Pith. sign in

REVIEW 4 major objections 4 minor 29 references

A small grammar model over host behavior catches adaptive malware by the regularity of its timing.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

A compact transformer and inter-event timing regularity (coefficient of variation) reportedly detect a self-adapting malware agent at 93% with a roughly 4% false-positive rate.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection A clever, clearly-written architecture with an honest ablation, but the headline FPR is not the system's real false-positive rate, and the temporal CV claim is asserted rather than proven. the 4 major comments →

arxiv 2608.00745 v1 pith:4OY4ZSG4 submitted 2026-08-01 cs.AI

Behavioral Grammar: Detecting Adaptive Malware via Tiny Language Model Priors and Second-Order Temporal Analysis

Zihan Luo This is my paper
classification cs.AI
keywords behavioral grammaradaptive malwaretemporal anomaly detectioncoefficient of variationlanguage model priorhost intrusion detectionself-supervised anomaly detectioneBPF telemetry
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that host runtime behavior is a learnable grammar, and that adaptive malware—software that actively mimics normal behavior—still leaves a detectable trace in the regularity of its actions. It reports a detection architecture that turns each system event into eight semantic tokens, learns the conditional distribution of benign behavior with a 0.88M-parameter transformer, and scores anomalies per slot. The central quantitative claim is 93% detection of an Adaptive Adversarial Agent at a 3.84% onboarding false-positive rate, with the coefficient of variation of inter-event intervals as the strongest signal: agent stepping cadence CV 0.310 versus 9.786 for benign sleep intervals. A sympathetic reader would care because if the claim is right, timing regularity is a structural detector that adaptive malware cannot cheaply evade, shifting the defense problem from rule matching to distribution matching.

Core claim

Behavioral Grammar claims that normal endpoint activity is grammatically narrow, so a small causal transformer can learn it and flag deviations. Each event is discretized into eight slots—event type, process, argument skeleton, path category, parent process, user, destination, and inter-event time bucket—and the model predicts the next event's tokens, producing per-slot negative log-likelihood anomaly scores with independently calibrated thresholds. Against an adaptive agent that mimics host distributions, routes commands through shells, and matches event rates, the architecture attains 93% detection at a 3.84% onboarding false-positive rate. The load-bearing discovery is second-order tempor

What carries the argument

The 8-token behavioral grammar and the coefficient of variation of inter-event intervals. The grammar maps a raw eBPF event to x=[ET,PROC,ARGV,PC,PARENT,UID,DST,DT] over a 263-token vocabulary; TinyGPT learns p_theta(x_t | x_<t) in a 128-event context. The CV analyzer computes CV_p = sigma(Delta t_p)/mu(Delta t_p) per process in a sliding window, with CV < 1.5 flagging anomalously regular cadence. Slots supply per-dimension NLL thresholds; CV supplies the structural constraint that the paper argues cannot be mimicked without sacrificing capability.

Load-bearing premise

Goal-directed adaptive agents must act on a regular schedule (CV below 1.5) to remain responsive, so they cannot hide in benign bursty timing without losing capability; if an adversary can be fully functional with heavy-tailed, event-triggered timing, the temporal detection surface disappears.

