DSN-2025: Accepted Tutorials

Title: Generative AI in Cybersecurity: Generating Offensive Code from Natural Language
Speakers: Pietro Liguori, Roberto Natella, Domenico Cotroneo (Università degli Studi di Napoli Federico II, Italy)
Overview
This tutorial we introduce recent advances and open challenges in Generative AI for Cybersecurity, focusing on AI Code Generators. The presentation will highlight practical applications of AI in cybersecurity, demonstrating how AI-generated code can be used in the generation of code for o5ensive security purposes.

We will examine datasets to illustrate the generation of security exploits. Then, we will discuss evaluation methodologies for AI Code Generators, with focus on the assessment of AI-generated code using automated techniques. We will then consider prompt engineering techniques for optimizing AI Code Generators. Finally, we will analyze the role of data processing and data augmentation, showcasing how these methods enhance the accuracy of AI Code Generators in security contexts.

By providing a comprehensive overview of AI's role in cybersecurity, participants will gain valuable insights into the future of automated o5ensive security practices and the critical importance of thorough assessment to ensure the reliability of AI-generated code.

Outline
First part (1.5 hours):
- Introduction to AI Code Generators and applications to cybersecurity (15 min)
- Basic concepts on Large Language Models (15 min)
- Datasets for AI Code Generators (20 min)
- Metrics and techniques for the evaluation of AI-generated code (40 min)
Break (0.5 hours)
Second part (1.5 hours)
- Prompt Engineering for O5ensive Code Generation (20 min)
- Data Augmentation for O5ensive Code Generation (20 min)
- Practical experiments with O5ensive Code Generation (40 min)
Title: Quantum Computing and Post-Quantum Cryptography: Preparing for the Next Era of Cybersecurity
Speakers: Hazel Murray, George O’Mahony, Anila Mjeda (Department of Computer Science Munster Technological University Cork, Ireland)
Overview
Quantum computing is emerging as a disruptive force in cybersecurity, offering both new opportunities and substantial threats. While quantum systems hold the promise of solving computational problems far beyond the capabilities of classical computers, they also pose existential risks to modern cryptographic protocols. The ability of quantum algorithms, such as Shor’s and Grover’s algorithms, to break widely used encryption schemes necessitates an urgent shift towards post-quantum cryptography (PQC).

This half-day tutorial will begin with an introductory lecture on the fundamentals of quantum computing, its implications for cybersecurity, and the challenges posed by quantum algorithms to classical cryptographic systems. This will be followed by an exploration of the current state of quantum software, including its pain points, development environments, programming frameworks, and providing an interactive demonstration of quantum programming. Finally, the tutorial will conclude with an in-depth discussion of post-quantum cryptography (PQC), its emerging standards, and strategies for transitioning security infrastructures to quantum-resistant cryptographic algorithms.

