arXiv Machine Learning June 2, 2026 By Wenjie Zhang, Yun Lin, Chun Fung Amos Kwok, Xiwen Teoh, Xiaofei Xie, Frank Liauw, Hongyu Zhang, Jin Song Dong

MINES: Explainable Anomaly Detection through Web API Invariant Inference

Read the original on arXiv Machine Learning →

arXiv:2512. 06906v2 Announce Type: replace-cross Abstract: Detecting the anomalies of web applications, important infrastructures for running modern companies and governments, is crucial for providing reliable web services.

Summary generated by The Flow from the publisher's feed. The full article lives at arXiv Machine Learning.

arXiv Machine Learning

Jul 21

FAME: Failure-Aware Mixture-of-Experts for Message-Level Log Anomaly Detection

arXiv:2605. 22779v2 Announce Type: replace-cross Abstract: Production systems generate millions of log lines daily, yet most anomaly detectors operate at the session or window-level, flagging groups of lines rather than identifying the specific message responsible.

By Huanchi Wang, Zihang Huang, Yifang Tian, Kristina Dzeparoska, Hans-Arno Jacobsen, Alberto Leon-Garcia

llms

arXiv Machine Learning

Jun 30

ANVIL: Anomaly-based Vulnerability Identification without Labelled Training Data

arXiv:2408. 16028v4 Announce Type: replace-cross Abstract: Supervised-learning-based vulnerability detectors often fall short due to limited labelled training data.

By Weizhou Wang, Eric Liu, Xiangyu Guo, Xiao Hu, Ilya Grishchenko, David Lie

llms benchmarks

arXiv AI

Aug 11

ActBench: Self-Evolving Benchmark of Behavioral Safety in Cowork Agents

arXiv:2608. 09476v1 Announce Type: cross Abstract: Cowork agents may complete benign tasks while disclosing protected data, manipulating unauthorized state, invocate unauthorized API.

By Hongwei Yao, Yiming Liu, Meihui Chen, Jieling Chen, Zikun Chen, Yiling He, Wangze Ni, Cong Wang, Kui Ren

llms agents benchmarks safety

arXiv Machine Learning

Jun 4

NLLog: Lightweight, Explainable SOC Anomaly Detection via Log-to-Language Rewriting

arXiv:2606. 04957v1 Announce Type: cross Abstract: System-generated logs underpin security monitoring, yet their rigid template-based format hinders both automated analysis and human comprehension.

By Samuel Ndichu, Tao Ban, Seiichi Ozawa, Takeshi Takahashi, Daisuke Inoue

safety

arXiv AI

Jun 6

From Attack Simulation to SIEM Rule: Deterministic Detection-as-Code Synthesis with Probe-Level Traceability

arXiv:2606. 05252v1 Announce Type: cross Abstract: Security teams routinely simulate attacks against their own systems to check whether their monitoring would catch a real intruder.

By Alexandre Cristov\~ao Maiorano

llms

arXiv Machine Learning

Aug 4

How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection

arXiv:2608. 01454v1 Announce Type: cross Abstract: Provenance-based intrusion detection systems (PIDS) frequently report strong performance, but the conclusions drawn from these results can be highly sensitive to benchmarking choices and evaluation protocols.

By Lorenzo Guerra, Thomas Chapuis, Guillaume Duc, Pavlo Mozharovskyi, Van-Tam Nguyen

benchmarks

Related stories

FAME: Failure-Aware Mixture-of-Experts for Message-Level Log Anomaly Detection

ANVIL: Anomaly-based Vulnerability Identification without Labelled Training Data

ActBench: Self-Evolving Benchmark of Behavioral Safety in Cowork Agents

NLLog: Lightweight, Explainable SOC Anomaly Detection via Log-to-Language Rewriting

From Attack Simulation to SIEM Rule: Deterministic Detection-as-Code Synthesis with Probe-Level Traceability

How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection