Pith. sign in

REVIEW 5 major objections 6 minor 131 references

Taming Data Challenges in ML-based Security Tasks Using Generative AI

T0 review · 5 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Carefully engineered synthetic data can lift security classifier F-scores by up to 32.6% even when only 17 attack samples are available for training.

desk verdict A careful, honest empirical study that makes a useful case for GenAI data augmentation in security classifiers, but it needs to close two gaps: baseline hyperparameter fairness and direct measurement of synthetic sample novelty. read the letter →

arxiv 2507.06092 v4 pith:HDGPBU6X submitted 2025-07-08 cs.CR cs.AIcs.LG

Shravya Kanchi , Neal Mangaokar , Aravind Cheruvu , Sifat Muhammad Abdullah , Shirin Nilizadeh , Atul Prakash , Bimal Viswanath This is my paper · ORCID
classification cs.CRcs.AIcs.LG
keywords generativeAIsyntheticdataaugmentationsecurityclassifierstabularclassimbalanceconceptdriftVAEsample-conditionedgeneration
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that the main bottleneck for many ML-based security classifiers is not the algorithm but the training data: security tasks routinely suffer from extreme class imbalance, too few attack samples, high-dimensional sparse features, and concept drift. The authors propose attacking the data problem directly by augmenting the real training set with synthetic samples drawn from generative models, and they test this across seven real security tasks with six existing tabular-data generators plus a new generator of their own, called Nimai. The central claim is that a carefully engineered generative model can measurably improve classifier generalization beyond what the same classifier achieves on real data alone, with the largest reported gain a 32.61% mean relative F-score improvement on BGP serial-hijacker detection, a task whose training set contains only 180 samples and just 17 attack samples. Alongside the pre-deployment gains, the paper claims that the same machinery enables rapid post-deployment recovery from concept drift, restoring performance with as few as 64 newly labeled samples in a PE-malware case study. The authors also report where the approach fails, identifying noisy labels, overlapping class distributions, and highly sparse feature vectors as settings in which generative augmentation does not help.

What carries the argument

The load-bearing mechanism is Nimai, a VAE-based generator that uses a vector-quantized discrete latent space with a BERT-style masked-token model trained as a prior over discrete latent vectors. Given a real sample, the encoder maps it to a discrete latent vector, a fraction of the latent tokens are masked and refilled by the MTM, and the decoder maps the result back to a feature-space sample in the vicinity of the original; when all tokens are masked the same machinery reduces to class-conditioned generation. This masking ratio is treated as a tunable hyper-parameter, so the same architecture spans the whole spectrum from sample-conditioned neighborhood synthesis (Nimai-S) to class-conditioned generation (Nimai-C), and the paper's post-deployment scheme, Nimai-hybrid, mixes the two. It is this controlled, sample-conditioned generation that the paper credits for outperforming both off-the-shelf generative models and traditional interpolation-based augmenters such as SMOTE on the data-constrained BGP and IoT tasks.

What would settle it

Compute the nearest-neighbor distance between every synthetic attack-class sample and its conditioning sample, and compare it with the typical nearest-neighbor distance among real attack samples. If synthetic samples sit far closer to the conditioning sample than real attack samples sit to each other, the generator is memorizing rather than learning the attack distribution. A confirming test: train the classifier on synthetic samples only and measure F-score on held-out real attacks; near-chance performance means the generator never learned the attack distribution.

Watch

Extended reading notes

Core claim

The paper's core claim is that data challenges, not algorithmic limitations, are the main obstacle to better security classifiers, and that generative AI can address those challenges by producing synthetic training samples that balance classes and mitigate in-class bias. Across seven tabular security tasks, augmenting real training data with synthetic samples improves classifier F-score in five tasks, with the largest reported gain an up-to-32.6% relative gain in an extremely data-constrained BGP hijacker-detection task trained on only 180 samples (17 positive). The new scheme, Nimai, is a VAE with a discrete latent space whose masked-token-model prior allows sample-conditioned generation: synthetic points are produced in the vicinity of a chosen real sample, at a controllable masking ratio, so the defender can target underrepresented regions of the data manifold. The paper's explanation for the gains is that synthetic data reduce bias by shifting feature distributions toward symmetry, reporting increased entropy and reduced skewness in the attack class for the IoT and BGP tasks after augmentation. The paper also claims that a hybrid of sample-conditioned and class-conditioned Nimai enables rapid recovery from concept drift after deployment, outperforming retraining on uncertainty-labeled samples alone on the worst-affected months of a 13-month PE-malware dataset.

Load-bearing premise

The synthetic samples Nimai and the other generators produce are genuinely new examples from the real attack distribution, not near-duplicates of the handful of training samples they were conditioned on.

Editorial extensions

If this is right

  • If the central claim holds, security practitioners can improve deployed classifier performance without changing the classifier algorithm, by swapping better synthetic-augmentation data into the training pipeline.
  • The BGP result implies that even tasks with only a handful of positive samples, often considered hopeless for supervised learning, can yield usable classifiers if the generator can synthesize plausible neighbors of the few real attacks.
  • The concept-drift result implies that post-deployment drift recovery can be made much cheaper: a few dozen labels from the drifted distribution, amplified through sample-conditioned generation, can match or beat labeling hundreds of drifted samples.
  • The failure cases imply that GenAI augmentation is not a universal fix: tasks with noisy labels, overlapping classes, or extreme feature sparsity will need different mechanisms, a useful negative result for practitioners choosing whether to adopt the approach.
  • Because the improvements are measured relative to the same classifier trained on real data alone, the results are directly actionable: any team with a tabular security classifier can replicate the protocol on their own dataset and measure whether augmentation helps.
  • The paper's own framing implies that GenAI tools built specifically for security data, rather than generic tabular generators, are a promising research direction; LLM-based generators in particular need scalability fixes before they can be used on high-dimensional security features.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable implication the paper leaves implicit: if sample-conditioned generation works by filling under-represented regions of the data manifold, then the value of Nimai-S should correlate with a measurable quantity, the local density of the attack class around each conditioned sample. Generators conditioned on the most isolated attack samples should produce the largest marginal gains.
  • A second implication: the paper's skewness/entropy analysis is evidence about feature-marginal distributions, but the actual classifier decision boundaries are joint. A direct test would be to verify that synthetic samples land inside the classifier's low-confidence region more often than real minority samples do, which would mechanistically explain improved generalization.
  • One connection worth checking: the discrete-latent-space design is closely analogous to quantized autoencoders used for images and text, so the Nimai architecture is portable to any tabular domain with the same data challenges, not just security. The scarcity of attack data is the binding constraint, and the generator's ability to produce diverse neighbors of rare points is what would transfer.
  • A cautionary inference for downstream users: if generators memorize the few positive samples rather than learn the attack distribution, augmentation gains would evaporate once the adversary shifts tactics. The paper does not measure duplication directly, so a prudent practitioner would add a nearest-neighbor diversity check before trusting the synthetic samples.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper studies whether generative models can address data challenges (class imbalance, limited samples, high dimensionality, concept drift) in tabular security classification tasks. It evaluates six existing tabular GenAI schemes plus a new VQ-VAE-based scheme called Nimai, which supports sample-conditioned generation through a masked-token model in a discrete latent space, across seven security tasks. The main empirical findings are that augmentation can improve classifier F-scores, with the largest gain (32.61% relative) reported for BGP serial-hijacker detection using Nimai-S, and that a hybrid Nimai-C/Nimai-S approach can aid post-deployment concept-drift recovery in the BODMAS malware task. The paper also documents many cases where existing GenAI schemes fail to instantiate or produce negative gains, and it identifies class overlap, noisy labels, and feature sparsity as factors that hinder augmentation.

Significance. If the central claims hold, this would be a useful systematic contribution: it demonstrates that carefully controlled synthetic tabular data can improve security classifiers in severely data-constrained settings, and it provides a new generative architecture (Nimai) that is more controllable than existing class-conditional generators. The paper's strengths include the use of 10 repeated trials with reported standard deviations, the coefficient-of-variation criterion for unreliable measurements, non-parametric statistical tests, honest reporting of model failures, and public release of code, data, and models. The comparison against SMOTE and MC-CCR and the analysis of tasks where GenAI fails are also valuable. However, the central causal explanation for why Nimai-S improves performance---that synthetic samples 'mitigate biases'---is not directly supported because the paper never measures whether the generated samples are actually novel or are near-duplicates of the conditioning seeds; this is the main correctness risk in the manuscript.

major comments (5)
  1. [Section 7.1, 'Why does augmentation improve performance?'; Section 5.4; Appendix F; Table 9] The paper attributes Nimai-S's gains on BGP and IoT to 'mitigating biases' via entropy and skewness shifts, but it never measures whether the synthetic samples are genuinely novel or are near-duplicates of the conditioning samples. With only 17 real positive training samples (Section 4), the masking ratio is the only control on how far synthetic samples move from their seed, and the paper does not report the selected masking ratio for BGP or any sample-level diversity or duplication metric for the 146 synthetic malicious samples (Table 9). If the masking ratio is low, Nimai-S may be equivalent to a sophisticated oversampler, which would undermine the claimed causal explanation and weaken the distinction from SMOTE (which reaches only 12.63% on the same task). I request that the authors report the selected masking ratios for each task and add direct measurements of synthetic-sample diversity, for example the distribution of nearest-neighbor distances from synthetic samples to their conditioning seeds and to other real training samples, and the fraction of synthetic samples that are exact or near duplicates of a seed.
  2. [Appendix C (baseline hyperparameters); Section 7.1 tables] Several baseline GenAI schemes (TVAE, CTAB-GAN+, TabSyn, REaLTabFormer) are run with default hyperparameters because 'the authors provide no tuning guidelines.' Since these models are known to be sensitive to hyperparameters, this choice may systematically handicap the baselines, making the conclusion that existing GenAI schemes are inferior to Nimai less robust. The paper should either tune the baselines with a comparable search budget (e.g., the same ASHA procedure used for Nimai) or clearly state this as a limitation and temper the comparative claims. This issue is load-bearing for the paper's central comparison in Tables 2-4.
  3. [Section 8, Table 5] The post-deployment concept-drift recovery result is a single case study on BODMAS months 5 and 6, and the reported F-scores appear to be the best over any previous month (N-1) across the uncertainty-sampling subsets. The paper does not fully clarify how this best-selection is performed, how many comparisons are made, or whether the selection is held out. This makes the 60.4% boost claim less conclusive. I ask the authors to report the selection rule explicitly and, if possible, to validate the Nimai-hybrid approach on at least one additional drifting task or to present the current result as an exploratory case study rather than a general finding.
  4. [Appendix G (month 7 statistical analysis)] The text states that for BODMAS month 7 the Kruskal-Wallis test 'shows a significant difference in means with a p-value of 0.0982 < 0.05.' Since 0.0982 is greater than 0.05, this either is a typo or the wrong threshold/correction is being used. This error directly affects the claim that post-hoc ranking (SMOTE > Nimai-C > TabDDPM) is justified for month 7. Please correct the p-value or the test interpretation and adjust the conclusion if the difference is not significant.
  5. [Section 7.2, Finding 5 and Appendix H] The artificial class-overlap experiment flips 20% of class-0 labels to class 1 in BGP and shows that all augmentation methods degrade. This is presented as evidence that 'GenAI methods yield negative gains' under overlap, but the manipulation changes label noise as well as class overlap, so the two effects are confounded. Additionally, the sparsity experiment in nPrintML (reducing 13 classes to 5) only reports SMOTE's mean gain of -0.31% and does not compare GenAI schemes on the same reduced task, so the conclusion that sparsity 'plays a role' is not directly supported. Please either separate these factors with additional experiments or soften the corresponding causal statements.
minor comments (6)
  1. [Section 8] There is a typo: 'uncertanity sampling' should be 'uncertainty sampling.'
  2. [Section 5.2 and throughout] The paper inconsistently writes 'GreaT' and 'GReaT'; please use a single spelling throughout.
  3. [Section 6] The coefficient-of-variation threshold of 1 for 'unreliable' measurements is introduced without justification or a citation; please cite prior use or provide a rationale for this threshold.
  4. [Figure 4] The t-SNE plot is used to support the claim of class overlap in Tor, but t-SNE is purely visual; consider adding a quantitative overlap measure (e.g., class-conditional nearest-neighbor purity) to make the claim more robust.
  5. [Section 4, Table 1] The BGP row reports '180' training samples but the text notes only 17 positive samples; the table could clarify that the class imbalance is the key challenge here.
  6. [Abstract and Section 7] The abstract says 'improvements of up to 32.6%' but this is a relative gain on the malicious-class F-score; please state the relative nature explicitly in the abstract to avoid misinterpretation.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the central pre-deployment and drift-recovery results are held-out empirical comparisons, with only a minor non-load-bearing self-citation.