Attendees will gain a practical understanding of quantum computing’s capabilities, limitations, and impact on cybersecurity.
Outline
Introduction to quantum computing - 30 minutes
- The tutorial will introduce the foundational principles of quantum computing, explaining key concepts such as qubits, superposition, entanglement, and quantum gates in an accessible way. This session will also outline the computational advantages of quantum computing over classical systems, highlighting its ability to solve problems exponentially faster than conventional hardware.
Impact of quantum computing on cybersecurity - 40 minutes
- Quantum computing presents both risks and opportunities for cybersecurity. On the one hand, quantum algorithms like Shor’s and Grover’s threaten classical cryptographic systems by breaking public-key encryption and weakening symmetric encryption, necessitating the shift to post-quantum cryptography. On the other hand, quantum principles offer new security mechanisms, such as Quantum Key Distribution (QKD), which ensures secure communication through the no-cloning theorem, and zero-knowledge proofs, which enhance authentication without exposing sensitive data. This session will explore both the cybersecurity challenges posed by quantum computing and the potential strengths of quantum cryptographic techniques, providing a strategic perspective on securing systems in the quantum era.
Quantum software engineering - 40 minutes
- This session will explore the landscape of quantum software development, focusing on quantum software engineering quality issues, the latest advancements in quantum software testing, and the tools and frameworks that enable quantum computing applications. Participants will be introduced to quantum programming languages such as Qiskit and Cirq, which provide the foundation for designing and executing quantum algorithms as well as quantum software in general. The session will also examine quantum development environments (IDEs), including Jupyter-based tools and emerging commercial quantum IDEs, which facilitate coding, visualization, and debugging of quantum programs. Finally, the session will address the challenges of quantum software quality and verification, discussing the state of the art in quantum software testing. Given the inherent noise and instability in quantum hardware, ensuring reliable computation remains a major challenge, and ongoing research is focused on improving error correction and sound software engineering approaches.
Demonstration of quantum programming - 40 minutes
- Through a live demonstration, we will explore quantum programming concepts, highlighting key differences and commonalities between quantum and classical computation. The session will showcase the process of writing and executing basic quantum programs, constructing quantum circuits, and applying fundamental quantum gates to illustrate superposition and entanglement in action. This demonstration will provide an intuitive understanding of how quantum algorithms operate.
Demonstration of quantum programming - 30 minutes
- As quantum computing advances, the urgency for quantum-resistant cryptographic methods grows. This session will explore post-quantum cryptography (PQC), introducing key algorithms such as lattice-based, hash-based, code-based, and multivariate cryptographic approaches, focusing on those selected in the NIST PQC standardization process. This session will examine the challenges of PQC adoption, including performance trade-offs, system compatibility, and migration risks, as well as the role of hybrid cryptographic models in easing the transition. The session will also highlight real-world efforts by governments and industries to implement quantum-safe encryption providing insight into how organizations can future-proof the security and dependability of infrastructures for a post-quantum future.
Title: Benchmarking of AI Agents for IT Automation Tasks using ITBench
Speakers: Rohan Arora, Saurabh Jha, (IBM Research, Yorktown Heights, USA)
Overview
This tutorial will introduce attendees to ITBench, primarily focusing on site reliability engineering (SRE). Participants will learn how to use ITBench to benchmark and improve AI agents for site reliability engineering (SRE), compliance and security operations (CISO), and financial operations (FinOps) tasks. The hands-on tutorial will guide participants through the fundamentals of modern IT management challenges, explore how large language models (LLMs) and AI agents can transform IT operations, and provide practical experience with ITBench. Through guided exercises, attendees will be able to contribute SRE scenarios into ITBench and build effective AI agents capable of handling such scenarios. This exercise of deploying AI agents will help participants uncover limitations of current agentic AI approaches to advance the state-of-the-art in automated IT operations. The tutorial targets researchers and practitioners in dependable systems with basic knowledge of AI/LLM technologies. We also look forward to feedback on improving ITBench to help us enable community contributions at scale.
Attendees will learn:
- Real-world challenges in IT automation and how to address them
- Building AI agents for IT automation and evaluating them
- Creating realistic scenarios for IT automation tasks
Outline
IT Automation Challenges—30 minutes
- Complexity of modern IT systems
- Domain-specific (SRE, CISO, FinOps) challenges
- State-of-the-art approaches: AI and heuristics
ITBench: Overview, Architecture, and Principles—30 minutes
- Framework architecture: open and extensible
- Benchmark scenarios
- Evaluation methodologies
Large Language Models (LLMs) and Agents—45 minutes
- LLMs: overview
- Agents: overview
- Leveraging SREAgent, an existing open-source agent
Break—15 minutes Hands-On Session—75 minutes
- Environment setup
- Running an existing scenario, with an agent attempting to resolve it
- Contributing a *new* scenario
Community Contributions and Feedback—15 minutes
- Q&A session
Title: Decentralized Federated Learning: Enhancing Reliability with Blockchain
Speakers: Antonella Del Pozzo, Maxence Perion, (Universite ́ Paris-Saclay, CEA, List, France)
Overview
The goal of this tutorial is to help attendees gain a clear understanding of when and how to use blockchain, what it can truly offer, and at what cost. Blockchain is often viewed as either a universal solution to all problems or an inefficient, energy-consuming technology with limited real-world applications. This tutorial aims to move beyond these extremes by offering a structured discussion on its actual strengths, trade-offs, and limitations. An essential part of this exploration is considering the role blockchain plays in solving specific problems. By examining Federated Learning (FL) as a use case, we will also explore whether, depending on the situation, blockchain is the best fit, or if alternatives can be used to achieve similar objectives with fewer trade-offs. This perspective will enable participants to understand how decentralization can enhance reliability and trust in FL, while also considering other approaches that may better address scalability, efficiency, and resource consumption.
Outline
The tutorial is structured as follows:
- Federated Learning (FL), introduction and limitations. Basic overview of the FL paradigm with a focus on its main limitations. (15 min)
- Blockchain Introduction. Basic overview of blockchain technology—what it is, its components, limitations, and how it can be applied in distributed systems beyond cryptocurrencies. (25 min)
- Initial Integration Attempt: Challenges and Inefficiencies. Discussion on challenges and inefficiencies (25 min)
- External storage. Exploration of how external storage can be integrated into FL-blockchain systems to improve efficiency and performance. We also discuss their limitations, particularly in terms of data availability and computational integrity. (25 min)
- Final Solution with External Storage and Certificates. Discussion on how integrating certificates and additional mechanisms can address the shortcomings of the previous approach (25 min)
- Implementation: Technology Discussion. Discussion of why we chose Cosmos for the blockchain framework and Cosmos ABCI for custom blockchain applications and how does it work. We also discuss our use of Zenoh for pub/sub communication (40 min)
- Final Discussion. Discussion to reflect on the lessons learned, the role of blockchain in solving real-world problems, and the trade-offs involved. We will specifically explore whether blockchain is always necessary in the context of FL or if, depending on the situation, alternative solutions might be more efficient and effective. (20 min)
Title: Evaluating Blockchain Fault Tolerance with STABL
Speakers: Vincent Gramoli (University of Sydney and Redbelly Network Australia), Rachid Guerraoui (EPFL, Switzerland), Andrei Lebedev (University of Sydney, Australia), Gauthier Voron (EPFL Switzerland)
Overview
Blockchains are often assumed to be fault tolerant due to their decentralized nature, yet real-world failures repeatedly challenge this assumption. Outages lasting days have been observed across major blockchain networks. Some could not even recover from transient isolated failures. Unlike traditional distributed systems, where well-established fault tolerance mechanisms exist, blockchains vary significantly in their consensus protocols, network structures, and failure handling approaches, making dependability evaluation particularly challenging. Despite the critical importance of fault tolerance, most blockchain benchmarking efforts focus primarily on performance metrics such as throughput and latency, often under ideal conditions that fail to account for real-world failure scenarios.

