Xue Tan, Hao Luan, Mingyu Luo, Xiaoyan Sun, Ping Chen, Jun Dai. Findings of the Association for Computational Linguistics: EMNLP 2025. 2025.

With the rapid development of the Internet of Things (IoT), ensuring secure communication between devices has become a crucial challenge. This paper proposes a novel secure communication solution by extracting wireless channel state information (CSI) features from IoT devices to generate a device identity. Due to the instability of the wireless channel, the CSI features are fuzzy and time-varying; thus, we a employ locally sensitive hashing (LSH) algorithm to ensure the stability of the generated identity in a dynamically changing wireless channel environment. Furthermore, zero-knowledge proofs are utilized to guarantee the authenticity and effectiveness of the generated identity. Finally, the identity generated using the aforementioned approach is integrated into an IBE communication scheme, which involves the fuzzy extraction of channel state information from IoT devices, stable identity extraction for fuzzy IoT devices using LSH, and the use of zero-knowledge proofs to ensure the authenticity of the generated identity. This identity is then employed as the identity information in identity-based encryption (IBE), constructing the device’s public key for achieving confidential communication between devices.

In the face of escalating cyber threats to critical infrastructures, achieving robust cyber resilience has become paramount. This paper proposes an endogenous security-oriented framework for cyber resilience assessment, specifically tailored for critical infrastructures. Drawing on the principles of endogenous security, our framework integrates dynamic heterogeneous redundancy (DHR) and adaptive defense mechanisms to address both known and unknown threats. We model resilience across four key dimensions—Prevention, Destruction Resistance, Adaptive Recovery, and Evolutionary Learning—using a novel mathematical formulation that captures nonlinear interactions and temporal dynamics. The framework incorporates environmental threat entropy to dynamically adjust resilience scores, ensuring relevance in evolving attack landscapes. Through empirical validation on simulated critical infrastructure scenarios, we demonstrate the framework’s ability to quantify resilience trajectories and trigger timely defensive adaptations. Empiricalvalidation on a real-world critical infrastructure system yielded an overall resilience score of 82.75, revealing a critical imbalance between strong preventive capabilities (90/100) and weak Adaptive Recovery (66/100). Our approach offers a significant advancement over static risk assessment models by providing actionable metrics for strategic resilience investments. This work contributes to the field by bridging endogenous security theory with practical resilience engineering, paving the way for more robust protection of critical systems against sophisticated cyber threats.

This paper proposes a co-design adaptive defense scheme against a class of zero-day buffer over-read attacks that follow unknown stationary probability distributions. In particular, the co-design scheme integrates an improved UCB algorithm and a customized server. The improved UCB algorithm adaptively allocates guard pages on a heap based on induced damage of the guard pages so as to minimize the accumulated damage over time. The security damages of the improved UCB algorithm are proven to be always below a temporal bound without knowing which attack is launched when the buffer allocation follows a certain stationary probability distribution. Then an efficient server modification is introduced to randomly allocate buffers. Moreover, the damages of our scheme asymptotically converge to those of the optimal defense policy where the launched attacks and their distributions are known in advance. Further, the co-design scheme is evaluated with several real-world Heartbleed attacks. The experiment results demonstrate the validity of the upper bound and show that the adaptive defense is effective against all the attacks of interest with runtime overheads as low as 5%.

Programmable Logic Controllers (PLCs), widely used in industrial automation, are often programmed in IEC 61131-3 Structured Text (ST), which is prone to subtle logic vulnerabilities. Traditional tools like static analysis and fuzzing struggle with the complexity and domain-specific semantics of ST. This work explores Large Language Models (LLMs) for PLC vulnerability detection, supported by both theoretical insights and empirical validation. Theoretically, we prove that control flow features carry the most vulnerability-relevant information, establish a feature informativeness hierarchy, and derive sample complexity bounds. We also propose an optimal synthetic data mixing strategy to improve learning with limited supervision. Empirically, we build a dataset combining real-world and synthetic ST code with five vulnerability types. We fine-tune open-source LLMs (CodeLlama, Qwen2.5-Coder, Starcoder2) using LoRA, demonstrating significant gains in binary and multi-class classification. The results confirm our theoretical predictions and highlight the promise of LLMs for PLC security. Our work provides a principled and practical foundation for LLM-based analysis of cyber-physical systems, emphasizing the role of domain knowledge, efficient adaptation, and formal guarantees.

Yin Cai, Zhouhong Gu, Zhaohan Du, Zheyu Ye, Shaosheng Cao, Yiqian Xu, Hongwei Feng, Ping Chen. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers). 2025.