tag: Machine-Learning · 14 items
- Engineer — Learn: Relevant only if building privacy-preserving ML inference pipelines under FHE; SPA reduces polynomial approximation latency for GELU/SiLU activations, but this is foundational research with no immediate deployment artifact or patching action.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: Research quantifying privacy leakage tradeoffs between DP-SGD and privacy-aware synthetic data rewriting when fine-tuning on sensitive records — useful design input for any ML pipeline that ingests PII, but no patch or configuration action required today.
- SOC/IR — Skip
- Leader — Learn: Provides benchmarking evidence that privacy-aware data rewriting outperforms naive paraphrasing and DP-SGD for capability-privacy balance — relevant background for shaping AI/data governance policy if the organization fine-tunes models on sensitive data.
- Engineer — Learn: Novel attack class showing that latent behaviors in deployed ML models can be activated without modifying weights or training data — relevant if you run production classifiers; no patch or mitigation available yet, but worth factoring into model security reviews.
- SOC/IR — Learn: Pure research with no IOCs, ATT&CK mapping, or detection surface at this stage; understand the technique exists but no hunt or detection work is actionable today.
- Leader — Learn: Demonstrates a new risk category for organizations deploying ML inference in production — useful context for AI security policy discussions, but no breach or vendor exposure requiring immediate action.
- Engineer — Learn: Academic improvement to differentially private ML training noise allocation — relevant only if you are actively implementing DP-SGD pipelines; no running-system changes required.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: Academic research on detecting sophisticated LOTL-based abuse of security platforms using multi-modal ML. No immediate patch or config action — worth understanding as a design pattern for abuse-resistant SaaS instrumentation.
- SOC/IR — Learn: The multi-modal approach to cold-start LOTL detection and the framing of security tools themselves as an abuse surface is worth absorbing for detection strategy, but the paper yields no ready-to-deploy rules or IOCs.
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: The finding that 98% of MISP events lack sector tagging quantifies a real operational gap in shared CTI value; the BERT-based approach achieving F1 0.89 for sector routing is worth tracking as a future tooling direction for CTI triage workflows.
- Leader — Learn: The statistic that nearly all shared CTI events go uncategorized by sector is a useful benchmark for conversations about the operational return on threat intel program investments; no action is required now, but it frames the value case for better-structured intel feeds.
- Engineer — Learn: Novel technique for running object detection on encrypted images without accuracy loss; worth tracking if building privacy-sensitive CV pipelines, but no production implementation or tooling is available yet.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: TTP-R1 automates mapping CTI prose to ATT&CK (sub-)techniques with meaningful F1 gains over LLM baselines; worth tracking if your team annotates CTI at scale, but no detection or hunt action follows from this research paper alone.
- Leader — Skip
- Engineer — Learn: Research-stage framework for privacy-preserving ML inference using partial homomorphic encryption; no production deployment target yet, but relevant for teams evaluating MLaaS privacy architectures.
- SOC/IR — Skip
- Leader — Learn: Emerging approach to MLaaS model-and-data confidentiality could inform vendor risk questions around proprietary model exposure; no near-term action required.
- Engineer — Learn: Academic research showing ordinary ambient sounds can backdoor speech recognition models at only 5% poisoning rate with no clean-accuracy drop — informs threat modeling for teams training or fine-tuning ASR models, but no specific product or actionable patch is involved.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: Research shows adding entropy-based features to supervised traffic classifiers reduces misclassifications in high-variability scenarios; worth evaluating if the team maintains its own ML-based detection pipeline.
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: Academic research showing a feature-aggregation technique that improves IDS accuracy by up to 7% while cutting data volume significantly — worth tracking if evaluating or tuning ML-based network detection models, but no tooling or deployable artifact yet.
- Leader — Skip
- Engineer — Learn: Academic proposal for interpretable static PDF analysis using Tsetlin Machines; no tooling released or integrated into common pipelines, but the interpretability angle is worth tracking for teams building or evaluating ML-based malware classifiers.
- SOC/IR — Learn: The interpretability feature could eventually improve analyst trust in ML-based PDF triage, but no detection rules, IOCs, or deployable tooling accompany this research paper.
- Leader — Skip
- Engineer — Learn: Novel cross-level attack class that bridges electromagnetic/physical fault injection with algorithmic backdoors in embedded neural networks, bypassing input-space defenses. No immediate patch action — relevant if you design or deploy ML inference on embedded hardware, as it signals a new threat surface to consider during architecture review.
- SOC/IR — Skip
- Leader — Skip