DeepChronos detects multi-step attacks with phase rules
On DARPA 2000 and AIT-LDS V2, authors report up to 11.3% higher macro F1 and no causal violations.
Stories per day · 30 days
2 RSS
Relatedintrusion-detection1kerberoasting1lateral-movement1multi-step-attacks1ndr1neuro-symbolic1soc1
5 stories, newest first · one card per story
Stories tagged #network-detection
Attackers hide routine activity in the gaps between SOC alerts
The explainer says LDAP, Kerberos, SMB, and slow HTTPS or DNS transfer can look like ordinary business traffic.
Estimation is Not Enough: Carpet-Bombing Detection via Per-Packet Uniformity Testing
SweepSketch detects carpet-bombing DDoS in milliseconds on Tofino2 using 44-byte buckets and no source state.
When Agents Look Like Beacons: NIDS Evasion by Model Context Protocol Traffic
Research shows Model Context Protocol agent traffic structurally resembles C2 beaconing and evades Suricata signatures and RITA behavioral scoring in testbeds.
A GAN-Based Framework for Robust DDoS Attack Detection
WGAN-GP-generated adversarial DDoS traffic augments training data, improving detection resilience against evasion attempts.