AEGIS: Adversarial Entropy-Guided Immune System -- Thermodynamic State Space Models for Zero-Day Network Evasion Detection

• URL: http://arxiv.org/abs/2604.02149v1
• Date: Thu, 02 Apr 2026 15:16:56 GMT
• Title: AEGIS: Adversarial Entropy-Guided Immune System -- Thermodynamic State Space Models for Zero-Day Network Evasion Detection
• Abstract summary: AEGIS is an Adversarial Entropy-Guided Immune System powered by a Thermodynamic Variance-Guided Hyperbolic Liquid State Space Model.<n>A pure C++ eBPF Harvester with zero-copy IPC bypasses the Python GIL, enabling a linear-time O(N) Mamba-3 core to process 64,000-packet swarms at line-rate.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: As TLS 1.3 encryption limits traditional Deep Packet Inspection (DPI), the security community has pivoted to Euclidean Transformer-based classifiers (e.g., ET-BERT) for encrypted traffic analysis. However, these models remain vulnerable to byte-level adversarial morphing -- recent pre-padding attacks reduced ET-BERT accuracy to 25.68%, while VLESS Reality bypasses certificate-based detection entirely. We introduce AEGIS: an Adversarial Entropy-Guided Immune System powered by a Thermodynamic Variance-Guided Hyperbolic Liquid State Space Model (TVD-HL-SSM). Rather than competing in the Euclidean payload-reading domain, AEGIS discards payload bytes in favor of 6-dimensional continuous-time flow physics projected into a non-Euclidean Poincare manifold. Liquid Time-Constants measure microsecond IAT decay, and a Thermodynamic Variance Detector computes sequence-wide Shannon Entropy to expose automated C2 tunnel anomalies. A pure C++ eBPF Harvester with zero-copy IPC bypasses the Python GIL, enabling a linear-time O(N) Mamba-3 core to process 64,000-packet swarms at line-rate. Evaluated on a 400GB, 4-tier adversarial corpus spanning backbone traffic, IoT botnets, zero-days, and proprietary VLESS Reality tunnels, AEGIS achieves an F1-score of 0.9952 and 99.50% True Positive Rate at 262 us inference latency on an RTX 4090, establishing a new state-of-the-art for physics-based adversarial network defense.

Related papers

• Quantum-Enhanced Learning Framework for Intelligent and AI-Native 6G Wireless Networks [28.680231795970837]
  We introduce Quantumer, a hybrid TinyML--quantum framework that integrates multi-scale dilated convolutions and scaled dot-product attention.<n>We also present QuantiblentLayer, a four-qubit variational circuit that maps compact traffic representations into Hilbert-space features.<n>By transferring these quantum-assisted embeddings into an energy-efficient, lightweight transformer, Quantumer achieves strong detection performance with minimal compute and memory overhead.
  arXiv  Detail & Related papers  (2026-09-06T20:13:42Z)
• When Time Meets Space: Entropy Integration and Dynamic Threshold for Adaptive DDoS Detection in SDN [24.48377951509124]
  This paper proposes a lightweight temporal entropy-based detector for DDoS attacks.<n>It requires 3.95 ms of core processing per window and 11.65% system-wide CPU deployment.
  arXiv  Detail & Related papers  (2026-08-16T09:17:05Z)
• Machine Learning-Based Reconstruction for Resistive Silicon Sensors [53.365453214937496]
  We study machine-learning-based reconstruction and compression for resistive silicon sensors.<n>We use full-waveform information from correlated pads to regularise the reconstruction and extract spatial information.<n>We first introduce recurrent neural network models based on LSTM layers, which provide a proof-of-concept implementation for full-waveform reconstruction.
  arXiv  Detail & Related papers  (2026-07-13T14:03:26Z)
• AI-Native Closed-Loop Security for 6G-Enabled Cyber-Physical Systems: From Edge Detection to Network-Wide Mitigation [13.344675738769395]
  Cyber-physical systems will run over ultra-reliable low-latency slices in 6G networks.<n>This survey reframes 6G CPS security as a closed-loop, AI-native pipeline.<n>We formalise a per-slice, tail-bounded latency contract on the sense, detect, mitigate stages.
  arXiv  Detail & Related papers  (2026-06-06T13:36:59Z)
• Scaling Parallel Sequence Models to Foundation-Scale Vision Encoders [123.58723804218151]
  Vision foundation models are bottlenecked by the quadratic cost of self-attention.<n>We present C-GSPN based on 2D spatial propagation propagation.
  arXiv  Detail & Related papers  (2026-05-30T14:29:43Z)
• GenAI for Energy-Efficient and Interference-Aware Compressed Sensing of GNSS Signals on a Google Edge TPU [37.74014735747033]
  This paper introduces a novel method for compressing and classifying jamming threats using generative artificial intelligence (GenAI)<n>Our proposed approach efficiently compresses data streams directly at the hardware receiver while simultaneously classifying jamming and spoofing attacks in real time.<n>The hardware-centric GenAI approach also substantially reduces jammer signal transmission costs, offering a practical solution for interference mitigation.
  arXiv  Detail & Related papers  (2026-05-14T13:43:55Z)
• Characterizing AI-Assisted Bot Traffic in Darknet Data: Implications for ICS and IIoT Security [0.0]
  The rise of automated scanning tools and AI assisted reconnaissance agents has significantly altered internet background traffic patterns.<n>This paper characterizes the evolution of automated bot traffic by analyzing a longitudinal dataset of 192 million passive darknet packets captured across 2021 and 2025 from the Merit ORION Network Telescope.
  arXiv  Detail & Related papers  (2026-05-14T00:07:20Z)
• Neuromorphic Continual Learning for Sequential Deployment of Nuclear Plant Monitoring Systems [1.2744523252873352]
  We present the first spiking neural network (SNN)-based anomaly detection system with continual learning for nuclear ICS.<n>We evaluate five continual learning strategies, including sequential fine-tuning, Elastic Weight Consolidation (EWC), Synaptic Intelligence (SI), experience replay, and a hybrid EWC+Replay approach.<n>The hybrid EWC+Replay method achieves an average F1 score of 0.979 with near-zero average forgetting.
  arXiv  Detail & Related papers  (2026-04-13T21:25:22Z)
• PARD-SSM: Probabilistic Cyber-Attack Regime Detection via Variational Switching State-Space Models [0.0]
  We present PARD-SSM, a probabilistic framework that models network telemetry as a Linear Dynamical System with K = 4 hidden regimes.<n>A structured variational approximation reduces inference complexity from exponential to O(TK2), enabling real-time detection on standard CPU hardware.<n>The model also produces predictive alerts approximately 8 minutes before attack onset, a capability absent in prior systems.
  arXiv  Detail & Related papers  (2026-04-02T17:38:52Z)
• Information-Theoretic Digital Twins for Stealthy Attack Detection in Industrial Control Systems: A Closed-Form KL Divergence Approach [0.0]
  Digital twins (DTs) are increasingly used to monitor and secure Industrial Control Systems (ICS)<n>But detecting stealthy False Data Injection Attacks (FDIAs) that manipulate system states within normal physical bounds remains challenging.<n>We propose a closed-loop Information-Theoretic Digital Twin (IT-DT) framework for real-time anomaly detection.
  arXiv  Detail & Related papers  (2026-03-02T08:56:11Z)
• A Lightweight Defense Mechanism against Next Generation of Phishing Emails using Distilled Attention-Augmented BiLSTM [34.0814379994364]
  The MobileBERT teacher receives fine-tuning before its transformation into a BiLSTM model with multi-head attention.<n>The system demonstrates excellent performance in terms of accuracy and latency while maintaining a compact size.<n>The paper examines system performance under high traffic conditions and security measures for privacy protection and implementation methods for operational deployment.
