Pith. sign in

REVIEW 6 major objections 5 minor 26 references

On the Veracity of Cyber Intrusion Alerts Synthesized by Generative Adversarial Networks

T0 review · 6 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that GANs, especially with a mutual-information constraint, can synthesize realistic cyber-intrusion alerts that preserve feature dependencies and recover rare, attack-relevant alert values.

desk verdict Application study of GANs for NIDS alert synthesis with a plausible evaluation scheme, but the central MI-benefit claim is confounded and the data tables contain duplicated and copied entries. read the letter →

arxiv 1908.01219 v1 pith:RJW44HM7 submitted 2019-08-03 cs.LG cs.CRstat.ML

Christopher Sweet , Stephen Moskal , Shanchieh Jay Yang This is my paper · ORCID
classification cs.LGcs.CRstat.ML
keywords generativeadversarialnetworksWGAN-GPmutualinformationcyberintrusionalertsfeaturedependencyhistogramintersectionconditionalentropyattackstages
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that a generative adversarial network trained on real network intrusion alerts can synthesize new alerts that match the source data in more than marginal statistics: the joint behavior of alert features—signature, destination service, source IP, and time bin—is preserved, and the dependencies among features are recoverable from the generated samples. The authors test this on alerts from two collegiate penetration-testing competitions, segmented per target IP, using histogram intersection plus conditional and joint entropy to compare ground truth and generated data. They further claim that adding a mutual-information constraint to the generator increases the output of low-probability alert combinations, and that those captured combinations correspond to meaningful attack stages such as targeted scanning. If correct, this gives defenders a way to expand scarce alert logs and to surface rare attacker behaviors that standard generation would miss.

What carries the argument

The argument runs on three instruments. (1) WGAN-GP, a Wasserstein GAN with gradient penalty, trained per target IP on one-hot encoded alert features, with a five-to-one discriminator-to-generator update ratio. (2) A mutual-information constraint WGAN-GPMI, which adds to the generator loss an estimate of the Donsker–Varadhan KL divergence between the noise input and generated samples; the estimate comes from a small auxiliary network, and the resulting gradient is clipped so it never exceeds the adversarial gradient. (3) An analysis stack: histogram intersection for m-tuples of features up to all four, a weighted normalized conditional entropy, and normalized joint entropy, which together expose which feature dependencies the generator has learned and how faithfully. The output-mode and attack-stage comparison then attaches the low-probability values the MI term recovers to analyst-meaningful attack behaviors.

What would settle it

Retrain both models on the same target IPs with identical epochs, batch size, learning rate, and gradient-penalty lambda, and recompute histogram intersection, mode-drop fraction, and attack-stage coverage; if the MI variant no longer improves these metrics, the claimed benefit of the mutual-information constraint fails.

Watch

Extended reading notes

Core claim

The central claim is that WGAN-GP—and more strongly WGAN-GPMI, which adds a neural-estimated mutual-information loss—learns the joint distribution of four categorical alert features well enough to produce synthetic alerts whose histogram intersections with the ground truth remain high even for 4-tuple combinations, and whose weighted normalized conditional entropies closely match those of real alerts. On CPTC'17 targets the mutual-information variant improves histogram intersection by 14.63% on average, and on CPTC'18 by 5.6%; it also reduces the fraction of output modes dropped on most CPTC'17 targets. The rare modes recovered by the MI constraint are not arbitrary: mapped to attack stages, the generated distribution approximates the ground-truth attack-stage distribution, including a targeted-scanning stage that plain WGAN-GP almost never emits. This is offered as evidence that GANs reveal feature dependencies within alerts and can synthesize low-probability, operationally meaningful alerts.

Load-bearing premise

The load-bearing premise is that the WGAN-GP and WGAN-GPMI runs are comparable, so the difference in results comes from the mutual-information term and not from the unequal training budget (200 vs 300 epochs) or the different gradient-penalty weight (0.1 vs 0.4).

