Pith. sign in

REVIEW 3 major objections 7 minor 37 references

Improving Network Threat Detection by Knowledge Graph, Large Language Model, and Imbalanced Learning

T0 review · 3 major / 7 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A knowledge graph, an imbalanced-learning classifier with learned per-sample weights, and an LLM interpreter together raise threat capture by 3–4% and add plain-English risk explanations.

desk verdict The system integration is real, but the central 3–4% gain is built on a learning objective that is degenerate as printed, so the empirical claim needs a corrected method and a proper evaluation before anyone should rely on it. read the letter →

arxiv 2501.16393 v2 pith:SFIB4GHZ submitted 2025-01-26 cs.LG cs.CRstat.ML

Lili Zhang , Quanyan Zhu , Herman Ray , Ying Xie This is my paper · ORCID
classification cs.LGcs.CRstat.ML
keywords networkthreatdetectionknowledgegraphlargelanguagemodelimbalancedlearningmulti-agentAIweightedlog-likelihoodinsideranomaly
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper aims to establish that a three-part system detects insider threats better than a single classifier: a knowledge graph records user activities and their relationships, an imbalanced-learning model prunes weak or redundant graph information and scores the likelihood that a logon session is a known threat, and a large language model translates analyst questions into graph queries and writes plain-English explanations of the risk scores. On a public insider-threat dataset in which only 0.34% of logons are labeled threats, the authors show that a gradient-boosting model trained with per-sample weights learned from a custom log-likelihood captures more true threats among the riskiest logons than the same model trained without those weights: 60% versus 56% at the top 3% of predicted risky logons, and 98% versus 95% at the top 30%. The paper also proves that the weighted estimator is consistent with the usual $O(1/\sqrt{n})$ generalization rate, bounds how far the weighted Jaccard graph-similarity score can drop under bounded activity changes, and frames the three agents' cooperation as a convex cooperative game with a non-empty core. If the central claim is right, the framework gives security analysts a modest but concrete gain in catching rare threats plus natural-language interpretations that connect each risk score to specific user activities.

What carries the argument

The load-bearing machinery is the weighted log-likelihood objective in Equation 2, in which each training sample $i$ receives its own learned weight $\lambda_i$; these weights are learned from 70% of the data, then applied when training the gradient-boosting classifier, and the same weights weigh knowledge-graph nodes and edges so that strong threat signals are retained and weak or redundant signals are pruned. The second piece is the weighted Jaccard similarity $J(G,H)$ between a user's current and previous activity graphs, with the paper proving that a bounded total weight change $\Delta$ relative to total weight $W$ keeps $J$ above $(W-\Delta)/(W+\Delta)$, so an abrupt drop in $J$ acts as a calibrated anomaly signal. The third piece is the LLM agent layer, which converts natural-language questions into graph queries, retrieves indexed text content, and generates human-readable risk interpretations; the agents' cooperation is modeled as a supermodular cooperative game, one in which adding an agent is more valuable when the other agents are already cooperating, so the Shapley value lies in the core.

What would settle it

Re-run the Model 1 versus Model 2 comparison under repeated k-fold cross-validation on the same dataset; if the top-3% capture-rate advantage does not persist across folds (or falls within noise), the claimed 3–4% gain is split-dependent. A complementary check is a label-shuffling test: if shuffled labels still produce a similar gain, the learned weights are absorbing noise rather than threat signal.

Watch

Extended reading notes

Core claim

The central claim is that the three components work together rather than separately: the knowledge graph supplies structural activity patterns, the imbalanced-learning layer prunes and weights the graph and scores known threats, and the LLM retrieves and interprets the resulting evidence. The quantitative core is the learned-weight classifier: Model 2, a gradient-boosting model trained with per-sample weights $\lambda_i$ from the custom weighted log-likelihood (Equation 2), outperforms Model 1 without those weights on the same validation data, capturing 60% versus 56% of true threats among the top 3% predicted risky logons and 98% versus 95% among the top 30%, with area under the precision-recall curve rising from 0.186 to 0.204. The paper further claims that a drop in weighted Jaccard similarity between a user's current and previous activity graphs flags unknown-threat behavior shifts, and that the LLM layer can summarize user activity and explain both known-threat and unknown-threat likelihoods in natural language, as demonstrated in an application demo.

