Pith. sign in

REVIEW 3 major objections 6 minor 33 references

Agentic SABRE: An Uncertainty-Aware Neuro-Symbolic Multi-Agent Framework for Adaptive Ransomware Detection

T0 review · 3 major / 6 minor · reviewed 2026-07-11 · grok-4.5

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Ransomware defence can auto-contain only when risk is high and uncertainty is low, escalating everything else.

desk verdict Solid engineering of uncertainty-as-control for ransomware triage; the multi-agent idea is real, but the headline fusion numbers rest on unpaired score-level stitching of two non-overlapping corpora. read the letter →

arxiv 2607.04292 v1 pith:X3N3XTZM submitted 2026-07-05 cs.AI cs.CR

Henry Kabuye , Biju Issac , Jeyamohan Neera This is my paper · ORCID
classification cs.AIcs.CR
keywords RansomwareDetectionExplainableArtificialIntelligenceUncertaintyEstimationMulti-AgentSystemsSemanticEmbeddingsMonteCarloDropoutNeuro-SymbolicTriagePolicy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Monolithic ransomware detectors give a single score and force a hard choice between false positives and missed attacks, especially under concept drift and polymorphism. This paper argues that the right architecture is multi-agent: one agent reads static semantic structure of binaries, another reads runtime behavioural telemetry, each reports both a risk probability and its own epistemic uncertainty via Monte Carlo Dropout, and a decision orchestrator fuses those signals. The orchestrator then applies a simple, auditable policy with risk and uncertainty thresholds: high-risk and low-uncertainty cases are auto-contained, ambiguous or high-uncertainty cases go to human analysts, and the rest are allowed. On a saturated semantic dataset the system keeps perfect discrimination; under weak behavioural signals it still reduces unnecessary escalations while keeping calibrated uncertainty. Explainability tools (saliency, permutation importance, counterfactuals) show that the decisions rest on interpretable ransomware-relevant features with bounded flip cost.

What carries the argument

Uncertainty-aware triage policy: fused risk ˆp and max agent uncertainty σ_max are compared to thresholds (τ, κ) and a stricter pair (τ_high, κ_low) to produce AUTO-CONTAIN only when risk is high and uncertainty is low; otherwise escalate or allow. This policy, not ensemble voting, is the control mechanism.

What would settle it

Deploy the same agents on a corpus of truly paired samples (same executable, same run: static PE features plus simultaneous I/O/memory telemetry), re-optimise thresholds, and check whether the reported reduction in false escalations at equal recall and the calibration of σ_max still hold; if escalation savings vanish or uncertainty no longer routes novel families correctly, the central claim fails.

Watch

Extended reading notes

Core claim

Agentic SABRE shows that ransomware detection can be turned into an executable triage contract: fuse semantic and behavioural agent scores, quantify per-agent epistemic uncertainty with Monte Carlo Dropout, and let two pairs of thresholds (risk and uncertainty budget) decide AUTO-CONTAIN, ESCALATE, or ALLOW. On RDset and RanSMAP this preserves AUC = 1.0 in the saturated semantic regime, improves robustness when behavioural signals are weak, and yields up to a 4.9% relative reduction in false escalations at equal recall while remaining calibrated and explainable.

Load-bearing premise

The evaluation treats score-level fusion of two unpaired datasets (static PE metadata and separate runtime I/O traces) as a valid stand-in for real joint telemetry; if that approximation fails in deployment, the claimed fusion and triage benefits do not transfer.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes Agentic SABRE, a multi-agent ransomware detector that pairs a semantic CNN (PE embeddings from RDset) with a behavioural CNN (I/O/memory telemetry from RanSMAP), estimates per-agent epistemic uncertainty via Monte Carlo Dropout, and fuses scores with a CTGAN-augmented Decision Agent. An orchestrator then applies an axis-aligned triage policy over fused risk p̂ and max-aggregated uncertainty σ_max, mapping samples to AUTO-CONTAIN, ESCALATE, or ALLOW under thresholds (τ, κ, τ_high, κ_low). The authors report perfect semantic discrimination (AUC = 1.0 on RDset), weak standalone behavioural ranking (AUC ≈ 0.60), calibrated fused probabilities, multi-split generalisation on RanSMAP (including family holdout AUROC 0.707), ablations of CTGAN/uncertainty/mean fusion, and counterfactual/permutation explainability. The central operational claim is that uncertainty-aware triage reduces false escalations at equal recall while preserving safe autonomous containment under concept drift.

Significance. If the evaluation of fusion and triage transfers to real paired static–runtime telemetry, the work would be a useful systems contribution: it treats epistemic uncertainty as an executable control signal rather than a diagnostic, and the triage geometry is interpretable and recalibratable without retraining. Strengths that should be credited include explicit algorithms (Algs. 1–4), ablations of CTGAN and uncertainty inputs (Tables 11–12), reliability diagrams, multi-seed multi-split generalisation (Table 2, family holdout), behavioural evasion stress tests (Table 5), and counterfactual cost analysis with PE/I/O validity caveats. The architectural separation of neural agents from symbolic threshold policy is a clean design choice relative to tightly coupled neuro-symbolic systems. The significance is therefore primarily operational and systems-oriented rather than a new learning-theoretic result.

major comments (3)
  1. [Section 8.1; Eqs. (1), (22); Table 4] Section 8.1 (“Cross-source fusion rationale”) and Eqs. (1), (22): the Decision Agent, CTGAN score augmentation, σ_max (Eq. 3), optimised thresholds (Eqs. 24–25), and reported escalation reductions are all evaluated on score vectors assembled from unpaired RDset and RanSMAP samples. No instance has both a real PE embedding and a real runtime trace from the same execution, so the joint distribution of (p_sem, p_beh, σ_sem, σ_beh) is synthetic. This is load-bearing for the fusion/triage claims (including the abstract’s 4.9% false-escalation reduction). Either evaluate on paired multi-view traces, or quantify sensitivity of p̂, σ_max, and J(τ, κ) to plausible cross-modal correlation structures; without that, transfer to SOC joint telemetry is unestablished.
  2. [Tables 3, 4, 11; §9.2; Fig. 5a] Table 3 vs Table 4 (and Table 11): the Behavioural CNN reports AUC 0.6030 on RanSMAP, while fused triage reports RanSMAP AUC ≈ 0.539–0.540 (MLP w/ CTGAN 0.5397; mean fusion 0.501). This appears to contradict the narrative that fusion “substantially improves separability” under weak behavioural signals (Fig. 5a caption; §9.2). Clarify the exact evaluation population for fusion AUC (window-level RanSMAP only vs mixed unpaired score manifold), reconcile the drop relative to the behavioural base agent, and restate the robustness claim only for metrics that actually improve (e.g., escalation volume at fixed recall) with those metrics tabulated.
  3. [Abstract; §8.1; §9; Table 2] §9 and abstract: the headline RDset AUC = 1.0 is obtained without family-wise or temporal splits (§8.1, §9 generalisation caveats). The authors correctly flag structural-similarity risk, yet still lead with perfect discrimination as a primary result. Given that family holdout on RanSMAP already drops AUROC to 0.707 (Table 2), the saturated RDset figure should be demoted to a stress-test of the triage layer under minimal semantic uncertainty, not presented as evidence of general semantic superiority. Prefer family/temporal RDset partitions or remove AUC = 1.0 from the abstract claim set.
minor comments (6)
  1. [Abstract; §9] The abstract’s “up to a 4.9% relative reduction in false escalations at equal recall” is not clearly traceable to a numbered table or equation in §9/§11. Point to the exact comparison (policies, datasets, recall level) or recompute and tabulate it.
  2. [§9.2; Eq. (24)] τ = 0.999999 (Eq. 24) is extreme; §9.2 discusses dataset specificity, but a short sensitivity plot of J(τ, κ) or AUTO-CONTAIN volume vs τ on a held-out slice would make recalibration guidance concrete for practitioners.
  3. [§4; §3.5] “Neuro-symbolic” is used heavily; the symbolic content is ATT&CK-inspired threshold/heuristic cues rather than a knowledge base or logic program. A one-sentence scope note early in §4 would set expectations.
  4. [Eqs. (1), (22)] Notation: s is introduced as [p̄_sem, p̄_beh] in Eq. (1) but later as a four-vector including uncertainties in Eq. (22). Unify the definition at first use.
  5. [Table 4; §8.1] Table 4 confusion counts on RanSMAP are very large relative to the 11,820 traces stated in §8.1; state whether these are window-level instances, CTGAN-augmented scores, or repeated sessions so readers can interpret escalation rates.
  6. [Abstract; §1] Minor prose issues: missing spaces in the abstract/intro (“Ransomwarehasevolved”, “fast–moving”), and occasional inconsistent hyphenation of “uncertainty-aware”.

Circularity Check

1 steps flagged · score 1.0 of 10

Empirical multi-agent framework with held-out threshold optimisation; one non-load-bearing self-citation to prior uncertainty work, no derivation that reduces to its inputs by construction.

  1. self citation load bearing [Section 3 (Related Work) and Table 1; also Introduction paragraph contrasting [10]]
    "Whereas existing approaches quantify uncertainty to interpret predictions [10], Agentic SABRE operationalises uncertainty to govern system actions. ... Kabuye et al.[10]×✓× ×✓× ×"

    The authors cite their own prior uncertainty-aware ransomware paper [10] for the diagnostic use of uncertainty. The citation is background only; it is not invoked as a uniqueness result, ansatz, or premise that forces the multi-agent architecture, the (τ, κ) triage policy, or the reported escalation reductions. The new claims rest on the present experiments and the explicit optimisation of J(τ, κ), so the self-citation is non-load-bearing and raises the score only to 1.

full rationale

Agentic SABRE is an empirical systems paper. The fused risk p̂ (Eq. 23), max-aggregated uncertainty σ_max (Eq. 3), and triage actions (Eqs. 5–7) are produced by trained agents plus an MLP Decision Agent; thresholds (τ, κ, τ_high, κ_low) are selected by maximising the explicit scalarised objective J(τ, κ) = bal_acc − λ EscRate on held-out data (Eq. 12, Section 6). The reported 4.9 % relative reduction in false escalations and AUC figures are therefore measured outcomes of that optimisation and of the agents, not quantities forced by definition or by a fitted constant renamed as a prediction. The sole self-citation to Kabuye et al. [10] appears in Related Work and Table 1 as background that prior uncertainty work treated uncertainty diagnostically; the present paper explicitly distinguishes itself by operationalising uncertainty inside an executable triage policy. That citation is not used as a uniqueness theorem, ansatz, or hidden premise that forces the new multi-agent or triage results. No equation equates a claimed prediction to a fitted input, no uniqueness is imported from the authors’ prior work, and no known empirical pattern is merely renamed. The unpaired score-level fusion of RDset and RanSMAP is a methodological validity concern, not a circularity of derivation. Consequently the derivation chain is self-contained against the paper’s own equations and external benchmarks; circularity is negligible.