Editorial extensions

If this is right

  • Synthetic alert logs could be generated per target IP to expand scarce datasets for training classifiers and predictors of attacker behavior.
  • The entropy and histogram-intersection audit gives a model-agnostic way to check whether any discrete-data generator has learned joint dependencies rather than marginals.
  • Adding the mutual-information constraint can be used deliberately to amplify rare but important modes, provided the extra training budget is acceptable.
  • Attack-stage mapping means generated alerts could be used to reason about which phases of an attack are underrepresented in observed data.
  • The same preprocessing and analysis pipeline transfers to any NIDS alert stream, not just competition data.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Extending the paper's audit to other discrete event logs would test whether the mutual-information constraint's mode-recovery benefit is specific to NIDS alerts or general.
  • A testable operational follow-up: use the per-target generators to create augmented alert sets, then measure whether downstream intrusion detectors trained on them catch rare attack stages they previously missed.
  • The attack-stage mapping suggests generated rare modes could seed synthetic attack graphs, but the paper does not construct such graphs; checking whether the generated rare modes align with actual multi-step attack paths would be a direct extension.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 5 minor

Summary. The paper applies WGAN-GP and a mutual-information-constrained variant (WGAN-GPMI) to synthesize network intrusion alerts on a per-target-IP basis using the CPTC 2017 and 2018 datasets. Fidelity is assessed through histogram intersection for feature combinations, normalized conditional/joint entropy, and counts of dropped/noisy output modes. The authors claim that GANs learn intra-alert feature dependencies and that the mutual information constraint increases generation of low-probability, critical alert values. The paper also maps generated alert signatures to attack stages to provide contextual interpretation.

Significance. If the central claims were substantiated, the work would offer a practical method for expanding scarce cyber-alert data and for exposing feature dependencies that are relevant to intrusion analysis. The per-target preprocessing pipeline and the use of histogram intersection as an interpretable fidelity metric are reasonable starting points. However, the reported evidence is not internally consistent: the comparison between the two models is confounded by different epochs and gradient-penalty coefficients, the CPTC'18 mode-dropping results contradict the rare-alert coverage claim, and several tables contain duplicated or implausibly identical entries. These issues are load-bearing rather than cosmetic, so the paper's conclusions are not currently supported.

major comments (6)
  1. [§V-A, Table V] Table V contains duplicated rows for distinct feature combinations: the 'A,T' row duplicates the 'D' row, 'A,S' duplicates 'S', 'S,D' duplicates 'T', 'A,S,D' duplicates 'S,T', and 'S,D,T' duplicates 'A,S,D,T' across all four target IPs. This indicates that the reported histogram intersections are not independent measurements for these feature tuples, so the table cannot support the claim that the model captures joint feature dependencies.
  2. [§V-B, Table VI] Several conditional entropy rows in Table VI are identical between ground truth and generated data to three decimals across all four target IPs (e.g., T|A, D|T, D|S,T, S|D,T, T|A,D, A|D,T). Given stochastic GAN training and sampling, such exact agreement is highly implausible and suggests a copying or evaluation error. Meanwhile, other rows show large mismatches (e.g., S|A: 0.800 vs 0.229 on 10.0.0.100), which contradicts the text's claim that the model 'closely imitates' the dependencies of the ground truth.
  3. [§V and §V-A] The comparison between WGAN-GP and WGAN-GPMI is confounded: Section V states that WGAN-GP was trained for 200 epochs with gradient-penalty λ=0.1, while WGAN-GPMI was trained for 300 epochs with λ=0.4. Any observed difference in histogram intersection, entropy, or mode coverage could be caused by the training budget or regularization change rather than by the mutual information term, so the paper's attribution of improvements to the MI constraint is not established.
  4. [§V-C, Table IX] Table IX directly contradicts the abstract's claim that the mutual information constraint increases generation of low-probability, critical alert values. For CPTC'18, WGAN-GPMI drops more output modes than WGAN-GP on three of four targets (10.0.1.46: 29 vs 7; 10.0.0.24: 18 vs 10; 10.0.0.22: 18 vs 8). The text acknowledges this only obliquely, yet this outcome is opposite to the stated purpose of the MI constraint.
  5. [§V-C, Table VIII] The numerical interpretation of the noise ratio is inconsistent. For target 10.0.0.27, the noise ratio is 3.593, which means roughly 1/(1+3.593) ≈ 22% of outputs fall within the ground-truth domain, not the '83% chance' stated in the text. Additionally, the statement that in CPTC'18 'for all but target IP 10.0.0.24 the inverse relationship between Dropped and Noisy output modes holds true' is false because 10.0.1.5 exhibits decreases in both dropped and noisy modes.
  6. [§V-B, Figs. 3-4 and Tables VI-VII] The dependency analysis for target 10.0.0.22 combines Fig. 3, which is constructed from WGAN-GP results, with Tables VI and VII, which report WGAN-GPMI results. Mixing results from different models in a single analysis invalidates the specific conclusions drawn about conditional entropy and histogram intersection differences for that target.
minor comments (5)
  1. [§III, Eq. (2)] Equation (2) appears malformed: the DV KL divergence term is written as E[Pgz] + log(E[e^{Pg⊗Pz}]), which is not a recognizable representation of the Donsker-Varadhan objective; please provide the correct formula.
  2. [§III] The description of the WGAN-GP gradient penalty states that it constrains the gradient of D(Pz) with samples from Pz, but in the original formulation the penalty is applied to interpolated samples between the real and generated distributions.
  3. [§V-A] The text says 'the standard deviation for individual scores was never higher than 0.01%', but the tables report standard deviations up to 0.010, which is 1%; please correct the unit or value.
  4. [§V-C and Fig. 6] The caption of Fig. 6 refers to '10.0.0.23' while the accompanying text discusses 10.0.0.27; the IP address should be made consistent.
  5. [Global] Minor typographical errors include 'one's' in §V-A, 'Privledges' in Table III, and 'Proccedings' in references [13], [14], and [18]; these should be corrected.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation chain: the paper is an empirical GAN evaluation, though reported experiments contain confounds and data anomalies that undermine the conclusions.

