Network Security and Intrusion Detection

Latest papers

• A Structured State Space Sequence Model for Multi-Class Classification of Malware

  Emmanuela Andam, Rana Shaaban, Emanuel Grant, Naima Kaabouch · 2 October 2026

  By 2030, Internet of Things (IoT) devices are projected to reach 40 billion, with fast-paced technological advancements in fields such as industry, healthcare, agriculture, automobiles, and building/home automation systems. This expansion has created a large attack surface for cybercrime, as the maj…

• From Network Intrusion Detection to Blockchain-Backed Endpoint Detection and Response: Mapping the Landscape of Decentralized Detection-and-Response Architectures

  Yahya Shahsavari, Sara Rouhani, Kaiwen Zhang · 2 October 2026

  While the literature on blockchain-assisted intrusion detection and prevention systems (IDS/IPS) for Internet of Things (IoT) and Industrial Internet of Things (IIoT) networks is mature, existing systematic reviews suffer from two critical limitations: they overlook the structural shift toward moder…

• Jev-IDS: System One Models for Network Intrusion Detection

  Paulo Severo, Silvio E. Quincozes, Amanda Dias · 2 October 2026

  Machine-learning Network Intrusion Detection Systems (IDS) depend on substantial labeled datasets and task-specific training, whereas Large Language Models (LLMs) detection can analyze flow records directly but incurs higher inference cost and latency, with less constrained outputs. This paper prese…

• Adversarial Defense in Cybersecurity: A Systematic Review of GANs for Threat Detection and Mitigation

  Tharcisse Ndayipfukamiye, Jianguo Ding, Doreen Sebastian Sarwatt, Adamu Gaston Philipo, Huansheng Ning · 30 September 2026

  Machine learning-based cybersecurity systems are highly vulnerable to adversarial attacks, while Generative Adversarial Networks (GANs) act as both powerful attack enablers and promising defenses. This survey systematically reviews GAN-based adversarial defenses in cybersecurity (2021--August 31, 20…

• Adversarial Debiasing of Machine Learning Models for Enhanced Network Security against DDoS Attacks

  Aadith Sukumar, Isha Singh, Devershika Mohane, Ankit Mukherjee, Ankush Dutta, Rahee Walambe, Ketan Kotecha · 30 September 2026

  Distributed Denial of Service attacks are a growing threat to network infrastructure, and new techniques, including the use of generative AI, make them harder to detect. Traditional detection systems, such as rule based firewalls, often fail to identify these evolving attack patterns. In this study,…

• Input-Layer Starvation: Why Per-Layer Pruning Breaks IoT Intrusion Detectors

  Md Anas Biswas · 28 September 2026

  Intrusion detectors for small Internet-of-Things (IoT) devices are usually compressed by pruning and judged by overall accuracy. We show that this hides a severe class-level failure, find its cause, and give low-overhead prevention and repair. On CICIoT2023, a two-layer convolutional detector pruned…

• Probabilistic Robustness-driven Universal Adversarial Perturbations with Explainability against Deep Reinforcement Learning-based Intrusion Detection System

  Hongsen Zhang, Lu Zhang, Mingjing Xu, Yi Zhang, Gregory Epiphaniou, Carsten Maple · 28 September 2026

  Deep reinforcement learning (DRL) enables adaptive intrusion detection in dynamic network environments but also exposes intrusion detection systems (IDS) to adversarial threats such as universal adversarial perturbations (UAPs), which apply a single input-agnostic perturbation to degrade detection p…

• Unmasking Shortcut Learning in IoT Intrusion Detection: A Forensic, Multi-Paradigm Evaluation of Feature Dependence and Data Leakage

  Uday Shankar Roy, Mahbuba Jahan Minu · 25 September 2026

  Machine learning-based Network Intrusion Detection Systems often report near-perfect performance on IoT benchmarks. However, whether these models learn generalizable attack behavior or exploit spurious dataset shortcuts- such as static testbed IP/MAC addresses and chronological recording artifacts-r…

• Topological Signatures of Cyber-Attack Classes in Natural Visibility Graph Representations of Network Traffic

  Ali Melih Kanca, Ilker Turker · 25 September 2026

  Natural Visibility Graph (NVG)-based representations provide a promising approach for capturing structural patterns in sequential network traffic. However, whether different cyber-attack classes exhibit distinctive topological signatures in such representations remains insufficiently understood. Thi…

• Reliable Federated TinyML Deployment for IoT Security

  Younsoo Park, Seokhyoen Bae, Shasi Kumar Ramachandran Prabhu, Suman Saha, Peilong Li · 24 September 2026

  The growing deployment of Internet of Things (IoT) devices has increased the need for privacy-preserving intrusion detection systems that operate directly on resource-constrained hardware. Federated Learning enables collaborative model training without sharing raw data, but conventional federated mo…

• An LLM-Assisted AutoML Framework for Intrusion Detection in IoT Networks

  Li Yang · 22 September 2026

  Internet of Things (IoT) systems are increasingly deployed in smart homes, transportation, energy systems, and critical infrastructure. This broad connectivity improves service intelligence, but also enlarges the attack surface of IoT networks. Machine Learning (ML)-based Intrusion Detection Systems…

• Clustering-Based Collective Anomaly Detection in IoT Systems: A Graph Neural Network Approach

  Dalila Khettaf, Djamel Djenouri, Zeinab Rezaeifar, Youcef Djenouri · 22 September 2026

  The rapid advancement of Internet of Things (IoT) technology has led to the widespread deployment of smart, interconnected devices across a range of domains. However, this expansion has also resulted in a substantial increase in network traffic, creating more opportunities for malicious actors to la…