Assumptions & free parameters 6 free parameters · 5 assumptions · 3 invented entities

The central empirical claim rests on a handful of fitted triage thresholds, the modelling choice that unpaired score fusion is informative, the standard MC-Dropout approximation to epistemic uncertainty, and the architectural invention of the orchestrator itself. No new physical entities are postulated; the free parameters and domain assumptions are the main load-bearing items a reader must accept.

free parameters (6)
  • risk threshold τ (safety-optimal) = 0.999999
    Optimised on held-out data to 0.999999; directly controls the AUTO-CONTAIN / ESCALATE boundary and therefore the reported escalation reduction.
  • uncertainty budget κ = 0.458
    Fitted to 0.458; jointly with τ defines the escalation region whose volume is the operational cost metric.
  • stricter pair (τ_high, κ_low) = 0.99 / 0.229
    Set to (0.99, 0.229); carves out the autonomous-containment region whose size is claimed to be safe.
  • escalation cost weight λ = 0.5
    Set to 0.5 for the low-escalation regime; trades balanced accuracy against escalation rate in J(τ, κ).
  • MC Dropout passes T = 30
    Fixed at 30; controls the quality of the epistemic-uncertainty estimate σ that drives triage.
  • counterfactual flip threshold θ = 0.49
    Fixed at 0.49 for all behavioural and semantic counterfactual experiments; defines what counts as a successful label flip.
assumptions (5)
  • domain assumption Monte Carlo Dropout variance is a sufficiently calibrated estimate of epistemic uncertainty for triage decisions.
    Invoked throughout Sections 4–5 and Algorithm 2; the paper notes ensembles may be better under strong shift but still treats MC Dropout as operationally adequate.
  • ad hoc to paper Semantic (RDset) and behavioural (RanSMAP) score vectors can be fused meaningfully even though the underlying samples are unpaired.
    Stated in Section 8.1 “Cross-source fusion rationale”; without this the multi-agent evaluation collapses.
  • ad hoc to paper Max aggregation σ_max = max(σ_sem, σ_beh) is a conservative and appropriate uncertainty summary for the orchestrator.
    Equation (3) and Section 4.3; alternative aggregations are not ablated.
  • domain assumption Axis-aligned thresholds (τ, κ) preserve interpretability and stability under distribution shift better than learned non-linear boundaries.
    Section 5.1; used to justify the entire policy geometry.
  • domain assumption Conditional independence of the two agents’ evidential contributions is an acceptable modelling approximation for the fusion MLP.
    Acknowledged as a limitation in Section 13; still used for the reported fusion results.
invented entities (3)
  • Agentic SABRE multi-agent architecture with Decision-layer orchestrator
    purpose: Decompose ransomware detection into semantic and behavioural agents whose scores and uncertainties are fused and then triaged by an executable policy.
    The system itself is the main postulated object; independent evidence is limited to the empirical tables on two public datasets.
  • Risk-and-uncertainty triage policy (AUTO-CONTAIN / ESCALATE / ALLOW)
    purpose: Convert fused risk and max epistemic uncertainty into one of three operational actions via two pairs of thresholds.
    Defined by Eqs. (5)–(7) and Algorithm 4; the policy is new as an executable control contract, not merely a post-hoc diagnostic.
  • Score-level CTGAN augmentation for the Decision Agent
    purpose: Enrich rare high-risk score vectors before training the fusion MLP without altering base-agent uncertainties.
    Algorithm 3; ablation shows a modest AUC drop when removed, but the entity is internal to the pipeline.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Agentic SABRE: An Uncertainty-Aware Neuro-Symbolic Multi-Agent Framework for Adaptive Ransomware Detection." pith.science (2026). https://pith.science/paper/X3N3XTZM

@misc{pith2026260704292,
  author       = {Pith},
  title        = {Pith review of: Agentic SABRE: An Uncertainty-Aware Neuro-Symbolic Multi-Agent Framework for Adaptive Ransomware Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/X3N3XTZM}},
  note         = {Machine review of arXiv:2607.04292}
}
read the original abstract