full rationale

The paper's derivation chain is empirical rather than first-principles. Pre-deployment gains (e.g., BGP +32.61% in Table 2) are computed via Eq. (2) on held-out test sets (Table 1), with all augmentation schemes sharing the same classifier configuration. Nimai's masking ratio and architecture are tuned by ASHA on a separate validation set (Appendix F), not on the test set, so the reported F-scores are not fitted constants. The 'Why does augmentation improve performance?' analysis (Section 7.1) is a post-hoc LIME/entropy/skewness description, not a derivation whose output is built from the same corrected test instances. The post-deployment experiment (Section 8) explicitly labels a small random subset of the test set for active-learning conditioning; although this introduces partial in-sample signal, the INSOMNIA baseline receives the same labeled subset, so the Nimai-hybrid vs. INSOMNIA comparison controls for that signal, and the paper discloses the protocol. The only self-citation found ([48], a prior GAN-augmentation paper by co-author Bimal Viswanath) appears in related work and the data-challenges survey and is not load-bearing for any main claim; this minor non-load-bearing self-citation accounts for the non-zero score. No listed circularity pattern is instantiated; the skeptic concern about unmeasured synthetic diversity is a correctness or mechanism gap, not a circular reduction.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim rests on a handful of modeling choices: the task selection, default baseline hyperparameters, the augmentation strategy, and ad hoc thresholds. These are the main sources of external variability.

free parameters (3)
  • Nimai masking ratio = tuned via ASHA on validation set
    Controls the degree of sample-conditioning vs class-conditioning; chosen per task on the validation set, so it is fitted to task data (Section 5.4).
  • Nimai-hybrid synthetic-to-real multiplier = 5
    In Section 8, Nimai-S generates 5 synthetic samples per uncertain real sample; this constant is chosen without an ablation.
  • Uncertainty sampling confidence interval = 0.3 to 0.7
    Samples with classifier confidence in this range are selected for labeling in the concept drift recovery (Section 8); the specific range is a design choice.
assumptions (4)
  • domain assumption The 7 selected security tasks and their data challenges are representative of the broader set of ML-based security classifiers.
    Tasks chosen from the 35-paper review based on criteria (a)-(d) in Section 4; there is no formal guarantee that results transfer to other security tasks.
  • ad hoc to paper Default hyperparameters for baseline GenAI schemes (TVAE, CTAB-GAN+, TabSyn, etc.) are adequate proxies for their best achievable performance.
    Section 5.2 states authors provide no tuning guidelines, so defaults are used; this may systematically handicap the baselines.
  • domain assumption The macro F-score and relative gain are the appropriate metrics for comparing augmentation schemes across binary and multi-class tasks with class imbalance.
    Section 6 defines metrics; macro averaging is standard but can be sensitive to small classes.
  • ad hoc to paper A coefficient of variation >= 1 reliably marks a measurement as unreliable.
    Section 6 defines CV threshold; this heuristic is not derived from a statistical principle.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Taming Data Challenges in ML-based Security Tasks Using Generative AI." pith.science (2026). https://pith.science/paper/HDGPBU6X

@misc{pith2026250706092,
  author       = {Pith},
  title        = {Pith review of: Taming Data Challenges in ML-based Security Tasks Using Generative AI},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HDGPBU6X}},
  note         = {Machine review of arXiv:2507.06092}
}
read the original abstract

Machine learning-based supervised classifiers are widely used for security tasks, and their improvement has been largely focused on algorithmic advancements. We argue that data challenges that negatively impact the performance of these classifiers have received limited attention. We address the following research question: Can developments in Generative AI (GenAI) address these data challenges and improve classifier performance? We propose augmenting training datasets with synthetic data generated using GenAI techniques to improve classifier generalization. We evaluate this approach across 7 diverse security tasks using 6 state-of-the-art GenAI methods and introduce a novel GenAI scheme called Nimai that enables highly controlled data synthesis. We find that GenAI techniques can significantly improve the performance of security classifiers, achieving improvements of up to 32.6% even in severely data-constrained settings (only ~180 training samples). Furthermore, we demonstrate that GenAI can facilitate rapid adaptation to concept drift post-deployment, requiring minimal labeling in the adjustment process. Despite successes, our study finds that some GenAI schemes struggle to initialize (train and produce data) on certain security tasks. We also identify characteristics of specific tasks, such as noisy labels, overlapping class distributions, and sparse feature vectors, which hinder performance boost using GenAI. We believe that our study will drive the development of future GenAI tools designed for security tasks.

