Abstract This paper presents a comprehensive framework for enhancing Cyber Threat Intelligence (CTI) analysis through a domain specific, security aware Retrieval Augmented Generation (RAG) architecture. It begins by defining CTI as the process of transforming raw cyber data into actionable intelligence, emphasizing its role in understanding adversarial Tactics, Techniques, and Procedures (TTPs) via structured knowledge bases like MITRE ATT&CK. The paper reviews the evolution of... This paper presents a comprehensive framework for enhancing Cyber Threat Intelligence (CTI) analysis through a domain specific, security aware Retrieval Augmented Generation (RAG) architecture. It begins by defining CTI as the process of transforming raw cyber data into actionable intelligence, emphasizing its role in understanding adversarial Tactics, Techniques, and Procedures (TTPs) via structured knowledge bases like MITRE ATT&CK. The paper reviews the evolution of CTI analysis from traditional rule based and machinelearning systems to modern Large Language Model (LLM) driven approaches highlighting persistent challenges such as hallucinations, a lack of contextual grounding, and vulnerability to adversarial manipulation in retrieval pipelines. Drawing on 2025 CrowdStrike threat data, the analysis reveals critical trends: a 27% year over year rise in interactive intrusions, 73.4% of which are financially motivated (eCrime), while 26.5% stem from nationstate actors targeting strategic sectors like Government (+126%), Telecommunications (+130%), and Industrials & Engineering (+185%). Opportunistic attacks declined by 12%, indicating a shift toward highvalue, precision targeting. These insights inform a proposed CTI RAG system that integrates real world threat statistics to enable sector aware retrieval, sector weighted ATT&CK alignment, and evidence grounded reasoning. Unlike generic or LLM-only baselines, this approach reduces the risk of hallucination, improves TTP accuracy, shortens analyst triage time, and enhances explainability by linking outputs directly to verified CTI sources and sectorspecific tactics. The architecture is designed as an end to end, modular pipeline supporting ingestion, semantic indexing, secure retrieval, grounded reasoning, and analyst feedback making it suitable for operational Security Operations Centers (SOCs). By unifying empirical threat trends, structured knowledge, and robust AI reasoning, the framework offers a scalable, trustworthy solution for next generation CTI that balances tactical eCrime defence with strategic awareness of nation state threats. Read More Read Less

Abstract This paper outlines a probabilistic intrusion detection and computer forensics framework tailored for cloud and networked environments. It addresses the limitations of traditional intrusion detection systems (IDSs), particularly the inefficacy of signature based methods against evolving threats such as polymorphic malware and advanced persistent threats (APTs). The proposed approach integrates Bayesian networks with an Improved Synthetic Weighted Naïve Bayes (ISWNB) classifier, which enhances detection... This paper outlines a probabilistic intrusion detection and computer forensics framework tailored for cloud and networked environments. It addresses the limitations of traditional intrusion detection systems (IDSs), particularly the inefficacy of signature based methods against evolving threats such as polymorphic malware and advanced persistent threats (APTs). The proposed approach integrates Bayesian networks with an Improved Synthetic Weighted Naïve Bayes (ISWNB) classifier, which enhances detection accuracy by incorporating attribute correlation and value sensitive weighting thereby relaxing the strict independence assumption of standard Naïve Bayes models. The methodology includes Bayesian fuzzy clustering for grouping cloud nodes based on behavioral similarity, followed by a two level classification using a Group Search- Gravitational optimized Support Vector Neural Network (GG-SVNN), as introduced in prior work by Tummalapalli (2021). Experimental evaluation was conducted on the KDD Cup 1999 dataset, with preprocessing steps including feature selection and discretization. Results show that ISWNB achieves an average classification accuracy of 98.76%, outperforming baseline models such as J48, standard Naïve Bayes, and other weighted variants. The system demonstrates strong performance against common attack types (DoS, Probe), but faces challenges with minority classes such as R2L and U2R due to dataset imbalance. Computational efficiency remains high, enabling near real time forensic analysis. The framework also emphasizes forensic integrity, aligning with standardized digital evidence handling procedures. Future work includes validation on modern datasets (e.g., NSL-KDD, CICIDS), integration with deep or ensemble learning, and incorporation of explainable AI (XAI) techniques to enhance interpretability in forensic investigations. Overall, the study advances scalable, accurate, and interpretable intrusion detection for dynamic cloud environments. Read More Read Less

Abstract The document explores the evolution and strategic importance of Enterprise Risk Management (ERM) in today's volatile global environment, emphasizing its shift from traditional, siloed risk approaches to an integrated, enterprise wide framework. ERM is presented not only as a tool for risk mitigation but also as a driver of value creation, innovation, and resilience particularly in sectors like energy undergoing digital and low carbon... The document explores the evolution and strategic importance of Enterprise Risk Management (ERM) in today's volatile global environment, emphasizing its shift from traditional, siloed risk approaches to an integrated, enterprise wide framework. ERM is presented not only as a tool for risk mitigation but also as a driver of value creation, innovation, and resilience particularly in sectors like energy undergoing digital and low carbon transitions. The integration of ERM with performance management systems, such as the Balanced Scorecard, is discussed, along with challenges such as professional tensions and difficulties in linking risk to performance outcomes. Digitalization emerges as a key enabler of modern ERM, enhancing real time monitoring, predictive analytics, and stakeholder collaboration especially in complex clean energy projects. Green Financial Innovation (GFI) is highlighted for its role in reducing technological and market risks while supporting sustainable financing. The core of the analysis focuses on cross border M&A in the energy sector and identifies six key risk categories. Market and integration risks are deemed most critical. Using Fuzzy Risk Assessment and Grey Relational Analysis, three M&A plans (A, B, C) are evaluated; Plan C consistently ranks as the least risky due to its low exposure to high weight risks. Sensitivity analysis confirms Plan C's robustness across varying risk weight scenarios. The study concludes that combining quantitative risk models with qualitative governance practices strengthens strategic decision making in uncertain, globalized markets. Read More Read Less