What would settle it

Configure an adaptive agent whose actions are event-triggered—acting only when a file changes or a C2 message arrives—rather than sleep-stepped, and measure the coefficient of variation of its inter-event intervals while it completes reconnaissance, persistence, and exfiltration tasks. If such an agent sustains CV > 1.5 without measurably worse task completion, the claimed structural stealth-functionality trade-off that carries the temporal detector is false.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • If the paper's claims hold, a compact, auditable model (0.88M parameters, 263-token vocabulary) is enough to model normal host behavior; the ceiling on detection is the event representation, not model scale.
  • The temporal cadence signal alone can drive the system: in ablation, temporal-only detection reaches 89.7% detection at 9.3% FPR, and removing it drops fused detection from 93% to 73.9%.
  • Detectors should stop trying to match adaptive malware's individual events and instead measure distributional regularity; adaptive agents that mimic process names, arguments, and rates still cannot hide regularized stepping cadence without losing responsiveness.
  • Per-slot threshold calibration and local onboarding can cut cross-machine false positives from 92% to 3.84% without retraining the prior, making per-host deployment feasible.
  • The evasion-cost asymmetry means defenders gain by adding independent observation surfaces—slots, patterns, cadence—because each added surface forces an attacker to match another distribution.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The paper's CV threshold is calibrated against one agent configuration and one benign workload (nighttime administrative activity); before deploying at scale, the CV < 1.5 rule should be stress-tested on cron-driven servers, build agents, and interactive terminal sessions, where bursty-but-regular cadences may overlap.
  • An event-triggered or human-paced agent—acting only on external commands or C2 messages—may sidestep the cadence detector; if so, the strongest defense would be to combine CV with cross-slot joint distributions rather than rely on temporal regularity alone.
  • The economic claim that rule evasion is O(1) while baseline evasion is O(d) suggests a testable prediction: adding a new token slot should raise the attacker's measured evasion cost more than it raises the defender's training cost, which a mutation-based evasion loop could measure.
  • The 7% missed detection during pure sleep windows implies a detector blind spot for very sparse actors; longer observation windows or windowed CV estimation over larger samples could close some of that gap.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes Behavioral Grammar, an endpoint detection architecture that discretizes eBPF runtime events into eight semantic tokens and learns a compact 0.88M-parameter causal Transformer prior over normal behavior. Anomaly scores are per-slot negative log-likelihoods with per-slot 99.5th-percentile thresholds, supplemented by prototype-based ATT&CK attribution, second-order temporal analysis based on the coefficient of variation of inter-event intervals, adaptive event detectors, and a five-network fusion pipeline. The central empirical claim is 93% detection of an Adaptive Adversarial Agent (AAA) at a 3.84% onboarding false-positive rate, with temporal cadence (CV 0.310 vs. benign 9.786) identified as the strongest discriminative signal. The paper also presents a threshold-tuning impossibility result, a prototype radius claimed to guarantee zero false positives, a self-learning pattern extraction pipeline, and an economic/coevolutionary discussion.

Significance. If the results held as stated, the paper would make a valuable contribution: a compact, auditable, field-level language model for host anomaly detection, plus a concrete hypothesis that temporal regularity is a structural vulnerability of adaptive malware. The deployment protocol (multi-VM prior plus local calibration), the closed-loop red-team methodology, and the explicit ablation study are commendable features. However, the central claims are undermined by an inconsistent FPR report, an asserted rather than derived structural trade-off, and definitional 'by construction' guarantees. The paper does not provide code, data, or machine-checked proofs, and the claimed impossibility proof is not actually shown. The significance of the empirical results therefore cannot be assessed as presented.

