sequential detection

Security Operations Centers (SOCs) grapple with alert fatigue caused by overwhelming volumes of alerts, hindering timely responses to critical threats. This study systematically reviews 119 works published between 2015 and 2026, including 87 core contributions, and proposes the first four-stage alert processing workflow taxonomy encompassing filtering, triage, correlation, and generative augmentation. It traces the evolution of machine learning, deep learning, graph neural networks, and large language models in alert prioritization and reduction. The analysis identifies critical gaps in deployment realism, adversarial robustness, cross-environment validation, and evaluation practices. Building on these insights, the paper outlines a future research agenda toward trustworthy cognitive SOCs, offering a theoretical foundation and strategic direction for developing efficient and reliable security operations frameworks.

This study addresses a novel Lazarus Group campaign targeting cryptocurrency wallets and financial data, focusing on its persistence mechanisms, C2 communication patterns, and data exfiltration tactics. Method: We systematically map the underlying infrastructure and innovatively integrate Tactics, Techniques, and Procedures (TTPs) with multi-source threat intelligence to construct a threat-hunting hypothesis model aligned with the MITRE ATT&CK framework. The methodology combines static and dynamic reverse engineering, IoC correlation mining, and real-time behavioral anomaly detection. Contribution/Results: We derive actionable detection rules and alert-optimization strategies that bridge tactical analysis with strategic risk forecasting. Experimental evaluation demonstrates over a threefold improvement in threat detection speed, significantly enhancing predictive capability against APT behaviors and strengthening defensive resilience.

To address the redundancy and delayed response caused by intrusion detection system (IDS) alert flooding, this paper proposes a real-time hierarchical correlation method operating directly on raw network events—bypassing conventional alert-level correlation. It introduces the first event-level hierarchical modeling and correlation framework, integrating similarity-based matching with graph-structured analysis. The method employs lightweight event clustering and semantic association algorithms to perform pre-detection integration of heterogeneous network events. Evaluated on the DARPA99 dataset, it compresses raw events by 87%, generating approximately 21,000 semantically cohesive clusters within 30 seconds. This substantially reduces alert volume and analytical overhead, while significantly improving both the timeliness and interpretability of threat perception.

Existing ransomware detection methods struggle with rapidly evolving, polymorphic, and previously unseen variants. To address this, we propose a dynamic behavioral modeling framework based on temporal association graphs (TAGs), which captures spatiotemporal dependencies among system calls at the process level in real time. Our approach pioneers the use of TAGs for ransomware behavior dissection and anomaly localization, enabling zero-shot identification and adaptive evolutionary analysis. It integrates a dynamic graph neural network, behavioral sequence segmentation, streaming feature extraction, and a lightweight anomaly scoring mechanism. Evaluated on a multi-family ransomware dataset, the framework achieves 99.2% detection accuracy—significantly outperforming conventional signature-based and heuristic methods—while maintaining low computational overhead, high real-time responsiveness, and enterprise-grade deployability.

Traditional intrusion predictors suffer from poor scalability to hundreds of attack types and require separate, attack-specific modeling. To address this, we propose a modular, online intrusion prediction framework based on statistical learning. The framework decouples attack detection from attack-stage identification into reusable functional components—including feature extraction, temporal modeling, and stage classification—enabling on-demand dynamic composition and tunable performance parameterization. Experiments on public datasets demonstrate that our approach maintains real-time inference capability while significantly improving generalization and development efficiency: a single component suite supports over数十 attack types; average stage identification accuracy improves by 12.3%; and model deployment time decreases by 76%. Our core contribution is the first principled design of an intrusion prediction system that is modular, composable, and controllable—thereby overcoming the scalability bottleneck inherent in monolithic predictors.

