{"id":"https://openalex.org/W7166644953","doi":"https://doi.org/10.48550/arxiv.2606.29981","title":"Hephaestus: Toward a Cybersecurity AI Scientist","display_name":"Hephaestus: Toward a Cybersecurity AI Scientist","publication_year":2026,"publication_date":"2026-06-29","ids":{"openalex":"https://openalex.org/W7166644953","doi":"https://doi.org/10.48550/arxiv.2606.29981"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.29981","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.29981","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.29981","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5139714231","display_name":"Jiaqi Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Jiaqi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139714687","display_name":"Yang Zhao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhao, Yang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100550437","display_name":"Wen Lu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lu, Wen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5063980320","display_name":"Lvyang Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Lvyang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5139714009","display_name":"Lidong Zhai","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhai, Lidong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.16349999606609344,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.16349999606609344,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.10520000010728836,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.05339999869465828,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/frame","display_name":"Frame (networking)","score":0.5382000207901001},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.5073999762535095},{"id":"https://openalex.org/keywords/automation","display_name":"Automation","score":0.4375},{"id":"https://openalex.org/keywords/object","display_name":"Object (grammar)","score":0.42289999127388},{"id":"https://openalex.org/keywords/realization","display_name":"Realization (probability)","score":0.34779998660087585},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.3257000148296356},{"id":"https://openalex.org/keywords/energy","display_name":"Energy (signal processing)","score":0.31679999828338623},{"id":"https://openalex.org/keywords/digital-evidence","display_name":"Digital evidence","score":0.2854999899864197}],"concepts":[{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6762999892234802},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6007000207901001},{"id":"https://openalex.org/C126042441","wikidata":"https://www.wikidata.org/wiki/Q1324888","display_name":"Frame (networking)","level":2,"score":0.5382000207901001},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.5073999762535095},{"id":"https://openalex.org/C115901376","wikidata":"https://www.wikidata.org/wiki/Q184199","display_name":"Automation","level":2,"score":0.4375},{"id":"https://openalex.org/C2781238097","wikidata":"https://www.wikidata.org/wiki/Q175026","display_name":"Object (grammar)","level":2,"score":0.42289999127388},{"id":"https://openalex.org/C2781089630","wikidata":"https://www.wikidata.org/wiki/Q21856745","display_name":"Realization (probability)","level":2,"score":0.34779998660087585},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.3257000148296356},{"id":"https://openalex.org/C186370098","wikidata":"https://www.wikidata.org/wiki/Q442787","display_name":"Energy (signal processing)","level":2,"score":0.31679999828338623},{"id":"https://openalex.org/C2781357168","wikidata":"https://www.wikidata.org/wiki/Q5276084","display_name":"Digital evidence","level":3,"score":0.2854999899864197},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.28450000286102295},{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.28139999508857727},{"id":"https://openalex.org/C2780264999","wikidata":"https://www.wikidata.org/wiki/Q7445032","display_name":"Security domain","level":2,"score":0.27959999442100525},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.27230000495910645},{"id":"https://openalex.org/C114869243","wikidata":"https://www.wikidata.org/wiki/Q133735","display_name":"Security through obscurity","level":5,"score":0.26930001378059387},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.2687000036239624},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.26589998602867126},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.2587999999523163},{"id":"https://openalex.org/C10511746","wikidata":"https://www.wikidata.org/wiki/Q899388","display_name":"Data security","level":3,"score":0.2565999925136566}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.29981","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.29981","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.29981","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.29981","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.5905662178993225,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Cyber":[0],"offense":[1],"is":[2,10,34,60,94,158],"moving":[3],"to":[4,147],"machine":[5],"speed;":[6],"cyber":[7,71],"research":[8,18,99],"itself":[9,159],"not.":[11],"Existing":[12],"AI":[13,89],"scientist":[14],"systems":[15],"make":[16],"end-to-end":[17],"automation":[19],"increasingly":[20],"plausible,":[21],"but":[22],"they":[23],"target":[24],"relatively":[25],"stable":[26],"scientific":[27,39,114],"domains.":[28],"We":[29,83],"argue":[30],"that":[31,101,117],"AI-native":[32,140],"cybersecurity":[33],"a":[35,79,95,123,134],"different":[36],"kind":[37],"of":[38,44,155],"object.":[40],"Its":[41],"recurring":[42],"units":[43],"study":[45],"are":[46],"security":[47,157],"events":[48],"and":[49,57,64,73,113,116,130,151,177,181,189],"interaction":[50],"traces,":[51],"not":[52,62],"static":[53],"assets;":[54],"its":[55,119],"model":[56],"tool":[58,107],"substrate":[59],"non-stationary,":[61],"steady-state;":[63],"credible":[65],"evaluation":[66],"depends":[67],"on":[68,78,139,184],"digital":[69],"twins,":[70],"ranges,":[72],"auditable":[74],"evidence":[75],"rather":[76],"than":[77],"single":[80,174],"benchmark":[81],"score.":[82],"call":[84],"this":[85],"object":[86],"the":[87,152,168],"Cybersecurity":[88],"Scientist.":[90],"A":[91],"practical":[92],"realization":[93],"modular,":[96],"role-specialized":[97],"multi-agent":[98],"system":[100],"coordinates":[102],"problem":[103],"framing,":[104],"threat":[105],"modeling,":[106],"generation,":[108],"controlled":[109],"experimentation,":[110],"evaluation,":[111],"governance,":[112],"reporting,":[115],"anchors":[118],"concrete":[120],"objectives":[121],"in":[122],"four-zeros":[124],"frame":[125],"spanning":[126],"risk,":[127],"trust,":[128],"incident,":[129],"energy":[131],"dimensions.":[132],"As":[133],"representative":[135],"agenda":[136,183],"we":[137],"focus":[138],"defense,":[141],"where":[142],"steady-state":[143],"perimeters":[144],"give":[145],"way":[146],"resilient":[148],"agent":[149,163],"legions":[150],"classical":[153],"category":[154],"terminal":[156],"being":[160],"deconstructed":[161],"into":[162],"security.":[164],"This":[165],"paper":[166],"defines":[167],"object,":[169],"separates":[170],"it":[171],"from":[172],"any":[173],"organizational":[175],"realization,":[176],"offers":[178],"an":[179,182],"architecture":[180],"which":[185],"later":[186],"systems,":[187],"benchmarks,":[188],"empirical":[190],"programs":[191],"can":[192],"be":[193],"built.":[194]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-07-01T00:00:00"}