major comments (4)
  1. The headline '93% detection at 3.84% false-positive rate' is not a coherent operating point. Table 12 reports a 24.7% benign FPR for the full five-layer system, while Table 13 reports 3.79% 'Benign FPR' at p99.5 and §4.5 reports a 3.84% 'deployable FPR'. Given Eq. (3) sets each of eight slot thresholds at the 99.5th percentile, and an event is flagged when any slot exceeds its threshold, the event-level false-positive rate is 1 - 0.995^8 ≈ 3.9% by construction. The 3.84% therefore appears to be the per-event OR of independent slot thresholds, not the full-system alert-level FPR. The paper must report one consistent operating point and explicitly distinguish event-level, onboarding, and full-system FPR; the current text conflates them and supports the abstract claim only in the narrow by-construction sense.
  2. The structural claim that goal-directed adaptive agents cannot evade temporal CV detection is load-bearing but not established. The 'formal argument' in §7.1 is qualitative: it asserts a monotonic trade-off between CV and responsiveness without defining responsiveness, modeling tasks, or deriving a bound. The empirical support comes from one AAA configuration with hand-specified log-normal stepping parameters (μ=0.9, σ=0.7, §5.3). The ablation (Table 12) shows that removing P4 drops detection from 93.0% to 73.9% and that prior-only detection is 0.4%, so the headline result depends almost entirely on this unvalidated premise. Event-triggered or burst-scheduled agents could plausibly maintain high CV while completing tasks. The paper needs an adversarial scheduler search that varies inter-event interval distributions while measuring task success, and should report detection rate and task-s
  3. The paper claims a 'quantitative proof' that pure threshold tuning cannot simultaneously achieve low FPR and high detection margin, but no proof is presented. The paragraph gives two threshold examples (τ≥8 vs. τ=2.435) and an empirical data-volume claim (FPR decreasing from 3.75% to 1.00% as training data grows). This does not constitute a proof, and the statement that 'compressing the tail ... can only be achieved through data volume, not threshold repositioning' is asserted. Moreover, because Eq. (3) defines τ_s as the 99.5th percentile of the benign NLL distribution, the resulting FPR is a direct consequence of the percentile choice; calling this a mathematical bound is circular. Either provide the derivation or reclassify the claim as an empirical observation.
  4. The prototype radius is defined as the geometric midpoint between the maximum intra-class distance and the minimum benign distance. This guarantees zero benign hits by construction: any benign sample closer than the midpoint would contradict the definition of the minimum benign distance. The statement 'guaranteeing zero false positives by construction' is therefore definitional, not evidence of generalization. The held-out benign FPR of 0/20,000 in Table 8 is meaningful only if the radius is fixed before seeing the held-out set; the text does not clarify whether the midpoint is computed on the training set alone. This issue should be clarified, and the 'zero false positives' claim should be restated as a property of the construction rather than a measured result.
minor comments (4)
  1. The rows 'Benign total FPR' and 'Onboarding FPR' are not defined consistently. For v4, benign total FPR is 25% while onboarding FPR is 3.84%; the difference between these metrics should be explained in the text.
  2. The P0 row reads '0 hits * 4 (true positive C2)'. This is contradictory: zero hits cannot also be four true positives. The footnote explains P0 hits depend on specific events, but the table entry should be corrected.
  3. Technique-level recall is reported as 10/10 in §4.6 and 14/14 in Table 8. Both are called 'technique-level recall'; the discrepancy should be resolved.
  4. The 'SPECIES framework' and the 'honest footnote' are discussed at length but no citation or external reference is provided. The connection to the detection architecture would be clearer if the framework were cited and the analogy made precise.

Circularity Check

2 steps flagged

FPR bound and prototype zero-FP guarantee are definitional; the core temporal-CV detection is empirical but the structural trade-off is asserted, not derived.

specific steps
  1. self definitional [Section 4.4, Eq. (3); Section 6.8, Table 13; Section 6.1]
    "For each slot s∈{1,...,8}, we compute the NLL distribution over a held-out benign set and set: τs = max(Percentile99.5(NLLs),1.0) (3). ... An event is flagged on slot s if its NLL for that slot exceeds τs. ... [Table 13:] p99.5 3.79% Selected (operational target)."

    The per-slot threshold is defined as the 99.5th percentile of the benign NLL distribution, so each slot has a false-positive rate of 0.5% on benign data by construction. For eight independent slots, the event-level benign false-positive rate is approximately 1 − 0.995^8 ≈ 3.93%, which is essentially the reported 3.84% onboarding FPR. Thus the 'mathematically bounded false-positive rate' is a restatement of the calibration percentile, not an independent empirical result; the FPR figure is forced by the threshold definition rather than discovered from data.

  2. self definitional [Section 4.6, Radius calibration; Table 8]
    "We instead define the classification radius as the geometric midpoint between the maximum intra-class distance and the minimum benign distance. Across all 14 techniques, this radius is strictly positive (minimum 3.27), guaranteeing zero false positives by construction."

    The classification radius is chosen to lie exactly between the farthest intra-class sample and the nearest benign sample, so benign samples fall outside the radius by definition. The subsequent reported result 'Held-out benign FPR 0/20,000' (Table 8) is therefore a tautology, not an empirical validation. The 96.2% catch rate may be empirically meaningful, but the zero-false-positive guarantee is a direct consequence of how the radius is defined.

full rationale

The central empirical finding — that temporal CV separates the AAA's stepping cadence (CV = 0.310) from benign sleep intervals (CV = 9.786) and that removing P4 drops detection from 93.0% to 73.9% — is not circular: it is measured from data and the ablation is an independent comparison. However, two claimed guarantees are circular by construction. First, the 'mathematically bounded FPR' is simply the arithmetic consequence of setting each of eight slot thresholds at the 99.5th percentile of benign NLL; the reported 3.84% onboarding FPR is approximately 1 − 0.995^8, so the bound is the definition of the calibration rule. Second, the prototype radius is defined as the midpoint between max intra-class and min benign distance, guaranteeing zero false positives by construction; the later 0/20,000 benign FPR is a restatement of that definition. These are partial circularities in supporting contributions, not in the main temporal-CV detection. The paper's further claim that the CV < 1.5 threshold is a structural, non-evadable law (Section 7.1) is an asserted monotonic trade-off with no formal model of task responsiveness; that is a correctness and evadability risk, but not a circularity because no equation forces it. Overall, the score reflects the definitional FPR and zero-FP guarantees, while acknowledging that the core temporal comparison has independent empirical content.

Axiom & Free-Parameter Ledger

8 free parameters · 5 axioms · 2 invented entities

The central detection result rests on thresholds calibrated to benign data (per-slot tau, CV bounds), on the unproven structural claim that adaptive agents cannot raise CV, on a trusted telemetry layer, and on a small labeled attack library. The reported FPR is largely a construction artifact of the percentile choice.

free parameters (8)
  • Per-slot NLL thresholds tau_s (8 slots) = examples: DT 4.346, PARENT 6.465, PC 2.247 (host, Table 4)
    Calibrated at 99.5th percentile of held-out benign NLL, floor 1.0 (Section 4.4).
  • CV thresholds cv_low, cv_suspicious, tail_low = 1.5, 1.6, 3.3
    Set at benign p5/p10 for CV, p5 for tail (Section 4.7).
  • Prototype margin m = 0.5
    Contrastive loss margin in Equation 4.
  • Number of prototypes per technique K = 3
    Chosen in Section 4.6.
  • Number of clusters K for self-learning = 22
    Chosen in Section 4.10; silhouette 0.653.
  • EWMA smoothing factor = unspecified
    Referenced in Section 5.1 as inflating scores but never defined.
  • DT inter-event buckets = 7 levels from 1 ms to 60 s
    Discretization choice in Table 2.
  • AAA v4 stepping log-normal parameters = mu 0.9, sigma 0.7
    Adversary configuration, Section 5.3, fit to evade detection but still CV 0.7.
axioms (5)
  • domain assumption Per-slot NLLs are treated as independent so OR-ing 8 p99.5 thresholds yields about 3.9% event FPR
    Implied by 'mathematically bounded FPR' in Section 4.4; not stated or tested.
  • ad hoc to paper Regularized cadence (CV < 1.5) is structurally necessary for goal-directed adaptive agents
    Section 7.1 asserts monotonic trade-off between stealth and functionality; load-bearing for temporal detection.
  • domain assumption eBPF telemetry is trusted and not subverted
    Stated in Limitations 2; kernel rootkits out of scope.
  • domain assumption Training data from 7 VMs under normal load is representative of deployment
    Section 4.3; cross-VM FPR still up to 6.1% in Table 14.
  • standard math Coefficient of variation and NLL are appropriate statistics
    Standard statistical definitions used throughout.
invented entities (2)
  • Adaptive Adversarial Agent (AAA) no independent evidence
    purpose: Target threat model and source of all detection-rate results
    Described only at abstraction level (Section 7.7); implementation withheld; no public artifact to falsify claims.
  • SPECIES framework (Digital Organism Architecture Constitution) no independent evidence
    purpose: Theoretical framing in Section 7.3, quoted at length
    Repeatedly cited in text but absent from reference list; cannot be checked.

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Behavioral Grammar: Detecting Adaptive Malware via Tiny Language Model Priors and Second-Order Temporal Analysis." pith.science (2026). https://pith.science/paper/4OY4ZSG4

@misc{pith2026260800745,
  author       = {Pith},
  title        = {Pith review of: Behavioral Grammar: Detecting Adaptive Malware via Tiny Language Model Priors and Second-Order Temporal Analysis},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4OY4ZSG4}},
  note         = {Machine review of arXiv:2608.00745}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Modern endpoint detection systems face a fundamental tension: signature-based approaches are trivially evaded by polymorphic or adaptive threats, while heavy deep-learning models resist auditability and deployment at scale. This paper presents Behavioral Grammar, a detection architecture that treats host runtime behavior as a structured language and learns its grammar with a compact 0.88M-parameter causal Transformer (TinyGPT). Each system event is discretized into an 8-token representation spanning event type, process, argument skeleton, path category, parent process, user, destination, and inter-event timing. The model learns the conditional distribution of normal behavior in a purely self-supervised manner, and anomaly scores are derived from per-slot negative log-likelihood (NLL) statistics, yielding a mathematically bounded false-positive rate. We augment this prior with prototype learning for known-attack attribution, second-order temporal analysis for cadence-based detection, self-learning pattern extraction, and a five-network fusion pipeline. Against an Adaptive Adversarial Agent (AAA)--a threat that learns survival strategies under defensive pressure, performs behavioral mimicry, and matches host event rates--our system achieves 93% detection at 3.84% onboarding false-positive rate. The strongest discriminative signal arises not from any single event but from the coefficient of variation of inter-event intervals: the AAA stepping cadence exhibits CV=0.310 versus 9.786 for benign sleep intervals, a 30x separation reflecting a fundamental stealth-functionality trade-off. We frame these findings within a coevolutionary economics model, arguing that behavior-grammar detection shifts the evasion cost from rule circumvention (cheap) to distribution matching (expensive), establishing a structural asymmetry favoring the defender.

Figures

Figures reproduced from arXiv: 2608.00745 by Zihan Luo.

Figure 1
Figure 1. Figure 1: System architecture overview. eBPF telemetry (Tracee) is discretized into 8-token events and scored by the TinyGPT prior (0.88M parameters, 7-VM universal model). Five detection networks (P0 adaptive high-risk, P1 pattern match with ATT&CK prototypes, P2 per-slot context anomaly, P3 rarity, P4 second-order temporal, P5 adaptive low-risk) feed a priority-ordered fusion pipeline that emits tiered responses (… view at source ↗
Figure 2
Figure 2. Figure 2: Second-order temporal analysis. (a) Per-process temporal CV for benign nighttime activity versus the adaptive agent’s active phase; the detection threshold (CV = 1.5) cleanly separates the two distributions. (b) Sleep-process inter-event interval distribution (log x-axis): benign sleep intervals are heavy-tailed (CV = 9.79), while agent sleep intervals are tightly concentrated (CV = 0.31), a 30× separation… view at source ↗
Figure 3
Figure 3. Figure 3: (a) Detection signal strength across three adversarial rounds. The predicted parent-process (PARENT) vulnerability was empirically falsified (sh -c immunity), and the prototype network achieved zero hits against the mimicking agent; the DT temporal signal emerged as the dominant detection surface. (b) Per-layer alert distribution of the v4 model: P4 (temporal) shows the strongest separation between agent a… view at source ↗
Figure 4
Figure 4. Figure 4: Four-generation model comparison. (a) Cross-host generalization: total benign FPR and cross-host (P2+P3) FPR fall from 52%/69% (v1 host prior) to 25%/9.5% (v4 multi-VM prior with p99.5 calibration). (b) The AAA detection rate is stable at 93–94% across generations, while P4 temporal-layer detection improves from 67% to 92%. Key observations: 1. Detection rate is stable at 93% across all generations—the beh… view at source ↗
Figure 5
Figure 5. Figure 5: Self-learning pattern discovery: 22 behavioral clusters (silhouette = 0.653) extracted from 80 labeled attack sequences, shown with cluster sizes. Automatically discovered clusters map to concrete ATT&CK techniques, including reconnaissance variants (T1082), cron and systemd persistence (T1053.003, T1543.002), SUID escalation (T1548.001), SSH key manipulation (T1098.004), and user creation (T1136.001). 6.5… view at source ↗
Figure 6
Figure 6. Figure 6: Ablation study: contribution of each detection layer to agent detection, benign FPR, and discrimination (detection minus FPR). Removing the temporal layer (P4) causes the largest detection drop (93% → 74%); temporal-only achieves the best discrimination (+80.5%). The prior alone (P2/P3) collapses to 0.4% detection against the mimicking agent. 18 [PITH_FULL_IMAGE:figures/full_fig_p018_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: τ percentile sensitivity analysis. Benign FPR falls monotonically with the threshold percentile; p99.5 (3.79%) is selected as the operating point, meeting the 5% target without excessive conservatism [PITH_FULL_IMAGE:figures/full_fig_p020_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Cross-host generalization on 7 unseen VMs (leave-one-VM-out). Six of seven VMs achieve FPR below the 5% target; only t6 slightly exceeds it (6.1%). The average FPR of 3.4% confirms that multi-VM joint training resolves the cross-host mismatch that produced a 92% FPR in the v1 baseline. 6.10 Model Characteristics [PITH_FULL_IMAGE:figures/full_fig_p021_8.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