Load-bearing premise

The load-bearing premise is that the per-sample weights learned from the custom log-likelihood on 70% of the historical data generalize to the held-out 30%, so the 3–4% capture-rate improvement reflects real signal rather than overfitting or a favorable split.

Editorial extensions

If this is right

  • Security teams can review fewer logons to find the same threats: the learned-weight model catches 60% of true threats in the top 3% of predicted risky logons, versus 56% without weights, and 98% versus 95% in the top 30%.
  • The weighted Jaccard drop gives an independent signal for unknown threats, because an anomalous burst of new or changed activity edges pushes the graph-similarity score below its normal near-1 range.
  • Analysts get an on-demand plain-language explanation of why a user is risky, because the LLM retrieves the relevant subgraph and classifier scores instead of being fine-tuned on threat text.
  • The framework supports agile, online detection: new events are added as edges to the knowledge graph at each time step, so the graph and the anomaly score update as activity streams in.
  • The cooperative-game result guarantees that the three agents can be credited in a stable way, so no subset of agents has an incentive to break away from the collaboration.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: the same learned-weight recipe is a general rare-event classifier, so it should be testable on other imbalanced security logs such as intrusion alerts or phishing reports, where the minority class is also below 1%.
  • Beyond the paper: the paper never measures whether the LLM's explanations are accurate or helpful; a human-subject study comparing analyst decision time and correctness with and without the explanations would settle that.
  • Beyond the paper: the Jaccard-drop anomaly signal and the weighted classifier are assumed complementary but never jointly evaluated; an injected-anomaly experiment could measure whether the similarity signal fires on novel attack patterns before the classifier has seen them.
  • Beyond the paper: the supermodularity of the cooperative game is assumed rather than estimated; computing empirical Shapley values from ablations of each agent on realistic workloads would test whether the core is actually non-empty for this system.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. The paper proposes a multi-agent framework for network threat detection that combines a user-activity knowledge graph, an imbalanced-learning-weighted classifier, and a large language model for retrieval and interpretation. The framework is applied to the CERT insider-threat dataset, and the authors report that the weighted Gradient Boosting model captures 3-4% more true threats at fixed false-positive operating points (Table 1) and that an LLM-based demo provides natural-language risk explanations. The paper also contains three theoretical components: a consistency result for weighted logistic regression (Theorem 1), a bound on the weighted Jaccard similarity under graph updates (Theorem 2), and a cooperative-game core result for LLM collaboration (Theorem 3). The central empirical claim is that learning per-sample weights via Equation (2) improves threat-capture rate over an unweighted model.

Significance. If the claimed 3-4% detection improvement were properly supported, the imbalanced-learning weighting component would be a modest but practically meaningful contribution to insider-threat detection, and the LLM interpretation layer addresses a real usability gap. The use of a public benchmark (CERT) is a strength, as are the explicit theoretical bounds in Theorems 2 and 3. However, the empirical support is currently preliminary: Table 1 rests on a single 70/30 split with no error bars, no cross-validation, and only one baseline; the LLM interpretation is demonstrated on substituted online documents rather than the CERT content; and the printed learning objective in Equation (2) is degenerate. These issues are load-bearing for the paper's central claims, so the contribution is not yet established in reproducible form.

