arXiv subjects

Igor Kozlov

Publications and source records attributed to Igor Kozlov.

6 recordsLinked to original sources

arXiv2026

Cyber Defense Benchmark: Agentic Threat Hunting Evaluation for LLMs in SecOps

We introduce the Cyber Defense Benchmark, a benchmark for measuring how well large language model (LLM) agents perform the core SOC analyst task of threat hunting: given a database of raw Windows event logs with no guided questions or hints, identify the exact timestamps of malicious events. The benchmark wraps 106 real attack procedures from the OTRF Security-Datasets corpus - spanning 86 MITRE ATT&CK sub-techniques across 12 tactics - into a Gymnasium reinforcement-learning environment. Each episode presents the agent with an in-memory SQLite database of 75,000-135,000 log records produced by a deterministic campaign simulator that time-shifts and entity-obfuscates the raw recordings. The agent must iteratively submit SQL queries to discover malicious event timestamps and explicitly flag them, scored CTF-style against Sigma-rule-derived ground truth. Evaluating five frontier models - Claude Opus 4.6, GPT-5, Gemini 3.1 Pro, Kimi K2.5, and Gemini 3 Flash - on 26 campaigns covering 105 of 106 procedures, we find that all models fail dramatically: the best model (Claude Opus 4.6) submits correct flags for only 3.8% of malicious events on average, and no run across any model ever finds all flags. We define a passing score as >= 50% recall on every ATT&CK tactic - the minimum bar for unsupervised SOC deployment. No model passes: the leader clears this bar on 5 of 13 tactics and the remaining four on zero. These results suggest that current LLMs are poorly suited for open-ended, evidence-driven threat hunting despite strong performance on curated Q&A security benchmarks.

cs.CR↗

arXiv2023

Anomaly Detection for Scalable Task Grouping in Reinforcement Learning-based RAN Optimization

The use of learning-based methods for optimizing cellular radio access networks (RAN) has received increasing attention in recent years. This coincides with a rapid increase in the number of cell sites worldwide, driven largely by dramatic growth in cellular network traffic. Training and maintaining learned models that work well across a large number of cell sites has thus become a pertinent problem. This paper proposes a scalable framework for constructing a reinforcement learning policy bank that can perform RAN optimization across a large number of cell sites with varying traffic patterns. Central to our framework is a novel application of anomaly detection techniques to assess the compatibility between sites (tasks) and the policy bank. This allows our framework to intelligently identify when a policy can be reused for a task, and when a new policy needs to be trained and added to the policy bank. Our results show that our approach to compatibility assessment leads to an efficient use of computational resources, by allowing us to construct a performant policy bank without exhaustively training on all tasks, which makes it applicable under real-world constraints.

cs.LG↗

arXiv2023

Self-Supervised Transformer Architecture for Change Detection in Radio Access Networks

Radio Access Networks (RANs) for telecommunications represent large agglomerations of interconnected hardware consisting of hundreds of thousands of transmitting devices (cells). Such networks undergo frequent and often heterogeneous changes caused by network operators, who are seeking to tune their system parameters for optimal performance. The effects of such changes are challenging to predict and will become even more so with the adoption of 5G/6G networks. Therefore, RAN monitoring is vital for network operators. We propose a self-supervised learning framework that leverages self-attention and self-distillation for this task. It works by detecting changes in Performance Measurement data, a collection of time-varying metrics which reflect a set of diverse measurements of the network performance at the cell level. Experimental results show that our approach outperforms the state of the art by 4% on a real-world based dataset consisting of about hundred thousands timeseries. It also has the merits of being scalable and generalizable. This allows it to provide deep insight into the specifics of mode of operation changes while relying minimally on expert knowledge.

cs.LG↗

arXiv2014

Anisotropic flow of thermal photons as a quark-gluon plasma viscometer

We present state-of-the-art calculations of viscous photon emission from nuclear collisions at RHIC and LHC. Fluctuating initial density profiles are evolved with event-by-event viscous hydrodynamics. Momentum spectra of thermal photons radiated by these explosively expanding fireballs and their $p_T$-differential anisotropic flow coefficients $v_n(p_T)$ are computed, both with and without accounting for viscous corrections to the standard thermal emission rates. Viscous corrections to the rates are found to have a larger effect on the $v_n$ coefficients than the viscous suppression of hydrodynamic flow anisotropies. The benefits of taking the ratio of elliptic to triangular flow, $v_2/v_3$, are discussed, and the spacetime regions which contribute dominantly to the photon flow harmonics are identified. The directed flow $v_1$ of thermal photons is predicted for RHIC and LHC energies.

nucl-th↗

arXiv2014

Signatures of collective behavior in small systems

We perform 3+1D viscous hydrodynamics calculations of proton-nucleus (pA) and nucleus-nucleus (AA) collisions. Our goal is to understand the apparent collective behavior recently observed in pA collisions and to verify whether the highest multiplicity collision systems can be accurately described as a relativistic fluid. We compare our calculations of flow variables to existing measurements, and demonstrate that hydrodynamics correctly captures the measured trends. We show that our predictions for the pair correlation observable $r_n$ are validated by recent experimental pA measurements, and that our results are sensitive to the granularity of the initial state. We also compare our results with measurements done for nucleus-nucleus collisions.

nucl-th↗

arXiv2014

Transverse momentum structure of pair correlations as a signature of collective behavior in small collision systems

We perform 3+1D viscous hydrodynamic calculations of proton-lead and lead-lead collisions at top LHC energy. We show that existing data from high-multiplicity p-Pb events can be well described in hydrodynamics, suggesting that collective flow is plausible as a correct description of these collisions. However, a more stringent test of the presence of hydrodynamic behavior can be made by studying the detailed momentum dependence of two-particle correlations. We define a relevant observable, $r_n$, and make predictions for its value and centrality dependence if hydrodynamics is a valid description. This will provide a non-trivial confirmation of the nature of the correlations seen in small collision systems, and potentially to determine where the hydrodynamic description, if valid anywhere, stops being valid. Lastly, we probe what can be learned from this observable, finding that it is insensitive to viscosity, but sensitive to aspects of the initial state of the system that other observables are insensitive to, such as the transverse length scale of the fluctuations in the initial stages of the collision.

nucl-th↗