  arXiv  Detail & Related papers  (2026-02-24T20:06:45Z)
• Accurate Network Traffic Matrix Prediction via LEAD: a Large Language Model-Enhanced Adapter-Based Conditional Diffusion Model [41.23125529149133]
  We present LEAD, a conditional Diffusion model that transforms traffic matrices into RGB images.<n>We also propose a Dual-Conditioning Strategy to guide a diffusion model to generate complex, dynamic network traffic.<n>Experiments on the Abilene and GEANT datasets demonstrate that LEAD outperforms all baselines.
  arXiv  Detail & Related papers  (2026-01-29T09:16:05Z)
• LiQSS: Post-Transformer Linear Quantum-Inspired State-Space Tensor Networks for Real-Time 6G [85.58816960936069]
  Proactive and agentic control in Sixth-Generation (6G) Open Radio Access Networks (O-RAN) requires control-grade prediction under stringent Near-Time (Near-RT) latency and computational constraints.<n>This paper investigates a post-Transformer paradigm for efficient radio telemetry forecasting.<n>We propose a quantum-inspired state-space tensor network that replaces self-attention with stable structured state-space dynamics kernels.
  arXiv  Detail & Related papers  (2026-01-18T12:08:38Z)
• Hybrid Deep Learning-Federated Learning Powered Intrusion Detection System for IoT/5G Advanced Edge Computing Network [0.0]
  IoT and 5G-Advanced applications have enlarged the attack surface for DDoS, malware, and zero-day intrusions.<n>We propose an intrusion detection system that fuses a convolutional neural network (CNN), a bidirectional LSTM (BiLSTM), and an autoencoder (AE) bottleneck.
  arXiv  Detail & Related papers  (2025-09-19T03:23:51Z)
• Attention Meets UAVs: A Comprehensive Evaluation of DDoS Detection in Low-Cost UAVs [1.6820106165213193]
  This paper explores the critical issue of enhancing cybersecurity measures for low-cost, Wi-Fi-based Unmanned Aerial Vehicles (UAVs) against Distributed Denial of Service (DDoS) attacks. We have developed a detection mechanism that runs on the companion computer of the UAV system. In this work, we present the necessary steps required to build an on-board DDoS detection mechanism.
  arXiv  Detail & Related papers  (2024-06-28T12:44:01Z)
• Lazy Layers to Make Fine-Tuned Diffusion Models More Traceable [70.77600345240867]
  A novel arbitrary-in-arbitrary-out (AIAO) strategy makes watermarks resilient to fine-tuning-based removal. Unlike the existing methods of designing a backdoor for the input/output space of diffusion models, in our method, we propose to embed the backdoor into the feature space of sampled subpaths. Our empirical studies on the MS-COCO, AFHQ, LSUN, CUB-200, and DreamBooth datasets confirm the robustness of AIAO.
  arXiv  Detail & Related papers  (2024-05-01T12:03:39Z)
• A reconfigurable neural network ASIC for detector front-end data compression at the HL-LHC [0.40690419770123604]
  A neural network autoencoder model can be implemented in a radiation tolerant ASIC to perform lossy data compression. This is the first radiation tolerant on-detector ASIC implementation of a neural network that has been designed for particle physics applications.
  arXiv  Detail & Related papers  (2021-05-04T18:06:23Z)
• Defending Water Treatment Networks: Exploiting Spatio-temporal Effects for Cyber Attack Detection [46.67179436529369]
  Water Treatment Networks (WTNs) are critical infrastructures for local communities and public health, WTNs are vulnerable to cyber attacks. We propose a structured anomaly detection framework to defend WTNs by modeling thetemporal characteristics of cyber attacks in WTNs.
  arXiv  Detail & Related papers  (2020-08-26T15:56:55Z)
• Near-chip Dynamic Vision Filtering for Low-Bandwidth Pedestrian Detection [99.94079901071163]
  This paper presents a novel end-to-end system for pedestrian detection using Dynamic Vision Sensors (DVSs) We target applications where multiple sensors transmit data to a local processing unit, which executes a detection algorithm. Our detector is able to perform a detection every 450 ms, with an overall testing F1 score of 83%.
  arXiv  Detail & Related papers  (2020-04-03T17:36:26Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.