major comments (3)
  1. [§4.3, Eq. (2); §5.2.3, Table 1] The objective in Equation (2) as printed is degenerate and does not define the claimed 'learnable weights' procedure. For a positive sample (y_i = 1), the term is −λ_i log π(β^T x_i), and since log π(β^T x_i) is negative, minimizing over λ_i drives λ_i to zero (or to −∞ if λ_i is unrestricted); no constraint or penalty on λ_i is stated anywhere. This means the 4% and 3% gains in Table 1 cannot be reproduced from the manuscript as written. The reference to [Zhang et al., 2022] does not supply the missing specification, and Theorem 1 uses a fixed class weight α > 1 rather than per-sample learned λ_i, so it does not justify the procedure. The authors must state the actual constrained/regularized objective (or reproduce the exact optimization from the cited paper) and confirm that Table 1 was generated with that objective.
  2. [§5.2.3, Table 1; §6 Future Work] The quantitative comparison is based on a single 70/30 train-validation split, with no error bars, no repeated runs, no cross-validation, and no ablations. The paper's own Future Work section lists 'Cross-validation experiments' as a future step, which confirms that the reported numbers are not backed by variance estimates. The 3-4% gain could be an artifact of a favorable split or of the unregularized weight-fitting procedure in Equation (2). To support the central claim, the authors should provide at least multiple random splits or cross-validated estimates, and compare against a standard cost-sensitive baseline (e.g., fixed class weights) in addition to the unweighted model.
  3. [§5.3.2, Figure 8] The LLM interpretation claim is not demonstrated on the CERT dataset used for the quantitative evaluation. The text explicitly states that the CERT content produced incoherent responses and that 'for demonstration purposes, we used the online public documents to build the content nodes in the graph.' This contradicts the abstract's phrasing that the solution adds interpretations 'based on the user activities' and the Section 3 statement that all experiments use CERT. The LLM demo should either be clearly labeled as a synthetic illustration, or the authors should show how CERT content is preprocessed and interpreted; in either case, the 80%/70% risk figures in Figure 8 need a provenance or a caveat.
minor comments (7)
  1. [§4.3 and §4.3.1] There is an inconsistency between the general weighted logistic regression introduced at the start of §4.3, which fixes w_i = α for positive samples and w_i = 1 for negative samples, and the per-sample learned λ_i in Equation (2) and §5.2.3. Please reconcile these and state clearly which weighting scheme is actually used for the experiments.
  2. [§4.3.1, proof of Theorem 1] The stated uniform deviation bound O(√(log(1/δ)/n)) is too strong as written; for a bounded and Lipschitz loss, uniform convergence over a parameter set typically incurs a dependence on the dimension or covering number. The consistency claim is standard, but the proof sketch should be corrected to avoid an unrealistic rate.
  3. [§5.2.3, Table 1] The term 'Gain' in Table 1 is not defined in the caption or text. Clarify whether it is recall at a fixed ranked cutoff and how the cutoff is chosen.
  4. [§5.2.3] The phrase 'the percentage of threats detected is 0.34%' should be revised to 'the proportion of positive (threat) samples in the training data is 0.34%,' since detection rate is not a property of the data alone.
  5. [§5.3.2] The bullet stating that the LLM interprets risk 'based on its own training knowledge base from the whole Web' is vague and raises the risk of unsupported or hallucinated explanations. If this is a design choice, it should be justified and ideally evaluated by human reviewers; the paper currently provides no evaluation of explanation quality.
  6. [§3 and §5.3.2] The statement at the end of Section 3 that 'All experiments in this paper use this dataset' is contradicted by the use of online public documents for the LLM demo in Section 5.3.2. Please correct the inconsistency.
  7. [§5.3.1] Minor typos and capitalization issues appear, e.g., 'The Content of the user's Email, File, and Web Visits are important behavior factors.' Please proofread throughout.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the claimed 3-4% improvement is a held-out empirical comparison, and the self-citations to the weighting method are not load-bearing derivations.

full rationale

The paper's central quantitative claim is a genuine train/validation comparison on the external CERT Insider Threat Test Dataset. In Section 5.2.3, the per-sample weights λ_i are learned on the 70% training split through Equation 2, and Model 2 is evaluated on the remaining 30% split, with the gain reported in Table 1. Nothing in Equation 2 or the cited prior work forces the validation-set improvement of 60% vs 56% or 98% vs 95%; those numbers are measured outcomes, not identities. The self-citations to Zhang et al. (2020, 2022) provide the weighted-log-likelihood construction, but the paper does not ask the reader to accept the improvement on the authority of those citations alone, and the cited results are externally published and falsifiable. Theorems 1-3 are standard consistency, Jaccard-bound, and Shapley-core results used as supporting context rather than as generators of the empirical predictions. The main substantive caveats in the paper are correctness and robustness issues, not circularity: Equation 2, as printed, omits any constraint or regularization on λ_i and is degenerate as an optimization objective, and the paper's own Future Work section concedes that cross-validation and baseline comparisons remain to be done. These are important limitations, but they do not amount to the paper's predictions being equivalent to its inputs by construction.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

