arXiv subjects

Tao Ban

Publications and source records attributed to Tao Ban.

4 recordsLinked to original sources

arXiv2026

NLLog: Lightweight, Explainable SOC Anomaly Detection via Log-to-Language Rewriting

System-generated logs underpin security monitoring, yet their rigid template-based format hinders both automated analysis and human comprehension. We present NLLog (Natural-Language Log), a lightweight pipeline that deterministically rewrites parsed templates into WHO-WHAT-SEVERITY sentences, pools them with term-frequency-inverse-document-frequency weighting, classifies sessions with tree ensembles, and back-projects evidence with TreeSHAP for analyst review. On Hadoop Distributed File System (HDFS) and Blue Gene/L (BGL) corpora, NLLog exceeds two reproduced matched-protocol baselines; across HDFS, BGL, and the AIT Alert Data Set, it sustains low false-positive rates with commodity-hardware latency suitable for security operations center triage. Coverage, sparse-versus-dense, faithfulness, and adversarial ablations show that fallback sufficiency is corpus-dependent, that an enrollment-time coverage check can surface refinement requirements before deployment, and that an auditable deterministic rewrite combined with lightweight dense encoding provides a measurable representation layer for log-anomaly detection and triage.

cs.CR↗

arXiv2026

PACT: Reducing Alert Fatigue in Low-Prevalence SOC Streams with Triggered Active Learning

Security operations centers face persistent alert fatigue: in low-prevalence streams, even low false-positive rates generate substantial investigation load, while aggregate F1 scores obscure analyst burden. We introduce PACT, a Pareto-aware controller for triggered active learning, which wraps an already-deployed frozen XGBoost-Focal screener with an adaptive windowing score-shift trigger and a hybrid acquisition rule combining threshold-relative uncertainty with high-score sampling. On two public low-prevalence benchmarks, AIT-ADS (AIT Alert Data Set), and BOTSv1 (Boss of the SOC version 1), PACT attains the lowest benign-normalized false-positive (FP) burden among the adaptive methods tested. It reduces burden by 43% and 21%, respectively, relative to a frozen baseline, while using 3.8x and 5.2x fewer analyst queries than periodic uniform-random updating. A matched-trigger ablation controls trigger timing and shows that acquisition contributes beyond timing alone, at the cost of approximately ten percentage points of positive-window recall under free-running triggers. A frozen threshold-only baseline pushes FP lower still but collapses BOTSv1 recall by 55 percentage points. Under the evaluated workload assumptions, pure FP minimization trades unacceptable recall for that lower burden.

cs.CR↗

arXiv2026

AI-Driven Security Alert Screening and Alert Fatigue Mitigation in Security Operations Centers: A Survey

Security alert screening is the downstream task of filtering, prioritizing, correlating, and contextualizing alerts for analyst attention in Security Operations Centers. This survey reviews artificial-intelligence-driven alert screening and alert-fatigue mitigation from 2015 to 2026. We synthesize 119 records, including 87 core studies, into a four-stage workflow taxonomy covering filtering, triage, correlation, and generative augmentation. We find persistent gaps in operational validation, adversarial robustness, cross-environment generalization, and evaluation practice. The survey concludes with a research agenda toward trustworthy Cognitive Security Operations Centers.

cs.CR↗

arXiv2024

Finding Natural, Dense, and Stable Frustrated Lewis Pairs on Wurtzite Crystal Surfaces

The surface frustrated Lewis pairs (SFLPs) open up new opportunities for substituting noble metals in the activation and conversion of stable molecules. However, the applications of SFLPs on a larger scale are impeded by the complex construction process, low surface density, and sensitivity to the reaction environment. Herein, wurtzite-structured crystals such as GaN, ZnO, and AlP are found for developing natural, dense, and stable SFLPs. It is revealed that the SFLPs can naturally exist on the (100) and (110) surfaces of wurtzite-structured crystals. All the surface cations and anions serve as the Lewis acid and Lewis base in SFLPs, respectively, contributing to the surface density of SFLPs as high as 7.26 x 1014 cm-2. Ab initio molecular dynamics simulations indicate that the SFLPs can keep stable under high temperatures and the reaction atmospheres of CO and H2O. Moreover, outstanding performance for activating the given small molecules is achieved on these natural SFLPs, which originates from the optimal orbital overlap between SFLPs and small molecules. Overall, these findings not only provide a simple method to obtain dense and stable SFLPs but also unfold the nature of SFLPs toward the facile activation of small molecules.

cond-mat.mtrl-sci↗