{"id":"https://openalex.org/W7212435786","doi":"https://doi.org/10.1038/s41598-026-71232-8","title":"Multistage advanced persistent threat detection and malware attribution using Mamba state space models with Kolmogorov Arnold networks","display_name":"Multistage advanced persistent threat detection and malware attribution using Mamba state space models with Kolmogorov Arnold networks","publication_year":2026,"publication_date":"2026-09-13","ids":{"openalex":"https://openalex.org/W7212435786","doi":"https://doi.org/10.1038/s41598-026-71232-8"},"language":"en","primary_location":{"id":"doi:10.1038/s41598-026-71232-8","doi":"https://doi.org/10.1038/s41598-026-71232-8","is_oa":true,"landing_page_url":"https://doi.org/10.1038/s41598-026-71232-8","pdf_url":"https://www.nature.com/articles/s41598-026-71232-8_reference.pdf","source":{"id":"https://openalex.org/S196734849","display_name":"Scientific Reports","issn_l":"2045-2322","issn":["2045-2322"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","dongbi-c","doyens","jufo-1","ki-jl-1","medline","norway-1","poland-140","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319908","host_organization_name":"Nature Portfolio","host_organization_lineage":["https://openalex.org/P4310319908","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Nature Portfolio","Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Scientific Reports","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.nature.com/articles/s41598-026-71232-8_reference.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5006616690","display_name":"Ahmad A. M. Abushariah","orcid":"https://orcid.org/0000-0002-9700-5398","observed_orcids":["https://orcid.org/0000-0002-9700-5398"]},"institutions":[{"id":"https://openalex.org/I4210117471","display_name":"Ajloun National University","ror":"https://ror.org/01m28kg79","country_code":"JO","type":"education","lineage":["https://openalex.org/I4210117471"]}],"countries":["JO"],"is_corresponding":false,"raw_author_name":"Ahmad A. M. Abushariah","raw_affiliation_strings":["Department of Data Science and Artificial Intelligence, Faculty of Information Technology, Ajloun National University, P.O.43, Ajloun, 26810, Jordan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Data Science and Artificial Intelligence, Faculty of Information Technology, Ajloun National University, P.O.43, Ajloun, 26810, Jordan","institution_ids":["https://openalex.org/I4210117471"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5049493052","display_name":"Mohammed Tawfik","orcid":"https://orcid.org/0000-0002-1227-387X","observed_orcids":["https://orcid.org/0000-0002-1227-387X","https://orcid.org/0009-0004-7622-5991"]},"institutions":[{"id":"https://openalex.org/I4210117471","display_name":"Ajloun National University","ror":"https://ror.org/01m28kg79","country_code":"JO","type":"education","lineage":["https://openalex.org/I4210117471"]}],"countries":["JO"],"is_corresponding":false,"raw_author_name":"Mohammed Tawfik","raw_affiliation_strings":["Department of Cyber Security, Faculty of Information Technology, Ajloun National University, Ajloun, 26810, Jordan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Cyber Security, Faculty of Information Technology, Ajloun National University, Ajloun, 26810, Jordan","institution_ids":["https://openalex.org/I4210117471"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5053177567","display_name":"Belal Alsellami","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I170535673","display_name":"Sana'a University","ror":"https://ror.org/04hcvaf32","country_code":"YE","type":"education","lineage":["https://openalex.org/I170535673"]}],"countries":["YE"],"is_corresponding":true,"raw_author_name":"Belal Al-sellami","raw_affiliation_strings":["Faculty of Computer and Information Technology, Sana\u2019a University, Sana\u2019a, Yemen"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Faculty of Computer and Information Technology, Sana\u2019a University, Sana\u2019a, Yemen","institution_ids":["https://openalex.org/I170535673"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5085198226","display_name":"Mohamed S. Sawah","orcid":"https://orcid.org/0000-0001-9196-5796","observed_orcids":["https://orcid.org/0000-0001-9196-5796"]},"institutions":[{"id":"https://openalex.org/I4210117471","display_name":"Ajloun National University","ror":"https://ror.org/01m28kg79","country_code":"JO","type":"education","lineage":["https://openalex.org/I4210117471"]}],"countries":["JO"],"is_corresponding":false,"raw_author_name":"Mohamed S. Sawah","raw_affiliation_strings":["Department of Data Science and Artificial Intelligence, Faculty of Information Technology, Ajloun National University, P.O.43, Ajloun, 26810, Jordan","Department of Information Systems, AL-Alson