No new physical entities, forces, or conserved quantities are postulated. The LLM agents (Collaborator 1, Collaborator 2, Supervisor) are software components of the proposed system, not hypothesized entities requiring independent falsifiable evidence. The free parameters listed are the fitted or hand-chosen quantities the central empirical claim depends on.

free parameters (5)
  • learned sample weights λ_i = per-sample, not reported
    Equation 2 jointly optimizes β and per-sample weights λ_i on the 70% training split; the same weights are then applied to a Gradient Boosting Model. The number of fitted parameters scales with sample size and no regularization is described, so the method may overfit. Section 5.2.3.
  • feature selection threshold or selected variables = 16 of 56 variables retained; cutoffs not given
    Section 5.2.2 selects features via information value and variable clustering, but the criteria and whether selection used only training labels are unspecified. This choice affects which graph nodes and edges are pruned.
  • GBM hyperparameters = not reported
    Section 5.2.3 trains two Gradient Boosting Models without reporting tree count, learning rate, depth, or regularization, preventing replication.
  • reporting cutoffs = top 3% and top 30% of predicted risky logons
    Table 1's 4% and 3% gains are measured at these chosen probability cutoffs; the gains vary with cutoff, and the paper states 'around 2%' overall improvement at other cutoffs.
  • reference time window τ = e.g., 1 month in demo (Jan 2024 vs Dec 2023)
    The weighted Jaccard anomaly score compares G_t to a reference G_{t-τ} or baseline; the choice of τ is a free modeling choice that affects anomaly scores. Section 4.2, Figure 8.
assumptions (5)
  • standard math Weighted likelihood estimators for logistic regression are consistent and asymptotically normal under stated regularity conditions.
    Theorem 1 relies on this classical result, citing Xue et al. 2021. The proof sketch is not fully formal and assumes bounded features and identifiability. Section 4.3.1.
  • standard math The total edge weights of the two compared graphs are equal (W) after normalization.
    Theorem 2's bound J ≥ (W−Δ)/(W+Δ) requires both graphs to have total weight W; the paper says 'after possible normalization' but does not define the normalization procedure. Section 4.3.2.
  • ad hoc to paper The agents' value function v is supermodular, so bigger coalitions yield larger marginal gains.
    Section 4.4 assumes supermodularity ('having all three agents cooperate yields more detection value than any subset') without empirical justification; the theorem that the core is non-empty is then a classical result. This assumption is not used in the experiments.
  • domain assumption CERT Insider Threat Test Dataset event logs and threat labels provide a valid proxy for enterprise insider-threat detection.
    All experiments use this dataset (Section 3); the paper relies on its ground-truth labels being correct and representative.
  • domain assumption Linking long text content to embeddings in a vector database is an efficient way to incorporate text into the knowledge graph.
    Section 5.3.1 asserts this without benchmarking; the demo then uses online public documents instead of the dataset's content because the dataset text is incoherent (Section 5.3.2).

how reviews work

0 comments
Cite this review

Pith. "Pith review of Improving Network Threat Detection by Knowledge Graph, Large Language Model, and Imbalanced Learning." pith.science (2026). https://pith.science/paper/SFIB4GHZ

@misc{pith2026250116393,
  author       = {Pith},
  title        = {Pith review of: Improving Network Threat Detection by Knowledge Graph, Large Language Model, and Imbalanced Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SFIB4GHZ}},
  note         = {Machine review of arXiv:2501.16393}
}
read the original abstract

Network threat detection has been challenging due to the complexities of attack activities and the limitation of historical threat data to learn from. To help enhance the existing practices of using analytics, machine learning, and artificial intelligence methods to detect the network threats, we propose an integrated modelling framework, where Knowledge Graph is used to analyze the users' activity patterns, Imbalanced Learning techniques are used to prune and weigh Knowledge Graph, and LLM is used to retrieve and interpret the users' activities from Knowledge Graph. The proposed framework is applied to Agile Threat Detection through Online Sequential Learning. The preliminary results show the improved threat capture rate by 3%-4% and the increased interpretabilities of risk predictions based on the users' activities.

