{"id":"https://openalex.org/W7154274172","doi":"https://doi.org/10.48550/arxiv.2604.10534","title":"Machine Learning-Based Detection of MCP Attacks","display_name":"Machine Learning-Based Detection of MCP Attacks","publication_year":2026,"publication_date":"2026-04-12","ids":{"openalex":"https://openalex.org/W7154274172","doi":"https://doi.org/10.48550/arxiv.2604.10534"},"language":"en","primary_location":{"id":"pmh:oai:DiVA.org:bth-29581","is_oa":true,"landing_page_url":"http://urn.kb.se/resolve?urn=urn:nbn:se:bth-29581","pdf_url":null,"source":{"id":"https://openalex.org/S4306401559","display_name":"KTH Publication Database DiVA (KTH Royal Institute of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/bachelorThesis"},"type":"dissertation","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"http://urn.kb.se/resolve?urn=urn:nbn:se:bth-29581","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5010028998","display_name":"Tobias Mattsson","orcid":"https://orcid.org/0000-0003-0717-4014"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Mattsson, Tobias","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133592272","display_name":"Samuel Nyberg","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nyberg, Samuel","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5046863989","display_name":"Anton Borg","orcid":"https://orcid.org/0000-0002-8929-7220"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Borg, Anton","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5029910583","display_name":"Ricardo Britto","orcid":"https://orcid.org/0000-0002-7220-9570"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Britto, Ricardo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.15790000557899475,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.15790000557899475,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.14569999277591705,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.1388999968767166,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.5882999897003174},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.5404000282287598},{"id":"https://openalex.org/keywords/workflow","display_name":"Workflow","score":0.5016000270843506},{"id":"https://openalex.org/keywords/block","display_name":"Block (permutation group theory)","score":0.5},{"id":"https://openalex.org/keywords/binary-classification","display_name":"Binary classification","score":0.45350000262260437},{"id":"https://openalex.org/keywords/multiclass-classification","display_name":"Multiclass classification","score":0.3711000084877014},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.3273000121116638},{"id":"https://openalex.org/keywords/confusion","display_name":"Confusion","score":0.3151000142097473},{"id":"https://openalex.org/keywords/protocol","display_name":"Protocol (science)","score":0.3059000074863434}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7930999994277954},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.6292999982833862},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5961999893188477},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5882999897003174},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.5404000282287598},{"id":"https://openalex.org/C177212765","wikidata":"https://www.wikidata.org/wiki/Q627335","display_name":"Workflow","level":2,"score":0.5016000270843506},{"id":"https://openalex.org/C2777210771","wikidata":"https://www.wikidata.org/wiki/Q4927124","display_name":"Block (permutation group theory)","level":2,"score":0.5},{"id":"https://openalex.org/C66905080","wikidata":"https://www.wikidata.org/wiki/Q17005494","display_name":"Binary classification","level":3,"score":0.45350000262260437},{"id":"https://openalex.org/C123860398","wikidata":"https://www.wikidata.org/wiki/Q6934605","display_name":"Multiclass classification","level":3,"score":0.3711000084877014},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3587999939918518},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3273000121116638},{"id":"https://openalex.org/C2781140086","wikidata":"https://www.wikidata.org/wiki/Q557945","display_name":"Confusion","level":2,"score":0.3151000142097473},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.3059000074863434},{"id":"https://openalex.org/C48372109","wikidata":"https://www.wikidata.org/wiki/Q3913","display_name":"Binary number","level":2,"score":0.3050000071525574},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.3009999990463257},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.2985999882221222},{"id":"https://openalex.org/C110083411","wikidata":"https://www.wikidata.org/wiki/Q1744628","display_name":"Statistical classification","level":2,"score":0.2822999954223633},{"id":"https://openalex.org/C136389625","wikidata":"https://www.wikidata.org/wiki/Q334384","display_name":"Supervised