Research
Papers written by our engineers. Our own reports are free to read in full; papers published elsewhere carry the abstract and a link to the publisher. Every one can be cited.
- 01Enhancing Cybersecurity Incident Response Efficiency Through Autonomous Agentic AI: Design, Implementation, and Evaluation with Wazuh SIEMMohamad Nour Shahin, Ruslan DamindarovSVCC 2026AbstractSecurity Operations Centers (SOCs) increasingly struggle with high alert volumes, limited analyst capacity, and strict mean-time-to-respond (MTTR) targets in industrial environments. This paper evaluates an AI-assisted incident-response workflow that integrates the Wazuh Security Information and Event Management (SIEM) platform with an AI assistant through a Model Context Protocol (MCP) server. In Phase 0, we establish a manual baseline: a human analyst triages alerts and writes incident reports for controlled attack scenarios deployed on Amazon Web Services (AWS) hosts protected by Wazuh agents, achieving 83.33% detection rate, 10.04 minutes average analysis time, 846 minutes dwell time, and 804 minutes MTTR. In Phase 1, the same scenarios are executed with AI assistance that uses MCP tools to query the Wazuh manager, enrich alerts, and generate structured incident reports, resulting in 91.67% detection rate (+8.34 percentage points), 1.23 minutes analysis time (−88%), 222 minutes MTTR (−72%), and 222 minutes dwell time (−74%) compared to Phase 0. In Phase 2, we extend the system with fully automated active-response capabilities, including IP blocking, account disabling, automated metrics tracking, and automatic reporting to the SOC engineer. Under this configuration, the system achieves 0.15 minutes average analysis time (98.5% faster than Phase 0), 15.2 minutes MTTR (98.1% faster than Phase 0), and 13.9 minutes dwell time (98.4% faster than Phase 0), with 87.50% precision and an 8.33% false-positive rate, both better than earlier phases. We measure key operational metrics, including mean time to detect (MTTD), analysis time, mean time to acknowledge (MTTA), mean time to respond (MTTR), detection quality, and attacker dwell time. The results confirm that MCP-based AI support can significantly improve analyst efficiency, response speed, and risk exposure, and that fully automated MCP-driven response further optimizes MTTR and dwell time, provided adequate SIEM rule coverage is in place.·SVCC 2026Enhancing Cybersecurity Incident Response Efficiency Through Autonomous Agentic AI: Design, Implementation, and Evaluation with Wazuh SIEMMohamad Nour Shahin and Ruslan DamindarovSecurity Operations Centers (SOCs) increasingly struggle with high alert volumes, limited analyst capacity, and strict mean-time-to-respond (MTTR) targets in industrial environments. This paper evaluates an AI-assisted incident-response workflow that integrates the Wazuh Security Information and Event Management (SIEM) platform with an AI assistant through a Model Context Protocol (MCP) server. In Phase 0, we establish a manual baseline: a human analyst triages alerts and writes incident reports for controlled attack scenarios deployed on Amazon Web Services (AWS) hosts protected by Wazuh agents, achieving 83.33% detection rate, 10.04 minutes average analysis time, 846 minutes dwell time, and 804 minutes MTTR. In Phase 1, the same scenarios are executed with AI assistance that uses MCP tools to query the Wazuh manager, enrich alerts, and generate structured incident reports, resulting in 91.67% detection rate (+8.34 percentage points), 1.23 minutes analysis time (−88%), 222 minutes MTTR (−72%), and 222 minutes dwell time (−74%) compared to Phase 0. In Phase 2, we extend the system with fully automated active-response capabilities, including IP blocking, account disabling, automated metrics tracking, and automatic reporting to the SOC engineer. Under this configuration, the system achieves 0.15 minutes average analysis time (98.5% faster than Phase 0), 15.2 minutes MTTR (98.1% faster than Phase 0), and 13.9 minutes dwell time (98.4% faster than Phase 0), with 87.50% precision and an 8.33% false-positive rate, both better than earlier phases. We measure key operational metrics, including mean time to detect (MTTD), analysis time, mean time to acknowledge (MTTA), mean time to respond (MTTR), detection quality, and attacker dwell time. The results confirm that MCP-based AI support can significantly improve analyst efficiency, response speed, and risk exposure, and that fully automated MCP-driven response further optimizes MTTR and dwell time, provided adequate SIEM rule coverage is in place.Incident responseSIEMAgentic AIModel Context ProtocolSecurity operations
- 02
·Technical reportCyberNet: A Scenario-Based Web Serious Game for Everyday Cybersecurity AwarenessMohammad JaafarCybersecurity breaches often result from human decisions rather than technical failures, yet traditional awareness training, delivered through static e-learning and compliance courses, rarely holds attention or changes behaviour. This paper designs, implements, and evaluates CyberNet, a scenario-based web serious game that encodes five everyday threats (phishing, password choice, voice phishing, removable-media baiting, and public Wi-Fi exposure) as short branched decisions with narrated outcomes and debriefs, grounded in the MDA, MOTENS, and Garris frameworks. The five concept areas map onto a ten-item knowledge test, two items each. In a single-group, within-subjects, pre- and post-test study with N = 102 participants, mean accuracy rose from 54.80% to 77.75%, a gain of 22.94 percentage points (paired Cohen's d = 1.07, p < 0.001), and all five concepts reached family-wise significance under Holm–Bonferroni correction, with effects from d = 0.39 (vishing) to d = 0.85 (password). Confidently-incorrect answers fell from 39.8% to 20.3%, and moved into confident-correct rather than uncertainty. An eleven-item engagement survey scored high but did not correlate with the knowledge gain. The paper contributes a review of serious games for cybersecurity awareness, the deployed prototype released as an anonymous study instrument, empirical evidence from a within-subjects study, and a presentation-layer instrument that evaluates narration, music, and visual design as a distinct dimension. Limitations of the single-session design and three extensions (a control group, a delayed-retention follow-up, and a post-debrief behavioural probe) are discussed.Serious gamesCybersecurity awarenessHuman factorsUser study - 03Formulation of the Maximum Independent Set Problem on QDeep Hybrid Solver: Benchmarking Quantum Solutions on Real-World GraphsMahmoud Naderi, Mohammad Jaafar, Haydar Sarhan, Marko Pezer, Muhammad Naveed Zafar, Manuel MazzaraAINA 2026AbstractThe Maximum Independent Set (MIS) problem is a fundamental NP-hard problem with widely known applications in network science, scheduling, bioinformatics, and combinatorial optimization. Recent advances in hybrid quantum–classical computing have introduced new opportunities for solving large-scale discrete optimization problems through Quadratic Unconstrained Binary Optimization (QUBO) formulations. In this work, we investigate the performance of the QDeep QonQuester Cloud platform, a secure hybrid quantum–classical optimization system, for solving MIS instances of varying scales and graph densities. We encode MIS as a QUBO problem and evaluate QDeep’s black-box solver selection mechanism, which automatically chooses between quantum, heuristic, and classical backends based on input structure. Our work highlights the strengths and limitations of hybrid QUBO-based solvers for combinatorial graph problems and provides insights for applying quantum-ready optimization tools to MIS and related NP-hard problems. The results indicate that hybrid approaches – such as QDeep – offer a practical pathway toward using quantum computing concepts for real-world optimization tasks before full-scale quantum hardware becomes widely available.·AINA 2026Formulation of the Maximum Independent Set Problem on QDeep Hybrid Solver: Benchmarking Quantum Solutions on Real-World GraphsMahmoud Naderi, Mohammad Jaafar, Haydar Sarhan, Marko Pezer, Muhammad Naveed Zafar, and Manuel MazzaraThe Maximum Independent Set (MIS) problem is a fundamental NP-hard problem with widely known applications in network science, scheduling, bioinformatics, and combinatorial optimization. Recent advances in hybrid quantum–classical computing have introduced new opportunities for solving large-scale discrete optimization problems through Quadratic Unconstrained Binary Optimization (QUBO) formulations. In this work, we investigate the performance of the QDeep QonQuester Cloud platform, a secure hybrid quantum–classical optimization system, for solving MIS instances of varying scales and graph densities. We encode MIS as a QUBO problem and evaluate QDeep’s black-box solver selection mechanism, which automatically chooses between quantum, heuristic, and classical backends based on input structure. Our work highlights the strengths and limitations of hybrid QUBO-based solvers for combinatorial graph problems and provides insights for applying quantum-ready optimization tools to MIS and related NP-hard problems. The results indicate that hybrid approaches – such as QDeep – offer a practical pathway toward using quantum computing concepts for real-world optimization tasks before full-scale quantum hardware becomes widely available.Maximum independent setQUBOHybrid quantum–classical optimisationCombinatorial optimisation
- 04Quantum Microservices: Transforming Software Architecture with Quantum ComputingSuleiman Karim Eddin, Hadi Salloum, Mohamad Nour Shahin, Badee Salloum, Manuel Mazzara, Mohammad Reza BahramiAINA 2024AbstractThis paper conducts an exhaustive exploration of the evolutionary journey of microservices within the domain of software architecture. It meticulously traces the historical trajectory, current status, and potential future pathways of microservices in software design. Additionally, this study introduces a pioneering concept known as Quantum Microservices. Quantum Microservices represent a novel approach aimed at augmenting software design by leveraging concepts from quantum computing. In this paper, we will delve into defining their architecture, core features, challenges, and future prospects. This study envisions their pivotal role in reshaping the landscape of software development by offering enhanced efficiency and innovation opportunities.·AINA 2024Quantum Microservices: Transforming Software Architecture with Quantum ComputingSuleiman Karim Eddin, Hadi Salloum, Mohamad Nour Shahin, Badee Salloum, Manuel Mazzara, and Mohammad Reza BahramiThis paper conducts an exhaustive exploration of the evolutionary journey of microservices within the domain of software architecture. It meticulously traces the historical trajectory, current status, and potential future pathways of microservices in software design. Additionally, this study introduces a pioneering concept known as Quantum Microservices. Quantum Microservices represent a novel approach aimed at augmenting software design by leveraging concepts from quantum computing. In this paper, we will delve into defining their architecture, core features, challenges, and future prospects. This study envisions their pivotal role in reshaping the landscape of software development by offering enhanced efficiency and innovation opportunities.MicroservicesSoftware architectureDistributed systemsQuantum computing