29 extracted references · 28 canonical work pages

  1. [1]

    Intrusion detection using sequences of system calls,

    S. Hofmeyr, S. Forrest, and A. Somayaji, “Intrusion detection using sequences of system calls,” Journal of Computer Security, vol. 6, no. 3, pp. 151–180, 1998

    work page 1998

  2. [2]

    Data mining approaches for intrusion detection,

    W. Lee and S. J. Stolfo, “Data mining approaches for intrusion detection,” inProc. 7th USENIX Security Symposium, 1998, pp. 79–93

    work page 1998

  3. [3]

    From eBPF to system call-based intrusion detection,

    D. Schrammel et al., “From eBPF to system call-based intrusion detection,” inProc. ACM Workshop on Security and Privacy Analytics, 2021

    work page 2021

  4. [4]

    DeepLog: Anomaly detection and diagnosis from system logs through deep learning,

    M. Du, F. Li, G. Zheng, and V. Srikumar, “DeepLog: Anomaly detection and diagnosis from system logs through deep learning,” inProc. ACM CCS, 2017, pp. 1285–1298

    work page 2017

  5. [5]

    MERLIN: A reinforcement learning-based open framework for autonomous malware evasion,

    W. Gao, J. Li, R. Wang, and H. Xiao, “MERLIN: A reinforcement learning-based open framework for autonomous malware evasion,” inProc. IEEE Trustcom, 2021

    work page 2021

  6. [6]

    An investigation of the limitations of an ML-based clone detector for malware,

    E. Raff et al., “An investigation of the limitations of an ML-based clone detector for malware,” inProc. AAAI Workshop on Artificial Intelligence for Cyber Security, 2019

    work page 2019

  7. [7]

    Detecting anomalies in system logs using NLP and deep learning,

    R. Cohen, O. Lyzhov, and D. Raz, “Detecting anomalies in system logs using NLP and deep learning,” inProc. IEEE INFOCOM Workshops, 2020

    work page 2020

  8. [8]

    Tools and metrics for processing log-based anomaly detection,

    J. Zhu et al., “Tools and metrics for processing log-based anomaly detection,” inProc. IEEE/IFIP Network Operations and Management Symposium, 2022

    work page 2022

  9. [9]

    Detecting intrusions using system calls: Alter- native data models,

    C. Warrender, S. Forrest, and B. Pearlmutter, “Detecting intrusions using system calls: Alter- native data models,” inProc. IEEE Symposium on Security and Privacy, 1999

    work page 1999

  10. [10]

    Building diverse computer systems,

    S. Forrest, A. Somayaji, and D. Ackley, “Building diverse computer systems,” inProc. IEEE HOTOS, 1997

    work page 1997

  11. [11]