Figures

Figures reproduced from arXiv: 2501.16393 by the authors.

Figure 1
Figure 1. LLM Question-Answer Process knowledge, theory and data, construct and execute codes, and analyze results using multiple numerical methods [Ni and Buehler, 2024]. Another example is that multi-agent AI systems are used to enhance the decision support for smart city management, combining LLMs with existing urban information systems to process complex routing queries and generate contextually relevant responses, achiev… view at source ↗
Figure 2
Figure 2. Multi-agent AI Framework of Network Threat Detection [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. LLM-based Knowledge Graph Retriever and Interpreter [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: User-Activity Knowledge Graph Schema 5.2 Graph Pruning and Graph Weighting using Imbalanced Learn￾ing techniques To reduce redundant and insignificant information in the Knowledge Graph and improve the al￾gorithm efficiency, we prune and weigh the graph using Imbalance…
Figure 5
Figure 5. Figure 5: User CSC0217 Activity Graph and Change Score [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 6
Figure 6. Figure 6: User-Activity Knowledge Graph Schema Extended with Content Texts [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: Application Demo Data Workflow In this experiment, the open source graph database Nebula is used to build and store user activity graphs, the Python package llama-index is used to index Knowledge Graph, the text￾embedding model Text-embedding-3-large is used to vectori…
Figure 8
Figure 8. Figure 8: Application Demo Results 6 Future Work We outline a formal roadmap for system benchmarking and performance goals: • Performance Metrics: Define specific targets for latency and throughput. For example, under a streaming rate of thousands of events per second, the syste…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

37 extracted references · 31 canonical work pages

  1. [1]

    Akoglu, H

    L. Akoglu, H. Tong, and D. Koutra. Graph-based anomaly detection and description: a survey. Data Mining and Knowledge Discovery, 29 0 (3): 0 626--688, 2015

    work page 2015

  2. [2]

    T. B. Brown, B. Mann, N. Ryder, M. Subbiah, J. Kaplan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sastry, A. Askell, S. Agarwal, A. Herbert-Voss, G. Krueger, T. Henighan, R. Child, A. Ramesh, D. M. Ziegler, J. Wu, C. Winter, C. Hesse, M. Chen, E. Sigler, M. Litwin, S. Gray, B. Chess, J. Clark, C. Berner, S. McCandlish, A. Radford, I. Sutskever, and D. Amod...

    work page 2020

  3. [3]

    T. Chen, C. Dong, M. Lv, Q. Song, H. Liu, T. Zhu, K. Xu, L. Chen, S. Ji, and Y. Fan. Apt-kgl: An intelligent apt detection system based on threat knowledge and heterogeneous provenance graph learning. IEEE Transactions on Dependable and Secure Computing, 2022

    work page 2022

  4. [4]

    Z. Chen, Q. Yan, H. Han, S. Wang, L. Peng, L. Wang, and B. Yang. Machine learning based mobile malware detection using highly imbalanced network traffic. Information Sciences, 433: 0 346--364, 2018

    work page 2018

  5. [5]

    Chong, Y

    Y. Chong, Y. Ding, Q. Yan, and S. Pan. Graph-based semi-supervised learning: A review. Neurocomputing, 408: 0 216--230, 2020

    work page 2020

  6. [6]

    Cyber incident response to public safety answering points: A state’s perspective

    CISA. Cyber incident response to public safety answering points: A state’s perspective. https://www.cisa.gov/sites/default/files/publications/22\_0414\_cyber\_incident\_case\_studies\_state\_final\_508c.pdf, 2023. Accessed: November 1, 2024

    work page 2023

  7. [7]

    Internet crime report 2023

    FBI. Internet crime report 2023. https://www.ic3.gov/AnnualReport/Reports/2023\_IC3Report.pdf, 2024. Accessed: November 1, 2024

    work page 2023

  8. [8]

