HIDBench - NodLink HW20: leaderboard
Metric: Matthews correlation coefficient of malicious-event detection times 100 (-100 to 100), from the HIDBench pipeline (attack-centric windows of host provenance-graph events serialized for the LLM, high-confidence evidence identification, k-hop context expansion, then attack narrative and indicator-of-compromise output) on the NodLink simulated-data HW20 host logs (1,217 events, 43 malicious); higher is better. Source: arxiv.org. Saturation forecast: Around January 2027. 9 models tracked.
Top models
| # | Model | Score |
|---|---|---|
| 1 | Qwen 3.6 Plus | 73.9 |
| 2 | DeepSeek V3.2 | 69.7 |
| 3 | Claude Sonnet 4.5 | 69.5 |
| 4 | Claude Opus 4.6 | 63.3 |
| 5 | Claude Sonnet 4 | 55.7 |
| 6 | GPT-5.2 | 52.9 |
| 7 | GPT-4.1 | 48.7 |
| 8 | GPT-OSS-120B | 46.3 |
| 9 | Gemini 2.5 Flash | 32.8 |
Interactive version: theaggregate.ai/benchmark?slug=hidbench-nodlink-hw20 · How It Works · Data refreshed daily, snapshot 2026-10-07.