CCR: Towards a Common, Quality-Gated CACAO Integrations Registry for European Cybersecurity Automation

arXiv:2609.27567 · cs.CR · Submitted 2026-09-23 · Read on arXiv

cs.CR

Submitted: 2026-09-23

Updated: 2026-09-24

Comments: 20 pages. Accepted at the 12th Workshop on the Security of Industrial Control Systems & of Cyber-Physical Systems (CyberICPS 2026), held in conjunction with ESORICS 2026. To appear in Springer LNCS

Code: https://github.com/cacao-common-registry/integrations

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Accuracy — 10× in this paper · explained in 1 episode
• Provenance — 6× in this paper · explained in 3 episodes
• Trace — 5× in this paper · explained in 2 episodes
• Common CACAO Registry — 4× in this paper
• Rule-Based Baseline — 4× in this paper
• Alignment — 3× in this paper · explained in 1 episode
• Consistency — 3× in this paper · explained in 3 episodes
• Grounding — 2× in this paper · explained in 3 episodes
• Ontology — 2× in this paper · explained in 2 episodes
• Benchmark — 1× in this paper · explained in 2 episodes
• Failure Modes — 1× in this paper · explained in 3 episodes
• Large Language Model (LLM) — 1× in this paper · explained in 3 episodes
• Robustness — 1× in this paper · explained in 5 episodes

Sources

• From Legacy to Standard: LLM-Assisted Transformation of Cybersecurity Playbooks into CACAO Format
• API-Bank: A Comprehensive Benchmark for Tool-Augmented LLMs
• Developer Perspectives on REST API Usability: A Study of REST API Guidelines

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs