The research team, led by co-first authors Fei Zheng and Wenjia Zhang under the senior authorship of Ping Yin and Nan Hong, set out to address a specific and practical problem. Pre-operative differentiation between benign and malignant sacral tumors is essential for guiding treatment strategy, yet the similarity of clinical symptoms and imaging characteristics reduces the specificity and accuracy of conventional assessments of bone malignancy. Their solution does not require new scanners, injected contrast agents, or additional radiation exposure. Instead, it extracts far more information than radiologists can perceive by eye from the non-contrast computed tomography images that these patients often already receive.

The study enrolled 112 patients whose sacral tumors were ultimately confirmed by pathology between July 2021 and September 2023, providing a ground-truth backbone against which every algorithmic prediction could be measured. The investigators drew regions of interest around each tumor on the CT scans and then applied a technique known as habitat radiomics. The underlying premise is that a tumor is not a uniform blob of tissue; it is a patchwork of biologically distinct sub-regions, each with its own density, texture, and microarchitecture. On a CT image, these sub-regions express themselves as subtle differences in Hounsfield units, the standard measure of radiodensity, that are invisible to casual inspection but statistically robust when quantified systematically.

To capture that internal heterogeneity, the team used K-means clustering, a classic unsupervised machine learning algorithm, to partition each tumor into three spatial habitats. K-means works by iteratively grouping voxels, the three-dimensional pixels of the CT volume, into clusters based on how similar their intensity patterns are, so that each habitat represents a compartment of relatively homogeneous imaging behavior within the tumor. The number of clusters was selected with statistical validation, referenced in the paper through the Calinski-Harabasz criterion, which rewards partitions that are tight within clusters and well separated from one another. The result is a digital map of the tumor’s internal architecture rather than a single averaged measurement of the whole lesion.

The innovation did not stop at the tumor’s edge. The researchers also deliberately extended their analysis outward into the tissue surrounding the lesion, dilating the tumor regions by thicknesses of 3 millimeters and 6 millimeters to create peri-tumoral shells. This choice reflects a growing recognition in imaging science that malignant processes remodel their surroundings, altering the density and texture of adjacent bone and soft tissue in ways that benign lesions typically do not. By comparing models built on the narrower 3-millimeter band with those built on the wider 6-millimeter band, the team could test empirically how much diagnostic signal resides just beyond the visible tumor margin. Their findings favored the tighter band: a Multi-Layer Perceptron, a type of neural network, based on the 3-millimeter peri-tumoral region exhibited enhanced performance relative to the one using the 6-millimeter region.

The feature extraction pipeline drew on the established vocabulary of radiomics, quantifying first-order statistics of voxel intensities, textural patterns that describe how densities are spatially arranged, and finer structural descriptors. To keep the models honest and generalizable, the researchers used Least Absolute Shrinkage and Selection Operator, or LASSO, regularization, a technique that penalizes model complexity and drives the coefficients of uninformative features toward zero, leaving a compact set of genuinely predictive measurements. Multiple machine learning architectures were compared, including logistic regression, random forests, support vector machines, and the Multi-Layer Perceptron, with reproducibility of feature measurements checked through correlation coefficients before modeling began.

The headline result concerned the habitats model. A Multi-Layer Perceptron trained on the three-habitat partition of the tumor achieved an area under the receiver operating characteristic curve, or AUC, of 0.877 in the test cohort, outperforming a model based on the conventional whole-tumor region of interest. An AUC of that magnitude indicates that the model ranks a randomly chosen malignant tumor as more suspicious than a randomly chosen benign one nearly nine times out of ten. That the habitat-based approach beat the standard whole-lesion analysis is the study’s central conceptual message: the spatial arrangement of a tumor’s internal sub-regions carries diagnostic information that averaging across the entire lesion destroys.

