搜索结果：Holmes

Cloud environments face frequent DDoS threats due to centralized resources and broad attack surfaces. Modern cloud-native DDoS attacks further evolve rapidly and often blend multi-vector strategies, creating an operational dilemma: defenders need wire-speed monitoring while also requiring explainable, auditable attribution for response. Existing rule-based and supervised-learning approaches typically output black-box scores or labels, provide limited evidence chains, and generalize poorly to unseen attack variants; meanwhile, high-quality labeled data is often difficult to obtain in cloud settings. We present Holmes (DDoS Detective), an LLM-based DDoS detection agent that reframes the model as a virtual SRE investigator rather than an end-to-end classifier. Holmes couples a funnel-like hierarchical workflow (counters/sFlow for continuous sensing and triage; PCAP evidence collection triggered only on anomaly windows) with an Evidence Pack abstraction that converts binary packets into compact, reproducible, high-signal structured evidence. On top of this evidence interface, Holmes enforces a structure-first investigation protocol and strict JSON/quotation constraints to produce machi

The rapid development of AI-generated content (AIGC) technology has led to the misuse of highly realistic AI-generated images (AIGI) in spreading misinformation, posing a threat to public information security. Although existing AIGI detection techniques are generally effective, they face two issues: 1) a lack of human-verifiable explanations, and 2) a lack of generalization in the latest generation technology. To address these issues, we introduce a large-scale and comprehensive dataset, Holmes-Set, which includes the Holmes-SFTSet, an instruction-tuning dataset with explanations on whether images are AI-generated, and the Holmes-DPOSet, a human-aligned preference dataset. Our work introduces an efficient data annotation method called the Multi-Expert Jury, enhancing data generation through structured MLLM explanations and quality control via cross-model evaluation, expert defect filtering, and human preference modification. In addition, we propose Holmes Pipeline, a meticulously designed three-stage training framework comprising visual expert pre-training, supervised fine-tuning, and direct preference optimization. Holmes Pipeline adapts multimodal large language models (MLLMs) fo

Logical reasoning is essential for reliable AI, yet existing benchmarks are largely first-order-logic-centric, focusing on object-level deduction over fixed predicates. This misses many realistic scenarios where models must reason over rules, predicates, functions, constraints, and decision procedures themselves. We introduce HOLMES (Higher-Order Logic Meets real-world Explainable Symbolic reasoning), the first real-world benchmark for higher-order symbolic reasoning in LLMs, containing 1379 instances. Built on higher-order logic, HOLMES pairs natural-language problems with HOL formalizations, ground-truth answers, verifiable reasoning traces, and fine-grained controllable reasoning factors across law and finance. Experiments show that current LLMs still struggle on HOLMES, with an average accuracy of only 50.64% and the best model reaching 59.54%. Our analyses further reveal that high final-answer accuracy can mask shortcut reasoning in conflict-resolution settings, while performance drops sharply under scope-conditioned and compositional reasoning. These findings identify higher-order symbolic reasoning as a key bottleneck for building reliable and verifiable LLMs. The project co

Recent advances in CoT reasoning and RL post-training have been reported to enhance video reasoning capabilities of MLLMs. This progress naturally raises a question: can these models perform complex video reasoning in a manner comparable to human experts? However, existing video benchmarks primarily evaluate visual perception and grounding abilities, with questions that can be answered based on explicit prompts or isolated visual cues. Such benchmarks do not fully capture the intricacies of real-world reasoning, where humans must actively search for, integrate, and analyze multiple clues before reaching a conclusion. To address this issue, we present Video-Holmes, a benchmark inspired by the reasoning process of Sherlock Holmes, designed to evaluate the complex video reasoning capabilities of MLLMs. Video-Holmes consists of 1,837 questions derived from 270 manually annotated suspense short films, which spans seven carefully designed tasks. Each task is constructed by first identifying key events and causal relationships within films, and then designing questions that require models to actively locate and connect multiple relevant visual clues scattered across different video segmen

Deep neural networks (DNNs) can easily be cheated by some imperceptible but purposeful noise added to images, and erroneously classify them. Previous defensive work mostly focused on retraining the models or detecting the noise, but has either shown limited success rates or been attacked by new adversarial examples. Instead of focusing on adversarial images or the interior of DNN models, we observed that adversarial examples generated by different algorithms can be identified based on the output of DNNs (logits). Logit can serve as an exterior feature to train detectors. Then, we propose HOLMES (Hierarchically Organized Light-weight Multiple dEtector System) to reinforce DNNs by detecting potential adversarial examples to minimize the threats they may bring in practical. HOLMES is able to distinguish \textit{unseen} adversarial examples from multiple attacks with high accuracy and low false positive rates than single detector systems even in an adaptive model. To ensure the diversity and randomness of detectors in HOLMES, we use two methods: training dedicated detectors for each label and training detectors with top-k logits. Our effective and inexpensive strategies neither modify

