Towards Understanding LLM-Based Log Anomaly Detection: An Empirical Study of Performance, Efficiency, and Robustness

Large language models LLMs have demonstrated promising performance in log anomaly detection, yet how their adaptation strategies, architectures, and deployment configurations affect detection effectiveness remains insufficiently understood. To investigate these factors, we conduct a systematic...

DistillGuard: Malicious NPM Package Detection and API Attack Chain Analysis Via Static Graph and LLM Distillation

The Node.js ecosystem heavily relies on NPM packages, and software supply chain attacks targeting malicious NPM packages are rampant. Malicious code primarily triggers during package installation, import, and runtime. Traditional static analysis fails to understand code semantics; machine...

Improving the Reliability of Anomaly Detection for Encrypted OPC UA Traffic over Private 5G

Open Platform Communications Unified Architecture OPC UA is increasingly deployed over private 5G networks in industrial environments, where end-to-end encryption prevents payload inspection by network-based intrusion detection systems IDSs. Although payload-agnostic statistical features extracte...

Prompt Injection Detection for Email Agents through Attack Chain Modeling

Large language model email assistants are particularly vulnerable to indirect prompt injection because untrusted email content can be retrieved into the model context and influence subsequent tool use. Existing prompt injection detectors mainly formulate this problem as binary malicious text...

CVE-2026-63451

A flaw was found in Suricata, a network Intrusion Detection System. A local user can craft a detection rule that combines frame inspection without content and a transformed match without content. Loading this specially crafted rule can trigger a heap buffer overflow, leading to a denial of servic...

CVE-2026-57222

A flaw was found in Suricata. This vulnerability allows a remote attacker to cause an incorrect detection state by sending specially crafted IPv4 and IPv6 address pairs. The flaw occurs because the system's IPPair hash does not properly compare the IP address family, leading to the reuse of state...

CVE-2026-57229

A flaw was found in Suricata, a network Intrusion Detection System IDS, Intrusion Prevention System IPS, and Network Security Monitoring engine. The SMTP Simple Mail Transfer Protocol MIME Multipurpose Internet Mail Extensions parser does not fully reset its state when processing encapsulated...

SAGEGAN: Style-Based Anomaly Detection with Gaussian Embeddings Using Generative Adversarial Networks

Malware evolves faster than rule-based and signature-driven detection pipelines. This paper presents SAGEGAN, a benign-only trained malware anomaly detection framework that converts portable executable files into compact three-channel images and models benign structure through style-conditioned...

A Gmail-Based Phishing Detection Prototype for Nigerian Fintech Emails Using Sender Checks and BiLSTM Classification

Phishing emails that impersonate Nigerian fintech providers can combine deceptive sender addresses, lookalike links, and locally familiar language. This study presents a Gmail browser extension that integrates sender-domain and URL checks with a bidirectional long short-term memory BiLSTM...

"What I See Is What I Hear": Deepfake Detection across Diverse Hearing Abilities

The proliferation of audiovisual deepfakes has lowered the cost of fraud, impersonation, and misinformation, but their success ultimately depends on human perception. Detection requires integrating auditory and visual cues, yet security and privacy research has largely overlooked d/Deaf and...

ODPure: Backdoor Purification for Object Detection Via Ensemble Corruption Consensus

With the development of applications like autonomous driving, object detection has gained significant attention, while also highlighting critical vulnerabilities like backdoor attacks that severely compromise model integrity. Specifically, such attacks involve altering the categories of objects...

Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates

A zero-day proof-of-concept tool that stops Microsoft Defender from installing platform and signature updates by filling all available disk space was published on GitHub on September 19. The tool, called BigDiskBuster , has no patch, no CVE, and no Microsoft advisory. Its author, Abdelhamid Nacer...

forensic-timeliner

Высокоскоростной движок криминалистической обработки, созданный для специалистов DFIR. Быстрое объединение CSV-вывода от лучших инструментов триажа в единую мини-хронологию со встроенными фильтрацией, обнаружением артефактов, фильтрацией по датам, присвоением ключевых слов и дедупликацией. Релиз...

How It's Made: Uncovering Detection Engineering Processes for Network Intrusion Detection Rules

Many Security Operations Centers rely on signature-based Network Intrusion Detection Systems like Suricata, yet detection rule engineering remains understudied. We investigate this process by introducing SuriCap, a platform for rule engineering exercises, and hosting CTF-style workshops where 60...

Confidence-Guided Cross-Modal Knowledge Transfer for Multimodal Anomaly Detection in Microservice Systems

Accurate anomaly detection is essential for reliable and secure operations of microservice systems. While an increasing number of studies have shifted from unimodal modeling to multimodal interaction and fusion, effectively leveraging reliable cross-modal information remains challenging. The...

Solidity Meets LLMs: A Transformer-Based Approach to Smart Contract Vulnerability Detection

The growing adoption of blockchain technologies, particularly the Ethereum platform, has amplified the critical role of smart contracts in decentralized applications. However, the increasing complexity and financial value of these contracts make them prime targets for cyber attacks. In this work,...

Multi-View Fusion for Encrypted C2 Detection: A Leakage-Controlled Measurement Study of Evaluation Pitfalls

Command-and-control C2 traffic increasingly hides within TLS, so defenders now apply machine learning to traffic metadata. Many studies assume that combining two metadata views, namely flow statistics and TLS handshake fingerprints, improves both accuracy and robustness. We tested this assumption...

Toward Responsible AI-Augmented Cyber Defense: Pattern Recognition, Defense-In-Depth, and the Case for Human-AI Collaboration

Cybersecurity literature has extensively documented the operational benefits of artificial intelligence AI for threat detection, incident response, and prevention, while raising qualitative concerns about over-automation, algorithmic bias, and analyst-skill erosion. What remains largely absent is...

Comparative Evaluation of Static Embedding Models for HTTP Request Anomaly Detection

Web applications are increasingly targeted by cyberattacks that exploit HTTP requests to evade security mechanisms. Traditional web application firewalls WAFs rely on rule-based approaches that often exhibit high false positive rates and limited adaptability. Recent studies have explored machine...

SR-Fraud: An Outcome-Supervised Reflective LLM Agent Framework for Non-Stationary Payment Fraud Detection

Real-time payment fraud detection is a non-stationary streaming prediction problem: adversaries adapt before supervised labels mature, and localized burst attacks can cause losses before retraining. Production systems typically rely on tabular classifiers and rules, which can struggle to capture...