full rationale

This paper contains no derivation chain that could reduce to its inputs by construction. The central claims are empirical: GANs are trained on per-target CPTC alert data and then evaluated by histogram intersection, conditional/joint entropy, and mode-coverage statistics against the same ground-truth distribution. That is standard generative-model assessment, not a logical tautology; the generator could easily fail to reproduce the training distribution. The mutual-information comparison is also not forced by construction: the MI term is an explicit regularizer added to the generator loss, and the claimed effect on rare-alert coverage is an experimental observation rather than an identity. The time-bin method cited as [20] is a self-citation with overlapping authors, but it is described operationally in Section IV-A and is not load-bearing for the central claims. The more serious problems are experimental validity issues, not circularity: Section V reports that WGAN-GP was trained for 200 epochs while WGAN-GPMI was trained for 300 epochs, and the gradient-penalty lambda values differ (0.1 vs 0.4), so the MI benefit cannot be isolated. In addition, Table V contains duplicated rows (e.g., A,T repeats D; A,S repeats S; S,D repeats T), and Table VI shows many ground-truth and generated conditional entropies identical to three decimals, which is extraordinary if genuinely measured. These anomalies undermine support for the paper's conclusions, but they do not constitute a circular derivation. No equation, fitted parameter, or self-citation chain makes the claimed results equivalent to their own inputs.

Assumptions & free parameters 6 free parameters · 6 assumptions · 1 invented entities

The paper is an empirical application study; its central claims rest on hand-chosen hyperparameters, a manual attack-stage mapping, and domain assumptions about the CPTC alert data. The most consequential free parameters are the different training budgets and gradient penalty lambdas used for WGAN-GP and WGAN-GPMI, which prevent clean attribution of observed differences to the mutual-information term.