Figures

Figures reproduced from arXiv: 2507.06092 by the authors.

Figure 1
Figure 1. Overview of data augmentation using GenAI. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Macro F-score for BODMAS classifier. nPrintML [47, 88]. A multi-class classification of network traffic originating from one of 13 operating systems (OS) for intrusion detection. Using the nPrintML framework [47], raw traffic is con￾verted into tabular form, and AutoML [45] suggests a classifier. Each sample includes 4,169 binary features indicating the presence or absence of protocol fields and payloads. The traini… view at source ↗
Figure 3
Figure 3. Architecture of Nimai framework. synthetic data, MC-CCR performs a “cleaning” stage, where samples with “wrong” labels are repositioned by moving samples from other classes which are close to samples of the target class. Re-positioning is achieved by translating the mislabeled samples to the surface of a sphere around it. If many wrong labeled samples are re-positioned around a data sample, it is considered “difficu… view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: t-SNE plot for BGP and Tor task data. observe substantial distributional changes. We measure the distri￾bution changes using entropy i.e., the randomness of the probability distribution; and skewness [29], a measure of the degree of asym￾metry of a probability distribu…
Figure 5
Figure 5. Figure 5: Feature-wise skewness comparison of attack-class [PITH_FULL_IMAGE:figures/full_fig_p016_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

131 extracted references · 71 canonical work pages

  1. [1]

    Microsoft Malware Classification Challenge - Kaggle

    2015. Microsoft Malware Classification Challenge - Kaggle. https://www.kagg le.com/c/malware-classification. Taming Data Challenges in ML-based Security Tasks Using Generative AI ASIA CCS ’26, June 1–5, 2026, Bangalore, India

    2015

  2. [2]

    Hervé Abdi. 2010. Coefficient of variation.Encyclopedia of research design (2010)

    2010

  3. [3]

    Charu C Aggarwal, Xiangnan Kong, Quanquan Gu, Jiawei Han, and S Yu Philip

  4. [4]

    Mansour Ahmadi, Dmitry Ulyanov, Stanislav Semenov, Mikhail Trofimov, and Giorgio Giacinto. 2016. Novel Feature Extraction, Selection and Fusion for Effective Malware Family Classification. InProc. Of ACM CODASPY

    2016

  5. [5]

    Giuseppina Andresini, Feargus Pendlebury, Fabio Pierazzi, Corrado Loglisci, Annalisa Appice, and Lorenzo Cavallaro. 2021. INSOMNIA: Towards Concept- Drift Robustness in Network Intrusion Detection. InProc. of ACM AISec

    2021

  6. [6]

    Jyoti Aneja, Alex Schwing, Jan Kautz, and Arash Vahdat. 2021. A contrastive learning approach for training variational autoencoder priors.Advances in neural information processing systems34 (2021), 480–493

    2021

  7. [7]

    Mahmoud Bahnasy, Fenglin Li, Shihan Xiao, and Xiangle Cheng. 2020. DeepBGP: A Machine Learning Approach for BGP Configuration Synthesis. InProc. of NetAI Workshop

    2020

  8. [8]

    Yutong Bai et al. 2024. Sequential modeling enables scalable learning for large vision models. InProc. of CVPR

    2024

Show all 131 references
  1. [9]

    Federico Barbero, Feargus Pendlebury, Fabio Pierazzi, and Lorenzo Cavallaro

  2. [10]

    Diogo Barradas, Nuno Santos, and Luís Rodrigues. 2018. Effective Detection of Multimedia Protocol Tunneling using Machine Learning. InProc. of USENIX Security

    2018

  3. [11]

    Samy Bengio and Yoshua Bengio. 2000. Taking on the Curse of Dimensionality in Joint Distributions Using Neural Networks.IEEE TNN(2000)

    2000

  4. [12]

    2006.Pattern recognition and machine learning

    Christopher M Bishop and Nasser M Nasrabadi. 2006.Pattern recognition and machine learning. Springer

    2006

  5. [13]

    Rok Blagus and Lara Lusa. 2013. SMOTE for high-dimensional class-imbalanced data.BMC Bioinformatics(2013)

    2013

  6. [14]

    Dino Bollinger, Karel Kubicek, Carlos Cotrini, and David Basin. 2022. Automat- ing Cookie Consent and GDPR Violation Detection. InProc. of USENIX Security

    2022

  7. [15]

    Vadim Borisov, Kathrin Seßler, Tobias Leemann, Martin Pawelczyk, and Gjergji Kasneci. 2023. Language Models are Realistic Tabular Data Generators. InProc. of ICLR

    2023

  8. [16]

    Huiwen Chang, Han Zhang, Lu Jiang, Ce Liu, and William T Freeman. 2022. MaskGIT: Masked Generative Image Transformer. InProc. of CVPR

    2022

  9. [17]

    Nitesh V Chawla, Kevin W Bowyer, Lawrence O Hall, and W Philip Kegelmeyer

  10. [18]

    Yuqi Chen, Christopher M Poskitt, and Jun Sun. 2018. Learning from Mutants: Using Code Mutation to Learn and Monitor Invariants of a Cyber-Physical System. InProc. of IEEE S&P

    2018

  11. [19]

    Yizheng Chen, Shiqi Wang, Weifan Jiang, Asaf Cidon, and Suman Jana. 2021. Cost-Aware Robust Tree Ensembles for Security Applications. InProc. of USENIX Security

    2021

  12. [20]

    Yizheng Chen, Shiqi Wang, Dongdong She, and Suman Jana. 2020. On Training Robust PDF Malware Classifiers. InProc. of USENIX Security

    2020

  13. [21]

    Phillip Chlap et al . 2021. A Review of Medical Image Data Augmentation Techniques for Deep Learning Applications.JMIRO(2021)

    2021

  14. [22]

    Maximilian Christ, Nils Braun, Julius Neuffer, and Andreas W Kempa-Liehr

  15. [23]

    Hyung Won Chung et al. 2022. Scaling Instruction-Finetuned Language Models. Proc. of CoRR abs/2210.11416(2022)

    2022 arXiv

  16. [24]

    Asaf Cidon, Lior Gavish, Itay Bleier, Nadia Korshun, Marco Schweighauser, and Alexey Tsitkin. 2019. High Precision Detection of Business Email Compromise. InProc. of USENIX Security

    2019

  17. [25]

    D Dablain, B Krawczyk, and NV Chawla DeepSMOTE. 2021. DeepSMOTE: Fusing Deep Learning and SMOTE for Imbalanced Data.IEEE TNNLS(2021)

    2021

  18. [26]

    Wangzhi Dai, Kenney Ng, Kristen Severson, Wei Huang, Fred Anderson, and Collin Stultz. 2019. Generative Oversampling with a Contrastive Variational Autoencoder. InProc. of ICDM

    2019

  19. [27]

    Sumanth Dathathri, Andrea Madotto, Janice Lan, Jane Hung, Eric Frank, Piero Molino, Jason Yosinski, and Rosanne Liu. 2020. Plug and Play Language Models: A Simple Approach to Controlled Text Generation. InProc. of ICLR

    2020

  20. [28]

    Scott Deerwester, Susan T Dumais, George W Furnas, Thomas K Landauer, and Richard Harshman. 1990. Indexing by Latent Semantic Analysis.JASIST(1990)

    1990

  21. [29]

    David P Doane and Lori E Seward. 2011. Measuring skewness: a forgotten statistic?Journal of statistics education(2011)

    2011

  22. [30]

    Priyanka Dodia, Mashael AlSabah, Omar Alrawi, and Tao Wang. 2022. Exposing the Rat in the Tunnel: Using Traffic Analysis for Tor-based Malware Detection. InProc. of CCS

    2022

  23. [31]

    Evan Downing, Yisroel Mirsky, Kyuhong Park, and Wenke Lee. 2021. DeepRe- flect: Discovering Malicious Functionality through Binary Reconstruction. In Proc. of USENIX Security

    2021

  24. [32]

    Olive Jean Dunn. 1964. Multiple Comparisons Using Rank Sums.Technometrics (1964)

    1964

  25. [33]

    Val Andrei Fajardo, David Findlay, Roshanak Houmanfar, Charu Jaiswal, Jiaxi Liang, and Honglei Xie. 2018. Vos: a method for variational oversampling of imbalanced data.Proc. of CoRR abs/1809.02596(2018)

    2018 arXiv

  26. [34]

    Alberto Fernández, Salvador Garcia, Francisco Herrera, and Nitesh V Chawla

  27. [35]

    Pierre Geurts, Damien Ernst, and Louis Wehenkel. 2006. Extremely Randomized Trees.Machine learning(2006)

    2006

  28. [36]

    Jiajun Gong, Wuqi Zhang, Charles Zhang, and Tao Wang. 2022. Surakav: Generating Realistic Traces for a Strong Website Fingerprinting Defense. In Proc. of IEEE S&P

    2022

  29. [37]

    Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. 2014. Generative Adversarial Nets. InProc. of NeurIPS

    2014

  30. [38]

    Manbir Gulati and Paul Roysdon. 2024. TabMT: Generating Tabular data with Masked Transformers. InProc. of NeurIPS

    2024

  31. [39]

    SMOTE for Learning from Imbalanced Data: Progress and Challenges, Marking the 15-year Anniversary.JAIR(2018)

    2018

  32. [40]

    Wenbo Guo, Dongliang Mu, Xinyu Xing, Min Du, and Dawn Song. 2019. DEEP- VSA: Facilitating Value-set Analysis with Deep Learning for Postmortem Pro- gram Analysis. InProc. of USENIX Security

    2019

  33. [41]

    Xueyuan Han et al. 2021. SIGL: Securing Software Installations Through Deep Graph Learning. InProc. of USENIX Security

    2021

  34. [42]

    Xingran Hao, Zhengwei Jiang, Qingsai Xiao, Qiuyun Wang, Yepeng Yao, Baoxu Liu, and Jian Liu. 2021. Producing More with Less: A GAN-based Network Attack Detection Approach for Imbalanced Data. InProc. of CSCWD

    2021

  35. [43]

    Jamie Hayes and George Danezis. 2016. k-fingerprinting: a Robust Scalable Website Fingerprinting Technique. InProc. of USENIX Security

    2016

  36. [44]

    Ishaan Gulrajani, Faruk Ahmed, Martin Arjovsky, Vincent Dumoulin, and Aaron C Courville. 2017. Improved Training of Wasserstein GANs. InProc. of NeurIPS

    2017

  37. [45]

    Xin He, Kaiyong Zhao, and Xiaowen Chu. 2021. AutoML: A Survey of the State-of-the-Art.Knowledge-Based Systems(2021)

    2021

  38. [46]

    Grant Ho, Asaf Cidon, Lior Gavish, Marco Schweighauser, Vern Paxson, Stefan Savage, Geoffrey M Voelker, and David Wagner. 2019. Detecting and Character- izing Lateral Phishing at Scale. InProc. of USENIX Security

    2019

  39. [47]

    Jordan Holland, Paul Schmitt, Nick Feamster, and Prateek Mittal. 2021. New Directions in Automated Traffic Analysis. InProc. of CCS

    2021

  40. [48]

    Steve TK Jan, Qingying Hao, Tianrui Hu, Jiameng Pu, Sonal Oswal, Gang Wang, and Bimal Viswanath. 2020. Throwing Darts in the Dark? Detecting Bots with Limited Data using Neural Data Augmentation. InProc. of IEEE S&P