• Identifying Security Platform Product Abuse with Machine Learning

  Shaefer Drew, Michael Brautbar, Paul Knight, Edward Raff, Lana Peric-McDermott, Simran Sarin, Nickolas Machado, Hanna Albright, Vitaly Zaytsev · 21 September 2026

  Product abuse is an individually rare, but growing, problem across the SaaS industry. Highly sophisticated threat actors can misuse security platforms within customer environments or conduct bypass experiments on the product itself. Threat actors can leverage living-off-the-land (LOTL) attacks to av…

• Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defenses

  Hao Fang, Yixiang Qiu, Hongyao Yu, Wenbo Yu, Jiawei Kong, Baoli Chong, Bin Chen, Xuan Wang, Shu-Tao Xia, Ke Xu · 21 September 2026

  Deep Neural Networks (DNNs) have revolutionized various domains with their exceptional performance across numerous applications. However, Model Inversion (MI) attacks, which disclose private information about the training dataset by abusing access to the trained models, have emerged as a formidable …

• Robust Conformal Intrusion Detection via Traffic-Aware Calibration and Attack-Orbit Invariance

  Zhenpeng Li · 18 September 2026

  Large language models fine-tuned for network intrusion detection emit single-point predictions without statistical validity guarantees. Conformal prediction supplies a finite-sample coverage guarantee, but a threshold calibrated on clean traffic fails once an adversary perturbs controllable network …

• Risk-Calibrated Bayesian Streaming Intrusion Detection with SRE-Aligned Decisions

  Michel A. Youssef (Independent Researcher) · 16 September 2026

  [Corrected v2: an audit found that the score, threshold, and latency descriptions below are not what the shared codebase implements, and that the evaluation streams are assembled constructions. See the correction note on the title page and the corrected companion work, arXiv:2605.24696 (corrected v3…

• Not All Relations Are Equal: Relation-Balanced and Calibrated Graph Learning for Provenance-Based Intrusion Detection

  Lijie Zheng, Ji He, Alessandro Brighente, Yulong Shen, Mauro Conti · 16 September 2026

  Provenance-Based Intrusion Detection Systems (PIDSs) detect Advanced Persistent Threats (APTs) by analyzing system interactions. However, existing methods largely treat relations uniformly, overlooking statistical heterogeneity; in CADETS, relation frequencies differ by approximately $140{,}000\time…

• A Three-Axis Stress Test of LLM vs Classical ML for Network Intrusion Detection under Distribution Shift and Adversarial Evasion

  Muhammad Ebad Atif, Muhammad Haider Ali · 15 September 2026

  Large language models are increasingly benchmarked against classical machine learning for network intrusion detection (NIDS), almost always using same-dataset evaluation, and that protocol turns out to be incomplete. Evaluating XGBoost and RoBERTa-LoRA on two independently collected NetFlow v2 netwo…

• On Identifying Adversarial Intent Injection in AI-Native 6G Networks

  Nilesh Chakraborty, Petar Djukic, Burak Kantarci · 14 September 2026

  AI-native 6G networks have brought Intent-Based Networking (IBN) to the forefront, enabling high-level goals to be translated into network configurations. However, this abstraction opens new attack surfaces, primarily adversarial intent injection, where malicious policies are disguised within benign…

• Temporal and Multimodal Deep Learning for Cyberattack Detection in LEO Satellite Systems

  Kyle Stein, Guillermo Francia III, Eman El-Sheikh, Hossain Shahriar · 11 September 2026

  The growing reliance on Low-Earth Orbit (LEO) satellite communication systems has increased the need for intelligent methods capable of detecting cyberattacks across complex and dynamic space environments. Unlike conventional network intrusion detection, satellite systems generate heterogeneous info…

• Concept drift mitigation through community and spectral graph analysis for the detectionof cyberattacks in network traffic

  Julien Michel, Abdul Qadir Khan, Majed Jaber, Pierre Parrend · 10 September 2026

  In network traffic, legitimate behaviours and attack techniques evolve jointly - the phenomenon known as 'concept drift' [1]. Every detector is thereby left obsolete between two updates, and always one step behind adversaries. In this work, we propose to move the point of intervention from the model…

• HoneyRoute: Honeypot-Model Routing for Adversarial LLM Serving

  Han Jin · 10 September 2026

  We introduce HoneyRoute, an inference-serving layer that detects whether an incoming request is malicious and, if so, routes it to a dedicated honeypot model, shielding production while the adversary's interaction is continuously harvested for intelligence. Existing defenses embed traps inside model…

• Learning Intrusion Response Strategies for OT Systems

  Duc Huy Le, Rolf Stadler · 10 September 2026

  Cyberattacks against Operational Technology (OT) systems, which monitor and control industrial processes, pose an increasing threat to essential societal services. For this reason, developing automated intrusion response strategies is highly important. In this paper, we present a formal model of an …

• SIDE: Sensor Impersonation Detection at the Edge via Sequence Prediction

  Nahom Birhan · 9 September 2026

  Some low-cost Internet of Things (IoT) sensor deployments lack device-level source authentication, leaving them vulnerable to impersonation or injected sensor readings. We present a lightweight approach to sensor impersonation detection in a small proof-of-concept study. We formulate detection as a …

• XAI-SDN: An Explainable Entropy-Guided Machine Learning Framework for Real-Time DDoS Detection in Software Defined Networks

  Adeel Ahmad, Ali Akarma, Ahmad Ali, Hammad Muneer, Toqeer Ali Syed · 9 September 2026

  One of the biggest risks faced by Software Defined Networks (SDN) is the Distributed Denial of Service (DDoS) attack in which a compromised controller can make an entire network unusable. To address these challenges, we suggest an entropy-guided machine learning framework, called XAI-SDN, for real-t…