Aug 2026· Applied Sciences· Vol 16, pp. 7952· 0 citations· 34 references
TL;DR
A UEBA-based machine learning framework that constructs per-user behavioral profiles from enterprise proxy and access log data, scoring sessions against a 30-feature behavioral representation spanning temporal patterns, data-transfer anomalies, domain interactions, HTTP characteristics, and session-device signals is presented.
Abstract
Low-and-slow data exfiltration by malicious insiders remains among the most operationally difficult threat classes to detect: the behavior is unremarkable in any individual session and becomes recognizable only across weeks of otherwise routine activity. This paper presents a UEBA-based machine learning framework that constructs per-user behavioral profiles from enterprise proxy and access log data, scoring sessions against a 30-feature behavioral representation spanning temporal patterns, data-transfer anomalies, domain interactions, HTTP characteristics, and session-device signals. The contribution is an operationally integrated and empirically audited UEBA pipeline that combines a pre-specified behavioral representation, isolated evaluation regimes, and session-level analyst explanations. Training used a hybrid corpus of approximately 8.96 million sessions drawn from 160 GB of real and behaviorally parameterized simulated logs. On the full hybrid held-out partition, the LightGBM classifier achieved 96.84% overall accuracy, 95.38% balanced accuracy, 91.80% malicious-class precision, 92.90% recall, 92.35% F1-score, and 98.2% ROC-AUC. Because the hybrid test set uses an enriched 20.5% malicious-session evaluation prevalence, balanced accuracy and malicious-class F1 are emphasized alongside overall accuracy. In the strict real-only evaluation, the independently trained and calibrated LightGBM model achieved 95.99% overall accuracy, 93.80% balanced accuracy, 90.30% malicious-class precision, 90.10% recall, 90.20% F1-score, and 95.8% ROC-AUC, while hybrid-to-real transfer achieved 90.1% F1-score, 89.8% recall, and 96.1% ROC-AUC. These settings are reported separately to distinguish full-corpus benchmark performance from real-log generalization. Each scored session is accompanied by a SHAP-based decomposition that identifies which behavioral signals drove the alert, supporting analyst triage in operational SOC environments. The framework was further validated on a confirmed 17-day insider exfiltration incident that existing organizational controls had not detected. BiLSTM and a Tabular Transformer evaluated under the same regime-specific partitions produced closely matched performance, with malicious-class F1 differences of at most 0.4 percentage points; LightGBM retained the strongest measured performance–deployment trade-off for the engineered tabular pipeline.
Malicious activity detection in honeypot environments remains challenging due to the volume and heterogeneity of captured data, as well as the sequential nature of attacker behavior. This study proposes an integrated framework combining a Cowrie-based honeypot with a locally deployed Large Language Model (LLM) to enable automated detection and near-real-time behavioral analysis. Attacker interactions are captured and processed through a structured preprocessing stage that reconstructs session-level activity. These representations are analyzed using an LLM, allowing contextual interpretation of authentication patterns, command execution sequences, and post-compromise behavior. Structured analytical outputs are generated, including severity classification, reasoning, and recommended actions. Evaluation was conducted using isolated and concurrent attack scenarios. Results indicate effective identification of brute-force attacks, reconnaissance activity, persistence staging, and download-and-execute patterns, achieving a 94.23% Accuracy (95% CI: 84.05–98.79%), 100.0% Precision, 87.50% Recall, and an F1-score of 93.33% across an expanded evaluation of 52 independent observations, with zero false positives (FPs). These figures are derived from a single evaluation run and are reported as preliminary, proof-of-concept estimates rather than as stable, production-grade performance. Analytical output remained stable for sessions governed by deterministic severity overrides. However, a low-intensity multi-stage session produced inconsistent severity classifications under concurrent conditions, indicating that analyst review is still required for borderline cases. Integration of deterministic preprocessing with LLM-based reasoning enables the transformation of raw honeypot logs into structured and actionable cybersecurity intelligence, reducing analyst workload while improving the explainability and reliability of intrusion analysis in near-real-time environments.
Rúben Oliveira, Tiago Gomes, D. Pinho et al.· Journal of Cybersecurity and...· 0 citations
The rapid growth of web-based services, particularly API-driven architectures, reflects an increasing reliance on distributed systems, exposing sensitive data to security risks and making the adoption of automated defensive mechanisms essential. In this context, where benign traffic predominates in real-world settings, modern defenses increasingly model normal behavior, relying on semi-supervised approaches trained on only normal data. However, ensuring the complete absence of anomalous instances in such training data is inherently difficult in practice, and mislabeled or contaminated attack samples can introduce backdoors into the learned defense, causing the model to silently misclassify certain attack patterns as normal behavior. This paper investigates the effectiveness of Transformer-based Language Models (TLMs) in the detection of anomalies in HTTP requests, focussing on providing detailed explanations for the detected anomalies. The study employs token-level logit-based surprisal mapping to provide both an anomaly score and a direct, detailed explanation via heatmap-like highlighting. The effectiveness of the proposed explainability approach is demonstrated by the discovery of labelling inconsistencies in a popular public dataset, revealing how anomalous contamination in the training data had induced backdoor-like failures in the detection models.
