FALCON-C: Flow-based Analysis and Labeling for Connected Vehicular Network Cybersecurity

• URL: http://arxiv.org/abs/2605.24206v1
• Date: Fri, 22 May 2026 20:46:55 GMT
• Title: FALCON-C: Flow-based Analysis and Labeling for Connected Vehicular Network Cybersecurity
• Abstract summary: Electric Vehicle Supply Equipment (EVSE) has emerged as a new target for cyber attacks.<n>This paper proposes a Flow-based Analysis and Labeling for COnnected vehicular Network Cybersecurity framework.
• Score: 1.7474751673489866
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Along with the recent rise in popularity of Electric Vehicles (EVs), Electric Vehicle Supply Equipment (EVSE) has emerged as a new target for cyber attacks. Therefore, ensuring the security and integrity of network communication between EVSE components and vehicular clients is a significant challenge that must be addressed. To this end, this paper proposes a Flow-based Analysis and Labeling for COnnected vehicular Network Cybersecurity (FALCON-C) framework. The FALCON-C framework leverages an autoencoder for anomaly detection and is trained on a small number of benign flows from the CICEVSE2024 dataset. The model's objective is to model benign flow behavior and identify malicious flows by detecting statistically different reconstruction error profiles. The results demonstrate that the model can successfully identify malicious flows, achieving 100% accuracy. Initially, some benign flows were misclassified as malicious, resulting in a suboptimal false positive rate. A thorough analysis of the autoencoder's performance and the nature of misclassified flows led to the development of a refined decision boundary, improving the framework's performance by 8.6%. FALCON-C is intended to support Security Operations Center activities by automating flow labeling, leading to the enhanced curation of reliable datasets that can be used for various activities, including threat modeling and hunting, decision auditing, and intrusion detection system refinement.

Related papers

• Conformal Changepoint Localization and Root Cause Analysis with Corrupted Observations [55.76952683833966]
  This paper proposes weighted CONCH (W-CONCH) and weighted CROC (W-CROC) to reduce confidence set size when data may be corrupted.<n>Experiments on image-based and real-world changepoint and root-cause benchmarks show that uncertainty-based weighting substantially reduces confidence set size.
  arXiv  Detail & Related papers  (2026-07-29T05:16:59Z)
• NetVAD: Foundation-Model Representation Learning for Identifier-Free Unsupervised Intrusion Detection [1.529342790344802]
  textitNetVAD projects representations from a frozen Foundation Model into a task-specific latent space, trained solely on benign traffic.<n>On ToN-IoT, it achieves a 98% Micro F1-score and a 96% Macro F1-score at an operational false positive rate.
  arXiv  Detail & Related papers  (2026-05-31T21:14:25Z)
• Understanding AI Methods for Intrusion Detection and Cryptographic Leakage [42.8384136157456]
  We evaluate how machine learning techniques can detect malicious network activity and identify potential information leakage in cryptographic implementations.<n>Our results demonstrate that AI models can achieve near-perfect detection accuracy within stable network environment.<n>We also observed that learned models identify patterns consistent with side-channel leakage, suggesting that AI can assist in uncovering implementation-level vulnerabilities.
  arXiv  Detail & Related papers  (2026-03-26T18:42:57Z)
• A Blueprint for Self-Evolving Coding Agents in Vehicle Aerodynamic Drag Prediction [9.020568132598827]
  We present a contract-centric blueprint for self-evolving coding agents that discover executable surrogate pipelines for predicting drag coefficient $C_d$ under industrial constraints.<n>The method formulates surrogate discovery as constrained optimization over programs, not static model instances.<n>A hard evaluation contract enforces leakage prevention, deterministic replay, multi-seed, robustness and resource budgets before any candidate is admitted.
  arXiv  Detail & Related papers  (2026-03-23T08:36:57Z)
• SEAL-Tag: Self-Tag Evidence Aggregation with Probabilistic Circuits for PII-Safe Retrieval-Augmented Generation [36.47163805456756]
  SEAL-Tag is a runtime environment that protects Personally Identifiable Information (PII)<n> SEAL-Tag introduces the SEAL-Probe protocol, transforming auditing into a structured tool-use operation where the model generates a verifiable PII-Evidence Table (PET) alongside its draft.<n>To overcome the privacy "Cold Start" problem, we introduce the S0--S6 Anchored Synthesis Pipeline, generating high-fidelity, provenanced RAG interactions.
  arXiv  Detail & Related papers  (2026-03-18T02:40:54Z)
• FP-Predictor - False Positive Prediction for Static Analysis Reports [5.4164223824711755]
  This work presents a Graph Convolutional Network (GCN) model designed to predict Static Application Security Testing (SAST) reports as true and false positive.<n>The model leverages Code Property Graphs (CPGs) constructed from static analysis results to capture both, structural and semantic relationships within code.<n> Evaluation on the CryptoAPI-Bench benchmark demonstrated the model's practical applicability, reaching an overall accuracy of up to 96.6%.
  arXiv  Detail & Related papers  (2026-03-11T09:05:39Z)
• A Comparative Analysis of Ensemble-Based Machine Learning Approaches with Explainable AI for Multi-Class Intrusion Detection in Drone Networks [0.2708211191235587]
  This research aims to develop a robust and interpretable intrusion detection framework tailored for drone networks.<n>We present a comparative analysis of ensemble-based machine learning models, namely Random Forest, Extra Trees, AdaBoost, CatBoost, and XGBoost, trained on a labeled dataset.<n>The proposed approach not only delivers near-perfect accuracy but also ensures interpretability, making it highly suitable for real-time and safety-critical drone operations.
  arXiv  Detail & Related papers  (2025-09-23T00:59:21Z)
• A Kolmogorov-Arnold Network for Interpretable Cyberattack Detection in AGC Systems [1.5701326192371186]
  This work proposes Kolmogorov-Arnold Networks (KAN) as an interpretable and accurate method for FDIA detection in AGC systems.<n>KAN models include a method for extracting symbolic equations, and are thus able to provide more interpretability than the majority of machine learning models.<n>Our findings confirm that the proposed KAN model achieves FDIA detection rates of up to 95.97% and 95.9% for the initial model and the symbolic formula, respectively.
  arXiv  Detail & Related papers  (2025-09-05T17:18:17Z)
• Expert-in-the-Loop Systems with Cross-Domain and In-Domain Few-Shot Learning for Software Vulnerability Detection [38.083049237330826]
  This study explores the use of Large Language Models (LLMs) in software vulnerability assessment by simulating the identification of Python code with known Common Weaknessions (CWEs)<n>Our results indicate that while zero-shot prompting performs poorly, few-shot prompting significantly enhances classification performance.<n> challenges such as model reliability, interpretability, and adversarial robustness remain critical areas for future research.
  arXiv  Detail & Related papers  (2025-06-11T18:43:51Z)
• Automated Phishing Detection Using URLs and Webpages [35.66275851732625]
  This project addresses the constraints of traditional reference-based phishing detection by developing an LLM agent framework. This agent harnesses Large Language Models to actively fetch and utilize online information. Our approach has achieved with accuracy of 0.945, significantly outperforms the existing solution(DynaPhish) by 0.445.
  arXiv  Detail & Related papers  (2024-08-03T05:08:27Z)
• Data-Driven Lipschitz Continuity: A Cost-Effective Approach to Improve Adversarial Robustness [47.9744734181236]
  We explore the concept of Lipschitz continuity to certify the robustness of deep neural networks (DNNs) against adversarial attacks. We propose a novel algorithm that remaps the input domain into a constrained range, reducing the Lipschitz constant and potentially enhancing robustness. Our method achieves the best robust accuracy for CIFAR10, CIFAR100, and ImageNet datasets on the RobustBench leaderboard.
  arXiv  Detail & Related papers  (2024-06-28T03:10:36Z)
• Secure Hierarchical Federated Learning in Vehicular Networks Using Dynamic Client Selection and Anomaly Detection [10.177917426690701]
  Hierarchical Federated Learning (HFL) faces the challenge of adversarial or unreliable vehicles in vehicular networks. Our study introduces a novel framework that integrates dynamic vehicle selection and robust anomaly detection mechanisms. Our proposed algorithm demonstrates remarkable resilience even under intense attack conditions.
  arXiv  Detail & Related papers  (2024-05-25T18:31:20Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.