    Guastalla, Y

    M. Guastalla, Y. Li, A. Hekmati, and B. Krishnamachari. Application of large language models to ddos attack detection. In International Conference on Security and Privacy in Cyber-Physical Systems and Smart Vehicles, pages 83--99. Springer, 2023

    work page 2023

Show all 37 references
  1. [9]

    He and Y

    H. He and Y. Ma. Imbalanced learning: foundations, algorithms, and applications. 2013

    2013

  2. [10]

    Hogan, E

    A. Hogan, E. Blomqvist, M. Cochez, C. d'Amato, G. de Melo, C. Guti\'errez, S. Neumaier, A. Polleres, A. Schurr, and J. Sequeda. Knowledge graphs. ACM Computing Surveys, 54 0 (4): 0 71:1--71:37, 2021

    2021

  3. [11]

    Huang, Y

    H. Huang, Y. Chen, B. Lou, Z. Hongzhou, J. Wu, and K. Yan. Constructing knowledge graph from big data of smart grids. In 2019 10th International Conference on Information Technology in Medicine and Education (ITME), pages 637--641. IEEE, 2019

    2019

  4. [12]

    Janev, D

    V. Janev, D. Graux, H. Jabeen, and E. Sallinger. Knowledge graphs and big data processing. Springer Nature, 2020

    2020

  5. [13]

    Jarnac, M

    L. Jarnac, M. Couceiro, and P. Monnin. Relevant entity selection: Knowledge graph bootstrapping via zero-shot analogical pruning. In Proceedings of the 32nd ACM International Conference on Information and Knowledge Management, pages 934--944, 2023

    2023

  6. [14]

    Kalyuzhnaya, S

    A. Kalyuzhnaya, S. Mityagin, E. Lutsenko, A. Getmanov, Y. Aksenkin, K. Fatkhiev, K. Fedorin, N. O. Nikitin, N. Chichkova, V. Vorona, et al. Llm agents for smart city management: Enhancing decision support through multi-agent ai systems. Smart Cities (2624-6511), 8 0 (1), 2025

    2025

  7. [15]

    Lindauer

    B. Lindauer. Insider threat test dataset. https://doi.org/10.1184/R1/12841247.v1, 2020. Accessed: November 1, 2024

    2020 doi

  8. [16]

    X. Ma, J. Wu, S. Xue, J. Yang, C. Zhou, Q. Z. Sheng, H. Xiong, and L. Akoglu. A comprehensive survey on graph anomaly detection with deep learning. IEEE transactions on knowledge and data engineering, 35 0 (12): 0 12012--12038, 2021

    2021

  9. [17]

    B. Min, H. Ross, E. Sulem, A. P. B. Veyseh, T. H. Nguyen, O. Sainz, E. Agirre, I. Heintz, and D. Roth. Recent advances in natural language processing via large pre-trained language models: A survey. ACM Computing Surveys, 56 0 (2): 0 1--40, 2023

    2023

  10. [18]

    Ni and M

    B. Ni and M. J. Buehler. Mechagents: Large language model multi-agent collaborations can solve mechanics problems, generate new data, and integrate knowledge. Extreme Mechanics Letters, 67: 0 102131, 2024

    2024

  11. [19]

    Gpt-4 technical report, 2023

    OpenAI . Gpt-4 technical report, 2023. OpenAI Blog

    2023

  12. [20]

    J. S. Park, J. O'Brien, C. J. Cai, M. R. Morris, P. Liang, and M. S. Bernstein. Generative agents: Interactive simulacra of human behavior. In Proceedings of the 36th annual acm symposium on user interface software and technology, pages 1--22, 2023

    2023

  13. [21]

    Rastogi, S

    N. Rastogi, S. Dutta, R. Christian, J. Gridley, M. Zaki, A. Gittens, and C. Aggarwal. Predicting malware threat intelligence using kgs. arXiv preprint arXiv:2102.05571, 2021

    2021 arXiv

  14. [22]

