arxiv: 2605.03138 · v1 · submitted 2026-05-04 · 💻 cs.CR

Recognition: 1 theorem link

Zero Day Attacks: Novel Behaviour or Novel Vulnerability?

Nnamdi Jibunoh , Sara Khanchi , Adetokunbo Makanju

Authors on Pith no claims yet

Pith reviewed 2026-05-08 17:43 UTC · model grok-4.3

classification 💻 cs.CR

keywords zero-day attacksvulnerability exploitationintrusion detection systemsmachine learningcybersecuritymemory corruptiondefensive mechanisms

0 comments

The pith

Zero-day attacks exploit undisclosed vulnerabilities rather than novel behaviors.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper reviews documented zero-day incidents over 20 years to determine how such attacks actually manifest in networks. It finds that these incidents consistently arise from the exploitation of hidden vulnerabilities, especially memory-corruption flaws, rather than from entirely new attack behaviors or tactics. This observation leads to a taxonomy of zero-day vulnerability types and reveals a mismatch with many machine-learning intrusion detection systems, which are built to spot hypothetical novel behaviors. If the analysis holds, vulnerability-centered detection approaches would align more closely with real attack mechanisms than behavior-only methods.

Core claim

Documented zero-day incidents arise from the exploitation of undisclosed vulnerabilities rather than novel attack behavior. The authors propose a taxonomy of zero-day vulnerability types and show that memory-corruption flaws are the most used, while attacks targeting defensive-mechanism vulnerabilities have increased in recent years. Many ML-based detectors, however, are designed around the assumption of detecting novel behaviors during attack execution, creating a mismatch with the vulnerability-focused reality of actual incidents.

What carries the argument

The distinction between vulnerability exploitation and novel behavior as the defining mechanism of zero-day attacks, together with the proposed taxonomy of vulnerability types.

If this is right

Reliance on behavior-based detection alone may overstate zero-day detection capabilities in ML-based IDSs.
Vulnerability-centric methods are more aligned with real-world exploit characteristics.
Improved automated vulnerability detection frameworks should be developed to match real-world exploit characteristics.
The ability to detect novel TTPs is useful but does not equate to the ability to detect zero-day attacks.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

Shifting IDS design toward earlier vulnerability identification could enable mitigation at more points in the attack lifecycle.
Training data for ML detectors might need to incorporate more vulnerability-specific signals to reduce the current mismatch.
Policy efforts could usefully prioritize automated tools that scan for the vulnerability types identified in the taxonomy.
Re-examination of existing incident datasets could test whether the observed increase in defensive-mechanism targeting continues.

Load-bearing premise

The reviewed documented zero-day incidents are representative of real-world zero-day attacks and that the characterization of ML-based detectors as primarily designed for novel behaviors accurately reflects the literature.

What would settle it

Discovery of a successful zero-day attack that uses only novel behaviors with no underlying vulnerability exploitation would directly challenge the central claim.

read the original abstract

Zero-day attacks pose severe cybersecurity risks due to their high success rates and stealth. Because signature-based approaches struggle to detect such attacks, building Intrusion Detection Systems (IDSs) for detecting zero-day attacks is essential. We contend that for an IDS to be effective it must be grounded in an understanding of how zero-day attacks manifest in real-world networks. To this end, we review documented zero-day incidents spanning 20 years, finding that these attacks arise from the exploitation of undisclosed vulnerabilities rather than novel attack behavior. Guided by this insight, we propose a taxonomy of zero-day vulnerability types and analyze assumptions of ML-based intrusion detection approaches. Our analysis shows that incidents consistently involve vulnerability exploitation, with memory-corruption flaws being most used; additionally, attacks targeting defensive-mechanism vulnerabilities have increased in recent years. We also identify a mismatch: while incident reports emphasize vulnerability exploitation, many ML-based detectors are designed to detect hypothetical "novel behaviors" during attack execution. Our findings indicate that vulnerability-centric methods are more aligned with real-world attack mechanisms. Consequently, reliance on behavior-based detection alone may overstate zero-day detection capabilities in ML-based IDSs. We advocate for cautious interpretation of such claims and call for improved automated vulnerability detection frameworks aligned with real-world exploit characteristics. Effective defense against zero-day attacks requires prioritizing vulnerability-centeric approaches that enable early identification and mitigation across the lifecycle. The ability to detect attacks that utilize novel behaviors (Tactics, Techniques, and Procedures (TTPs)) is useful, but it does necessarily equate to the ability to detect zero-day attacks.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