free parameters (6)
  • Gradient penalty lambda (WGAN-GPMI) = 0.4
    Set to 0.4 for WGAN-GPMI and 0.1 for WGAN-GP in Section V; not held constant, so the comparison is confounded with the mutual-information term.
  • Training epochs (WGAN-GPMI) = 300
    WGAN-GPMI trained for 300 epochs while WGAN-GP trained for 200 epochs, adding another confound in Section V.
  • Learning rate = 5e-4 or 5e-5
    Section III states learning rate 5e-4, Section V says ADAM learning rate 5e-5; the inconsistency is unaddressed and affects training.
  • Time-bin cut thresholds = 10% of total data and 0.5% between consecutive events
    Used to segment timestamps into attack stages (Section IV.A), following self-cited methodology [20]; these thresholds are hand-chosen.
  • Histogram intersection dependency cutoff = 5%
    Used to color dependency graphs as dependent or not (Section V.B); arbitrary threshold.
  • Architecture hyperparameters = hidden dim 128, batch 100, noise 64, D:G 5:1
    Fixed by hand in Section III with no sensitivity analysis.
assumptions (6)
  • domain assumption CPTC competition alert data is representative of real-world cyber-attack alerts
    The paper generalizes from two collegiate competitions (Section IV.A) without arguing the alert distribution matches production networks.
  • domain assumption Suricata NIDS alerts constitute ground truth for attack actions
    All analysis treats the captured alerts as the target behavior (Sections I, IV.A); missed or false alerts are not modeled.
  • domain assumption Manual mapping of alert signatures to attack stages is correct
    The 12 attack stages in Table III are assigned by manual examination (Section IV.D) with no validation or inter-rater agreement.
  • domain assumption Time-binning from smoothed timestamp histograms captures attack stages
    Time bins T are built with thresholds from self-cited [20] (Section IV.A); no independent validation that bins correspond to attack phases.
  • domain assumption One-hot encoding with argmax post-processing preserves feature dependencies
    Section III converts continuous outputs to discrete one-hot vectors via argmax, which may discard information before entropy analysis.
  • standard math Standard definitions of histogram intersection, conditional entropy, joint entropy, WGAN-GP loss, and MINE estimate are valid
    Equations (1)-(7) rely on standard results from Arjovsky et al., Gulrajani et al., and Belghazi et al.
invented entities (1)
  • Attack-stage taxonomy for alert signatures
    purpose: Categorize generated alert signatures into analyst-meaningful stages such as IP Scan and Data Exfiltration
    Defined manually in Table III and assigned by expert judgment (Section IV.D). No external benchmark or inter-annotator check is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of On the Veracity of Cyber Intrusion Alerts Synthesized by Generative Adversarial Networks." pith.science (2026). https://pith.science/paper/RJW44HM7

@misc{pith2026190801219,
  author       = {Pith},
  title        = {Pith review of: On the Veracity of Cyber Intrusion Alerts Synthesized by Generative Adversarial Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RJW44HM7}},
  note         = {Machine review of arXiv:1908.01219}
}
read the original abstract

Recreating cyber-attack alert data with a high level of fidelity is challenging due to the intricate interaction between features, non-homogeneity of alerts, and potential for rare yet critical samples. Generative Adversarial Networks (GANs) have been shown to effectively learn complex data distributions with the intent of creating increasingly realistic data. This paper presents the application of GANs to cyber-attack alert data and shows that GANs not only successfully learn to generate realistic alerts, but also reveal feature dependencies within alerts. This is accomplished by reviewing the intersection of histograms for varying alert-feature combinations between the ground truth and generated datsets. Traditional statistical metrics, such as conditional and joint entropy, are also employed to verify the accuracy of these dependencies. Finally, it is shown that a Mutual Information constraint on the network can be used to increase the generation of low probability, critical, alert values. By mapping alerts to a set of attack stages it is shown that the output of these low probability alerts has a direct contextual meaning for Cyber Security analysts. Overall, this work provides the basis for generating new cyber intrusion alerts and provides evidence that synthesized alerts emulate critical dependencies from the source dataset.

Figures

Figures reproduced from arXiv: 1908.01219 by the authors.

Figure 1
Figure 1. WGAN-GP Model Architecture: The real samples provided to [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. WGAN-GPMI Model Architecture: The Generator and Dis [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 4
Figure 4. Intersection of Histogram Scores for combinations of feature [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figures from the paper (3 more)
Figure 3
Figure 3. Figure 3: Intersection of Histogram Scores for combinations of feature [PITH_FULL_IMAGE:figures/full_fig_p007_3.png]
Figure 5
Figure 5. Figure 5: Distribution of Attack Stages (AS) on target IP 10.0.0.22 from CPTC’17. Note that the WGAN-GPMI model results [C] have a much [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: CPTC’17 Target IPs 10.0.0.22 and 10.0.0.23: The WGAN [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

26 extracted references · 20 canonical work pages

  1. [1]

    AI2 : Training a big data machine to defend,

    K. Veeramachaneni, I. Arnaldo, V . Korrapati, C. Bassias, and K. Li, “AI2 : Training a big data machine to defend,” in Proceedings of IEEE 2nd International Conference on Big Data Security on Cloud , Beijing, China, June 2016, pp. 49–54

    work page 2016

  2. [2]

    RNN-based early cyber- attack detection for the tennessee eastman process,

    P. Filonov, F. Kitashov, and A. Lavrentyev, “RNN-based early cyber- attack detection for the tennessee eastman process,” in Proceedings of ICML Time Series Workshop , Sydney, Australia, August 11 2017

    work page 2017

  3. [3]

