{"id":"https://openalex.org/W7166666658","doi":"https://doi.org/10.48550/arxiv.2606.30479","title":"COHORT: Collaborative Orchestration for Hardening via Offensive Replay on Emulated Topologies","display_name":"COHORT: Collaborative Orchestration for Hardening via Offensive Replay on Emulated Topologies","publication_year":2026,"publication_date":"2026-06-29","ids":{"openalex":"https://openalex.org/W7166666658","doi":"https://doi.org/10.48550/arxiv.2606.30479"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.30479","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.30479","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.30479","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5139683389","display_name":"Chen Frydman","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Frydman, Chen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5078651280","display_name":"Aviram Zilberman","orcid":"https://orcid.org/0000-0002-8137-7314"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zilberman, Aviram","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5104435496","display_name":"Rubin Krief","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Krief, Rubin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5121624327","display_name":"Abed Showgan","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Showgan, Abed","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139698233","display_name":"Andres Murillo","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Murillo, Andres","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139662299","display_name":"Sekiya Motoyoshi","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Motoyoshi, Sekiya","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139657544","display_name":"Asaf Shabtai","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Shabtai, Asaf","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139634592","display_name":"Yuval Elovici","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Elovici, Yuval","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5139672471","display_name":"Rami Puzis","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Puzis, Rami","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.373199999332428,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.373199999332428,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.15710000693798065,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.11900000274181366,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/offensive","display_name":"Offensive","score":0.6215999722480774},{"id":"https://openalex.org/keywords/network-topology","display_name":"Network topology","score":0.6182000041007996},{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.6173999905586243},{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.5056999921798706},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.4562999904155731},{"id":"https://openalex.org/keywords/workflow","display_name":"Workflow","score":0.4341999888420105},{"id":"https://openalex.org/keywords/firewall","display_name":"Firewall (physics)","score":0.40369999408721924},{"id":"https://openalex.org/keywords/vendor","display_name":"Vendor","score":0.38960000872612},{"id":"https://openalex.org/keywords/scheduling","display_name":"Scheduling (production processes)","score":0.33410000801086426}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.661899983882904},{"id":"https://openalex.org/C176856949","wikidata":"https://www.wikidata.org/wiki/Q2001676","display_name":"Offensive","level":2,"score":0.6215999722480774},{"id":"https://openalex.org/C199845137","wikidata":"https://www.wikidata.org/wiki/Q145490","display_name":"Network topology","level":2,"score":0.6182000041007996},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.6173999905586243},{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.5056999921798706},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.4562999904155731},{"id":"https://openalex.org/C177212765","wikidata":"https://www.wikidata.org/wiki/Q627335","display_name":"Workflow","level":2,"score":0.4341999888420105},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.42250001430511475},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4178999960422516},{"id":"https://openalex.org/C77714075","wikidata":"https://www.wikidata.org/wiki/Q5452017","display_name":"Firewall (physics)","level":5,"score":0.40369999408721924},{"id":"https://openalex.org/C2777338717","wikidata":"https://www.wikidata.org/wiki/Q1762621","display_name":"Vendor","level":2,"score":0.38960000872612},{"id":"https://openalex.org/C206729178","wikidata":"https://www.wikidata.org/wiki/Q2271896","display_name":"Scheduling (production