    2020

  41. [49]

    Haibo He, Yang Bai, Edwardo A Garcia, and Shutao Li. 2008. ADASYN: Adaptive Synthetic Sampling Approach for Imbalanced Learning. InProc. of IEEE WCCI

    2008

  42. [50]

    Roberto Jordaney, Kumar Sharad, Santanu K Dash, Zhi Wang, Davide Papini, Ilia Nouretdinov, and Lorenzo Cavallaro. 2017. Transcend: Detecting Concept Drift in Malware Classification Models. InProc. of USENIX Security

    2017

  43. [51]

    Jacob Devlin Ming-Wei Chang Kenton and Lee Kristina Toutanova. 2019. BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. InProc. of NAACL-HLT

    2019

  44. [52]

    Nitish Shirish Keskar, Bryan McCann, Lav R Varshney, Caiming Xiong, and Richard Socher. 2019. CTRL: A Conditional Transformer Language Model for Controllable Generation.CoRR abs/1909.05858(2019)

    2019 arXiv

  45. [53]

    Saeed Khorram, Mingqi Jiang, Mohamad Shahbazi, Mohamad H Danesh, and Li Fuxin. 2024. Taming the Tail in Class-Conditional GANs: Knowledge Sharing via Unconditional Training at Lower Resolutions. InProc. of CVPR

    2024

  46. [54]

    Xi Jiang et al. 2024. Netdiffusion: Network data augmentation through protocol- constrained traffic generation.POMACS(2024)

    2024

  47. [55]

    Jayoung Kim, Chaejeong Lee, and Noseong Park. 2023. STaSy: Score-based Tabular Data Synthesis. InProc. of ICLR

    2023

  48. [56]

    Akim Kotelnikov, Dmitry Baranchuk, Ivan Rubachev, and Artem Babenko. 2023. TabDDPM: Modelling Tabular Data with Diffusion Models. InProc. of ICML

    2023

  49. [57]

    Michał Koziarski, Michał Woźniak, and Bartosz Krawczyk. 2020. Combined Cleaning and Resampling Algorithm for Multi-Class Imbalanced Data with Label Noise.Knowledge-Based Systems(2020)

    2020

  50. [58]

    Bartosz Krawczyk, Michał Koziarski, and Michał Woźniak. 2019. Radial-Based Oversampling for Multiclass Imbalanced Data Classification.IEEE TNNLS(2019)

    2019

  51. [59]

    Juno Kim, Jaehyuk Kwon, Mincheol Cho, Hyunjong Lee, and Joong-Ho Won

  52. [60]

    Chaejeong Lee, Jayoung Kim, and Noseong Park. 2023. CoDi: Co-evolving Contrastive Diffusion Models for Mixed-type Tabular Synthesis. InProc. of ICML

    2023

  53. [61]

    LemaÃŽtre, Guillaume and Nogueira, Fernando and Aridas, Christos K. 2017. Imbalanced-learn: A Python Toolbox to Tackle the Curse of Imbalanced Datasets in Machine Learning.JMLR(2017)

    2017

  54. [62]

    Huihan Li et al . 2024. In Search of the Long-Tail: Systematic Generation of Long-Tail Inferential Knowledge via Logical Rule Guided Search. InProc. of EMNLP. ASIA CCS ’26, June 1–5, 2026, Bangalore, India Kanchi et al

    2024

  55. [63]

    Huichen Li, Xiaojun Xu, Chang Liu, Teng Ren, Kun Wu, Xuezhi Cao, Weinan Zhang, Yong Yu, and Dawn Song. 2018. A Machine Learning Approach To Prevent Malicious Calls Over Telephony Networks. InProc. of IEEE S&P

    2018

  56. [64]

    Liam Li et al. 2020. A System for Massively Parallel Hyperparameter Tuning. In Proc. of MLSys

    2020

  57. [65]

    William H Kruskal and W Allen Wallis. 1952. Use of Ranks in One-Criterion Variance Analysis.JASA(1952)

    1952

  58. [66]

    Yuzhen Lu, Dong Chen, Ebenezer Olaniyi, and Yanbo Huang. 2022. Genera- tive Adversarial Networks (GANs) for Image Augmentation in Agriculture: A Systematic Review.Comput. Electron. Agric.(2022)

    2022

  59. [67]

    James Lucas, George Tucker, Roger Grosse, and Mohammad Norouzi. 2019. Understanding posterior collapse in generative latent variable models. (2019)

    2019

  60. [68]

    Guozheng Ma, Zhen Wang, Zhecheng Yuan, Xueqian Wang, Bo Yuan, and Dacheng Tao. 2022. A Comprehensive Survey of Data Augmentation in Visual Reinforcement Learning.CoRR abs/2210.04561(2022)

    2022 arXiv

  61. [69]

    Fares Meghdouri, Thomas Schmied, Thomas Gärtner, and Tanja Zseby. 2021. Controllable Network Data Balancing with GANs. InProc. of NeurIPS Workshop

    2021

  62. [70]

    Yisroel Mirsky, Tomer Doitshman, Yuval Elovici, and Asaf Shabtai. 2018. Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection. InProc. of NDSS

    2018

  63. [71]

    Zinan Lin, Alankar Jain, Chen Wang, Giulia Fanti, and Vyas Sekar. 2020. Using GANs for Sharing Networked Time Series Data: Challenges, Initial Promise, and Open Questions. InProc. of ACM IMC

    2020

  64. [72]

    Yu Nong et al. 2024. VGX: Large-Scale Sample Generation for Boosting Learning- Based Software Vulnerability Analyses. InProc. of ICSE

    2024

  65. [73]

    Dongmin Park et al. 2025. Rare-to-Frequent: Unlocking Compositional Genera- tion Power of Diffusion Models on Rare Concepts with LLM Guidance. InProc. of ICLR