But the researchers went one step further, assembling what they call an ensemble nomogram. This fusion model integrated three streams of information: the patient’s age, a clinical indicator with recognized relevance to sacral tumor biology; the peri-tumoral radiomic features from the 3-millimeter shell; and the habitat-derived signatures from within the tumor. The ensemble achieved the study’s best performance, an AUC of 0.892 in the test sets, and it did so by a statistically meaningful margin, significantly outperforming a model built on clinical data alone, which managed only an AUC of 0.619 with a P value of 0.02. For context, a clinical-only model at 0.619 is only modestly better than a coin flip, while the fused model approaches the performance threshold at which a test becomes genuinely actionable in the clinic.

Accuracy alone, however, is not enough for a predictive model to earn clinical trust, and the authors addressed this with two complementary assessments. Calibration curves, evaluated with Hosmer-Lemeshow statistics and mean standard error, demonstrated good concordance between what the nomogram predicted and what pathologists actually observed, meaning that when the model says a tumor has a seventy percent chance of being malignant, roughly seventy percent of such tumors truly are malignant. Decision curve analysis, meanwhile, revealed a high overall net benefit across a clinically relevant range of threshold probabilities, indicating that patients and physicians acting on the nomogram’s predictions would, on balance, make better decisions than they would under default strategies of treating everyone or treating no one.

The practical implications reach well beyond the radiology reading room. A reliable pre-operative classification can influence whether a surgeon pursues wide en bloc resection, a morbid but potentially curative procedure for malignancies, or a more conservative intralesional approach appropriate for benign lesions, as well as informing the decision to obtain a biopsy beforehand. Because the method relies on non-contrast CT, it avoids the cost, contrast exposure, and contraindications associated with enhanced imaging, making it deployable in settings where advanced modalities are scarce. The authors conclude that NCCT-based habitat and peri-tumoral radiomics markedly improve preoperative prediction of benign and malignant sacral tumors, with habitat signatures offering precise predictions capable of guiding personalized treatment. As with any retrospective single-center study of 112 patients, external validation across larger and more diverse cohorts will be the necessary next step, but the work demonstrates that a routine CT scan, read through the eyes of a machine, can surface biological distinctions that clinicians have spent decades trying to see.

Subject of Research: Pre-operative classification of benign and malignant sacral tumors using habitat and peri-tumoral radiomics from non-contrast CT

Article Title: NCCT-based habitats and peri-tumoral radiomics enhance pre-operative prediction of benign and malignant sacral tumors

Article References: Zheng, F., Zhang, W., Liang, K., Liu, T., Yin, P., & Hong, N. (2026). NCCT-based habitats and peri-tumoral radiomics enhance pre-operative prediction of benign and malignant sacral tumors. BMC Medical Imaging. https://doi.org/10.1186/s12880-026-02806-1

Image Credits: AI Generated

DOI: 10.1186/s12880-026-02806-1

Keywords: sacral tumor, radiomics, habitat imaging, non-contrast CT, machine learning, Multi-Layer Perceptron, K-means clustering, peri-tumoral micro-environment, nomogram, tumor heterogeneity, AUC, BMC Medical Imaging

The motivation is straightforward. Hydrologists building machine learning models for precipitation prediction face a cascade of choices before a single forecast is produced. Should suspicious values in the raw record be flagged with classical statistical tests or with modern density-based algorithms? How should gaps in the data be filled? Which learning algorithm deserves the effort of hyperparameter tuning? And does adding another decade of historical data genuinely help? Most studies compare these ingredients one or two at a time within a single catchment, leaving open the possibility that conclusions drawn in one climate simply do not transfer to another. The new research tackles this gap head-on by running a full factorial experiment across five Iranian basins that span markedly different precipitation regimes.