processes)","level":2,"score":0.33410000801086426},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.33180001378059387},{"id":"https://openalex.org/C59519942","wikidata":"https://www.wikidata.org/wiki/Q650665","display_name":"Drone","level":2,"score":0.3228999972343445},{"id":"https://openalex.org/C2775896111","wikidata":"https://www.wikidata.org/wiki/Q642560","display_name":"Router","level":2,"score":0.3118000030517578},{"id":"https://openalex.org/C146778888","wikidata":"https://www.wikidata.org/wiki/Q836862","display_name":"Installation","level":2,"score":0.2971000075340271},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2937999963760376},{"id":"https://openalex.org/C152124472","wikidata":"https://www.wikidata.org/wiki/Q1204361","display_name":"Redundancy (engineering)","level":2,"score":0.29190000891685486},{"id":"https://openalex.org/C2776543023","wikidata":"https://www.wikidata.org/wiki/Q2147046","display_name":"Rework","level":2,"score":0.2913999855518341},{"id":"https://openalex.org/C99821215","wikidata":"https://www.wikidata.org/wiki/Q1136583","display_name":"Swap (finance)","level":2,"score":0.28540000319480896},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.28279998898506165},{"id":"https://openalex.org/C2777062904","wikidata":"https://www.wikidata.org/wiki/Q545406","display_name":"Toolchain","level":3,"score":0.28189998865127563},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.2743000090122223},{"id":"https://openalex.org/C51929080","wikidata":"https://www.wikidata.org/wiki/Q2425187","display_name":"Codebase","level":3,"score":0.2727000117301941},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.26930001378059387},{"id":"https://openalex.org/C99237066","wikidata":"https://www.wikidata.org/wiki/Q17092610","display_name":"Internet topology","level":3,"score":0.26829999685287476},{"id":"https://openalex.org/C67212190","wikidata":"https://www.wikidata.org/wiki/Q104851","display_name":"Firmware","level":2,"score":0.26820001006126404}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.30479","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.30479","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.30479","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.30479","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.7088136076927185,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Mitigating":[0],"an":[1,5,14],"observed":[2],"adversary":[3,106],"in":[4,127],"enterprise":[6],"network":[7,110],"typically":[8],"takes":[9],"weeks":[10],"of":[11,187,203],"expert":[12,39],"work:":[13],"analyst":[15],"derives":[16],"a":[17,80,85,112,139,158,165,204],"mitigation":[18],"tailored":[19],"to":[20,56,168],"that":[21,150],"adversary,":[22],"validates":[23],"it":[24,30],"without":[25],"breaking":[26],"production,":[27],"and":[28,41,76,131,144,157,175,194,211],"verifies":[29],"disrupts":[31],"the":[32,47,52,104,108,116,121,192,201,208,219],"specific":[33],"attack.":[34],"The":[35],"procedure":[36,59],"relies":[37],"on":[38,84,107],"judgment":[40],"cannot":[42],"safely":[43],"be":[44],"exercised":[45],"against":[46,115],"production":[48],"network.":[49],"COHORT":[50],"is":[51,98,221],"first":[53],"end-to-end":[54],"framework":[55,220],"automate":[57],"this":[58],"for":[60,111],"deployable":[61],"mitigations.":[62],"A":[63,214],"role-decomposed":[64],"multi-agent":[65],"LLM":[66],"workflow":[67],"proposes":[68],"candidates,":[69],"implements":[70],"them":[71,78],"as":[72],"real":[73,90],"device":[74],"commands,":[75],"refines":[77],"through":[79,218],"critique":[81],"loop,":[82],"all":[83],"high-fidelity":[86],"GNS3":[87],"emulator":[88],"running":[89],"vendor":[91],"firmware":[92],"(firewall,":[93],"switch,":[94],"router).":[95],"Each":[96],"candidate":[97],"evaluated":[99],"by":[100],"offensive":[101],"replay:":[102,138],"re-executing":[103],"original":[105],"mitigated":[109],"paired":[113],"comparison":[114],"unmitigated":[117],"baseline,":[118],"rather":[119],"than":[120],"reward-signal":[122],"or":[123,154],"expert-judgment":[124],"proxies":[125],"used":[126],"prior":[128],"simulation,":[129],"hybrid,":[130],"configuration-generation":[132],"work.":[133],"Two":[134],"further":[135],"checks":[136],"complement":[137],"connectivity-regression":[140],"check":[141],"(LAN":[142],"ping":[143],"internet":[145,155],"HTTP":[146],"probe)":[147],"rejects":[148],"mitigations":[149,163,189],"disrupt":[151,191],"legitimate":[152],"LAN":[153],"connectivity,":[156],"cumulative":[159],"evaluation":[160],"stacks":[161],"approved":[162],"onto":[164],"persistent":[166],"state":[167],"surface":[169],"compound":[170],"effects.":[171],"Across":[172],"three":[173],"topologies":[174],"four":[176],"attack":[177,193],"scenarios":[178],"(ransomware,":[179],"lateral":[180],"movement,":[181],"DNS":[182],"exfiltration,":[183],"data":[184],"theft),":[185],"46.7%":[186],"generated":[188],"both":[190],"preserve":[195],"connectivity":[196],"under":[197],"replay,":[198],"4.4":[199],"times":[200],"rate":[202],"single-agent":[205],"baseline":[206],"using":[207],"same":[209],"model":[210],"tool":[212],"access.":[213],"demo":[215],"video":[216],"walking":[217],"available":[222],"with":[223],"our":[224],"released":[225],"artifacts.":[226]},"counts_by_year":[],"updated_date":"2026-07-01T06:29:00.853634","created_date":"2026-07-01T00:00:00"}