BioEnvSense: A Human-Centred Security Framework for Preventing Behaviour-Driven Cyber Incidents

Duy Anh Ta; Farnaz Farid; Farhad Ahamed; Ala Al-Areqi; Robert Beutel; Tamara Watson; Alana Maurushat

cs.CRFeb 23, 2026

BioEnvSense: A Human-Centred Security Framework for Preventing Behaviour-Driven Cyber Incidents

Authors: Duy Anh Ta, Farnaz Farid, Farhad Ahamed, Ala Al-Areqi, Robert Beutel, Tamara Watson, Alana Maurushat

Organizations: School of Computer, Data and Mathematical Sciences Western Sydney University · School of Social Sciences Western Sydney University

Abstract

Modern organizations increasingly face cybersecurity incidents driven by human behaviour rather than technical failures. To address this, we propose a conceptual security framework that integrates a hybrid Convolutional Neural Network-Long Short-Term Memory (CNN-LSTM) model to analyze biometric and environmental data for context-aware security decisions. The CNN extracts spatial patterns from sensor data, while the LSTM captures temporal dynamics associated with human error susceptibility. The model achieves 84% accuracy, demonstrating its ability to reliably detect conditions that lead to elevated human-centred cyber risk. By enabling continuous monitoring and adaptive safeguards, the framework supports proactive interventions that reduce the likelihood of human-driven cyber incidents

Cybersecurity

Cybersecurity develops methods to protect digital and cyber-physical systems from attacks, vulnerabilities, data loss, and misuse.

See all 354 papers

Policy-Guided Threat Hunting: An LLM enabled Framework with Splunk SOC Triage
Mar 25, 2026Rishikesh Sahay, Bell Eapen, Weizhi Meng +5Autonomous Cyber Defense
Department of Management Information Systems, University of Illinois, Springfield, USA · School of Computing and Communications, Lancaster University, United Kingdom · School of Computer Applications, Kalinga Institute of Industrial Technology, India +1
LiaisonAgent: An Multi-Agent Framework for Autonomous Risk Investigation and Governance
Feb 27, 2026Chuanming Tang, Ling Qing, Shifeng ChenAutonomous Cyber Defense Multi-Agent Systems
Shenzhen Institute of Advanced Technology, CAS · Sangfor Technologies Inc. · College of Management Science +2
SentinelSphere: Integrating AI-Powered Real-Time Threat Detection with Cybersecurity Awareness Training
Apr 8, 2026Nikolaos D. Tantaroudas, Ilias Karachalios, Andrew J. McCrackenCybersecurity Network Intrusion Detection
Institute of Communications and Computer Systems (ICCS), National Technical University of Athens, Iroon Polytechneiou 9, 15773 Zografou, Athens, Greece · National Technical University of Athens, Leof. Alimou, Katechaki, Zografou, 15772 Athens, Greece · DASKALOS-APPS, 183 Rue de l’Abbé Griffon, 01960 Péronnas, France

Mar 25, 2026J/K move · Enter open · S save

Policy-Guided Threat Hunting: An LLM enabled Framework with Splunk SOC Triage

Rishikesh Sahay, Bell Eapen, Weizhi Meng, Md Rasel Al Mamun+4

Department of Management Information Systems, University of Illinois, Springfield, USA · School of Computing and Communications, Lancaster University, United Kingdom · School of Computer Applications, Kalinga Institute of Industrial Technology, India+1

Autonomous Cyber Defense

Open paper AskPDF arXiv

With frequently evolving Advanced Persistent Threats (APTs) in cyberspace, traditional security solutions approaches have become inadequate for threat hunting for organizations. Moreover, SOC (Security Operation Centers) analysts are often overwhelmed and struggle to analyze the huge volume of logs received from diverse devices in organizations. To address these challenges, we propose an automated and dynamic threat hunting framework for monitoring evolving threats, adapting to changing network conditions, and performing risk-based prioritization for the mitigation of suspicious and malicious traffic. By integrating Agentic AI with Splunk, an established SIEM platform, we developed a unique threat hunting framework. The framework systematically and seamlessly integrates different threat hunting modules together, ranging from traffic ingestion to anomaly assessment using a reconstruction-based autoencoder, deep reinforcement learning (DRL) with two layers for initial triage, and a large language model (LLM) for contextual analysis. We evaluated the framework against a publicly available benchmark dataset, as well as against a simulated dataset. The experimental results show that the framework can effectively adapt to different SOC objectives autonomously and identify suspicious and malicious traffic. The framework enhances operational effectiveness by supporting SOC analysts in their decision-making to block, allow, or monitor network traffic. This study thus enhances cybersecurity and threat hunting literature by presenting the novel threat hunting framework for security decision-making, as well as promoting cumulative research efforts to develop more effective frameworks to battle continuously evolving cyber threats.

Abstract

Cybersecurity

Explore similar work

Policy-Guided Threat Hunting: An LLM enabled Framework with Splunk SOC Triage

LiaisonAgent: An Multi-Agent Framework for Autonomous Risk Investigation and Governance

SentinelSphere: Integrating AI-Powered Real-Time Threat Detection with Cybersecurity Awareness Training