The paper introduces a Hybrid Fuzzy Ensemble that combines a gradient‑optimized Takagi‑Sugeno‑Kang (TSK) fuzzy classifier with a parallel Fuzzy C‑Means (FCM) module to address the closed‑world gap in anomaly detection on the BETH dataset. It replaces traditional fuzzy membership scores with a robust Min Distance metric to mitigate the curse of dimensionality, achieving a state‑of‑the‑art AUROC of 0.9951 and outperforming Isolation Forest by 17.1%. The approach delivers near‑perfect out‑of‑distribution detection while maintaining interpretability through fuzzy logic.
arXiv:2409. 08521v2 Announce Type: replace-cross Abstract: In cybersecurity practice, new forms of cyberattacks continuously emerge, deliberately designed to evade defense systems that rely on previously observed behaviors.
arXiv:2609.36039v1 Announce Type: cross Abstract: Machine learning (ML) and deep learning (DL) have dominated Intrusion Detection System (IDS) research in recent years. Unfortunately, many existing s...
arXiv:2512. 22179v3 Announce Type: replace Abstract: Detecting previously unseen attacks remains a major challenge for machine learning-based intrusion detection systems.
The paper introduces ISER, an isolation-based method for unsupervised tabular anomaly detection that uses hypersphere radii to encode local density and maintains linear time and constant space complexity. ISER builds ensemble representations where smaller radii indicate dense regions and larger radii indicate sparse regions, and it employs a similarity-based scoring method that compares these representations to a theoretical anomaly reference pattern. Experiments on 20 real-world datasets show that ISER outperforms 12 state‑of‑the‑art methods, including an enhanced Isolation Forest.
arXiv:2605. 13922v2 Announce Type: replace-cross Abstract: During thDuring the last few years, the term Mechanistic Interpretability, a specific area, under the umbrella of explainable artificial intelligence (XAI), has been introduced, to explain the decisions made by complex machine learning (ML) models in critical systems like UAV intrusion detection systems (UAVIDS).
arXiv:2606. 13754v1 Announce Type: new Abstract: Anomaly detection is a fundamental component of intelligent systems with applications in healthcare, cybersecurity, smart grids, and IoT environments.
arXiv:2606. 18190v1 Announce Type: cross Abstract: Multi-stage cyberattacks span system, network, and browser logs.
The paper proposes a new unsupervised safety detection method for large language models that relies on anomaly detection rather than supervised training on unsafe data. By leveraging local sparsity in a linear representation space obtained via a sparse autoencoder, the authors develop a framework for locally masked SAE-based anomaly detection, providing theoretical support and empirical validation across multiple architectures and datasets. When calibrated with only 1% out-of-distribution data, the method achieves near‑optimal performance while using just 1–2% of SAE neurons for computation.
arXiv:2607. 18479v1 Announce Type: new Abstract: Malicious anomalous activity detection is a fundamental challenge for cyber security systems.
AIRO is a streaming-based machine learning framework designed to detect and mitigate cyber threats in Industrial Internet of Things (IIoT) environments. It integrates Apache Kafka for real-time data ingestion, attack-specific feature extraction, and ML inference using models such as Gradient Boosting and LightGBM. The system employs confidence-based decision logic to trigger risk reduction actions like IP blocking, account suspension, and traffic limiting, achieving F1-scores up to 0.9229 on specialized datasets for C2 beaconing, reconnaissance, SQL injection, and phishing.
Adversarial attacks on cybersecurity classifiers pose a dual threat: degrading predictions and destabilising the SHAP-based explanations that security analysts rely on to understand and triage alerts. We extend our prior MLP conference study to Random Forest and XGBoost across four tabular security datasets (phishing URLs, UNSW-NB15, NF-ToN-IoT, HIKARI-2021), evaluating five attacks including three black-box methods applicable to non-differentiable tree models.
arXiv:2606. 07716v1 Announce Type: cross Abstract: Adversarial attacks pose a serious and growing threat to Machine Learning (ML)-based Intrusion Detection Systems (IDS), where imperceptible perturbations to network flow features can systematically mislead classifiers into accepting malicious traffic as benign.