Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces a finite-dimensional macrostate framework for behavioral anomaly detection in network telemetry, moving beyond traditional entropy-based methods that treat entropy as a scalar statistic. By modeling macrostate transitions over persistent entities and temporal states, the framework enhances the ability to distinguish between benign workload drift and adversarial reorganization. Evaluation against established entropy baselines and standard anomaly detectors demonstrates significant improvements in anomaly discrimination and interpretability of cyber telemetry data.
A novel macrostate framework transforms how we detect and interpret anomalies in network telemetry, revealing hidden patterns that traditional methods miss.
Entropy-based methods have long been used for network anomaly detection, but most existing approaches treat entropy as a scalar statistic on narrow observables rather than as part of a broader behavioral state-space for cyber systems. We propose a finite-dimensional macrostate framework for network telemetry, instantiated over the Canonical Security Telemetry Substrate (CSTS), so that coarse-graining is performed over persistent entities, typed relations, and temporal state rather than isolated event records. The resulting macrostate captures activity, distributional disorder, structural organization, temporal volatility, persistence, and deviation from benign baselines. Rather than scoring only unusual states, we model window-to-window macrostate transitions and define regime structure, stability, and anomalous change. This supports discrimination between benign workload drift and adversarial reorganization. We evaluate the framework on benchmark network telemetry datasets and compare it against Shannon-, R\'enyi-, and Tsallis-style entropy baselines, as well as standard anomaly detectors. The proposed representation improves anomaly discrimination and supports more interpretable behavioral analysis of cyber telemetry.