    Audit-based host intrusion detection system,

    S. Forrester, H. Alipour, and A. Gurtov, “Audit-based host intrusion detection system,” in Proc. IEEE Trustcom, 2019

    work page 2019

  12. [12]

    Tracee: eBPF-based runtime security observability,

    D. Schrammel et al., “Tracee: eBPF-based runtime security observability,”Aqua Security Open Source Project, 2021. [Online]. Available:https://github.com/aquasecurity/tracee 27

    work page 2021

  13. [13]

    Tracee: Linux tracing and security observability using eBPF,

    Tracee Contributors, “Tracee: Linux tracing and security observability using eBPF,” 2023

    work page 2023

  14. [14]

    Falco: Cloud-native runtime security,

    Falco Authors, “Falco: Cloud-native runtime security,” CNCF Graduated Project, 2023. [Online]. Available:https://falco.org

    work page 2023

  15. [15]

    Neural discrete representation learning,

    A. van den Oord, O. Vinyals, and K. Kavukcuoglu, “Neural discrete representation learning,” inProc. NeurIPS, 2017, pp. 6306–6315

    2017

  16. [16]

    Malware detection by eating a whole exe,

    E. Raff et al., “Malware detection by eating a whole exe,” inProc. AAAI Workshop on Artificial Intelligence for Cyber Security, 2018

    work page 2018

  17. [17]

    MAB-Malware: Reinforcement learning for minimizing malware detection,

    Z. Fang et al., “MAB-Malware: Reinforcement learning for minimizing malware detection,” in Proc. IEEE Trustcom, 2021

    work page 2021

  18. [18]

    SAR V: Malware analysis and classification using image processing and machine learning,

    L. Nataraj et al., “SAR V: Malware analysis and classification using image processing and machine learning,” 2019

    work page 2019

  19. [19]

    A machine learning approach to malware similarity analysis using deep learning representations,

    F. Zaffarano et al., “A machine learning approach to malware similarity analysis using deep learning representations,” inProc. DIMV A, 2019

    work page 2019

  20. [20]

    MITRE ATT&CK: Design and philosophy,

    B. E. Strom et al., “MITRE ATT&CK: Design and philosophy,”MITRE Corporation, Tech. Rep. MP180360R1, 2020

    work page 2020

  21. [21]

    Alpcan and T

    T. Alpcan and T. Ba¸ sar,Network Security: A Decision and Game-Theoretic Approach. Cam- bridge University Press, 2010

    work page 2010

  22. [22]

    Decision support approaches for cyber security investment,

    A. Fielder, E. Panaousis, P. Malacaria, C. Hankin, and F. Smeraldi, “Decision support approaches for cyber security investment,”Decision Support Systems, vol. 86, pp. 13–23, 2016

    work page 2016

  23. [23]

    Why information security is hard: An economic perspective,

    R. Anderson, “Why information security is hard: An economic perspective,” inProc. ACSAC, 2001

    work page 2001

  24. [24]

    R. M. Anderson and R. M. May,Infectious Diseases of Humans: Dynamics and Control. Oxford University Press, 1991

    work page 1991

  25. [25]

    M-Trends 2023: Global threat landscape report,

    Mandiant, “M-Trends 2023: Global threat landscape report,”Mandiant Research, 2023

    work page 2023

  26. [26]

    Language models are unsupervised multitask learners,

    A. Radford, J. Wu, et al., “Language models are unsupervised multitask learners,”OpenAI Tech Report, 2019

    work page 2019

  27. [27]

    Attention is all you need,

    A. Vaswani et al., “Attention is all you need,” inProc. NeurIPS, 2017, pp. 5998–6008

    work page 2017

  28. [28]

    Learning a similarity metric discriminatively, with application to face verification,

    K. Chopra, R. Hadsell, and Y. LeCun, “Learning a similarity metric discriminatively, with application to face verification,” inProc. CVPR, 2005

    work page 2005

  29. [29]

    Atomic Red Team,

    MITRE Corporation, “Atomic Red Team,” 2023. [Online]. Available: https://github.com/ redcanaryco/atomic-red-team 28

    work page 2023

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.