English(EN) SoK: Timestamps Are Not a Time Model: Rethinking Temporal Reasoning in Host-Based Intrusion Detection

新的SoK论文质疑入侵检测系统中的时间推理

作者 PulseAugur 编辑部 · [1 个来源] · 2026-10-27 04:00

一篇新发表在arXiv上的系统化知识（SoK）论文，探讨了基于主机的入侵检测系统中时间推理的关键假设。研究强调，当前系统通常未能明确说明其对时钟、事件传递和证据完整性的假设。通过借鉴时间数据库、流处理和运行时验证，该论文提出了一个包含时间模型的五个组成部分和一份证据假设清单的框架，以解决这些差距。分析显示，虽然一些早期系统承认时钟错误，但当前基于出处（provenance-based）的检测器很少说明时钟边界或在传递失败时得出结论的有效性条件，给网络安全领域的时间推理留下了重大的开放性挑战。 AI

排序理由该集群包含一篇发表在arXiv上的研究论文。[lever_c_demoted from research: ic=1 ai=0.4]

在 arXiv cs.AI 阅读 →

AI 生成摘要 · Google Gemini · 来自 1 个来源。我们如何撰写摘要 →

本文如何被排名

Signal score: 4 / 100; Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket: Tool; 该集群包含一篇发表在arXiv上的研究论文。[lever_c_demoted from research: ic=1 ai=0.4]
Source corroboration: Single-source cluster; Only one publisher covered this so far. Single-source stories can still rank when the publisher is high-authority, but they lack cross-source corroboration.
Topics: paper, safety; Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance: Standard; On-topic for AI-industry coverage; kept in the public index.
Story freshness: Same-day; Cluster formed today. Ranking reflects the current source set at time of score.

完整方法见我们的编辑标准。

报道来源 [1]

arXiv cs.AI TIER_1 English(EN) · Rene Heinzl, Markus Nissl · 2026-10-27 04:00

SoK：时间戳并非时间模型：重新思考基于主机的入侵检测中的时间推理

arXiv:2610.35151v1 Announce Type: cross Abstract: Host-based intrusion detectors order events, window audit streams and sequence attack stages by their timestamps. Every conclusion they draw therefore rests on assumptions about clocks, delivery, entity identity and the integrity …

本文如何被排名

报道来源 [1]

SoK：时间戳并非时间模型：重新思考基于主机的入侵检测中的时间推理

相关实体

相关话题