CALIBURN: A Regime-Sensitivity Study of Operationally Calibrated Streaming Intrusion Detection

• URL: http://arxiv.org/abs/2605.24696v1
• Date: Sat, 23 May 2026 18:18:38 GMT
• Title: CALIBURN: A Regime-Sensitivity Study of Operationally Calibrated Streaming Intrusion Detection
• Abstract summary: Streaming network intrusion detection systems must process flows continuously while keeping memory bounded.<n>Most current methods leave alerting threshold selection as a post-hoc tuning problem poorly suited to production.<n>This paper presents CALIBURN, a five-component streaming alerting pipeline composed of a truncated Bayesian online change-point detector.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Streaming network intrusion detection systems must process flows continuously while keeping memory bounded, but most current methods leave alerting threshold selection as a post-hoc tuning problem poorly suited to production. Operators need alerting behaviour specifiable before deployment using inputs such as false-negative cost, false-positive cost, and alerting budget. This paper presents CALIBURN, a five-component streaming alerting pipeline composed of a truncated Bayesian online change-point detector, an isotonic calibration layer mapping the change-point posterior to an empirical conditional attack probability, a cost-sensitive decision threshold derived from operator-specified misclassification costs, a Conformal Risk Control wrapper that converts an alert-budget specification into a within-window valid threshold under exchangeability, and a multi-window burn-rate alerting layer adapted from Site Reliability Engineering practice. Rather than claiming uniform dominance, we present CALIBURN as a regime-sensitivity study, evaluating the pipeline across three attack-prevalence regimes: LITNET-2020 at 5.2 percent, CICIDS2017 at 22.06 percent, and UNSW-NB15 at 64 percent. In the rare-attack regime, CALIBURN achieves AUC-PR 0.943 on LITNET-2020, outperforming the best streaming baseline by 2.21x and the best batch reference by 4.12x; isotonic calibration reduces Brier score by 30 percent. In the moderate-prevalence regime, CALIBURN remains the strongest streaming method on CICIDS2017 but is exceeded by batch density methods. In the high-prevalence regime, all streaming methods approach the prevalence floor. We further identify two distinct CRC-collapse mechanisms driving the alert rule to degeneracy at small alpha, treating both as operational guidance for practitioners.

