← Back to all news
arXiv AI By Tianwei Mu, Shengyan Jiang, Mingzhe Yuan, Qing Luo, Min Xiao, Wenhong Wang, Jun Li, Manhong Huang

HydroJEV: A one-second, training-free screen for cyber-attack and fault attribution in water distribution networks

Read the original on arXiv AI →

HydroJEV is a training‑free, one‑second model that classifies SCADA alarms in water distribution networks into cyberattack, physical fault, normal transient, or faulty sensor. In a benchmark on the C‑Town EPANET network, HydroJEV matched a hand‑written rule tree and outperformed a supervised classifier, especially when few labeled events were available, while being 20‑40 times faster than large language models. When combined with a rule tree gate, it reduced the need for human review by about a third without sacrificing accuracy.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv AI.

Related stories

arXiv AI
Sep 4

CASCADE: A Component Ablation and Corpus Audit of a Layered Local Defense for MCP-Based Systems

The paper evaluates CASCADE, a fully local layered defense for Model Context Protocol (MCP)-based systems, by conducting a component ablation and corpus audit on a fixed 5,000-sample dataset. It demonstrates that the choice of aggregation convention heavily influences reported metrics, that detection performance varies with provenance, and that the released configuration does not fully disclose the operating point. The study also shows that a local review model invoked for a third of requests does not alter classification outcomes, highlighting the importance of reproducibility and transparency in defense evaluations.

By \.Ipek Abas{\i}kele\c{s} Turgut, Edip G\"um\"u\c{s}
llmsagentsbenchmarks
More like this →
arXiv AI
1d ago

Jev-IDS: System One Models for Network Intrusion Detection

JEV-IDS is an open experimental general network intrusion detection system that uses the Jev System One Model to detect zero‑day intrusions even when labeled data are scarce. The system processes one flow per request and asks the model two questions: a binary attack probability and a finite‑choice traffic category. In tests on a 300‑flow NSL‑KDD pilot split, JEV-IDS achieved an F1‑score of 0.859, precision of 0.941, recall of 0.790, and a novel‑attack recall of 0.838, while being 4.8 times faster and 3.8 times cheaper than GPT‑5.6 Luna and producing 15 times fewer false alarms than a low‑data Random Forest.

By Paulo Severo, Silvio E. Quincozes, Amanda Dias
llms
More like this →
arXiv Machine Learning
Sep 7

Candidate Comparability Before Promotion: Conditional Validation in Adaptive Network Intrusion Detection

The paper investigates how to properly validate candidate models before promoting them to replace incumbent classifiers in adaptive network intrusion detection systems. It demonstrates that promotion decisions can be biased by how challengers are constructed and the amount of evidence they receive, and that using self‑contained challenger pipelines and sufficient candidate evidence reduces apparent promotion harm. The study also shows that policy rankings shift with candidate comparability and that no single update policy dominates across benchmarks.

By Roberto Fern\'andez-Barrios, Iker Pastor-L\'opez, Amaia Pikatza-Huerga, Pablo Garc\'ia Bringas
benchmarks
More like this →