Zero-day attacks mostly exploit vulnerabilities rather than novel behaviors according to this review, but documented incidents may not capture the full picture.

read the letter

The paper's central message is that zero-day attacks in practice come from exploiting hidden vulnerabilities rather than from inventing entirely new behaviors, and this creates a gap with how some machine learning detectors are built. They review two decades of public incident reports and find a consistent pattern: memory corruption vulnerabilities are the most common, and there's been a rise in attacks that target the defensive mechanisms themselves. From this they build a taxonomy of vulnerability types and point out that many ML-based intrusion detection systems assume they need to catch novel execution patterns, when the real incidents are more about using known exploit techniques on unknown flaws. This is a solid observation and the taxonomy adds some structure to thinking about zero-days. The contrast with ML assumptions is drawn clearly from the incident data, which is the paper's strongest part. The main weakness is the selection of incidents. Only documented cases are available, and those are the ones that got noticed and reported later. Attacks that relied on truly novel behaviors might simply not have been documented in the same way, or at all. The authors don't detail their search method or inclusion criteria, so it's difficult to gauge how complete the sample is. The analysis of ML detectors also stays at a general level without deep dives into particular papers or datasets. This work is aimed at researchers in intrusion detection and zero-day defense, especially those using or evaluating ML techniques. It could help shift some priorities toward vulnerability scanning and patching over pure anomaly detection. The paper deserves to go to peer review. The point about alignment with real mechanisms is worth having in the literature, even if the evidence needs more methodological detail to be fully convincing.

Referee Report

2 major / 2 minor

Summary. The paper reviews documented zero-day incidents over a 20-year period and concludes that these attacks arise from exploitation of undisclosed vulnerabilities rather than novel attack behaviors. It proposes a taxonomy of zero-day vulnerability types, reports that memory-corruption flaws predominate and that attacks on defensive mechanisms have increased, and identifies a mismatch between incident characteristics and the assumptions underlying many ML-based intrusion detection systems, which often target hypothetical novel behaviors. The work advocates shifting toward vulnerability-centric detection methods and cautions against overstatement of zero-day capabilities in behavior-focused ML IDS research.

Significance. If the empirical observations hold after addressing selection and methodology concerns, the paper offers a useful bridge between real-world incident data and IDS design principles. It could temper overstated claims in the ML detection literature and encourage development of automated vulnerability discovery tools better aligned with observed exploit patterns, potentially improving practical zero-day defenses in cybersecurity.

major comments (2)

[Review of documented zero-day incidents] The central claim that 'incidents consistently involve vulnerability exploitation' (abstract and review section) rests on the reviewed incidents being representative of real-world zero-days. The manuscript provides no explicit selection criteria, total count of incidents, or quantitative breakdown (e.g., by vulnerability type or year), leaving open the possibility of disclosure bias toward detectable or later-reported cases. This directly weakens the downstream argument about mismatch with ML detectors and the taxonomy's grounding.
[Analysis of ML-based approaches] In the analysis of ML-based intrusion detection approaches, the paper states that many detectors are 'designed to detect hypothetical novel behaviors' and that this creates a mismatch with vulnerability-focused incidents. However, the critique lacks references to specific ML papers, datasets, or feature sets used in those works, making the characterization qualitative rather than evidence-based and limiting its ability to support the recommendation for vulnerability-centric methods.

minor comments (2)

[Abstract] Abstract contains two typographical errors: 'vulnerability-centeric' should read 'vulnerability-centric' and 'does necessarily equate' should read 'does not necessarily equate'.
[Taxonomy proposal] The taxonomy is introduced as 'guided by this insight' from the incident review, but the manuscript does not include a table or figure mapping specific incidents to taxonomy categories, reducing clarity on how the taxonomy was constructed.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for these constructive comments, which highlight opportunities to improve the transparency of our incident review and the specificity of our ML analysis. We address each point below and commit to revisions that strengthen the manuscript without altering its core conclusions.

read point-by-point responses

Referee: [Review of documented zero-day incidents] The central claim that 'incidents consistently involve vulnerability exploitation' (abstract and review section) rests on the reviewed incidents being representative of real-world zero-days. The manuscript provides no explicit selection criteria, total count of incidents, or quantitative breakdown (e.g., by vulnerability type or year), leaving open the possibility of disclosure bias toward detectable or later-reported cases. This directly weakens the downstream argument about mismatch with ML detectors and the taxonomy's grounding.