    Multivariate industrial time series with cyber-attack simulation: Fault detection using an LSTM-based predictive data model,

    P. Filonov, A. Lavrentyev, and A. V orontsov, “Multivariate industrial time series with cyber-attack simulation: Fault detection using an LSTM-based predictive data model,” in Proceedings of NIPS Time Series Workshop, Barcelona, Spain, December 9 2016

    work page 2016

  4. [4]

    Advanced vulnerability analysis and intrusion detection through predictive attack graphs,

    S. Noel and S. Jajodia, “Advanced vulnerability analysis and intrusion detection through predictive attack graphs,” Critical Issues in C4I, AFCEA Solutions Series. International Journal of Command and Con- trol, 2009

    work page 2009

  5. [5]

    Projecting cyberattacks through variable-length markov models,

    D. S. Fava, S. R. Byers, and S. J. Yang, “Projecting cyberattacks through variable-length markov models,” IEEE Transactions on Information Forensics and Security, vol. V ol. 3, no. Num. 3, pp. 359–369, September 2008

    work page 2008

  6. [6]

    Generative adversarial nets,

    I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y . Bengio, “Generative adversarial nets,” in Proceedings of Advances in Neural Information Processing Systems 27 , Z. Ghahramani, M. Welling, C. Cortes, N. D. Lawrence, and K. Q. Weinberger, Eds. Curran Associates, Inc., 2014, pp. 2672–2680. [Online]. Available...

    work page 2014

  7. [7]

    Wasserstein generative adversarial networks,

    M. Arjovsky, S. Chintala, and L. Bottou, “Wasserstein generative adversarial networks,” in Proceedings of the 34th International Conference on Machine Learning, ICML , Sydney, NSW, Australia, August 6-11 2017, pp. 214–223. [Online]. Available: http://proceedings. mlr.press/v70/arjovsky17a.html

    work page 2017

  8. [8]

    Improved training of wasserstein gans,

    I. Gulrajani, F. Ahmed, M. Arjovsky, V . Dumoulin, and A. Courville, “Improved training of wasserstein gans,” in Proceedings of Advances in Neural Information Processing Systems 30 , Long Beach, California, USA, December 4-9 2017, pp. 5769–5779. [Online]. Available: https: //papers.nips.cc/paper/7159-improved-training-of-wasserstein-gans

    work page 2017

Show all 26 references
  1. [9]

    MINE: mutual information neural estimation,

    I. Belghazi, S. Rajeswar, A. Baratin, R. D. Hjelm, and A. C. Courville, “MINE: mutual information neural estimation,” in Proceedings of International Conference on Machine Learning , Stockholmsmssan, Stockholm Sweden, July 10-15 2018. [Online]. Available: http: //arxiv.org/abs...

    2018 arXiv

  2. [10]

    A style-based generator architecture for generative adversarial networks,

    T. Karras, S. Laine, and T. Aila, “A style-based generator architecture for generative adversarial networks,” in Proceedings of The IEEE Conference on Computer Vision and Pattern Recognition (CVPR), (To Appear), vol. abs/1812.04948, Long Beach, California, USA, June 15-21 2019...

    2019 arXiv

  3. [11]

    Unpaired image-to-image translation using cycle-consistent adversarial networks,

    J.-Y . Zhu, T. Park, P. Isola, and A. A. Efros, “Unpaired image-to-image translation using cycle-consistent adversarial networks,” Venice, Italy, October 22-29 2017, pp. 2242–2251

    2017

  4. [12]

    Photo- realistic single image super-resolution using a generative adversarial network,

    C. Ledig, L. Theis, F. Huszar, J. Caballero, A. P. Aitken, A. Tejani, J. Totz, Z. Wang, and W. Shi, “Photo- realistic single image super-resolution using a generative adversarial network,” in Proceedings of The IEEE Conference on Computer Vision and Pattern Recognition (CVPR) ...

