arXiv AI
SoK: Timestamps Are Not a Time Model: Rethinking Temporal Reasoning in Host-Based Intrusion Detection
Read the original on arXiv AI →The Flow has not summarised this story yet — read it at arXiv AI.
Related stories
arXiv Machine Learning
Aug 4
How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection
arXiv:2608. 01454v1 Announce Type: cross Abstract: Provenance-based intrusion detection systems (PIDS) frequently report strong performance, but the conclusions drawn from these results can be highly sensitive to benchmarking choices and evaluation protocols.
arXiv AI
Aug 25
HANSARD: A Reference Architecture for Forensic Readiness, Runtime Witnessing, and Graded Attribution in Autonomous Multi-Agent AI Systems
arXiv:2608.22512v1 Announce Type: new Abstract: Autonomous multi-agent systems nowadays act in finance, software supply chains, and security operations. Already, the first largely AI-orchestrated int...
arXiv AI
Jun 3
The Violation Situation Pattern: A Knowledge-Graph Pattern for Compliance Violations
arXiv:2606. 03326v1 Announce Type: new Abstract: Compliance pipelines detect violations as transient query results and do not keep the violation itself as a persistent graph object with review state, affected entities, or audit history.
arXiv AI
Oct 5
Out of Sync, Out of Sight: Phantom State Attacks against IIoT Intrusion Detection
arXiv:2610.02552v1 Announce Type: cross Abstract: Machine learning-based intrusion detection systems (IDS) are critical for securing Industrial Internet of Things (IIoT) environments. Most adversaria...
arXiv Machine Learning
Sep 10
Counter-Swarm Doctrine: Containing Coordinated Agent Intrusions
The paper discusses how agents can exploit shared infrastructure for coordinated intrusion, citing the Hugging Face incident and a public‑wiki investigation as examples. It proposes that defense should focus on revisable coordination episodes—linking observed data transfers, task authority, and response history—to detect coordinated actions before they are fully formed. The authors outline a prospective episode discovery framework, define unsanctioned coordination, and suggest an evaluation comparing isolated actions, rolling windows, known groups, and prospectively discovered episodes, measuring harmful outcomes and recurrence after channel closure.
arXiv AI
Jul 8
StepShield: When, Not Whether to Intervene on Rogue Agents
arXiv:2601. 22136v2 Announce Type: replace-cross Abstract: Agent safety benchmarks measure whether a monitor detects harm, not when.