Authors: We agree that explicit documentation of the review methodology is necessary to substantiate representativeness. In the revised manuscript we will insert a dedicated subsection that specifies the data sources (public vulnerability databases, vendor reports, and security incident archives), the total number of incidents examined, the inclusion criteria applied to reduce selection bias, and quantitative breakdowns by vulnerability class and publication year. These additions will directly support the taxonomy and the subsequent claims about alignment with vulnerability-centric detection. revision: yes
Referee: [Analysis of ML-based approaches] In the analysis of ML-based intrusion detection approaches, the paper states that many detectors are 'designed to detect hypothetical novel behaviors' and that this creates a mismatch with vulnerability-focused incidents. However, the critique lacks references to specific ML papers, datasets, or feature sets used in those works, making the characterization qualitative rather than evidence-based and limiting its ability to support the recommendation for vulnerability-centric methods.

Authors: We concur that concrete citations would make the mismatch argument more rigorous. The revised version will expand the relevant section with references to representative ML-IDS studies, including the datasets they employ (e.g., NSL-KDD, CICIDS2017) and the feature sets they rely upon (primarily statistical and behavioral network-flow attributes). These examples will illustrate the predominant focus on anomaly detection rather than vulnerability exploitation, thereby furnishing an evidence-based foundation for advocating vulnerability-centric approaches. revision: yes

Circularity Check

0 steps flagged

No circularity: claims rest on external incident reports and literature analysis

full rationale

The paper is a literature review that derives its central claims (zero-day attacks arise from undisclosed vulnerabilities rather than novel behaviors; memory-corruption flaws dominate; mismatch with behavior-focused ML detectors) directly from documented external incidents spanning 20 years and analysis of other published work. No mathematical derivations, fitted parameters, self-referential equations, or load-bearing self-citations appear in the provided text. The taxonomy and critique follow from the reviewed sources without reducing to the paper's own inputs by construction. Selection bias in documented incidents is a potential external validity concern but does not constitute internal circularity in the derivation chain.

Axiom & Free-Parameter Ledger

0 free parameters · 2 axioms · 1 invented entities

The claims rest on domain assumptions about the representativeness of documented incidents and the characterization of ML approaches, plus the introduction of a new taxonomy without external validation.

axioms (2)

domain assumption Documented zero-day incidents over 20 years are representative of real-world zero-day attack mechanisms.
Invoked to generalize the finding that attacks arise from vulnerability exploitation rather than novel behavior.
domain assumption ML-based intrusion detection approaches are primarily designed around detection of hypothetical novel behaviors during attack execution.
Used to establish the mismatch with real incident reports.

invented entities (1)

Taxonomy of zero-day vulnerability types no independent evidence
purpose: To classify vulnerabilities exploited in zero-day attacks, highlighting memory-corruption and defensive-mechanism types.
New construct proposed from the review; no independent evidence or validation provided.

pith-pipeline@v0.9.0 · 5586 in / 1448 out tokens · 84439 ms · 2026-05-08T17:43:00.182762+00:00 · methodology

Review history (2 revisions) →

discussion (0)

Reference graph

Works this paper leans on

31 extracted references · 3 canonical work pages

[1]

ChronosGuard: A Hierarchical Machine Learning Intrusion Detection System for Modern Clouds

Verkerken M, Santos J, D’Hooge L, Wauters T, Volckaert B, De Turck F. ChronosGuard: A Hierarchical Machine Learning Intrusion Detection System for Modern Clouds. In: 2024 20th International Conference on Network and Service Management (CNSM); 2024. p. 1–9

2024
[2]

https://csrc.nist.gov/glossary/term/zero day attack

National Institute of Standards and Technology (NIST).: Zero-Day Attack Definition. https://csrc.nist.gov/glossary/term/zero day attack
[3]

A review of Machine Learning-based zero-day attack detection: Challenges and future directions

