HIDBench - NodLink WIN10: leaderboard
Metric: Matthews correlation coefficient of malicious-event detection times 100 (-100 to 100), from the HIDBench pipeline (attack-centric windows of host provenance-graph events serialized for the LLM, high-confidence evidence identification, k-hop context expansion, then attack narrative and indicator-of-compromise output) on the NodLink simulated-data WIN10 host logs (2,411 events, 136 malicious); higher is better. Source: arxiv.org. Saturation forecast: Not forecast. 9 models tracked.
Top models
| # | Model | Score |
|---|---|---|
| 1 | GPT-4.1 | 37.3 |
| 2 | Claude Opus 4.6 | 34.8 |
| 3 | Gemini 2.5 Flash | 34.1 |
| 4 | DeepSeek V3.2 | 30.5 |
| 5 | Claude Sonnet 4.5 | 25 |
| 6 | GPT-5.2 | 22.4 |
| 7 | Qwen 3.6 Plus | 21.8 |
| 8 | GPT-OSS-120B | 18.7 |
| 9 | Claude Sonnet 4 | 16.8 |
Interactive version: theaggregate.ai/benchmark?slug=hidbench-nodlink-win10 · How It Works · Data refreshed daily, snapshot 2026-10-07.