Convolutional Neural Networks (CNNs) are nowadays the model of choice in Computer Vision, thanks to their ability to automatize the feature extraction process in visual tasks. However, the knowledge acquired during training is fully subsymbolic, and hence difficult to understand and explain to end users. In this paper, we propose a new technique called HOLMES (HOLonym-MEronym based Semantic inspection) that decomposes a label into a set of related concepts, and provides component-level explanations for an image classification model. Specifically, HOLMES leverages ontologies, web scraping and transfer learning to automatically construct meronym (parts)-based detectors for a given holonym (class). Then, it produces heatmaps at the meronym level and finally, by probing the holonym CNN with occluded images, it highlights the importance of each part on the classification output. Compared to state-of-the-art saliency methods, HOLMES takes a step further and provides information about both where and what the holonym CNN is looking at, without relying on densely annotated datasets and without forcing concepts to be associated to single computational units. Extensive experimental evaluation

We introduce Holmes, a new benchmark designed to assess language models (LMs) linguistic competence - their unconscious understanding of linguistic phenomena. Specifically, we use classifier-based probing to examine LMs' internal representations regarding distinct linguistic phenomena (e.g., part-of-speech tagging). As a result, we meet recent calls to disentangle LMs' linguistic competence from other cognitive abilities, such as following instructions in prompting-based evaluations. Composing Holmes, we review over 270 probing studies and include more than 200 datasets to assess syntax, morphology, semantics, reasoning, and discourse phenomena. Analyzing over 50 LMs reveals that, aligned with known trends, their linguistic competence correlates with model size. However, surprisingly, model architecture and instruction tuning also significantly influence performance, particularly in morphology and syntax. Finally, we propose FlashHolmes, a streamlined version that reduces the computation load while maintaining high-ranking precision.

In this paper, we present HOLMES, a system that implements a new approach to the detection of Advanced and Persistent Threats (APTs). HOLMES is inspired by several case studies of real-world APTs that highlight some common goals of APT actors. In a nutshell, HOLMES aims to produce a detection signal that indicates the presence of a coordinated set of activities that are part of an APT campaign. One of the main challenges addressed by our approach involves developing a suite of techniques that make the detection signal robust and reliable. At a high-level, the techniques we develop effectively leverage the correlation between suspicious information flows that arise during an attacker campaign. In addition to its detection capability, HOLMES is also able to generate a high-level graph that summarizes the attacker's actions in real-time. This graph can be used by an analyst for an effective cyber response. An evaluation of our approach against some real-world APTs indicates that HOLMES can detect APT campaigns with high precision and low false alarm rate. The compact high-level graphs produced by HOLMES effectively summarizes an ongoing attack campaign and can assist real-time cyber-r

In this discussion note, we respond to the fascinating paper "Martingale Posterior Distributions" by E. Fong, C. Holmes, and S. G. Walker with a couple of comments. On the basis of previous research, a theorem is stated regarding the relationship between frequentist bootstrap and stick-breaking process.

HOLMES is a new experiment aiming at directly measuring the neutrino mass with a sensitivity below 2 eV. HOLMES will perform a calorimetric measurement of the energy released in the decay of $^{163}$Ho. The calorimetric measurement eliminates systematic uncertainties arising from the use of external beta sources, as in experiments with spectrometers. This measurement was proposed in 1982 by A. De Rujula and M. Lusignoli, but only recently the detector technological progress has allowed to design a sensitive experiment. HOLMES will deploy a large array of low temperature microcalorimeters with implanted $^{163}$Ho nuclei. HOLMES, besides being an important step forward in the direct neutrino mass measurement with a calorimetric approach, will also establish the potential of this approach to extend the sensitivity down to 0.1 eV and lower. In its final configuration HOLMES will collect about $3\cdot 10^{13}$ decays with 1000 detectors characterized by an instrumental energy resolution of the order of few eV and a time resolution of few microseconds. To embed the $^{163}$Ho into the gold absorbers a custom mass separator ion implanter is being developed. The detectors used for the HOL