    2017 arXiv

  5. [13]

    Dialogue generation with gan,

    H. Su, X. Shen, P. Hu, W. Li, and Y . Chen, “Dialogue generation with gan,” in Proccedings of AAAI Conference on Artificial Intelligence , New Orleans, Louisiana, USA, February 2-7 2018. [Online]. Available: https://aaai.org/ocs/index.php/AAAI/AAAI18/paper/view/16508

    2018

  6. [14]

    Musegan: Multi-track sequential generative adversarial networks for symbolic mu- sic generation and accompaniment,

    H.-W. Dong, W.-Y . Hsiao, L.-C. Yang, and Y .-H. Yang, “Musegan: Multi-track sequential generative adversarial networks for symbolic mu- sic generation and accompaniment,” inProccedings of AAAI Conference on Artificial Intelligence , New Orleans, Louisiana, USA, February 2-7 2018

    2018

  7. [15]

    V oice impersonation using generative adversarial networks,

    Y . Gao, R. Singh, and B. Raj, “V oice impersonation using generative adversarial networks,” inProceedings of IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Calgary, Alberta, Canada, April 15-20 2018, pp. 2506–2510

    2018

  8. [16]

    Bringing a gan to a knife-fight: Adapting malware communication to avoid detection,

    M. Rigaki and S. Garca, “Bringing a gan to a knife-fight: Adapting malware communication to avoid detection,” in Proceedings of IEEE Security and Privacy Workshops (SPW) , San Francisco, California, USA, May 24 2018

    2018

  9. [17]

    IDSGAN: generative adversarial networks for attack generation against intrusion detection,

    Z. Lin, Y . Shi, and Z. Xue, “IDSGAN: generative adversarial networks for attack generation against intrusion detection,” CoRR, vol. abs/1809.02077, 2018. [Online]. Available: http://arxiv.org/abs/1809. 02077

    2018 arXiv

  10. [18]

    Black-box attacks against RNN based malware detection algorithms,

    W. Hu and Y . Tan, “Black-box attacks against RNN based malware detection algorithms,” in Proccedings of AAAI Conference on Artificial Intelligence, New Orleans, Louisiana, USA, February 2-7 2018

    2018

  11. [19]

    Evading machine learning malware detection,

    H. S. Anderson, A. Kharkar, B. Filar, and P. Roth, “Evading machine learning malware detection,” inProceedings of Blackhat, Mandalay Bay, Las Vegas, NV , July 22-27 2017

    2017

  12. [20]

    Differentiating and predicting cyberattack behaviors using lstm,

    I. Perry, L. Li, C. Sweet, S. J. Yang, and A. Okutan, “Differentiating and predicting cyberattack behaviors using lstm,” in IEEE Conference on Dependable and Secure Computing , Kaohsiung, Taiwan, December 10-13 2018

    2018

  13. [21]

    Tiresias: Predicting security events through deep learning,

    Y . Shen, E. Mariconti, P. A. Vervier, and G. Stringhini, “Tiresias: Predicting security events through deep learning,” in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’18. New York, NY , USA: ACM, 2018, pp. 592–

    2018

  14. [22]

    Deep security: Cyber security threat behavior classification,

    I. Faber and G. Malloy, “Deep security: Cyber security threat behavior classification,” ”http://cs230.stanford.edu/projects spring 2018/reports/ 8285947.pdf”, 2018

    2018

  15. [23]

    Machine learning in cyber-security - problems, challenges and data sets,

    I. Amit, J. Matherly, W. Hewlett, Z. Xu, Y . Meshi, and Y . Weinberger, “Machine learning in cyber-security - problems, challenges and data sets,” vol. abs/1812.07858, 2019. [Online]. Available: http: //arxiv.org/abs/1812.07858

    2019 arXiv

  16. [24]

    An improved intrusion detection framework based on artificial neural networks,

    L. Hu, Z. Zhang, H. Tang, and N. Xie, “An improved intrusion detection framework based on artificial neural networks,” in Proceedings of 2015 11th International Conference on Natural Computation (ICNC) , Zhangjiajie, China, August 15-17 2015, pp. 1115–1120

    2015

  17. [25]

    Service name and transport protocol port number registry,

    J. Touch, E. Lear, A. Mankin, M. Kojo, K. Ono, M. Stiemerling, L. Eggert, A. Melnikov, W. Eddy, A. Zimmermann, B. Trammell, J. Iyengar, A. Mankin, M. Tuexen, E. Kohler, and Y . Nishida, “Service name and transport protocol port number registry,” 2018. [Online]. Available: http...

    2018

  18. [605]

    Available: http://doi.acm.org/10.1145/3243734.3243811

    [Online]. Available: http://doi.acm.org/10.1145/3243734.3243811

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.