Distributed Denial-of-Service (DDoS) attacks across cloud, edge, and Internet-of-Things infrastructures have intensified the need for detectors that are accurate, computationally efficient, and deployable at resource-constrained monitoring points. Much of the intrusion-detection literature implicitly links detection quality to architectural depth, larger parameter spaces, and richer learned representations. This paper examines a narrower hypothesis: for binary flow-level DDoS detection, a carefully engineered shallow pipeline can retain high detection quality while maintaining a compact computational footprint. We propose ShallowNet, a single-hidden-layer neural detector integrated with leakage-aware data partitioning, training-only normalization, principled feature selection, class-imbalance-aware optimization, early stopping, and calibration-guided threshold selection. The evaluation extends beyond standard held-out accuracy by incorporating cross-day temporal transfer, leave-one-attack-family-out robustness testing, controlled baseline comparison, systematic pipeline ablation, and probability-calibration analysis. The results show both the empirical utility and the limits of the approach: class concentration in widely used benchmark datasets can make aggregate metrics overly optimistic, and generalization degrades most sharply when the test traffic contains attack signatures absent from training. These findings suggest that, in lightweight binary flow-level DDoS detection, disciplined pipeline design can be as important as model depth and that stress-tested evaluation should accompany high benchmark accuracy claims.
Ali Alfatemi, Mohamed Rahouti, A. Chehri et al.· IEEE Transactions on Network...· 0 citations
Experimental results show that LLMs, when guided by rubric-based prompts and supplemented with ATT&CK domain knowledge, achieve robust performance across detection, localization, and TTP mapping tasks.
Joon-Young Gwak, Aubrey Strier, Zhaohan Xi et al.· 0 citations
Distributed Denial-of-Service (DDoS) attacks remain one of the most disruptive threats to modern web services, overwhelming application resources and degrading service availability. This paper presents a lightweight, virtualized system architecture for real-time DDoS detection that combines kernellevel telemetry collection with machine learning (ML) based analysis. The proposed architecture enables fine-grained, lowoverhead log collection without modifying the web applications because the network and application-level events generated during normal and attack traffic are captured directly at the kernel layer by means of an extended Berkeley Packet Filter (eBPF). The collected logs are then processed within a Security Information and Event Management (SIEM) platform, where ML–based detection models analyze traffic patterns and behavioral features to identify DDoS attacks in near real-time. This architecture improves visibility into attack characteristics while maintaining minimal performance impact on the protected services. The proposed system demonstrates how eBPF-based observability, when integrated with SIEM and ML techniques, can provide an effective, scalable, and modular approach for DDoS detection in virtualized environments. The design is particularly suited for cloud and multi-VM deployments, offering enhanced security monitoring, faster attack detection, and improved operational resilience.
Zeeshan Ali, A. Marotta, W. Tiberti et al.· 2026 International Conferenc...· 0 citations
Large language models (LLMs) embedded in enterprise workflows cannot structurally distinguish legitimate instructions from adversarial ones in the same token stream, making prompt injection OWASP's top LLM risk for two consecutive editions a persistent threat across direct and indirect vectors. This paper presents PromptShield-RT, a layered, real-time, model-agnostic framework combining input normalization and provenance tagging, lexical-heuristic pattern matching, a statistical classifier, structural anomaly features, and calibrated risk fusion, with policy-driven mitigation (allow/sanitize/quarantine/block) and an explainable, adaptive-feedback mechanism for SOC workflows. We construct an original evaluation corpus, SynPI-Bench (n = 450, six categories), and a template-disjoint held-out generalization set (n = 31) with novel phrasings, obfuscation encodings, and adversarial hard-negative benign text. Using template-grouped 5-fold cross-validation, the fused pipeline achieves 92.4% accuracy (F1 = 0.930, AUC = 0.990), outperforming heuristic-only (57.0%) and naive-averaged (59.2%) baselines, while a lexical classifier reaches 85.9% with lower precision. We report a pronounced generalization gap on the held-out set (48.4% accuracy, 90% false-positive rate on hard negatives), quantifying a known limitation of surface-lexical defenses. The pipeline achieves sub-millisecond P95 latency (0.266 ms), within typical 50 ms enterprise SLAs. We situate PromptShield-RT relative to structural, architectural, and guardrail-product defenses, arguing for layered, defense-in-depth architectures, with reproducible code provided.
Fatimah Alhamzawi· Al-Noor Journal of Engineeri...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