    Y. Ren, Y. Xiao, Y. Zhou, Z. Zhang, and Z. Tian. Cskg4apt: A cybersecurity knowledge graph for advanced persistent threat organization attribution. IEEE Transactions on Knowledge and Data Engineering, 35 0 (6): 0 5695--5709, 2022

    2022

  15. [23]

    L. S. Shapley. Cores of convex games. International Journal of Game Theory, 1: 0 11--26, 1971

    1971

  16. [24]

    L. F. Sikos. Cybersecurity knowledge graphs. Knowledge and Information Systems, 65 0 (9): 0 3511--3531, 2023

    2023

  17. [25]

    Steck, C

    H. Steck, C. Ekanadham, and N. Kallus. Is cosine-similarity of embeddings really about similarity? In Companion Proceedings of the ACM Web Conference 2024, pages 887--890, 2024

    2024

  18. [26]

    Y. Sui, Y. Zhang, J. Sun, T. Xu, S. Zhang, Z. Li, Y. Sun, F. Guo, J. Shen, Y. Zhang, et al. Logkg: Log failure diagnosis through knowledge graph. IEEE Transactions on Services Computing, 16 0 (5): 0 3493--3507, 2023

    2023

  19. [27]

    Talebirad and A

    Y. Talebirad and A. Nadiri. Multi-agent collaboration: Harnessing the power of intelligent llm agents. arXiv preprint arXiv:2306.03314, 2023

    2023 arXiv

  20. [28]

    C. Wu, Z. Zeng, Y. Yang, M. Chen, X. Peng, and S. Liu. Task-driven cleaning and pruning of noisy knowledge graph. Information Sciences, 646: 0 119406, 2023

    2023

  21. [29]

    X. Xue, J. Lu, and J. Zhang. Item-weighted likelihood method for measuring growth in longitudinal study with tests composed of both dichotomous and polytomous items. Frontiers in Psychology, 12: 0 580015, 2021. doi:10.3389/fpsyg.2021.580015

    2021

  22. [30]

    Zhang, H

    L. Zhang, H. Ray, J. Priestley, and S. Tan. A descriptive study of variable discretization and cost-sensitive logistic regression on imbalanced credit data. Journal of Applied Statistics, 47 0 (3): 0 568--581, 2020

    2020

  23. [31]

    Zhang, J

    L. Zhang, J. Priestley, J. DeMaio, S. Ni, and X. Tian. Measuring customer similarity and identifying cross-selling products by community detection. Big data, 9 0 (2): 0 132--143, 2021

    2021

  24. [32]

    Zhang, T

    L. Zhang, T. Geisler, H. Ray, and Y. Xie. Improving logistic regression on the imbalanced data by a novel penalized log-likelihood function. Journal of Applied Statistics, 49 0 (13): 0 3257--3277, 2022

    2022

  25. [33]

    Q. Zhao, J. Liu, N. Sullivan, K. Chang, J. Spina, E. Blasch, and G. Chen. Anomaly detection of unstructured big data via semantic analysis and dynamic knowledge graph construction. In Signal processing, sensor/information fusion, and target recognition XXX, volume 11756, pages...

    2021

  26. [34]

    W. X. Zhao, K. Zhou, J. Li, T. Tang, X. Wang, Y. Hou, Y. Min, B. Zhang, J. Zhang, Z. Dong, et al. A survey of large language models. arXiv preprint arXiv:2303.18223, 1 0 (2), 2023

    2023 arXiv

  27. [35]

    H. Zhou, T. Shen, X. Liu, Y. Zhang, P. Guo, and J. Zhang. Survey of knowledge graph approaches and applications. Journal on Artificial Intelligence, 2 0 (2): 0 89--101, 2020

    2020

  28. [36]

    Q. Zhu. Foundations of cyber resilience: The confluence of game, control, and learning theories. arXiv preprint arXiv:2404.01205, 2024

    2024 arXiv

  29. [37]

    Q. Zhu, C. Fung, R. Boutaba, and T. Basar. Guidex: A game-theoretic incentive-based mechanism for intrusion detection networks. IEEE Journal on Selected Areas in Communications, 30 0 (11): 0 2220--2230, 2012

    2012

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.