Email threat is a serious issue for enterprise security. The threat can be in various malicious forms, such as phishing, fraud, blackmail and malvertisement. The traditional anti-spam gateway often maintains a greylist to filter out unexpected emails based on suspicious vocabularies present in the email's subject and contents. However, this type of signature-based approach cannot effectively discover novel and unknown suspicious emails that utilize various evolving malicious payloads. To address the problem, in this paper, we present Holmes, an efficient and lightweight semantic based engine for anomalous email detection. Holmes can convert each email event log into a sentence through word embedding and then identify abnormalities that deviate from a historical baseline based on those translated sentences. We have evaluated the performance of Holmes in a real-world enterprise environment, where around 5,000 emails are sent/received each day. In our experiments, Holmes shows a high capability to detect email threats, especially those that cannot be handled by the enterprise anti-spam gateway. It is also demonstrated through our experiment that Holmes can discover more concealed mali

In recent years, the progress on low temperature detector technologies has allowed design of large scale experiments aiming at pushing down the sensitivity on the neutrino mass below 1\,eV. Even with outstanding performances in both energy ($\sim$eV on keV) and time resolution ($\sim 1\,μ$s) on the single channel, a large number of detectors working in parallel is required to reach a sub-eV sensitivity. HOLMES is a new experiment to directly measure the neutrino mass with a sensitivity as low as 2\,eV. HOLMES will perform a calorimetric measurement of the energy released in the electron capture (EC) decay of 163Ho. In its final configuration, HOLMES will deploy 1000 detectors of low temperature microcalorimeters with implanted 163Ho nuclei. The baseline sensors for HOLMES are Mo/Cu TESs (Transition Edge Sensors) on SiN\textsubscript{x} membrane with gold absorbers. The readout is based on the use of rf-SQUIDs as input devices with flux ramp modulation for linearization purposes; the rf-SQUID is then coupled to a superconducting lambda/4-wave resonator in the GHz range, and the modulated signal is finally read out using the homodyne technique. The TES detectors have been designed wi

The European Research Council has recently funded HOLMES, a new experiment to directly measure the neutrino mass. HOLMES will perform a calorimetric measurement of the energy released in the decay of 163Ho. The calorimetric measurement eliminates systematic uncertainties arising from the use of external beta sources, as in experiments with beta spectrometers. This measurement was proposed in 1982 by A. De Rujula and M. Lusignoli, but only recently the detector technological progress allowed to design a sensitive experiment. HOLMES will deploy a large array of low temperature microcalorimeters with implanted 163Ho nuclei. The resulting mass sensitivity will be as low as 0.4 eV. HOLMES will be an important step forward in the direct neutrino mass measurement with a calorimetric approach as an alternative to spectrometry. It will also establish the potential of this approach to extend the sensitivity down to 0.1 eV. We outline here the project with its technical challenges and perspectives.

For noisy two-dimensional data, which are approximately uniformly distributed near the circumference of an ellipse, Mardia and Holmes (1980) developed a model to fit the ellipse. In this paper we adapt their methodology to the analysis of helix data in three dimensions. If the helix axis is known, then the Mardia-Holmes model for the circular case can be fitted after projecting the helix data onto the plane normal to the helix axis. If the axis is unknown, an iterative algorithm has been developed to estimate the axis. The methodology is illustrated using simulated protein alpha-helices. We also give a multivariate version of the Mardia-Holmes model which will be applicable for fitting an ellipsoid and in particular a cylinder.

Deep learning models have achieved expert-level performance in healthcare with an exclusive focus on training accurate models. However, in many clinical environments such as intensive care unit (ICU), real-time model serving is equally if not more important than accuracy, because in ICU patient care is simultaneously more urgent and more expensive. Clinical decisions and their timeliness, therefore, directly affect both the patient outcome and the cost of care. To make timely decisions, we argue the underlying serving system must be latency-aware. To compound the challenge, health analytic applications often require a combination of models instead of a single model, to better specialize individual models for different targets, multi-modal data, different prediction windows, and potentially personalized predictions. To address these challenges, we propose HOLMES-an online model ensemble serving framework for healthcare applications. HOLMES dynamically identifies the best performing set of models to ensemble for highest accuracy, while also satisfying sub-second latency constraints on end-to-end prediction. We demonstrate that HOLMES is able to navigate the accuracy/latency tradeoff

This paper reviews the maxims used by three early modern fictional detectives: Monsieur Lecoq, C. Auguste Dupin and Sherlock Holmes. It find similarities between these maxims and Bayesian thought. Poe's Dupin uses ideas very similar to Bayesian game theory. Sherlock Holmes' statements also show thought patterns justifiable in Bayesian terms.

Edwin Alfred Holmes (1839 -1919) is best remembered for his discovery of a bright comet in 1892, now known as Comet 17P/Holmes. An amateur astronomer and authority on optics, he was an original member of the BAA and contributed to its Journal and meetings for many years. As a prolific writer of letters to the English Mechanic, he developed a reputation for his controversial and acerbic penmanship.