Data4Cyber publishes labeled OT attack data for a lab distribution grid
The lab DMS dataset pairs 1-second process data with Modbus/TCP and MQTT captures across one benign run and six attacks.
Stories per day · 30 days
2 RSS
Relatedexplainable-ai2forensics2network-security2neuro-symbolic2suricata2adversarial-robustness1backdoor1benchmarks1calibration1can-bus1cic-ids-20171cic-ids20171ciciot20231data-sanitization1dataset1distribution-grid1false-positives1feature-selection1
35 stories, newest first · one card per story
Stories tagged #intrusion-detection
DeepChronos detects multi-step attacks with phase rules
On DARPA 2000 and AIT-LDS V2, authors report up to 11.3% higher macro F1 and no causal violations.
Lightweight IoT IDS keeps accuracy with three to 15 features
On CICIoT2023, three features reached MCC 0.9622 and 15 preserved 99.97% of a 38-feature baseline.
CANMentor large-small model collaboration for CAN bus IDS
CANMentor framework uses cloud LLM to supervise vehicle-side lightweight IDS models via knowledge distillation, yielding up to 25% F1 gains on non-IID data.
MODEXRE Forensic Pipeline Uses SHAP Explainability for Intrusion Detection
Extends XGBoost classifier with SHAP for explainable forensic intrusion detection with chain of custody.
Adversarial robustness does not equal zero-day generalization in intrusion detectors
Perturbation-based robustness tests overestimate zero-day detection; models maintain 90.9-99.7% under attacks but drop to 22.8-76.2% on held-out families.
DeepWeave neuro-symbolic NIDS improves low-data detection and provides explanations
DeepWeave combines neural predictions with interpretable rules for robust, label-efficient NIDS.
DYNAS adds defensive noise to reinforcement-learning penetration tests
Pen-DHRL posts positive mean returns with defenses on from the start, while flat baselines stay negative.
Secondary analysis finds detection trade-offs in quantum ML intrusion detection
In one comparison a quantum SVM lowers false positives from 6.875% to 3.329% while true positives dip slightly.
SoK finds host intrusion detectors leave time assumptions unstated
A review of detector papers finds most provenance systems state no clock bound and trust stored evidence.
Paper details stealthy data-driven attacks on closed-loop control systems
A model-free MITM method identifies plant behavior and tracks arbitrary references while staying under an infinity-norm IDS.
VX-One study tests typed decision heads for perimeter triage
A 100K–10M-parameter model is measured against XGBoost and a Suricata cascade on public IDS sets.
VX-One study tests typed heads for real-time perimeter triage
Under CIC-IDS2017 drift VX-One leads detection, but calibration error rises from 0.04 to 0.40 for every method.
OT intrusion-detection scores can reflect recordings rather than attacks
On ProvICS, same-recording tests reverse modality rankings and drop cyber-only fusion AUC to 0.54.
Adaptive and Proximal Federated Optimization for Transferable Network Intrusion Detection
Proximal federated optimization beat FedAvg for transferable intrusion detection on CIC-IDS 2017, showing a depth-versus-breadth trade-off.
Analyzing and Mitigating Poisoning Attacks on Flow-Based Intrusion Detection
Researchers backdoor flow-based IDS models with 0.001% poisoned data and propose mitigations.
Decision-Focused Learning for Cyber-Physical Risk-Aware Power Grid Operations
Researchers tie grid intrusion-detection errors to operational cyber-physical costs via decision-focused learning.
PairAudit: Guiding Human Review with Graph Tokens under Distribution Shift
PairAudit uses graph tokens to surface overlooked intrusion-detector mistakes and improve fixed-budget review of unseen attacks.
Systematically Optimized CNN-Transformer with Focal Loss for Imbalanced Intrusion Detection on NSL-KDD
A tuned CNN-Transformer with Focal Loss reaches 98.73% accuracy on imbalanced NSL-KDD detection.
GCTAuto-encoder: A Cross modal Framework for Security Flaw Detection in IoT Networks
GCT auto-encoder reports 0.908 accuracy detecting IoT network intrusions from edge data.
Cybersecurity in Edge Computing: A Trust-Aware Federated Hybrid Intrusion Detection Framework
Researchers propose a trust-aware federated hybrid IDS that detects edge attacks without sharing raw telemetry.
Where the Numbers Come From: Auditing Evaluation in Provenance-Based Intrusion Detection
Audit finds provenance IDS scores overstate alarm precision; ThreaTrace labeled only 7 of 994 alarms as attacks.
Improving the Reliability of Anomaly Detection for Encrypted OPC UA Traffic over Private 5G
Paper proposes control-plane-aware threshold adaptation that cuts false positives in encrypted OPC UA traffic anomaly detection on industrial private 5G.
Passive Hybrid Network-Based Intrusion Detection System (Hybrid-NIDS) Combining Suricata and Random Forest
Suricata and Random Forest hybrid NIDS scored F1 0.97 on UNSW-NB15 but failed in lab tests.