arXiv:2607. 00763v1 Announce Type: cross Abstract: Digital forensic investigations of network intrusions require analytical outputs that are traceable, reproducible, and court-defensible - requirements existing machine learning pipelines do not satisfy, since they treat original evidence as training data and produce opaque classifications without instance-level justification.
By Jose Luis Vela Alonso, Carmen Pellicer
arXiv:2608. 15761v1 Announce Type: cross Abstract: Edge-IIoTset is the reference benchmark for machine-learning intrusion detection in the industrial Internet of Things, and results reported on it cluster above 99%.
By Mostafa M. Galal
arXiv:2609.36039v1 Announce Type: cross
Abstract: Machine learning (ML) and deep learning (DL) have dominated Intrusion Detection System (IDS) research in recent years. Unfortunately, many existing s...
By Yufeng Xin, Bryant Goseland, Mohamed Rahouti
arXiv:2608. 08100v1 Announce Type: cross Abstract: Retrieval-Augmented Generation (RAG) enables large language models to classify network flows and generate human-readable incident reports by retrieving semantically similar historical traffic from a vector knowledge base.
By Kaysarul Anas Apurba, Md. Hasibul Hasan, Mahedee Zaman Moon, Sk. Md. Mizanur Rahman, Atsuo Inomata
arXiv:2607. 26791v1 Announce Type: cross Abstract: Large Language Model (LLM) agents are increasingly adopted in real-world security operations with access to host artifacts and command-line interfaces (CLIs), making it critical to thoroughly assess their security capabilities.
By Lehan Wang, Boli Chen, Ruixue Ding, Pengjun Xie, Jinwei Huang, Zhendong Liu, Shuo Wang, Tao Lei, Xin Ouyang, Xiaomeng Li
arXiv:2609.15017v1 Announce Type: cross
Abstract: Prompt-injection detectors are typically evaluated using aggregate F1 on in-distribution test data, which offers limited insight into behavior under...
By Yusuf Khalid Shire, Sang-Chul Kim
The paper "Beyond Reproducibility: Towards Security-Aware Evaluation of Research Artifacts" examines 1,388 research artifacts from top security conferences, uncovering 132,431 candidate security findings through static analysis. It introduces a taxonomy for context-aware security assessment and presents SAFE, an autonomous framework that accurately distinguishes security-relevant findings and classifies risk types. The study demonstrates that nearly 45% of findings are security-relevant, highlighting the need for security-aware evaluation alongside traditional reproducibility checks.
By Nanda Rani, Christian Rossow
The paper introduces RECAL, an unsupervised framework that applies relation-balanced masked graph learning and error calibration to provenance-based intrusion detection. By addressing the large statistical heterogeneity among relations—where frequencies can differ by about 140,000×—RECAL better captures rare interaction patterns and normal error variations. On three DARPA E3 datasets, it achieves near-perfect F1 scores and dramatically reduces false positive rates compared to existing baselines.
By Lijie Zheng, Ji He, Alessandro Brighente, Yulong Shen, Mauro Conti
arXiv:2508. 18684v2 Announce Type: replace-cross Abstract: Signature-based Intrusion Detection Systems (IDS) detect malicious activity by matching network or host events against predefined rules.
By Shaswata Mitra, Subash Neupane, Martin Duclos, Sudip Mittal, Aritran Piplai, Md Rayhanur Rahman, Edward Zieglar, Shahram Rahimi
arXiv:2606. 10216v1 Announce Type: cross Abstract: Advanced Persistent Threats (APTs) are stealthy, multi-stage cyberattacks whose detection is difficult due to scarce labeled traces, severe class imbalance, and the challenge of generating realistic malicious behavior.
By Sidahmed Benabderrahmanea, Petko Valtchev, James Cheney, Talal Rahwan
arXiv:2608. 12789v1 Announce Type: cross Abstract: Tool-using agents consume external data from sources with different levels of trust, yet tool responses rarely identify who produced each component or what it should convey.
By Sanjay Kariyappa, Severin Klingler, G. Edward Suh
arXiv:2606. 05844v1 Announce Type: cross Abstract: Rule-based Intrusion Detection and Prevention Systems (IDPS) offer precise attack detection as well as mitigation, however their manually crafted, signature-driven rules limit adaptability to emerging and zero-day threats.
By Hassan Jalil Hadi, Rehana Yasmin, Ali Shoker