{"id":"https://openalex.org/W7172020617","doi":"https://doi.org/10.48550/arxiv.2607.28460","title":"Cybersecurity Detection Classification with Reasoning-enabled Language Models","display_name":"Cybersecurity Detection Classification with Reasoning-enabled Language Models","publication_year":2026,"publication_date":"2026-07-30","ids":{"openalex":"https://openalex.org/W7172020617","doi":"https://doi.org/10.48550/arxiv.2607.28460"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2607.28460","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.28460","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2607.28460","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5086021685","display_name":"Amol Khanna","orcid":"https://orcid.org/0000-0002-5566-095X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Khanna, Amol","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5044441612","display_name":"Manu Nandan","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nandan, Manu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5144121767","display_name":"Cristian Viorel Popa","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Popa, Cristian Viorel","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5144178860","display_name":"Joan Pujol-Roig","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Pujol-Roig, Joan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120458457","display_name":"Diana Bolocan","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Bolocan, Diana","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5116082941","display_name":"Laura Vasilie","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Vasilie, Laura","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5140900461","display_name":"Alexandru Apostu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Apostu, Alexandru","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5144130195","display_name":"Chase Helwig","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Helwig, Chase","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072054173","display_name":"Mihaela G\u0103man","orcid":"https://orcid.org/0000-0001-7751-6759"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Gaman, Mihaela","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5084452718","display_name":"Michael Brautbar","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Brautbar, Michael","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068036546","display_name":"Edward Raff","orcid":"https://orcid.org/0000-0002-9900-1972"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Raff, Edward","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5144169944","display_name":"Chase Midler","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Midler, Chase","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5090887052","display_name":"Sven Krasser","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Krasser, Sven","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.2581999897956848,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.2581999897956848,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.08940000087022781,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.07410000264644623,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/triage","display_name":"Triage","score":0.6776000261306763},{"id":"https://openalex.org/keywords/language-model","display_name":"Language model","score":0.5231999754905701},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.5105000138282776},{"id":"https://openalex.org/keywords/recall","display_name":"Recall","score":0.4528999924659729},{"id":"https://openalex.org/keywords/point","display_name":"Point (geometry)","score":0.4018999934196472},{"id":"https://openalex.org/keywords/precision-and-recall","display_name":"Precision and recall","score":0.37049999833106995},{"id":"https://openalex.org/keywords/debiasing","display_name":"Debiasing","score":0.3686999976634979}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8151999711990356},{"id":"https://openalex.org/C2777120189","wikidata":"https://www.wikidata.org/wiki/Q780067","display_name":"Triage","level":2,"score":0.6776000261306763},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.5231999754905701},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5212000012397766},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.5105000138282776},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.453000009059906},{"id":"https://openalex.org/C100660578","wikidata":"https://www.wikidata.org/wiki/Q18733","display_name":"Recall","level":2,"score":0.4528999924659729},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4237000048160553},{"id":"https://openalex.org/C28719098","wikidata":"https://www.wikidata.org/wiki/Q44946","display_name":"Point (geometry)","level":2,"score":0.4018999934196472},{"id":"https://openalex.org/C81669768","wikidata":"https://www.wikidata.org/wiki/Q2359161","display_name":"Precision and recall","level":2,"score":0.37049999833106995},{"id":"https://openalex.org/C2779458634","wikidata":"https://www.wikidata.org/wiki/Q24963715","display_name":"Debiasing","level":2,"score":0.3686999976634979},{"id":"https://openalex.org/C85847156","wikidata":"https://www.wikidata.org/wiki/Q59015987","display_name":"Verifiable secret sharing","level":3,"score":0.36660000681877136},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.33219999074935913},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.31299999356269836},{"id":"https://openalex.org/C148524875","wikidata":"https://www.wikidata.org/wiki/Q6975395","display_name":"F1 score","level":2,"score":0.29679998755455017},{"id":"https://openalex.org/C175154964","wikidata":"https://www.wikidata.org/wiki/Q380077","display_name":"Task analysis","level":3,"score":0.2865000069141388},{"id":"https://openalex.org/C75291252","wikidata":"https://www.wikidata.org/wiki/Q1315756","display_name":"TRACE (psycholinguistics)","level":2,"score":0.26919999718666077},{"id":"https://openalex.org/C2777267654","wikidata":"https://www.wikidata.org/wiki/Q3519023","display_name":"Test (biology)","level":2,"score":0.2637999951839447},{"id":"https://openalex.org/C175291020","wikidata":"https://www.wikidata.org/wiki/Q1156822","display_name":"Offset (computer science)","level":2,"score":0.26179999113082886},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.2547999918460846}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2607.28460","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.28460","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2607.28460","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.28460","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.7386481761932373,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"A":[0],"major":[1],"issue":[2],"in":[3,23],"Security":[4],"Operations":[5],"Centers":[6],"(SOCs)":[7],"is":[8,17,53,117,157],"alert":[9],"fatigue,":[10],"as":[11],"the":[12,90,106,112,115,127,154],"number":[13],"of":[14],"detections":[15,70],"reported":[16],"more":[18],"than":[19],"staff":[20],"can":[21],"triage":[22,39,63,95],"a":[24,38,51,54,59,102,146,172],"given":[25],"day.":[26],"Prior":[27],"work":[28],"prompts":[29],"or":[30],"fine-tunes":[31],"large":[32],"language":[33],"models":[34],"(LLMs)":[35],"to":[36,47,167],"emit":[37],"label":[40],"directly,":[41],"but":[42],"does":[43],"not":[44],"train":[45,58,101],"them":[46],"reason":[48],"about":[49],"whether":[50],"detection":[52],"genuine":[55],"threat.":[56],"We":[57,83,150],"chain-of-thought":[60],"(CoT)":[61],"reasoning-enabled":[62],"classifier":[64],"on":[65],"real,":[66],"human-labeled":[67],"Windows":[68],"endpoint":[69],"by":[71,138,143],"combining":[72],"automated":[73,94,133],"prompt":[74],"optimization,":[75],"self-training,":[76],"and":[77,110,140,170],"reinforcement":[78],"learning":[79],"with":[80],"verifiable":[81],"rewards.":[82],"find":[84],"that":[85,93,104,114,131,153,171],"CoT":[86],"reasoning":[87,108],"also":[88],"degrades":[89],"label-token":[91],"probabilities":[92],"relies":[96],"on,":[97],"so":[98],"we":[99],"separately":[100],"calibrator":[103,156],"reads":[105],"full":[107],"trace":[109],"estimates":[111],"probability":[113],"verdict":[116],"correct.":[118],"Our":[119],"system":[120],"reaches":[121],"82.6%":[122],"test":[123],"accuracy":[124],"and,":[125],"at":[126],"high-confidence":[128,165],"operating":[129],"point":[130],"governs":[132],"triage,":[134],"improves":[135],"benign":[136],"recall":[137,142,166],"43.0%":[139],"malicious":[141],"18.3%":[144],"over":[145,184],"direct-label":[147],"LLM":[148],"classifier.":[149],"further":[151],"show":[152],"trained":[155],"necessary":[158],"-":[159,169],"an":[160],"untrained":[161],"confidence":[162],"judge":[163],"collapses":[164],"zero":[168],"finetuned":[173],"30B":[174],"model":[175],"significantly":[176],"outperforms":[177],"frontier":[178],"general-purpose":[179],"models,":[180],"motivating":[181],"targeted":[182],"training":[183],"scale.":[185]},"counts_by_year":[],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2026-08-01T00:00:00"}