The data underpinning the study come from ERA5, the European Centre for Medium-Range Weather Forecasts’ flagship global reanalysis product, which provides gridded monthly precipitation estimates from 1990 through 2023. Reanalysis products like ERA5 blend observations with numerical weather model output, offering a consistent long-term record even in regions with sparse ground instrumentation. The researchers deliberately framed the forecasting task in a simple, reproducible way: one-step-ahead prediction of monthly precipitation using the three preceding monthly values and the month number as predictors. This minimalist setup ensures that differences in performance can be attributed to the modeling components under investigation rather than to an elaborate feature-engineering pipeline.

The experimental design is where the study earns its statistical teeth. Eight different outlier-detection methods were applied to each basin’s precipitation series, ranging from classical procedures such as Grubbs’ test and Tukey’s fences to robust approaches like the Hampel filter and density-based techniques including the Local Outlier Factor and Isolation Forest. Six imputation methods were then used to fill any missing values. On top of each resulting dataset, the team trained four machine learning models representing distinct families of algorithms: Random Forest, an ensemble of decision trees; XGBoost, a gradient-boosting system known for its efficiency and accuracy on tabular data; Gaussian Process Regression, a Bayesian non-parametric method; and the Multi-Layer Perceptron, a classic feedforward neural network. Each model was trained on three different record lengths — 12, 22, and 32 years of monthly data — producing a large grid of modeling configurations for every basin.

Crucially, the evaluation protocol respected the temporal structure of the data. The final three years of each series were held out as an independent test period, untouched during model development. Hyperparameter optimization was performed exclusively within the training data using TimeSeriesSplit, a cross-validation scheme that preserves chronology, and the tuning was carried out separately for two objective functions: one maximizing the Nash–Sutcliffe Efficiency (NSE) and one maximizing the Kling–Gupta Efficiency (KGE). These two metrics capture different aspects of forecast quality — NSE emphasizes the match of variances around the observed mean, while KGE decomposes performance into correlation, bias, and variability — so optimizing for each separately guards against conclusions that hinge on the choice of score.

The headline result is a striking dependence of component importance on climate. In the humid Haraz basin, the choice of machine learning model was overwhelmingly the dominant factor, accounting for 82.0 percent of the variance in NSE and 59.9 percent of the variance in KGE. In other words, in a wet basin where precipitation is abundant and relatively well-behaved statistically, picking the right algorithm matters far more than any preprocessing decision. As mean precipitation decreases, however, the picture inverts. In the drier basins, outlier-removal methods rose to prominence, contributing up to 31.5 percent of the NSE variance and as much as 54.5 percent of the KGE variance — meaning that in arid settings, how you clean the data can matter as much as or more than which model you choose.

This pattern has a plausible physical explanation. In dry regions, monthly precipitation is low, episodic, and heavily skewed, so a handful of extreme or anomalous values exert an outsized influence on the training signal. An outlier-detection method that aggressively removes or downweights such points can reshape the entire learning problem, whereas in a humid basin the signal is strong enough that individual anomalies barely register against the background of frequent, substantial rainfall. The finding suggests that data-cleaning pipelines should be treated as climate-sensitive design choices rather than one-size-fits-all preprocessing steps.

Two other results will surprise practitioners. First, the choice of imputation method — how missing values are filled — generally made a negligible contribution to performance variance across the basins. The lone exception was the Aras basin under the KGE metric, where imputation accounted for 16.2 percent of the variance, a reminder that even broadly negligible factors can matter in specific climatic and metric contexts. Second, and perhaps most counterintuitively, the length of the training record showed no consistent direct relationship with improved predictive performance. Adding ten or twenty extra years of data did not reliably produce better forecasts, challenging the common assumption that more history is always better in hydrological machine learning.

The methodological lesson is that factorial ANOVA offers a powerful, underused lens for machine learning research in the geosciences. By treating each modeling decision as a factor in a designed experiment and quantifying the share of performance variance each factor explains, researchers can move beyond leaderboard-style comparisons of individual algorithms and toward a principled understanding of where modeling effort is best spent. The approach also naturally exposes interactions between components — for instance, whether the benefit of a particular outlier filter depends on which algorithm is downstream of it — which pairwise comparisons tend to obscure.