Higher Institute, Cairo, Egypt"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Data Science and Artificial Intelligence, Faculty of Information Technology, Ajloun National University, P.O.43, Ajloun, 26810, Jordan","institution_ids":["https://openalex.org/I4210117471"]},{"raw_affiliation_string":"Department of Information Systems, AL-Alson Higher Institute, Cairo, Egypt","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5053177567"],"corresponding_institution_ids":["https://openalex.org/I170535673"],"apc_list":{"value":2690,"currency":"USD","value_usd":2690},"apc_paid":{"value":2690,"currency":"USD","value_usd":2690},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"16","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9771000146865845,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9771000146865845,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.008899999782443047,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.0034000000450760126,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/advanced-persistent-threats","display_name":"advanced persistent threats","score":0.9779999852180481},{"id":"https://openalex.org/keywords/malware-attribution","display_name":"malware attribution","score":0.5509999990463257},{"id":"https://openalex.org/keywords/apt-detection","display_name":"APT detection","score":0.5950000286102295},{"id":"https://openalex.org/keywords/mamba","display_name":"Mamba","score":0.718999981880188},{"id":"https://openalex.org/keywords/kolmogorov-arnold-networks","display_name":"Kolmogorov-Arnold networks","score":0.9049999713897705},{"id":"https://openalex.org/keywords/class-imbalance","display_name":"class imbalance","score":0.5320000052452087},{"id":"https://openalex.org/keywords/shap","display_name":"SHAP","score":0.7649999856948853},{"id":"https://openalex.org/keywords/network-flow-classification","display_name":"network flow classification","score":0.47699999809265137},{"id":"https://openalex.org/keywords/opcode-sequences","display_name":"opcode sequences","score":0.5550000071525574},{"id":"https://openalex.org/keywords/model-interpretability","display_name":"model interpretability","score":0.4690000116825104}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7479000091552734},{"id":"https://openalex.org/C2781067378","wikidata":"https://www.wikidata.org/wiki/Q17027399","display_name":"Interpretability","level":2,"score":0.7371000051498413},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7128999829292297},{"id":"https://openalex.org/C52173422","wikidata":"https://www.wikidata.org/wiki/Q766483","display_name":"Opcode","level":2,"score":0.694100022315979},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5134000182151794},{"id":"https://openalex.org/C165464430","wikidata":"https://www.wikidata.org/wiki/Q1570441","display_name":"Parameterized complexity","level":2,"score":0.4781000018119812},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.4763000011444092},{"id":"https://openalex.org/C149810388","wikidata":"https://www.wikidata.org/wiki/Q5374873","display_name":"Emulation","level":2,"score":0.4648999869823456},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.44130000472068787},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4153999984264374},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.4072999954223633},{"id":"https://openalex.org/C34736171","wikidata":"https://www.wikidata.org/wiki/Q918333","display_name":"Preprocessor","level":2,"score":0.39160001277923584},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.3889999985694885},{"id":"https://openalex.org/C72434380","wikidata":"https://www.wikidata.org/wiki/Q230930","display_name":"State space","level":2,"score":0.36959999799728394},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.35580000281333923},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.3504999876022339},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.3398999869823456},{"id":"https://openalex.org/C83665646","wikidata":"https://www.wikidata.org/wiki/Q42139305","display_name":"Feature vector","level":2,"score":0.3147999942302704},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.29600000381469727},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.295199990272522},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.29109999537467957},{"id":"https://openalex.org/C101738243","wikidata":"https://www.wikidata.org/wiki/Q786435","display_name":"Autoencoder","level":3,"score":0.27559998631477356},{"id":"https://openalex.org/C81363708","wikidata":"https://www.wikidata.org/wiki/Q17084460","display_name":"Convolutional neural network","level":2,"score":0.27070000767707825},{"id":"https://openalex.org/C163175372","wikidata":"https://www.wikidata.org/wiki/Q3339222","display_name":"Linear