The paper introduces an open generator for telecom alarm storms that produces exact root causes and propagation paths for every alarm on real backbone topologies, with each emitted field tied to standardized terms from NORIA‑O, RFC 8632, RFC 8345, or TMF642. Unlike previous benchmarks, the generator does not rely on confidential operator logs and includes fixed configurations, splits, a scorer, and nine baselines. A simple rule—ranking the device that raised the earliest critical alarm—outperforms more complex methods on both synthetic and real operator data, highlighting a key property of alarm streams.
Alarm root-cause analysis is studied on data that cannot be shared. Operator logs are confidential, so what the field publishes is a causal graph between alarm types rather than per-incident causes, a...
arXiv:2607. 27290v1 Announce Type: new Abstract: Modern telecommunication, cloud, and microservice systems emit correlated alarm cascades when components fail.
The paper demonstrates that emergent capabilities in machine learning models can be forecasted with lead time, calibrated uncertainty, and controlled false‑alarm rates. Using per‑seed analysis on transformers, the authors show that the formation time of a previous‑token head predicts the emergence of an induction head with Spearman ρ = 0.977 and a median lead of 975 training steps. Conformal intervals, blind pre‑registered tests, and a multiplicative rule relating anchor and event times further validate the predictive framework across multiple model families and configurations.
arXiv:2610.35151v1 Announce Type: cross Abstract: Host-based intrusion detectors order events, window audit streams and sequence attack stages by their timestamps. Every conclusion they draw therefor...
arXiv:2606. 05252v1 Announce Type: cross Abstract: Security teams routinely simulate attacks against their own systems to check whether their monitoring would catch a real intruder.
arXiv:2610.41072v1 Announce Type: new Abstract: Security operations centers (SOCs) need to turn terabytes of alerts, logs and flows into trusted, affordable decisions to unveil hidden threats. We pre...
The paper investigates whether graph structure improves microservice root‑cause analysis by conducting a controlled study on the RCAEval benchmark. Using identical features, optimizers, and evaluation protocols across three model variants, the authors find no consistent advantage for graph‑based models over flat models, with a negligible Avg@5 difference (0.003, p=0.844). They identify two benchmark properties—limited fault injection and a non‑uniform telemetry schema—that bias results, and propose a new model, PSC‑GRCA, which achieves higher Avg@5 mainly through a system prior rather than graph information.
arXiv:2609.36686v1 Announce Type: new Abstract: Identifying the root cause of an anomaly among hundreds of sensors is critical for preventing safety incidents and costly downtime in complex monitored...
arXiv:2608. 01725v1 Announce Type: cross Abstract: Modern computing and networking infrastructure emits telemetry continuously, yet operators convert it into decisions with a separate predictor per task, entity, and horizon.
arXiv:2609.22818v1 Announce Type: cross Abstract: Memory-poisoning defenses for LLM agents are typically evaluated by their ability to prevent attacks. However, the traffic they process is rarely adv...
The paper introduces a provenance‑aware execution graph for long‑horizon LLM agents, defining influence distance (DI) as the shortest structural path from an untrusted source to a sensitive action. Compared to the traditional sequence distance (DT), DI is always less than or equal to DT, revealing a median gap of nine hops in 454 injection–sink pairs across multiple models and datasets. The study shows that most pairs exhibit a non‑zero gap, and a deterministic DI‑based gate can block attacks missed by a sequence‑only gate without extra benign blocking.
The paper introduces a claim‑safe protocol for evaluating closed‑loop AI systems, consisting of three actions: Refuse, Decompose, and Refresh. It demonstrates the protocol in a simulator with 24 policy components and 1,440 held‑out cases, showing that abstention and stable false admission rates are low while providing detailed statistical diagnostics. The approach emphasizes that evaluation results should be tied to observable support and statistical calibration rather than a single PASS/FAIL label.