Guo Y. A review of Machine Learning-based zero-day attack detection: Challenges and future directions. Computer Communications. 2023;198:175–185. https: //doi.org/https://doi.org/10.1016/j.comcom.2022.11.001

work page doi:10.1016/j.comcom.2022.11.001 2023
[4]

Identifying Zero-Day Attacks with Machine Learning and Data Reduction Methods

Teymourlouei H, Stone D, Jackson L. Identifying Zero-Day Attacks with Machine Learning and Data Reduction Methods. In: 2023 Congress in Computer Science, Computer Engineering, & Applied Computing (CSCE); 2023. p. 2285–2290

2023
[5]

Before we knew it: an empirical study of zero-day attacks in the real world

Bilge L, Dumitra¸ s T. Before we knew it: an empirical study of zero-day attacks in the real world. CCS ’12. New York, NY, USA: Association for Computing Machinery; 2012. p. 833–844

2012
[6]

https://www.ibm.com/ think/topics/zero-day

IBM Security.: Understanding Zero-Day Vulnerabilities. https://www.ibm.com/ think/topics/zero-day
[7]

https://cloud.google.com /blog/topics/threat-intelligence/2024-zero-day-trends

(CTIG) GCTI.: 2024 Zero-Day Vulnerabilities Report. https://cloud.google.com /blog/topics/threat-intelligence/2024-zero-day-trends

2024
[8]

Revisiting Anomaly-based Network Intrusion Detection Systems [PhD Thesis - Research UT, graduation UT]

Bolzoni D. Revisiting Anomaly-based Network Intrusion Detection Systems [PhD Thesis - Research UT, graduation UT]. University of Twente. Netherlands; 2009. 10.3990/1.9789036528535. 22

work page doi:10.3990/1.9789036528535 2009
[9]

A sustainable framework for preventing iot systems from zero day ddos attacks by machine learning

Ali M, Siddique A, Hussain A, Hassan F, Ijaz A, Mehmood A. A sustainable framework for preventing iot systems from zero day ddos attacks by machine learning. Int J Emerg Technol. 2021;12:116–121

2021
[10]

Zero-day Attack Solutions Using Threat Hunt- ing Intelligence: Extensive Survey

AlMahmeed YS, Al-Omay AY. Zero-day Attack Solutions Using Threat Hunt- ing Intelligence: Extensive Survey. In: 2022 International Conference on Data Analytics for Business and Industry (ICDABI); 2022. p. 309–314

2022
[11]

Transfer Learning Method for Handling The Intrusion Detection System with Zero Attacks Using Machine Learning and Deep Learning

Upender T, Lal B, Nagaraju R. Transfer Learning Method for Handling The Intrusion Detection System with Zero Attacks Using Machine Learning and Deep Learning. In: Proceedings of the 5th International Conference on Infor- mation Management & Machine Intelligence. ICIMMI ’23. New York, NY, USA: Association for Computing Machinery; 2024

2024
[12]

On the Limitations of Machine Learning for Zero-Day Vulnerability Detection

Millar S, Ellis C. On the Limitations of Machine Learning for Zero-Day Vulnerability Detection. Journal of Cybersecurity Research. 2022;5(2):45–62

2022
[13]

Machine Learning in Vulnerability Assessment

Montuno D. Machine Learning in Vulnerability Assessment. Ottawa, ON, Canada: Defence Research and Development Canada, Ottawa Research Centre
[14]

Defence R&D Canada publication

D68-3/067-2019E-PDF. Defence R&D Canada publication. Available from: https://publications.gc.ca/collections/collection 2019/rddc-drdc/D68-3-067-201 9-eng.pdf

2019
[15]

Automated Vulnerability Assessment Using Machine Learning

Ogundairo O, Broklyn P. Automated Vulnerability Assessment Using Machine Learning. Journal of Cyber Security. 2024 08

2024
[16]

Machine learning based intrusion detection system for software defined networks

Abubakar A, Pranggono B. Machine learning based intrusion detection system for software defined networks. In: 2017 seventh international conference on emerging security technologies (EST). IEEE; 2017. p. 138–143

2017
[17]

Accessed: 2026-02-11

Wright E.: Showing Vulnerability to a Machine: Automated Prioritization of Soft- ware Vulnerabilities. Accessed: 2026-02-11. Mandiant / Google Cloud Blog. Available from: https://cloud.google.com/blog/topics/threat-intelligence/auto mated-prioritization-of-software-vulnerabilities/