learning","level":3,"score":0.2759000062942505},{"id":"https://openalex.org/C175154964","wikidata":"https://www.wikidata.org/wiki/Q380077","display_name":"Task analysis","level":3,"score":0.274399995803833},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.26930001378059387},{"id":"https://openalex.org/C2779190172","wikidata":"https://www.wikidata.org/wiki/Q4913888","display_name":"Binary data","level":3,"score":0.26919999718666077},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.26669999957084656},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.2660999894142151},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.26600000262260437},{"id":"https://openalex.org/C34872919","wikidata":"https://www.wikidata.org/wiki/Q7092302","display_name":"One-class classification","level":3,"score":0.25949999690055847},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.25110000371932983}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:DiVA.org:bth-29581","is_oa":true,"landing_page_url":"http://urn.kb.se/resolve?urn=urn:nbn:se:bth-29581","pdf_url":null,"source":{"id":"https://openalex.org/S4306401559","display_name":"KTH Publication Database DiVA (KTH Royal Institute of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/bachelorThesis"},{"id":"doi:10.48550/arxiv.2604.10534","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.10534","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:DiVA.org:bth-29581","is_oa":true,"landing_page_url":"http://urn.kb.se/resolve?urn=urn:nbn:se:bth-29581","pdf_url":null,"source":{"id":"https://openalex.org/S4306401559","display_name":"KTH Publication Database DiVA (KTH Royal Institute of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/bachelorThesis"},"sustainable_development_goals":[{"score":0.4501766562461853,"display_name":"Industry, innovation and infrastructure","id":"https://metadata.un.org/sdg/9"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"The":[0,124],"Model":[1],"Context":[2],"Protocol":[3],"(MCP)":[4],"is":[5],"a":[6,26,53,82,93,116,122,219,222],"new":[7,27],"and":[8,51,63,91,147,157,210,237],"emerging":[9],"technology":[10],"that":[11,119,127,199,241,249],"extends":[12],"the":[13,68,71,98,110,130,137,142,145,167,182,194,216,239,246,261],"functionality":[14],"of":[15,55,73,129,155,170],"large":[16],"language":[17],"models,":[18,113],"improving":[19],"workflows":[20],"but":[21,37],"also":[22,163],"exposing":[23],"users":[24],"to":[25,109,165,193,226,233],"attack":[28,39,99],"surface.":[29],"Several":[30],"studies":[31],"have":[32],"highlighted":[33],"related":[34],"security":[35],"flaws,":[36],"MCP":[38,75,195,229],"detection":[40,72],"remains":[41],"underexplored.":[42],"To":[43,214],"address":[44],"this":[45,48],"research":[46],"gap,":[47],"study":[49,189,247],"develops":[50],"evaluates":[52],"range":[54],"supervised":[56],"machine":[57,111,200],"learning":[58,112,201],"approaches,":[59],"including":[60],"both":[61],"traditional":[62,175,254],"deep-learning":[64],"models.":[65],"We":[66],"evaluated":[67],"systems":[69],"on":[70,136],"malicious":[74,87,105,209],"tool":[76],"descriptions":[77],"in":[78,185,207,218,258,260],"two":[79],"scenarios:":[80],"(1)":[81],"binary":[83,138],"classification":[84,95,139],"task":[85,96],"distinguishing":[86],"from":[88,104],"benign":[89,103,211],"tools,":[90],"(2)":[92],"multiclass":[94,143],"identifying":[97],"type":[100],"while":[101],"separating":[102,208],"tools.":[106],"In":[107,141],"addition":[108,192],"we":[114],"compared":[115],"rule-based":[117,255],"approach":[118],"serves":[120],"as":[121],"baseline.":[123],"results":[125],"indicate":[126],"several":[128],"developed":[131,225],"models":[132,149,202,251],"achieved":[133],"100\\%":[134],"F1-score":[135],"task.":[140],"scenario,":[144],"SVC":[146],"BERT":[148],"performed":[150],"best,":[151],"achieving":[152],"F1":[153],"scores":[154],"90.56\\%":[156],"88.33\\%,":[158],"respectively.":[159],"Confusion":[160],"matrices":[161],"were":[162],"used":[164],"visualize":[166],"full":[168],"distribution":[169],"predictions":[171],"often":[172],"missed":[173],"by":[174],"metrics,":[176],"providing":[177],"additional":[178],"insight":[179],"for":[180],"selecting":[181],"best-fitting":[183],"solution":[184,217],"real-world":[186],"scenarios.":[187],"This":[188],"presents":[190],"an":[191],"defence":[196],"area,":[197],"showing":[198],"can":[203,252],"perform":[204],"exceptionally":[205],"well":[206],"data":[212],"points.":[213],"apply":[215],"live":[220],"environment,":[221],"middleware":[223],"was":[224],"classify":[227],"which":[228],"tools":[230],"are":[231,242],"safe":[232],"use":[234,259],"before":[235],"execution,":[236],"block":[238],"ones":[240],"not":[243],"safe.":[244],"Furthermore,":[245],"shows":[248],"these":[250],"outperform":[253],"solutions":[256],"currently":[257],"field.":[262]},"counts_by_year":[],"updated_date":"2026-07-15T18:14:33.161393","created_date":"2026-04-15T00:00:00"}