CuraSec

tag: Anomaly-Detection · 6 items

Learn WADE: LSTM anomaly detection for WebAssembly runtime behavior
2026-10-26 · arXiv cs.CR · source ↗ #webassembly#anomaly-detection#research
  • Engineer — Learn: Novel behavioral detection approach for Wasm applications worth tracking if you ship WebAssembly workloads; the technique of training LSTM models on benign execution traces addresses Wasm’s lack of ASLR/stack canaries, but there’s no tooling ready to adopt yet.
  • SOC/IR — Learn: The function-trace anomaly detection methodology is conceptually applicable to future Wasm-specific detection coverage, but the research produces no IOCs, no ATT&CK mappings, and no detection rules to act on today.
  • Leader — Skip
Learn archived X-SPUR: Unsupervised Intrusion Detection for Automotive Ethernet
2026-09-21 · arXiv cs.CR · source ↗ #automotive-security#anomaly-detection#research
  • Engineer — Skip
  • SOC/IR — Learn: Novel unsupervised IDS approach using language-model surprisal on raw packet tokens may inform detection design for OT/automotive environments, though it targets in-vehicle networks outside typical enterprise SOC scope.
  • Leader — Skip
Learn archived Research: Hybrid Exploratory + Automated BGP Anomaly Detection
2026-09-21 · arXiv cs.CR · source ↗ #bgp-security#anomaly-detection#research
  • Engineer — Learn: Academic prototype exploring how combining human-driven exploratory analysis with automated detection improves coverage of complex BGP hijack scenarios — worth reading if you own BGP monitoring tooling, but no deployable artifact or configuration change today.
  • SOC/IR — Learn: The paper’s framing of alert-fatigue and missed event linkages maps directly to SOC triage challenges; the BGP-specific threat scenarios (spam propagation, DoS via route hijacking) may sharpen detection intuition, but no IOCs, Sigma rules, or hunt queries are provided.
  • Leader — Skip
Learn archived XAI Anomaly Detection Framework for DER/Power-Grid Networks (Research)
2026-09-14 · arXiv cs.CR · source ↗ #anomaly-detection#ot-security#explainable-ai
  • Engineer — Skip
  • SOC/IR — Learn: Academic paper exploring SHAP-based self-verification to flag inconsistent ML anomaly detection alerts — the explainability-as-confidence-check pattern could inform future ML detection pipelines, but the OT/DNP3 domain is too niche for most enterprise SOC teams.
  • Leader — Skip
Learn archived Entropy features improve network anomaly detection ML pipelines
2026-07-20 · arXiv cs.CR · source ↗ #anomaly-detection#machine-learning#network-security
  • Engineer — Skip
  • SOC/IR — Learn: Research shows adding entropy-based features to supervised traffic classifiers reduces misclassifications in high-variability scenarios; worth evaluating if the team maintains its own ML-based detection pipeline.
  • Leader — Skip
Learn archived Choquet-Integral Feature Aggregation Boosts Network Anomaly Detection
2026-07-20 · arXiv cs.CR · source ↗ #anomaly-detection#machine-learning#network-security
  • Engineer — Skip
  • SOC/IR — Learn: Academic research showing a feature-aggregation technique that improves IDS accuracy by up to 7% while cutting data volume significantly — worth tracking if evaluating or tuning ML-based network detection models, but no tooling or deployable artifact yet.
  • Leader — Skip