2026
[18]

Accessed: 2026-02-11

Liu D, Chang O, Nowakowski J, Keller J.: Scaling security with AI: from detection to solution. Accessed: 2026-02-11. Google Security Blog. Available from: https:// security.googleblog.com/2024/01/scaling-security-with-ai-from-detection.html

2026
[19]

Accessed: 2026-02-11

Google.: oss-fuzz-gen: LLM powered fuzzing via OSS-Fuzz. Accessed: 2026-02-11. GitHub repository. Available from: https://github.com/google/oss-fuzz-gen

2026
[20]

Accessed: 2026-02-11

The Big Sleep team.: From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code. Accessed: 2026-02-11. Google Project Zero blog. Available from: https://projectzero.google/2024/10/from-n aptime-to-big-sleep.html. 23

2026
[21]

Accessed: 2026-02-11

Nowakowski J, Keller J.: AI-powered patching: the future of automated vulnera- bility fixes. Accessed: 2026-02-11. Google Research / Google Security Engineering Technical Report. Available from: https://research.google/pubs/ai-powered-pat ching-the-future-of-automated-vulnerability-fixes/

2026
[22]

Accessed: 2026-05-02

Anthropic Red Team.: Mythos Preview. Accessed: 2026-05-02. https://red.anth ropic.com/2026/mythos-preview/

2026
[23]

Fatima Minhas, R

Nilg¨ un Karaca K, C ¸ etin A. Systematic Review of Current Approaches and Inno- vative Solutions for Combating Zero-Day Vulnerabilities and Zero-Day Attacks. IEEE Access. 2025;13:102071–102091. https://doi.org/10.1109/ACCESS.2025. 3577941

work page doi:10.1109/access.2025 2025
[24]

National Institute of Standards and Technology (NIST).: National Vulnerability Database (NVD). U.S. government repository of vulnerability management data represented using the Security Content Automation Protocol (SCAP). Available from: https://nvd.nist.gov/
[25]

Official source of CVE identifiers and related resources for publicly known cybersecurity vulnerabilities

CVE Program / MITRE.: Common Vulnerabilities and Exposures (CVE) — Offi- cial Website. Official source of CVE identifiers and related resources for publicly known cybersecurity vulnerabilities. Available from: https://www.cve.org/
[26]

Threat research article on machine learning-based code injec- tion detection

Chen J, Xu L, Guan A, Zhang Z, Fu Y.: Zero-Day Exploit Detection Using Machine Learning. Threat research article on machine learning-based code injec- tion detection. Available from: https://unit42.paloaltonetworks.com/injection-d etection-machine-learning/
[27]

Accessed: 2026-03-02

Leyden J.: Zero-day vulnerabilities in Nooie baby monitors could allow video feed hijack. Accessed: 2026-03-02. Available from: https://proteuscyber.com/nl/priv acy-database/news/5656-zero-day-vulnerabilities-in-nooie-baby-monitors-could -allow-video-feed-hijack-the-daily-swig

2026
[28]

In the Wild

Google Project Zero.: 0day “In the Wild”. Resource summarizing Project Zero’s tracking and analysis of zero-day exploits “in the wild”. Available from: https: //googleprojectzero.blogspot.com/p/0day.html
[29]

Accessed: 2026-03-04

Zero-Day cz Cybersecurity Help.: Zero-Day.cz — Zero-Day Vulnerability Tracking and Database. Accessed: 2026-03-04. Available from: https://www.zero-day.cz/

2026
[30]

Def- inition and explanation of zero-day vulnerabilities and attacks in cybersecurity

Cymulate.: Zero-day Vulnerabilities & Attacks — Cybersecurity Glossary. Def- inition and explanation of zero-day vulnerabilities and attacks in cybersecurity. Available from: https://cymulate.com/cybersecurity-glossary/zero-day/
[31]

RAWGraphs: A Visualisation Platform to Create Open Outputs

Mauri M, Elli T, Caviglia G, Uboldi G, Azzi M. RAWGraphs: A Visualisation Platform to Create Open Outputs. In: Proceedings of the 12th Biannual Confer- ence on Italian SIGCHI Chapter. CHItaly ’17. New York, NY, USA: ACM; 2017. p. 28:1–28:5. 24

2017