Related papers

• A Bayesian Correlated Equilibrium for Early Insider-Threat Detection [11.643788980306235]
  We model insider threat detection as a dynamic Bayesian game in which a platform coordinates a committee of strategic certifiers to sustain equilibrium among honest users.<n>On CERT r6.2 our mechanism achieves up to 28.3% pre-exfiltration detection with false positives below 1.6%, while both a transformer baseline and a streaming provenance approximation achieve near-zero pre-exfiltration detection.
  arXiv  Detail & Related papers  (2026-09-02T19:12:56Z)
• Drift-Aware RL-based Wavelet Denoising for Network-Traffic Anomaly Detection [1.5469452301122173]
  Traffic-utilisation measurements for network monitoring are corrupted by additive noise and statistical drift.<n>We propose a drift-aware framework treating adaptive wavelet denoising as a preprocessing layer optimised for two tasks.
  arXiv  Detail & Related papers  (2026-07-22T10:52:05Z)
• Stop Early, Spend Less: Hidden-State Probes as a Practical Recipe for Streaming Moderation of LLM Outputs [0.0]
  Existing approaches rely on a separate moderation model applied after generation.<n>We observe that the signal needed for moderation is already present in the model hidden states.<n>We train lightweight token-level probes that operate directly on internal activations.
  arXiv  Detail & Related papers  (2026-06-09T07:01:43Z)
• Send a SCOUT First: Pre-hoc Reasoning for Adaptive Detector Allocation in Prompt-Injection Defense [37.10272384523361]
  We develop a framework for predicting each detector's per-sample reliability and latency from how it behaved on similar past inputs.<n>We build SCOUT-450, a benchmark that captures the structurally complex, agent-facing injections that older prompt-injection sets under-represent.<n>On SCOUT-450, a safety-oriented operating point reduces attack-success rate by 46% and total wall-clock by 40% relative to an always-on GPT-4o judge.
  arXiv  Detail & Related papers  (2026-05-29T04:49:20Z)
• Diffusion Controller: Framework, Algorithms and Parameterization [54.82539154511621]
  We present a unified control-theoretic view that casts reverse diffusion sampling as state-only control within (generalized) linearly-solvable Markov Decision Processes.<n>Under this framework, control acts by reweighting the pretrained reverse-time transition kernels, balancing terminal objectives against an $f$-divergence cost.<n>Experiments on Stable Diffusion v1.4 show consistent gains in preference-alignment win rates and improved quality-efficiency trade-offs.
  arXiv  Detail & Related papers  (2026-03-07T01:49:59Z)
• Adaptive t Design Dummy-Gate Obfuscation for Cryogenic Scale Enforcement [0.0]
  Cloud quantum services can reveal circuit structure and timing through scheduler metadata, latency patterns, and co-tenant interference.<n>We introduce NADGO, a scheduling and obfuscation stack that enforces operational privacy for gate-model workloads.<n>We prototype the approach on a 4-qubit superconducting tile with cryo-CMOS control and evaluate both depth-varied local-random circuits and small QAOA instances.
  arXiv  Detail & Related papers  (2025-08-31T12:12:48Z)
• Efficient Test-time Adaptive Object Detection via Sensitivity-Guided Pruning [73.40364018029673]
  Continual test-time adaptive object detection (CTTA-OD) aims to online adapt a source pre-trained detector to ever-changing environments.<n>Our motivation stems from the observation that not all learned source features are beneficial.<n>Our method achieves superior adaptation performance while reducing computational overhead by 12% in FLOPs.
  arXiv  Detail & Related papers  (2025-06-03T05:27:56Z)
• GAQAT: gradient-adaptive quantization-aware training for domain generalization [54.31450550793485]
  We propose a novel Gradient-Adaptive Quantization-Aware Training (GAQAT) framework for DG.<n>Our approach begins by identifying the scale-gradient conflict problem in low-precision quantization.<n>Extensive experiments validate the effectiveness of the proposed GAQAT framework.
  arXiv  Detail & Related papers  (2024-12-07T06:07:21Z)
• Integrated high-performance error correction for continuous-variable quantum key distribution [23.485505158582775]
  An integrated error-correction scheme with high throughput, low frame errors rate (FER) and high reconciliation efficiency under low signal to noise ratio (SNR) is proposed. A novel two-stage error correction method with limited precision is proposed, and experimentally verified on a commercial FPGA. Compared with state-of-art results, the error-correction throughput can be improved more than one order of magnitude given FER0.1. The record-breaking results paves the way for large-scale deployment of high-rate integrated CV-QKD systems in metropolitan quantum secure network.
  arXiv  Detail & Related papers  (2024-07-23T12:30:46Z)
• Acquiring Better Load Estimates by Combining Anomaly and Change Point Detection in Power Grid Time-series Measurements [0.49478969093606673]
  Our approach prioritizes interpretability while ensuring robust and generalizable performance on unseen data. Results indicate the clear wasted potential when filtering is not applied. Our methodology's interpretability makes it particularly suitable for critical infrastructure planning.
  arXiv  Detail & Related papers  (2024-05-25T10:15:51Z)
• Lazy Layers to Make Fine-Tuned Diffusion Models More Traceable [70.77600345240867]
  A novel arbitrary-in-arbitrary-out (AIAO) strategy makes watermarks resilient to fine-tuning-based removal. Unlike the existing methods of designing a backdoor for the input/output space of diffusion models, in our method, we propose to embed the backdoor into the feature space of sampled subpaths. Our empirical studies on the MS-COCO, AFHQ, LSUN, CUB-200, and DreamBooth datasets confirm the robustness of AIAO.
  arXiv  Detail & Related papers  (2024-05-01T12:03:39Z)
• Cal-DETR: Calibrated Detection Transformer [67.75361289429013]
  We propose a mechanism for calibrated detection transformers (Cal-DETR), particularly for Deformable-DETR, UP-DETR and DINO. We develop an uncertainty-guided logit modulation mechanism that leverages the uncertainty to modulate the class logits. Results corroborate the effectiveness of Cal-DETR against the competing train-time methods in calibrating both in-domain and out-domain detections.
  arXiv  Detail & Related papers  (2023-11-06T22:13:10Z)
• Industrial Anomaly Detection and Localization Using Weakly-Supervised Residual Transformers [44.344548601242444]
  We introduce a novel framework, Weakly-supervised RESidual Transformer (WeakREST), to achieve high anomaly detection accuracy.<n>We reformulate the pixel-wise anomaly localization task into a block-wise classification problem.<n>We develop a novel ResMixMatch algorithm, capable of handling the interplay between weak labels and residual-based representations.
  arXiv  Detail & Related papers  (2023-06-06T08:19:30Z)
• SADet: Learning An Efficient and Accurate Pedestrian Detector [68.66857832440897]
  This paper proposes a series of systematic optimization strategies for the detection pipeline of one-stage detector. It forms a single shot anchor-based detector (SADet) for efficient and accurate pedestrian detection. Though structurally simple, it presents state-of-the-art result and real-time speed of $20$ FPS for VGA-resolution images.
  arXiv  Detail & Related papers  (2020-07-26T12:32:38Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.