Hybrid Latent-Structural Fusion (HLSF) for Cyber Anomaly Detection

2026-07-20

AI Summary

This work addresses the limitations of existing methods in modeling complex multidimensional network behavior data by proposing a novel unsupervised anomaly detection framework. The approach uniquely integrates, at the anomaly scoring level, structural anomaly scores derived from CP-APR (CANDECOMP-PARAFAC Alternating Poisson Regression) with density-based scores obtained from Normalizing Flows in latent space, thereby capturing both high-order structural patterns and deep distributional characteristics of behavioral data. Experimental evaluation on the LANL enterprise network red-team exercise dataset demonstrates that this fusion strategy significantly outperforms either method used in isolation, yielding substantial improvements in both accuracy and robustness for detecting malicious anomalous activities.

Abstract

Malicious anomalous activity detection is a fundamental challenge for cyber security systems. Both tensor decomposition under statistical framework with CANDECOMP-PARAFAC alternating Poisson regression (CP-APR) and normalizing flows have proven to be powerful unsupervised machine learning methods that model multi-dimensional data and capture complex and multi-faceted details of behavior profiles in cyber security applications. In this study, we propose Hybrid Latent-Structural Fusion (HLSF), a weighted anomaly fusion framework integrating CP-APR structural anomaly scores with latent-space density scores derived from normalizing flows. In our experiments, we show that the HLSF framework improves anomaly detection performance on a dataset of real-world compromised user credentials collected from the large enterprise network of Los Alamos National Laboratory (LANL) during a red-teaming exercise, compared with using CP-APR or normalizing flows alone.

Problem

• cyber anomaly detection
• malicious anomalous activity
• unsupervised machine learning
• multi-dimensional data
• behavior profiles

Innovation

• Hybrid Latent-Structural Fusion
• CP-APR
• normalizing flows
• anomaly detection
• tensor decomposition