model","level":2,"score":0.2531999945640564},{"id":"https://openalex.org/C176370821","wikidata":"https://www.wikidata.org/wiki/Q1826459","display_name":"Linear space","level":2,"score":0.25290000438690186}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1038/s41598-026-71232-8","doi":"https://doi.org/10.1038/s41598-026-71232-8","is_oa":true,"landing_page_url":"https://doi.org/10.1038/s41598-026-71232-8","pdf_url":"https://www.nature.com/articles/s41598-026-71232-8_reference.pdf","source":{"id":"https://openalex.org/S196734849","display_name":"Scientific Reports","issn_l":"2045-2322","issn":["2045-2322"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","dongbi-c","doyens","jufo-1","ki-jl-1","medline","norway-1","poland-140","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319908","host_organization_name":"Nature Portfolio","host_organization_lineage":["https://openalex.org/P4310319908","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Nature Portfolio","Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Scientific Reports","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:37633ac1306e4e4dbe7b32f808ecff16","doi":null,"is_oa":false,"landing_page_url":"https://doaj.org/article/37633ac1306e4e4dbe7b32f808ecff16","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Scientific Reports, Vol 16, Iss 1 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1038/s41598-026-71232-8","doi":"https://doi.org/10.1038/s41598-026-71232-8","is_oa":true,"landing_page_url":"https://doi.org/10.1038/s41598-026-71232-8","pdf_url":"https://www.nature.com/articles/s41598-026-71232-8_reference.pdf","source":{"id":"https://openalex.org/S196734849","display_name":"Scientific Reports","issn_l":"2045-2322","issn":["2045-2322"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","dongbi-c","doyens","jufo-1","ki-jl-1","medline","norway-1","poland-140","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319908","host_organization_name":"Nature Portfolio","host_organization_lineage":["https://openalex.org/P4310319908","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Nature Portfolio","Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Scientific Reports","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7212435786.pdf","grobid_xml":"https://content.openalex.org/works/W7212435786.grobid-xml"},"referenced_works_count":42,"referenced_works":["https://openalex.org/W1976526581","https://openalex.org/W2803920557","https://openalex.org/W2818789173","https://openalex.org/W2910711617","https://openalex.org/W2962703433","https://openalex.org/W2963351448","https://openalex.org/W3045754159","https://openalex.org/W3133235094","https://openalex.org/W3153029966","https://openalex.org/W4205611519","https://openalex.org/W4226372090","https://openalex.org/W4313306227","https://openalex.org/W4327935688","https://openalex.org/W4388020475","https://openalex.org/W4389326242","https://openalex.org/W4396821501","https://openalex.org/W4400077401","https://openalex.org/W4401753889","https://openalex.org/W4402659198","https://openalex.org/W4402679520","https://openalex.org/W4404013234","https://openalex.org/W4404452292","https://openalex.org/W4406376836","https://openalex.org/W4407129833","https://openalex.org/W4408387115","https://openalex.org/W4409347757","https://openalex.org/W4409507952","https://openalex.org/W4409968148","https://openalex.org/W4410512918","https://openalex.org/W4411173976","https://openalex.org/W4413199589","https://openalex.org/W4415191126","https://openalex.org/W4415564184","https://openalex.org/W4415797137","https://openalex.org/W4416389952","https://openalex.org/W4416848753","https://openalex.org/W7114788916","https://openalex.org/W7129010395","https://openalex.org/W7142056753","https://openalex.org/W7163892022","https://openalex.org/W7202139169","https://openalex.org/W7218744256"],"related_works":["https://openalex.org/W7123454935","https://openalex.org/W7159779419","https://openalex.org/W7030381322","https://openalex.org/W4415222937","https://openalex.org/W4396668036","https://openalex.org/W4226372090","https://openalex.org/W3047150775","https://openalex.org/W7160248950","https://openalex.org/W2920971804","https://openalex.org/W4412570164"],"abstract_inverted_index":{"Advanced":[0],"Persistent":[1],"Threats":[2],"(APTs)":[3],"represent":[4],"the":[5,113,153,168,210,233,259,263,285,295,309,331,359,366,394],"most":[6,395],"sophisticated":[7],"class":[8,170],"of":[9,63,156,230,361],"cyberattacks,":[10],"characterized":[11],"by":[12,20,112,245],"multi-stage,":[13],"stealthy,":[14],"and":[15,58,61,95,232,278,382,387,404],"persistent":[16],"intrusion":[17],"campaigns":[18],"orchestrated":[19],"well-funded,":[21],"often":[22],"state-sponsored":[23],"adversaries.":[24],"Existing":[25],"detection":[26,66,94],"methods":[27],"suffer":[28],"from":[29],"three":[30],"critical":[31],"limitations:":[32],"inability":[33],"to":[34,117,304],"model":[35],"long-range":[36],"temporal":[37,139],"dependencies":[38,140],"across":[39,141,221,240],"sequential":[40,142,297,356],"attack":[41,93,143,223],"phases,":[42,224],"reliance":[43],"on":[44,187,288,322],"fixed":[45,402],"activation":[46,106],"functions":[47,107],"that":[48,78,137],"cannot":[49],"capture":[50],"subtle":[51],"decision":[52],"boundaries":[53],"between":[54],"stealthy":[55],"APT":[56,92,174,235,376],"traffic":[57,227],"normal":[59],"operations,":[60],"lack":[62],"interpretability":[64],"in":[65,173],"decisions.":[67],"In":[68],"this":[69,292,323,364],"paper,":[70],"we":[71,255,290,349],"propose":[72],"MambaKAN-APT,":[73],"a":[74,132,194,272,305,347,355],"deep":[75,286],"learning":[76],"framework":[77],"synergizes":[79],"Kolmogorov\u2013Arnold":[80],"Networks":[81],"(KAN)":[82],"with":[83,145,164,199,225,281,317,330,372],"Mamba":[84,128,370],"Selective":[85],"State":[86],"Space":[87],"Models":[88],"(SSMs)":[89],"for":[90,123,375,409],"multi-stage":[91],"malware":[96,236],"family":[97],"attribution.":[98],"The":[99],"KAN":[100,373],"Feature":[101],"Encoder":[102],"employs":[103],"learnable":[104],"edge-wise":[105],"parameterized":[108],"as":[109,202,258,393],"B-splines":[110],"(evaluated":[111],"De":[114],"Boor":[115],"recursion)":[116],"automatically":[118],"discover":[119],"nonlinear":[120],"feature":[121],"transformations":[122],"each":[124],"input":[125],"dimension.":[126],"Stacked":[127],"SSM":[129],"blocks":[130],"implement":[131],"genuine":[133],"selective":[134],"state-space":[135,306],"recurrence":[136],"captures":[138],"phases":[144],"linear":[146],"computational":[147],"complexity":[148],"\\({\\mathscr":[149],"{O}}(L)\\)":[150],",":[151],"unlike":[152],"quadratic":[154],"cost":[155],"Transformer":[157],"architectures.":[158],"A":[159],"dual-pooling":[160],"classification":[161],"head":[162],"combined":[163],"Focal":[165],"Loss":[166],"addresses":[167],"severe":[169],"imbalance":[171],"inherent":[172],"datasets,":[175],"while":[176],"SHAP-based":[177],"explainability":[178],"provides":[179],"interpretable":[180],"per-feature":[181],"importance":[182],"analysis.":[183],"We":[184],"evaluate":[185],"MambaKAN-APT":[186],"two":[188],"real,":[189],"publicly":[190],"available":[191],"benchmarks":[192],"under":[193],"rigorous,":[195],"leakage-aware,":[196],"reproducible":[197],"protocol":[198],"results":[200],"reported":[201],"mean":[203,311],"\u00b1":[204],"standard":[205],"deviation":[206],"over":[207],"repeated":[208],"runs:":[209],"DAPT":[211,250,265],"2020":[212,251,266],"network-flow":[213],"benchmark":[214],"(86,691":[215],"flows,":[216],"64":[217],"informative":[218],"CICFlowMeter":[219],"features":[220],"five":[222,241],"Normal":[226],"forming":[228],"73.5%":[229],"flows)":[231],"CyberScienceLab":[234,298],"dataset":[237],"(1,428":[238],"samples":[239],"threat-actor":[242],"groups,":[243],"represented":[244],"disassembled":[246],"opcode":[247,389],"sequences).":[248],"Because":[249],"is":[252,271,279,327,365],"highly":[253],"imbalanced,":[254],"adopt":[256],"macro-F1":[257,312],"primary":[260],"metric.":[261],"On":[262,294],"tabular":[264],"task,":[267],"gradient":[268],"boosting":[269],"(XGBoost)":[270],"very":[273],"strong":[274,332],"baseline":[275,336],"(macro-F1":[276],"0.758)":[277],"competitive":[280],"or":[282],"stronger":[283],"than":[284,353],"models":[287],"macro-F1;":[289],"report":[291,350],"explicitly.":[293],"genuinely":[296],"attribution":[299],"task\u2014the":[300],"setting":[301],"best":[302,360],"suited":[303],"model\u2014MambaKAN-APT":[307],"attains":[308],"highest":[310],"(":[313,337],"\\(\\approx":[314,338],"0.959\\)":[315],")":[316],"low":[318],"across-seed":[319],"variance,":[320],"although":[321],"balanced":[324],"task":[325],"it":[326],"statistically":[328],"tied":[329],"XGBoost":[333],"n":[334,390],"-gram":[335],"0.954\\)":[339],";":[340],"paired":[341],"t":[342],"-test":[343],"p":[344],"=":[345],"0.59),":[346],"result":[348],"transparently":[351],"rather":[352],"over-claiming":[354],"advantage.":[357],"To":[358],"our":[362],"knowledge,":[363],"first":[367],"work":[368],"combining":[369],"SSMs":[371],"architectures":[374],"detection.":[377],"SHAP":[378],"analysis":[379],"identifies":[380],"flow-":[381],"packet-level":[383],"statistics":[384],"(DAPT":[385],"2020)":[386],"discriminative":[388],"-grams":[391],"(CyberScienceLab)":[392],"influential":[396],"features.":[397],"All":[398],"code,":[399],"cached":[400],"features,":[401],"seeds,":[403],"download":[405],"scripts":[406],"are":[407],"deposited":[408],"full":[410],"reproducibility.":[411]},"counts_by_year":[],"updated_date":"2026-11-10T11:39:43.021295","created_date":"2026-09-14T00:00:00"}