Ransomware has evolved into a complex, adaptive, and fast-moving adversary category in which static signatures and monolithic classifiers fail to generalise under concept drift, evasion, and behavioural polymorphism. In this paper, we present Agentic SABRE (Semantic-Behavioural Arbitration for Ransomware Evaluation), an uncertainty-aware, neuro-symbolic, multi-agent framework for adaptive ransomware detection. SABRE fuses semantic, representation-based evidence with behavioural, time-window forensic telemetry and employs Monte Carlo Dropout inference to quantify epistemic uncertainty for each agent. We introduce a decision-layer orchestrator that performs risk- and uncertainty-aware triage using two interpretable thresholds: a risk score and an uncertainty budget. High-confidence, high-risk samples are automatically contained, while uncertain or borderline cases are escalated to human analysts, establishing a flexible computational contract between autonomous response and analyst oversight. To support auditability and trust, SABRE integrates post-hoc explainability mechanisms, including gradient saliency, permutation importance, and counterfactual analysis, enabling both local and global interpretation of agent decisions. Extensive evaluation on RDset and RanSMAP demonstrates that Agentic SABRE preserves perfect discrimination on saturated semantic datasets, with AUC equal to 1.0, while improving robustness under weak behavioural signals. It achieves up to a 4.9 percent relative reduction in false escalations at equal recall while maintaining calibrated predictive uncertainty. Counterfactual analysis further shows that semantic and behavioural decisions can be reversed with bounded perturbation cost, indicating stable and interpretable decision boundaries.

Figures

Figures reproduced from arXiv: 2607.04292 by the authors.

Figure 1
Figure 1. Operational pipeline with uncertainty-aware, agentic policy. Semantic and behavioural CNNs (with MC Dropout) [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗
Figure 2
Figure 2. Mean AUROC with 95% confidence intervals across 6 seeds for each evaluation split. The family-holdout split shows [PITH_FULL_IMAGE:figures/full_fig_p015_2.png] view at source ↗
Figure 3
Figure 3. Permutation-based feature importance for the behavioural agent, measured as the drop in AUC after permuting [PITH_FULL_IMAGE:figures/full_fig_p017_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Reliability diagram for the fused risk score [PITH_FULL_IMAGE:figures/full_fig_p018_4.png]
Figure 5
Figure 5. Figure 5: Receiver operating characteristic (ROC) curves comparing base agents and fusion. [PITH_FULL_IMAGE:figures/full_fig_p019_5.png]
Figure 6
Figure 6. Figure 6: Triage policy geometry in the (ˆp, σmax) space. Horizontal and vertical thresholds correspond to the analytical decision rules in Eqs. (9) and (10), partitioning the space into ALLOW, ESCALATE, and AUTO-CONTAIN regions. Uncertainty acts as a stabilising control variabl…
Figure 7
Figure 7. Figure 7: Per-family detection rate under slow-encrypt attack ( [PITH_FULL_IMAGE:figures/full_fig_p021_7.png]
Figure 8
Figure 8. Figure 8: Semantic counterfactual diagnostics for N = 50 borderline-malicious samples. (Top-left) Distribution of counterfac￾tual distance ∥∆z∥2. (Top-right) Distribution of relative distance ∥∆z∥2/∥z∥2. (Bottom-left) Relationship between original semantic score psem and ∥∆z∥2. …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

33 extracted references · 14 canonical work pages

  1. [1]

    D. W. Fernando, N. Komninos, T. Chen, A study on the evolution of ransomware detection using machine learning and deep learning techniques, IoT 1 (2) (2020) 551–604

    2020

  2. [2]

    Razaulla, C

    S. Razaulla, C. Fachkha, C. Markarian, A. Gawanmeh, W. Mansoor, B. C. M. Fung, C. Assi, The age of ransomware: A survey on the evolution, taxonomy, and research directions, IEEE Access 11 (2023) 40698–40723. doi:10.1109/ACCESS.2023.3268535. URLhttps://doi.org/10.1109/ACCESS.2023.3268535

    work page doi:10.1109/access.2023.3268535 2023

  3. [3]

    Urooj, B

    U. Urooj, B. A. S. Al-Rimy, A. B. Zainal, F. Saeed, A. Abdelmaboud, W. Nagmeldin, Addressing behavioral drift in ransomware early detection through weighted generative adversarial networks, IEEE Access 12 (2024) 3910–3925. doi:10.1109/ACCESS.2023.3348451. URLhttps://doi.org/10.1109/ACCESS.2023.3348451

    work page doi:10.1109/access.2023.3348451 2024

  4. [4]