Evaluating fault tolerance requires a systematic approach to fault injection and measurement, enabling researchers and practitioners to analyze blockchain resilience, recoverability, and failure impact. This tutorial focuses on dependability assessment, covering practical methods for introducing faults, observing their effects, and quantifying blockchain sensitivity to failures, providing a different perspectives on blockchain performance evaluation compared to our tutorial on performance benchmarking with DIABLO.

In this half-day tutorial, we will evaluate the fault tolerance of one of the six blockchains, Algorand, Avalanche, Aptos, Ethereum, Redbelly and Solana with the recent STABL benchmark suite. We will look at the sensitivity score and extend the observer node with another fault type.
Outline
The tutorial will have the following structure:
- Introduction (20 min). What is blockchain, transaction throughput and latency, DIABLO and STABL benchmarking frameworks.
- Simple Demo (30 min). Using the virual machine image, members of the audience will run a local experiment on their own machines.
- Fault Tolerance and Dependability (20 min). Explanation of crash faults and network partitioning, and packet loss.
- Fault Tolerance Demo (30 min). We will introduce crash faults in the scenario and observe performance and sensitivity score under new conditions.
- Benchmarking Details (20 min). Explanation of metrics, workload types, and emulating various network conditions.
- Advanced Demo (30 min). We will explain the fault scenario implementation in STABL observer node and how to extend it with a new fault type.
- Discussion (30 min). Implications of design decisions, metrics and aspects to be evaluated.

Model-based Qualitative Dependability and Security Evaluation
Speakers: András Földvári, András Pataricza (Budapest University of Technology and Economics Department of Artificial Intelligence and Systems Engineering Budapest, Hungary)

Overview
The tutorial provides participants with a comprehensive understanding of Error Propagation Analysis (EPA), Qualitative Modeling [1], and their combinations for assessing dependability and security objectives in a Model-Based Systems Engineering (MBSE) approach. By integrating logic reasoning with qualitative evaluation, the tutorial aims to equip attendees with practical skills for applying qualitative EPA for system security and dependability assessment.

Through discussions on qualitative engineering models, logic-based reasoning, risk assessment, and security frameworks, participants will learn how the presented methodologies can contribute to systematic fault dynamics analysis, dependability evaluation, and reinforcement of security strategies. Additionally, applications and case studies will demonstrate how these methods can be applied to practical engineering challenges, enabling more resilient and validated system designs.

The goal of the tutorial is to provide an overview of state-of-the-art EPA solutions and present a qualitative logic reasoning-based MBSE approach, discussing its usage, advantages, open issues, and limitations.
Outline
The tutorial is divided into 4 main sections:

Section 1 - Error Propagation Analysis. This section provides an overview of state-of-the-art solutions for EPA in complex systems. Participants will gain insights into existing EPA methodologies, their strengths and limitations, and the challenges associated with propagation modeling in engineering applications.
Section 2 - Qualitative Modeling. This section introduces Qualitative Modeling as an alternative approach to traditional quantitative methods for analyzing system behavior. It covers qualitative engineering models and data-driven techniques for extracting qualitative representations from incomplete or unstructured data. The objective is to equip attendees with the ability to construct qualitative models that capture the operational modes of a system using symbolic and logic-based descriptions.
Section 3 - Qualitative EPA. This section explores the qualitative EPA approach that integrates logic reasoning with answer set programming (ASP) - a Prolog-like declarative programming approach, and an MBSE-based framework for EPA. It discusses the role of rule-based inference engines and qualitative logic in tracing and evaluating error propagation paths. Attendees will learn how to apply qualitative reasoning techniques within an MBSE-driven EPA framework, leveraging logical inference to enhance dependability and security analysis.
Section 4 - Applications and Case Study. This section demonstrates qualitative EPA applications, including dependability and security evaluations in critical engineering domains. Case studies illustrate how qualitative modeling and logical reasoning contribute to assessing requirements and assessing risk. Participants will understand how to apply qualitative EPA methods to practical engineering challenges and validate system designs. The theoretical concepts presented during the tutorial will be demonstrated on a pilot framework through real-life examples.