6 Novembre 2026 | 14:30
DEIB - NECSTLab Meeting Room (Ed. 20)
Online by Zoom
Contatti: Prof. Marco Santambrogio
Sommario
On Friday, November 6th, 2026, we will have a new talk for the series #NECSTFridayTalk.During this talk, we will have, as speaker, Lorenzo Bossi, PhD student at Dipartimento di Elettronica, Informazione e Bioingegneria.
Passive monitoring of underground forums is increasingly inadequate for cyber threat intelligence (CTI) as valuable discussions migrate to less accessible spaces. We introduce DarkBot, to our knowledge the first multi-agent LLM system for active CTI elicitation in such forums. Its eleven agents operate across three stages: relevance and safety screening, MITRE ATT&CK-guided question generation, and linguistic style adaptation. In tests on 100 CrimeBB conversations, DarkBot recovered 72.8% of validated ATT&CK techniques using only each thread's initial post, outperforming a monolithic baseline. Its layered safeguards contained all injected jailbreak attempts at the pipeline level. In a prospective matched deployment, DarkBot threads gained 3.85 more CTI entities on average than controls over seven days. Across 104 live conversations, it elicited CTI-relevant disclosures without observed account suspensions, moderator interventions, or explicit accusations of automated participation.
The NECSTLab is a DEIB laboratory, with different research lines on advanced topics in computing systems: from architectural characteristics, to hardware-software codesign methodologies, to security and dependability issues of complex system architectures.
#NECSTLab #Computerscience
Every week, the “NECSTFridayTalk” invites researchers, professionals or entrepreneurs to share their work experiences and projects they are implementing in the “Computing Systems”.