    Ceschin, M

    F. Ceschin, M. Botacin, H. M. Gomes, F. A. Pinage, L. S. Oliveira, A. Grégio, Fast & furious: Mod- elling malware detection as evolving data streams, CoRR abs/2205.12311 (2022). arXiv:2205.12311, doi:10.48550/ARXIV.2205.12311. URLhttps://doi.org/10.48550/arXiv.2205.12311

    arXiv doi:10.48550/arxiv.2205.12311 2022

  5. [5]

    D. W. Fernando, N. Komninos, Fesad ransomware detection framework with machine learning using adaption to concept drift, Comput. Secur. 137 (2024) 103629. doi:10.1016/J.COSE.2023.103629. URLhttps://doi.org/10.1016/j.cose.2023.103629 31

    doi:10.1016/j.cose.2023.103629 2024

  6. [6]

    Alraizza, A

    A. Alraizza, A. Algarni, Ransomware detection using machine learning: A survey, Big Data Cogn. Comput. 7 (3) (2023) 143. doi:10.3390/BDCC7030143. URLhttps://doi.org/10.3390/bdcc7030143

    work page doi:10.3390/bdcc7030143 2023

  7. [7]

    Zahoora, A

    U. Zahoora, A. Khan, M. Rajarajan, S. H. Khan, M. Asam, T. Jamal, Ransomware detection using deep learning based unsupervised feature extraction and a cost sensitive pareto ensemble classifier, Scientific reports 12 (1) (2022) 15647

    2022

  8. [8]

    B. G. Doan, D. Q. Nguyen, P. Montague, T. Abraham, O. Y. de Vel, S. Camtepe, S. S. Kanhere, E. Abbasnejad, D. C. Ranasinghe, Bayesian learned models can detect adversarial malware for free, in: J. García-Alfaro, R. Kozik, M. Choras, S. K. Katsikas (Eds.), Computer Security - ESORICS 2024 - 29th European Symposium on Research in Computer Security, Bydgoszc...

    work page doi:10.1007/978-3-031-70879-4_3 2024

Show all 33 references
  1. [9]

    Ispahany, M

    J. Ispahany, M. R. Islam, M. Z. Islam, M. A. Khan, Ransomware detection using machine learn- ing: A review, research limitations and future directions, IEEE Access 12 (2024) 68785–68813. doi:10.1109/ACCESS.2024.3397921. URLhttps://doi.org/10.1109/ACCESS.2024.3397921

    2024 doi

  2. [10]

    Kabuye, B

    H. Kabuye, B. Issac, R. Yumlembam, J. Neera, Explainable and uncertainty aware ai-based ransomware detection, IEEE Access 13 (2025) 106573–106589. doi:10.1109/ACCESS.2025.3581424. URLhttps://doi.org/10.1109/ACCESS.2025.3581424

    2025 doi

  3. [11]

    Alraizza, A

    A. Alraizza, A. Algarni, A. Alrayzah, Enhancing ransomware detection using storage access pattern, in: I. Maglogiannis, L. S. Iliadis, A. Andreou, A. Papaleonidas (Eds.), Artificial Intelligence Applications and Innovations - 21st IFIP WG 12.5 International Conference, AIAI 20...

    2025 doi

  4. [12]

    N. V. Chawla, K. W. Bowyer, L. O. Hall, W. P. Kegelmeyer, SMOTE: synthetic minority over-sampling technique, J. Artif. Intell. Res. 16 (2002) 321–357. doi:10.1613/JAIR.953. URLhttps://doi.org/10.1613/jair.953

    2002 doi

  5. [13]

    L. Xu, M. Skoularidou, A. Cuesta-Infante, K. Veeramachaneni, Modeling tabular data using conditional GAN, in: H. M. Wallach, H. Larochelle, A. Beygelzimer, F. d’Alché-Buc, E. B. Fox, R. Garnett (Eds.), Advances in Neural Information Processing Systems 32: Annual Conference on ...

