[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-83180-en":3,"doc-seo-83180-105":29,"detail-sidebar-cat-0-en-105":90},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},83180,1374391974468,"Eden","https://ap-avatar.wpscdn.com/davatar_29158cc5080c5b710cf443261637dec0",8,"Research & Report","Cyber Dynamics I Finite Macrostates for Behavioral Anomaly Detection in Network Telemetry","Entropy-based anomaly detection for networks often treats entropy as a single scalar over limited observables, rather than as part of a broader behavioral state-space. A finite-dimensional macrostate framework is proposed for network telemetry using the Canonical Security Telemetry Substrate (CSTS), where coarse-graining operates over persistent entities, typed relations, and temporal state. The macrostate models activity, disorder, structure, temporal volatility, persistence, and deviation from benign baselines. Window-to-window transitions enable regime structure, stability, and anomalous change, distinguishing benign drift from adversarial reorganization. Benchmark evaluations compare against Shannon-, Rnyi-, and Tsallis-style baselines and standard detectors, improving discrimination and interpretability.","Cyber Dynamics I: Finite Macrostates for Behavioral Anomaly Detection in  \nNetwork Telemetry  \nAbdul Rahman 1 , Eranga Bandara2 , Sachin Shetty2  \n1Howard University, USA  \n[arahman@alum.howard.edu](arahman@alum.howard.edu)  \n2 Old Dominion University, USA  \n{cmedawer, [sshetty](sshetty}@odu.edu)[}](sshetty}@odu.edu)[@odu.edu](sshetty}@odu.edu)  \narXiv :2607 .07075v 1 [ cs .CR] 8 Jul 2026  \nAbstract—Entropy-based methods have long been used for network anomaly detection, but most existing approaches treat entropy as a scalar statistic on narrow observables rather than as part of a broader behavioral state-space for cyber systems. We propose a finite-dimensional macrostate framework for network telemetry, instantiated over the Canonical Security Telemetry Substrate (CSTS), so that coarse-graining is performed over persistent entities, typed relations, and temporal state rather than isolated event records. The resulting macrostate captures activity, distributional disorder, structural organization, temporal volatility, persistence, and deviation from benign baselines. Rather than scoring only unusual states, we model window-to-window macrostate transitions and define regime structure, stability, and anomalous change. This supports discrimination between benign workload drift and adversarial reorganization. We evaluate the framework on benchmark network telemetry datasets and compare it against Shannon-, Rnyi-, and Tsallis-style entropy baselines, as well as standard anomaly detectors. The proposed representation improves anomaly discrimination and supports more interpretable behavioral analysis of cyber telemetry.  \nI. INTRODUCTION  \nA. Motivation  \nModern cyber defense operates in environments that are fundamentally dynamic, heterogeneous, and behavior-rich. Enterprise networks evolve continuously under ordinary operational forces such as office-hour transitions, scheduled backups, patch cycles, software deployment bursts, batch processing, cloud autoscaling, identity-driven access changes, and topology or service reconfiguration. At the same time, adversarial activity increasingly unfolds as multistage behavioral campaigns rather than isolated point anomalies, especially in advanced persistent threat (APT) settings, where persistence, lateral movement, staging, and coordinated re-use of infrastructure create temporal structure that is often more informative than any single event in isolation [1], [2] . These realities create a central tension for anomaly detection: the system must remain sensitive to genuinely malicious change while avoiding false alarms induced by normal operational variability, concept drift, and evolving workload conditions [3], [4] .  \nThis tension exposes a limitation of pointwise or narrowly aggregated anomaly formulations. When telemetry is reduced to isolated events or small feature vectors, the distinction between benign variation and adversarial reorganization can  \nbecome blurred. A burst of backup traffic, for example, may resemble exfiltration at the level of volume alone; a patch wave may resemble scanning or coordinated service churn at the level of connection counts; and cloud elasticity can alter endpoint and service distributions in ways that superficially mimic attack-induced instability. In such environments, meaningful detection requires not only sensitivity to unusual observations, but also a representation of system behavior over time: what entities are active, how they are related, how interaction structure shifts, and whether the system remains within a stable operational regime or transitions into an anomalous one [5]–[7] .  \nA further complication is that modern cybersecurity analytics increasingly draw from heterogeneous telemetry sources rather than from packet or flow data alone. Network events, process trees, identity activity, file operations, DNS interactions, and higher-level behavioral signals often need to be interpreted jointly. This has motivated work on schema normalizati","cbCaim7FbOYEWwIZ","https://ap.wps.com/l/cbCaim7FbOYEWwIZ","pdf",778157,1,23,"English","en",105,"# Abstract\n# Introduction\n## Motivation\n## From Entropy to Cyber Dynamics","[{\"question\":\"What limitation of entropy-based anomaly detection does the paper address?\",\"answer\":\"It argues that most methods treat entropy as a scalar statistic over narrow observables, rather than modeling a richer behavioral state-space for cyber systems.\"},{\"question\":\"How does the proposed macrostate framework represent network telemetry?\",\"answer\":\"It constructs finite-dimensional macrostates on top of CSTS, performing coarse-graining over persistent entities, typed relations, and temporal state rather than isolated event records.\"},{\"question\":\"How does the approach detect anomalies beyond scoring unusual states?\",\"answer\":\"It models transitions between macrostates across time windows, defining regime structure, stability, and anomalous change to separate benign workload drift from adversarial reorganization.\"}]",1784185808,58,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":85,"head_meta":87,"extra_data":89,"updated_unix":27},"cyber-dynamics-i-finite-macrostates-for-behavioral-anomaly-detection-in-network-telemetry","",{"@graph":35,"@context":84},[36,53,67],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/cyber-dynamics-i-finite-macrostates-for-behavioral-anomaly-detection-in-network-telemetry/83180/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":61,"encodingFormat":60,"isAccessibleForFree":62,"interactionStatistic":63},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-16",true,{"@type":64,"interactionType":65,"userInteractionCount":4},"InteractionCounter",{"@type":66},"ViewAction",{"@type":68,"mainEntity":69},"FAQPage",[70,76,80],{"name":71,"@type":72,"acceptedAnswer":73},"What limitation of entropy-based anomaly detection does the paper address?","Question",{"text":74,"@type":75},"It argues that most methods treat entropy as a scalar statistic over narrow observables, rather than modeling a richer behavioral state-space for cyber systems.","Answer",{"name":77,"@type":72,"acceptedAnswer":78},"How does the proposed macrostate framework represent network telemetry?",{"text":79,"@type":75},"It constructs finite-dimensional macrostates on top of CSTS, performing coarse-graining over persistent entities, typed relations, and temporal state rather than isolated event records.",{"name":81,"@type":72,"acceptedAnswer":82},"How does the approach detect anomalies beyond scoring unusual states?",{"text":83,"@type":75},"It models transitions between macrostates across time windows, defining regime structure, stability, and anomalous change to separate benign workload drift from adversarial reorganization.","https://schema.org",{"og:url":51,"og:type":86,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":88,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":91},[92,96,100,104,109,114,119,122,127,130,134],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":93,"show_sort_weight":94,"slug":95},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":97,"show_sort_weight":98,"slug":99},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":101,"show_sort_weight":102,"slug":103},"Exam",70,"exam",{"id":105,"doc_module":4,"doc_module_name":45,"category_name":106,"show_sort_weight":107,"slug":108},5,"Comic",60,"comic",{"id":110,"doc_module":4,"doc_module_name":45,"category_name":111,"show_sort_weight":112,"slug":113},6,"Technology",50,"technology",{"id":115,"doc_module":4,"doc_module_name":45,"category_name":116,"show_sort_weight":117,"slug":118},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":120,"slug":121},30,"research-report",{"id":123,"doc_module":4,"doc_module_name":45,"category_name":124,"show_sort_weight":125,"slug":126},9,"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":45,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":131,"doc_module":4,"doc_module_name":45,"category_name":132,"show_sort_weight":131,"slug":133},10,"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":45,"category_name":136,"show_sort_weight":105,"slug":137},19,"General","general"]