Cyber Dynamics I: Finite Macrostates for Behavioral Anomaly Detection in Network Telemetry

2026-07-08

AI Summary

This work addresses a key limitation of traditional entropy-based network anomaly detection methods, which reduce entropy to a single scalar and thus struggle to distinguish benign traffic shifts from malicious activity. The authors propose a finite-dimensional macrostate framework that coarsely models network telemetry through persistent entities, typed relationships, and temporal states, capturing multiple behavioral dimensions—including activity level, distributional disorder, structural organization, temporal volatility, persistence, and deviation from a benign baseline. For the first time, Shannon, Rényi, and Tsallis entropies are integrated into a multidimensional behavioral state space. By modeling transitions between macrostates across sliding windows, the approach effectively identifies adversarial reconfigurations rather than benign drifts. Experiments on standard datasets demonstrate that the method significantly outperforms conventional entropy-based techniques and typical anomaly detectors, achieving higher detection accuracy while enhancing interpretability.

Abstract

Entropy-based methods have long been used for network anomaly detection, but most existing approaches treat entropy as a scalar statistic on narrow observables rather than as part of a broader behavioral state-space for cyber systems. We propose a finite-dimensional macrostate framework for network telemetry, instantiated over the Canonical Security Telemetry Substrate (CSTS), so that coarse-graining is performed over persistent entities, typed relations, and temporal state rather than isolated event records. The resulting macrostate captures activity, distributional disorder, structural organization, temporal volatility, persistence, and deviation from benign baselines. Rather than scoring only unusual states, we model window-to-window macrostate transitions and define regime structure, stability, and anomalous change. This supports discrimination between benign workload drift and adversarial reorganization. We evaluate the framework on benchmark network telemetry datasets and compare it against Shannon-, Rényi-, and Tsallis-style entropy baselines, as well as standard anomaly detectors. The proposed representation improves anomaly discrimination and supports more interpretable behavioral analysis of cyber telemetry.

Problem

• anomaly detection
• network telemetry
• entropy
• behavioral state-space
• macrostate

Innovation

• macrostate
• behavioral anomaly detection
• network telemetry
• entropy-based methods
• regime transition