    2025

  66. [74]

    Sunnyeo Park, Dohyeok Kim, and Sooel Son. 2019. An Empirical Study of Prior- itizing JavaScript Engine Crashes via Machine Learning. InProc. of AsiaCCS

    2019

  67. [75]

    Neha Patki, Roy Wedge, and Kalyan Veeramachaneni. 2016. The Synthetic Data Vault. InProc. of IEEE DSAA

    2016

  68. [76]

    Christian Peeters, Hadi Abdullah, Nolen Scaife, Jasmine Bowers, Patrick Traynor, Bradley Reaves, and Kevin Butler. 2018. Sonar: Detecting SS7 Redirection Attacks With Audio-Based Distance Bounding. InProc. of IEEE S&P

    2018

  69. [77]

    Montgomery

    Douglas C. Montgomery. 2019.Design and Analysis of Experiments(10th ed.). John Wiley & Sons

    2019

  70. [78]

    PyTorch Contributors. 2023. PyTorch Vision Transforms. https://pytorch.org/vi sion/0.15/transforms.html. Accessed: 2025-02-14

    2023

  71. [79]

    Han Qiu, Yi Zeng, Shangwei Guo, Tianwei Zhang, Meikang Qiu, and Bhavani Thuraisingham. 2021. Deepsweep: An evaluation framework for mitigating DNN backdoor attacks using data augmentation. InProc. of Asia CCS

    2021

  72. [80]

    Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. 2016. Why should i trust you?: Explaining the predictions of any classifier. InProc. of KDD

    2016

  73. [81]

    Anirudh Sabnis and Ramesh K Sitaraman. 2021. TRAGEN: A Synthetic Trace Generator for Realistic Cache Simulations. InProc. ACM IMC

    2021

  74. [82]

    Dvir Samuel, Rami Ben-Ari, Simon Raviv, Nir Darshan, and Gal Chechik. 2024. Generating images of rare concepts using pre-trained diffusion models. InProc. of AAAI

    2024

  75. [83]

    Fabio Pierazzi, Feargus Pendlebury, Jacopo Cortellazzi, and Lorenzo Cavallaro

  76. [84]

    Samuel Schüppen, Dominik Teubert, Patrick Herrmann, and Ulrike Meyer. 2018. FANCI : Feature-based Automated NXDomain Classification and Intelligence. InProc. of USENIX Security

    2018

  77. [85]

    B Sebastian, C Christian, and P Alexander. 2017. Predicting the Resilience of Obfuscated Code Against Symbolic Execution Attacks via Machine Learning. InProc. of USENIX Security

    2017

  78. [86]

    Nabeel Seedat, Nicolas Huynh, Boris van Breugel, and Mihaela van der Schaar

  79. [87]

    Jie Shao, Ke Zhu, Hanxiao Zhang, and Jianxin Wu. 2024. DiffuLT: Diffusion for Long-tail Recognition Without External Knowledge. InProc. of NIPS

    2024

  80. [88]

    Iman Sharafaldin, Arash Habibi Lashkari, Ali A Ghorbani, et al. 2018. Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characteri- zation. InProc. of ICISSP

    2018

  81. [89]

    Dongdong She, Yizheng Chen, Abhishek Shah, Baishakhi Ray, and Suman Jana

  82. [90]

    Victor Sanh, Lysandre Debut, Julien Chaumond, and Thomas Wolf. 2019. Distil- BERT, a distilled version of BERT: smaller, faster, cheaper and lighter. InProc. of NeurIPS

    2019

  83. [91]

    Amit Kumar Sikder, Hidayet Aksu, and A Selcuk Uluagac. 2017. 6thSense: A Context-aware Sensor-based Attack Detector for Smart Devices. InProc. of USENIX Security

    2017

  84. [92]

    Aivin V Solatorio and Olivier Dupriez. 2023. REaLTabFormer: Generating Realis- tic Relational and Tabular Data using Transformers.Proc. of CoRR abs/2302.02041 (2023)

    2023 arXiv

  85. [93]

    Theresa Stadler, Bristena Oprisanu, and Carmela Troncoso. 2022. Synthetic Data – Anonymisation Groundhog Day. InProc. of USENIX Security

    2022

  86. [94]

    Samuel Stocksieker, Denys Pommeret, and Arthur Charpentier. 2024. Data Augmentation with Variational Autoencoder for Imbalanced Dataset.Proc. of CoRR abs/2412.07039(2024)

    2024 arXiv

  87. [95]

    Adrian Taylor, Sylvain Leblanc, and Nathalie Japkowicz. 2016. Anomaly De- tection in Automobile Control Network Data with Long Short-Term Memory Networks. InProc. of IEEE DSAA

    2016

  88. [96]

    Ege Tekiner, Abbas Acar, and A Selcuk Uluagac. 2022. A Lightweight IoT Cryptojacking Detection Mechanism in Heterogeneous Smart Home Networks. InProc. of NDSS

    2022

  89. [97]

    Cecilia Testart, Philipp Richter, Alistair King, Alberto Dainotti, and David Clark

  90. [98]

    Neutaint: Efficient Dynamic Taint Analysis with Neural Networks. In Proc. of IEEE S&P

  91. [99]

    Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and Suman Jana. 2019. NEUZZ: Efficient Fuzzing with Neural Program Smoothing. InProc. of IEEE S&P

    2019

  92. [100]

    Aaron Van den Oord, Nal Kalchbrenner, Lasse Espeholt, Oriol Vinyals, Alex Graves, et al. 2016. Conditional Image Generation with PixelCNN Decoders. In Proc. of NeurIPS

    2016

  93. [101]

    Aaron Van Den Oord, Oriol Vinyals, et al. 2017. Neural Discrete Representation Learning. InProc. of NeurIPS