To address the challenge of detecting Advanced Persistent Threats (APTs) that evade traditional rule-based engines, this paper proposes a lightweight, interpretable predictive analytics framework integrating logistic regression and K-means clustering. Designed for low-resource settings with small-scale security event data (Kaggle dataset, *n* = 2,000), it enables real-time threat detection and response. Methodologically, it is the first to synergistically combine these two models in resource-constrained environments and employs SPSS-based statistical tests to validate feature significance. Compared to baseline rule engines, the framework achieves significantly improved threat alert sensitivity (+23.6%) and reduces average response time by 41%, while preserving high model interpretability. It thus delivers actionable, proactive defense decision support for Security Operations Centers (SOCs).

Large language models (LLMs) can still generate unsafe outputs in deployment, necessitating efficient real-time monitoring. This work proposes a lightweight online safety monitoring mechanism that integrates signals from an external verification model, threshold-based decision rules, and risk control theory to produce reliable alerts through calibrated thresholds. The approach features a simple architecture that avoids computationally intensive procedures yet achieves detection performance on par with state-of-the-art sequential hypothesis testing methods across mathematical reasoning and red-teaming benchmarks. By combining practical efficiency with theoretical guarantees, the proposed method offers a viable solution for real-world LLM safety monitoring.

This work addresses the limitations of conventional time-window-based alert grouping methods, which often lead to alert fatigue and misclassification under high-noise and multi-concurrent-attack scenarios. To overcome these challenges, the authors propose AlertBERT, a novel framework that leverages a masked language model (MLM) for self-supervised semantic encoding of alerts and introduces a controllable data augmentation strategy to simulate realistic noise and concurrent attacks, thereby circumventing rigid temporal constraints. Robust alert grouping is achieved through density-based clustering (e.g., DBSCAN), enabling both real-time and post-hoc analysis. Experimental results on synthetic datasets demonstrate that AlertBERT significantly outperforms existing approaches in accurately identifying alert clusters corresponding to genuine attacks.

This study addresses the challenge of distinguishing benign network scans from high-severity attack escalations in the overwhelming volume of alerts generated by intrusion detection systems (IDS), with a focus on identifying attack trends exhibiting tail risk. To this end, the authors introduce, for the first time in cybersecurity, an extreme-state prediction methodology adapted from quantitative finance, proposing a time-series–based tail risk early-warning framework. The approach extracts features such as alert intensity, volatility, and short-term momentum via weighted moving averages and integrates extreme mechanism modeling with supervised learning for classification. Evaluated at a per-minute granularity, the model achieves 91% accuracy, 89% recall, and 98% precision. The training code is publicly released to facilitate reproducibility and interpretability analyses.

To address the latency in network attack response, this paper proposes an early threat detection method leveraging Telegram-based open-source intelligence (OSINT). Unlike conventional reactive defense paradigms, our approach integrates large language models (LLMs) for semantic understanding with graph neural networks (GNNs) to model adversarial collaboration patterns, establishing a novel multimodal alignment framework. This framework introduces, for the first time in the Telegram context, a verifiable “threat–event” mapping mechanism. By jointly analyzing linguistic content and interaction topology across 365K real-world messages, our model achieves an F1-score of 0.89—significantly outperforming unimodal baselines. Results empirically validate that semantic and behavioral signals from social platforms exhibit strong predictive power for emerging threats. This work establishes a new paradigm for proactive cybersecurity defense grounded in multimodal OSINT analysis.

Existing static defense mechanisms struggle to counter progressive adversarial attacks that span multiple turns and modalities, as they overlook the cumulative structural contamination embedded in dialogue trajectories. This work proposes TRIAD, a novel framework that uniquely integrates structural anomaly detection, Ledoit-Wolf regularized Mahalanobis distance, and topological trajectory acceleration within a time-varying Cox proportional hazards model augmented by Bayesian hidden Markov feedback. By formulating security verification as a dynamic survival prediction problem, TRIAD enables early detection and interception of malicious intent without requiring model retraining. The approach provides a theoretical upper bound on failure time under adversarial perturbations, ensuring accelerated divergence of malicious trajectories. Consequently, it offers multimodal conversational agents an efficient, interpretable, and theoretically grounded mechanism for continuous safety alignment.