    2019

  6. [14]

    Y. Gal, Z. Ghahramani, Dropout as a bayesian approximation: Representing model uncertainty in deep learning, in: M. Balcan, K. Q. Weinberger (Eds.), Proceedings of the 33nd International Conference on Machine Learning, ICML 2016, New York City, NY, USA, June 19-24, 2016, Vol. ...

    2016

  7. [15]

    Gawlikowski, C

    J. Gawlikowski, C. R. N. Tassi, M. Ali, J. Lee, M. Humt, J. Feng, A. M. Kruspe, R. Triebel, P. Jung, R. Roscher, M. Shahzad, W. Yang, R. Bamler, X. Zhu, A survey of uncertainty in deep neural networks, Artif. Intell. Rev. 56 (S1) (2023) 1513–1589. doi:10.1007/S10462-023-10562-...

    2023 doi

  8. [16]

    T. R. Besold, A. S. d’Avila Garcez, S. Bader, H. Bowman, P. M. Domingos, P. Hitzler, K. Kühnberger, L. C. Lamb, P. M. V. Lima, L. de Penning, G. Pinkas, H. Poon, G. Zaverucha, Neural-symbolic learning and reasoning: A survey and interpretation, in: P. Hitzler, M. K. Sarker (Ed...

    2021 doi

  9. [17]

    Vaswani, N

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. Kaiser, I. Polosukhin, Attention is all you need, in: I. Guyon, U. von Luxburg, S. Bengio, H. M. Wallach, R. Fergus, S. V. N. Vishwanathan, R. Garnett (Eds.), Advances in Neural Information Processing S...

    2017

  10. [18]

    S. Tian, T. Zhang, J. Liu, J. Wang, X. Wu, X. Zhu, R. Zhang, W. Zhang, Z. Yuan, S. Mao, D. I. Kim, Exploring the role of large language models in cybersecurity: A systematic survey, IEEE Transactions on Network Science and EngineeringEarly Access (2025). URLhttps://arxiv.org/a...

    2025 arXiv

  11. [19]

    Zhang, P

    J. Zhang, P. Wu, J. London, D. Tenney, Benchmarking and evaluating large language models in phishing detection for small and midsize enterprises: A comprehensive analysis, IEEE Access 13 (2025) 28335– 28352. doi:10.1109/ACCESS.2025.3540075. URLhttps://doi.org/10.1109/ACCESS.20...

    2025 doi

  12. [20]

    Patel, F

    U. Patel, F. Yeh, C. Gondhalekar, CANAL - cyber activity news alerting language model : Empirical approachvs.expensivellms, in: 3rdIEEEInternationalConferenceonAIinCybersecurity, ICAIC2024, Houston, TX, USA, February 7-9, 2024, IEEE, 2024, pp. 1–12. doi:10.1109/ICAIC60265.2024...

    2024 doi

  13. [21]

    P. P. Pawar, D. Kumar, M. K. Meesala, P. K. Pareek, S. R. Addula, K. S. Shwetha, Securing digital governance: A deep learning and blockchain framework for malware detection in IoT networks, in: 2nd IEEE International Conference on Integrated Intelligence and Communication Syst...