    2017

  94. [102]

    Laurens Van der Maaten and Geoffrey Hinton. 2008. Visualizing Data using t-SNE.JMLR(2008)

    2008

  95. [103]

    Pengkun Wang, Zhe Zhao, HaiBin Wen, Fanfu Wang, Binwu Wang, Qingfu Zhang, and Yang Wang. 2024. LLM-AutoDA: Large Language Model-Driven Automatic Data Augmentation for Long-tailed Problems. InProc. of NIPS

    2024

  96. [104]

    Shuhei Watanabe. 2023. Tree-Structured Parzen Estimator: Understanding Its Algorithm Components and Their Roles for Better Empirical Performance.CoRR abs/2304.11127(2023)

    2023 arXiv

  97. [105]

    Jiahua Xu and Benjamin Livshits. 2019. The Anatomy of a Cryptocurrency Pump-and-Dump Scheme. InProc. of USENIX Security

    2019

  98. [106]

    Lei Xu, Maria Skoularidou, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni

  99. [107]

    Shengzhe Xu et al. 2021. STAN: Synthetic Network Traffic Generation with Generative Neural Models. InDeployable Machine Learning for Security Defense: Second International Workshop, MLHat 2021, Virtual Event, August 15, 2021, Proceedings 2

    2021

  100. [108]

    Saravanan Thirumuruganathan, Mohamed Nabeel, Euijin Choo, Issa Khalil, and Ting Yu. 2022. SIRAJ: A Unified Framework for Aggregation of Malicious Entity Detectors. InProc. of IEEE S&P

    2022

  101. [109]

    Romain Thomas. 2017. LIEF - Library to Instrument Executable Formats. https://lief.quarkslab.com/

    2017

  102. [110]

    Limin Yang et al. 2021. CADE: Detecting and Explaining Concept Drift Samples for Security Applications. InProc. of USENIX Security

    2021

  103. [111]

    Limin Yang, Arridhana Ciptadi, Ihar Laziuk, Ali Ahmadzadeh, and Gang Wang

  104. [112]

    Zhiju Yang, Weiping Pei, Monchu Chen, and Chuan Yue. 2022. WTAGRAPH: Web Tracking and Advertising Detection using Graph Neural Networks. InProc. of IEEE S&P

    2022

  105. [113]

    Yucheng Yin, Zinan Lin, Minhao Jin, Giulia Fanti, and Vyas Sekar. 2022. Practi- cal gan-based synthetic ip header trace generation using netshare. InProc. of SIGCOMM

    2022

  106. [114]

    Lingjing Yu, Bo Luo, Jun Ma, Zhaoyu Zhou, and Qingyun Liu. 2020. You Are What You Broadcast: Identification of Mobile and IoT Devices from (Public) WiFi. InProc. of USENIX Security

    2020

  107. [115]

    Hengrui Zhang et al. 2024. Mixed-Type Tabular Data Synthesis with Score-Based Diffusion in Latent Space. InProc. of ICLR

    2024

  108. [116]

    Zilong Zhao, Aditya Kunar, Robert Birke, and Lydia Y Chen. 2021. CTAB-GAN: Effective Table Data Synthesizing. InProc. of ACML

    2021

  109. [117]

    Modeling tabular data using conditional gan. InProc. of NIPS

  110. [118]

    Yaqin Zhou, Shangqing Liu, Jingkai Siow, Xiaoning Du, and Yang Liu. 2019. De- vign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networks. InProc. of NeurIPS

    2019

  111. [119]

    Teng Xu et al. 2021. Deep Entity Classification: Abusive Account Detection for Online Social Networks. InProc. of USENIX Security

    2021

  112. [120]

    Xing Xu, Jie Li, Yang Yang, and Fumin Shen. 2020. Toward Effective Intrusion Detection Using Log-Cosh Conditional Variational Autoencoder.IEEE IoT (2020)

    2020

  113. [129]

    Zilong Zhao, Aditya Kunar, Robert Birke, Hiek Van der Scheer, and Lydia Y Chen. 2024. CTAB-GAN+: Enhancing Tabular Data Synthesis.Frontiers in big Data(2024)

    2024

  114. [131]

    Yadong Zhu, Xiliang Wang, Qing Li, Tianjun Yao, and Shangsong Liang. 2021. BotSpot++: A Hierarchical Deep Ensemble Model for Bots Install Fraud Detec- tion in Mobile Advertising.ACM TOIS(2021). Taming Data Challenges in ML-based Security Tasks Using Generative AI ASIA CCS ’26,...

    2021

  115. [2002]

    SMOTE: Synthetic Minority Over-sampling Technique.JAIR(2002)

    2002

  116. [2014]

    InData Classification

    Active Learning: A Survey. InData Classification. Chapman and Hall/CRC

  117. [2018]

    Time Series FeatuRe Extraction on basis of Scalable Hypothesis tests (tsfresh – A Python package).Neurocomputing(2018)

    2018

  118. [2019]

    Profiling BGP Serial Hijackers: Capturing Persistent Misbehavior in the Global Routing Table. InProc. of ACM IMC

  119. [2020]

    Intriguing Properties of Adversarial ML Attacks in the Problem Space. In Proc. of IEEE S&P

  120. [2021]

    BODMAS: An Open Dataset for Learning based Temporal Analysis of PE Malware. InProc. of IEEE S&P Workshop

  121. [2022]

    Transcending TRANSCEND: Revisiting Malware Classification in the Presence of Concept Drift. InProc. of IEEE S&P

  122. [2023]

    Curated LLM: Synergy of LLMs and Data Curation for tabular augmenta- tion in low-data regimes. InProc. of ICML

  123. [2024]

    $t^3$-Variational Autoencoder: Learning Heavy-tailed Data with Student’s t and Power Divergence. InProc. of ICLR

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.