For water managers and forecasters, the practical takeaway is that there is no universally optimal recipe for precipitation prediction. A workflow tuned in a temperate, humid catchment may misallocate effort entirely if transplanted to an arid one, where data cleaning deserves the lion’s share of attention. The authors argue for basin-specific, climate-aware modeling strategies: diagnose the precipitation regime first, then decide whether algorithm selection or data preprocessing is the higher-leverage investment. As machine learning spreads deeper into hydrology and water resources management, studies like this one suggest that the most valuable question is not which model is best, but which decision, in this place and this climate, actually moves the needle.

Subject of Research: Relative importance of machine learning modeling components for precipitation prediction across contrasting climatic basins

Article Title: Assessing the relative importance of machine learning modeling components for precipitation prediction using ANOVA

Article References: Dalir Gabrabad, A., Hosseinpour, M., & Ashrafzadeh, A. (2026). Assessing the relative importance of machine learning modeling components for precipitation prediction using ANOVA. Earth Science Informatics, 19(11), Article 204. https://doi.org/10.1007/s12145-026-02260-1

Image Credits: AI Generated

DOI: 10.1007/s12145-026-02260-1

Keywords: machine learning, precipitation forecasting, ANOVA, outlier detection, missing data imputation, Random Forest, XGBoost, Gaussian Process Regression, Multi-Layer Perceptron, ERA5 reanalysis, Nash-Sutcliffe Efficiency, Kling-Gupta Efficiency

The core problem the researchers set out to solve is one that plagues nearly every machine learning system deployed in cybersecurity: data imbalance. In real network traffic, malicious flows represent a vanishingly small fraction of the total. An intrusion detection system trained on such skewed data tends to learn the easy lesson, that almost everything is benign, and quietly ignores the rare but dangerous exceptions. Advanced persistent threats make this worse because they are deliberately designed to mimic legitimate behavior, spreading their activity across long time horizons and low-and-slow communication patterns that leave few obvious traces in any single packet or session.

The ADLM-TiM architecture attacks the problem in two stages. The first stage, the Advanced Deep Learning Module or ADLM, is responsible for feature extraction and the identification of abnormal behaviors within network traffic flows. It integrates two components: an improved Multi-Layer Perceptron, abbreviated iMLP, and an enhanced Long Short-Term Memory network, or iLSTM. The multi-layer perceptron excels at capturing nonlinear relationships among the numerical features that describe a traffic flow, such as packet counts, byte volumes, durations, and inter-arrival times. The LSTM, a recurrent architecture originally designed to remember long-range dependencies in sequential data, tracks how those features evolve over time, which is precisely the kind of temporal footprint that a patient attacker leaves behind.

The enhancements to these standard components matter. The authors draw on modern activation function research, including self-gated functions such as Swish and Gaussian Error Linear Units, which have been shown in recent years to outperform the classical rectified linear unit in deep networks. They also build on the extended LSTM line of work that has emerged from recent research into xLSTM architectures, which refine the gating and memory mechanisms of Hochreiter and Schmidhuber’s original 1997 design. The result is a feature extractor that is more sensitive to subtle anomalies in imbalanced data, where the difference between an APT beacon and routine background chatter may amount to a handful of statistical deviations spread across many time steps.

The second stage, the TiM module, handles information aggregation and final classification. A Transformer, the attention-based architecture that underpins modern large language models, is employed to aggregate the local behavioral information extracted by the ADLM. Attention mechanisms allow the model to weigh the relative importance of different behavioral signals, effectively deciding which fragments of evidence across a traffic sequence are most indicative of an orchestrated campaign rather than random noise. This is a natural fit for APT detection because these attacks unfold as chains of related events, and connecting those events is exactly what attention layers do well. Once the behavioral profile has been aggregated, an iMLP layer performs the final binary decision, labeling the sample as either APT or benign.

