HIDBench - NodLink HW17: leaderboard
Metric: Matthews correlation coefficient of malicious-event detection times 100 (-100 to 100), from the HIDBench pipeline (attack-centric windows of host provenance-graph events serialized for the LLM, high-confidence evidence identification, k-hop context expansion, then attack narrative and indicator-of-compromise output) on the NodLink simulated-data HW17 host logs (481 events, 16 malicious); higher is better. Source: arxiv.org. Saturation forecast: Around January 2027. 9 models tracked.
Top models
| # | Model | Score |
|---|---|---|
| 1 | GPT-5.2 | 66.5 |
| 2 | GPT-4.1 | 62.2 |
| 3 | Gemini 2.5 Flash | 57.3 |
| 4 | Claude Opus 4.6 | 54.2 |
| 5 | Qwen 3.6 Plus | 46.2 |
| 6 | Claude Sonnet 4.5 | 37.9 |
| 7 | Claude Sonnet 4 | 36.5 |
| 8 | DeepSeek V3.2 | 30 |
| 9 | GPT-OSS-120B | 21.7 |
Interactive version: theaggregate.ai/benchmark?slug=hidbench-nodlink-hw17 · How It Works · Data refreshed daily, snapshot 2026-10-07.