    2024 doi

  14. [22]

    Ashrapov, Tabular gans for uneven distribution, CoRR abs/2010.00638 (2020)

    I. Ashrapov, Tabular gans for uneven distribution, CoRR abs/2010.00638 (2020). arXiv:2010.00638. URLhttps://arxiv.org/abs/2010.00638

    2010 arXiv

  15. [23]

    Habibi, M

    O. Habibi, M. Chemmakha, M. Lazaar, Imbalanced tabular data modelization using CTGAN and machine learning to improve iot botnet attacks detection, Eng. Appl. Artif. Intell. 118 (2023) 105669. doi:10.1016/J.ENGAPPAI.2022.105669. URLhttps://doi.org/10.1016/j.engappai.2022.105669

    2023 doi

  16. [24]

    B. N. Chaithanya, S. H. Brahmananda, Ai-enhanced defense against ransomware within the organiza- tion’s architecture, J. Cyber Secur. Mobil. 11 (4) (2022) 621–654. doi:10.13052/JCSM2245-1439.1146. URLhttps://doi.org/10.13052/jcsm2245-1439.1146

    2022 doi

  17. [25]

    Zhang, S

    Z. Zhang, S. Li, L. Zhang, J. Ye, C. Hu, L. Yan, LLM-LADE: large language model- based log anomaly detection with explanation, Knowl. Based Syst. 326 (2025) 114064. doi:10.1016/J.KNOSYS.2025.114064. URLhttps://doi.org/10.1016/j.knosys.2025.114064

    2025 doi

  18. [26]

    S. M. Lundberg, S. Lee, A unified approach to interpreting model predictions, in: I. Guyon, U. von Luxburg, S. Bengio, H. M. Wallach, R. Fergus, S. V. N. Vishwanathan, R. Garnett (Eds.), Advances in Neural Information Processing Systems 30: Annual Conference on Neural Informat...

    2017

  19. [27]

    S. Jia, Z. Cui, K. Wang, Y. Ding, D. Han, T. Ma, Adversarial and cooperation tasks in multi-agent system with large language models, in: 2024 IEEE International Conference on Unmanned Systems (ICUS), IEEE, 2024, pp. 1840–1847

    2024

  20. [28]

    Soltani, K

    M. Soltani, K. Khajavi, M. J. Siavoshani, A. H. Jahangir, A multi-agent adaptive deep learn- ing framework for online intrusion detection, CoRR abs/2303.02622 (2023). arXiv:2303.02622, doi:10.48550/ARXIV.2303.02622. URLhttps://doi.org/10.48550/arXiv.2303.02622

    2023 doi arXiv

  21. [29]

    W. Yang, L. Some, M. Bain, B. H. Kang, A comprehensive survey on integrating large language models with knowledge-based methods, Knowl. Based Syst. 318 (2025) 113503. doi:10.1016/J.KNOSYS.2025.113503. URLhttps://doi.org/10.1016/j.knosys.2025.113503

    2025 doi

  22. [30]

    I. A. Fares, M. A. Elaziz, Explainable tabnet transformer-based on google vizier op- timizer for anomaly intrusion detection system, Knowl. Based Syst. 316 (2025) 113351. doi:10.1016/J.KNOSYS.2025.113351. URLhttps://doi.org/10.1016/j.knosys.2025.113351

    2025 doi

  23. [31]

    Hirano, R

    M. Hirano, R. Hodota, R. Kobayashi, Ransap: An open dataset of ransomware storage access patterns for training machine learning models, Digit. Investig. 40 (Supplement) (2022) 301314. doi:10.1016/J.FSIDI.2021.301314. URLhttps://doi.org/10.1016/j.fsidi.2021.301314

    2022 doi

  24. [32]

    Hirano, R

    M. Hirano, R. Kobayashi, Ransmap: Open dataset of ransomware storage and memory access pat- terns for creating deep learning based ransomware detectors, Comput. Secur. 150 (2025) 104202. doi:10.1016/J.COSE.2024.104202. URLhttps://doi.org/10.1016/j.cose.2024.104202

    2025 doi

  25. [33]

    Mathur, Ransomware (malware) detection using machine learning, accessed: Nov

    M. Mathur, Ransomware (malware) detection using machine learning, accessed: Nov. 9, 2023 (2020). URLhttps://github.com/muditmathur2020/RansomwareDetection/tree/master 34

    2023

Pith tools

Reviewed July 11, 2026 · model on record in the stance chip above.