The experimental evaluation was deliberately broad. The model was assessed across multiple scenarios and datasets, including variants derived from the Malware Capture Facility Project’s traffic captures, the CIC Botnet dataset, the CSE-CIC ToN IoT dataset, and an updated version of the CICIDS2018 intrusion detection corpus. The authors report results averaged over different random seeds, a practice that guards against the possibility that a single favorable training run inflates the apparent performance. Confusion matrices, ROC curves with AUC scores, and training and validation loss curves are all documented, giving a fuller picture of how the model behaves during learning and where it makes its remaining errors.

The headline result is that ADLM-TiM outperforms most existing methods, with improvements ranging from two to seven percent across all evaluation metrics and datasets. In a field where incremental gains of half a percent can justify publication, a consistent multi-point improvement across four datasets is notable. The authors also conducted ablation studies, systematically removing components of the model to measure each one’s contribution. These tests, reported for the IDS2018-v2, BoT-v2, and ToN-v2 datasets, confirm that both the enhanced deep learning module and the Transformer aggregation stage contribute meaningfully, and that the combination is more than the sum of its parts.

The work does not appear in a vacuum. The research group, based at the Posts and Telecommunications Institute of Technology, Hanoi University, and the Hanoi University of Industry, has a track record in this area, including earlier ensemble learning approaches to APT detection, feature extraction and representation learning methods published in PLoS ONE, and an advanced computing approach described in Scientific Reports. The broader literature they engage with spans graph neural network intrusion detectors such as E-GraphSAGE and Anomal-E, CNN-BiLSTM models enhanced with attention mechanisms, knowledge graph approaches to malware attribution, and generative techniques such as conditional GANs and SMOTE-based oversampling aimed squarely at the data imbalance problem. ADLM-TiM distinguishes itself by addressing imbalance and aggregation within a single end-to-end architecture rather than treating them as separate preprocessing and modeling tasks.

The choice of a Transformer for aggregation also reflects a wider trend. Since Vaswani and colleagues introduced attention in 2017, the architecture has migrated from natural language processing into time series analysis, anomaly detection, and security. The authors position their work alongside recent sequence modeling innovations, from BERT-style pretraining to linear-time alternatives such as Mamba and RWKV, suggesting that the design was informed by a careful reading of how sequence models have evolved. For defenders, the practical implication is that models can now be built that reason over entire behavioral histories rather than isolated snapshots, which is essential when the adversary’s strategy is precisely to keep any single snapshot unremarkable.

Caveats remain, as they always do in this field. The paper notes that no new datasets were generated or analyzed during the study, meaning the model was validated on existing public benchmarks rather than live production traffic, where distribution shift, encrypted flows, and adversarial evasion present additional hurdles. The authors themselves frame the contribution as addressing the twin challenges of data imbalance and effective information aggregation, not as a complete solution to the APT problem. Still, the consistent performance gains, the rigorous multi-seed evaluation, and the ablation evidence make a credible case that combining enhanced recurrent and feed-forward feature extraction with Transformer-based aggregation is a promising direction. As persistent threats grow more patient and more camouflaged, architectures that can stitch faint signals into coherent behavioral profiles may become an essential layer of network defense.

Subject of Research: Deep learning detection of advanced persistent threat cyberattacks in imbalanced network traffic

Article Title: A novel approach to detecting advanced persistent threats in imbalanced network traffic

Article References: Do Xuan, C., Bao, T. H., Cong, N. M., & Duc, V. T. (2026). A novel approach to detecting advanced persistent threats in imbalanced network traffic. Cluster Computing, 29(14), Article 813. https://doi.org/10.1007/s10586-026-06535-6

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06535-6

Keywords: advanced persistent threats, APT detection, network traffic, data imbalance, deep learning, Transformer, LSTM, multi-layer perceptron, intrusion detection, cybersecurity, attention mechanism, machine learning