp and the Outer arm. We analyzed their astrometric parameters and determined that 48 of them demonstrate high reliability in radial density profile. Furthermore, through manual isochrone fitting and visual inspection, we confirmed 119 BSS candidates and identified 328 additional possible candidates within these clusters. Our results contribute to a 46% increase in the sample size of BSSs in open clusters for regions of the Galactic disc where Rgc > 12 kpc. We observed that the new samples are fainter compared to those identified in the past. Additionally, we investigated the maximum fractional mass excess (Me) of the BSSs in open clusters, including previously published BSS samples. Our findings indicate a strong correlation between the capability to produce highest-Me BSSs and the mass of their host clusters. This observation appears to reinforce a fundamental principle whereby an increase in the mass of a star cluster correlates with a higher likelihood of stellar mergers. In contrast, we observe minimal correlation between maximum-Me and the cluster age. Among clusters containing BSSs, younger clusters (0.5 to 1 Gyr) display a scarcity of high-Me BSSs. This scarcity may be attributed to the absence of more massive clusters within this age range.

astro-ph.SR↗

arXiv2024

Basket-Enhanced Heterogenous Hypergraph for Price-Sensitive Next Basket Recommendation

Next Basket Recommendation (NBR) is a new type of recommender system that predicts combinations of items users are likely to purchase together. Existing NBR models often overlook a crucial factor, which is price, and do not fully capture item-basket-user interactions. To address these limitations, we propose a novel method called Basket-augmented Dynamic Heterogeneous Hypergraph (BDHH). BDHH utilizes a heterogeneous multi-relational graph to capture the intricate relationships among item features, with price as a critical factor. Moreover, our approach includes a basket-guided dynamic augmentation network that could dynamically enhances item-basket-user interactions. Experiments on real-world datasets demonstrate that BDHH significantly improves recommendation accuracy, providing a more comprehensive understanding of user behavior.

cs.IR↗

arXiv2023

Survey for Distant Stellar Aggregates in Galactic Disk: Detecting Two Thousand Star Clusters and Candidates, along with the Dwarf Galaxy IC10

Despite having data for over 10^9 stars from Gaia, only less than 10^4 star clusters and candidates have been discovered. Particularly, distant star clusters are rarely identified, due to the challenges posed by heavy extinction and great distance. However, Gaia data has continued to improve, enabling even fainter cluster members to be distinguished from field stars. In this work, we will introduce a star cluster search method based on the DBSCAN algorithm; we have made improvements to make it better suited for identifying clusters on dimmer and more distant stars. After removing member stars of known Gaia-based clusters, we have identified 2086 objects with |b|<10 deg, of which 1488 are highly reliable open star clusters, along with 569 candidates, 28 globular cluster candidates and 1 irregular galaxy IC 10 at low Galactic latitudes. We found that the proper motion of IC10 is similar yet slightly different from the water maser observations, which is an important result for the comparison with Gaia and VLBA. Besides, when compared with the star clusters appearing in Gaia DR2/EDR3, we have found nearly three times as many new objects above a distance of 5 kpc, including hundreds of them above Av > 5 mag. And it has enabled us to detect a higher number of old clusters, over a billion years old, that are difficult to detect due to observational limitations. Our findings significantly expand the remote cluster sample and enhance our understanding of the limits of Gaia DR3 data in stellar aggregates research. The full figure set for 2085 clusters can be seen in \url{https://nadc.china-vo.org/res/r101258/}

astro-ph.GA↗