arXiv preprint ·
Bounded Retained History in a Proxy Flow Replay: A Mixed Predictive Pilot and an Allocation Study
- Published
- Source
- arXiv preprint, posted before peer review
- Original
- Read it at arXiv
- Topics
Abstract
We examine bounded retained history through a frozen predictive pilot and a subsequent allocation study on a curated UNSW-NB15 flow mirror. Both use an artificial release-order replay based on raw ltime ticks, with equal-tick records querying a shared prior-group state. In the pilot, the model with added retained relational features had lower reconnaissance recall than the current-flow-plus-counters baseline (43.66% versus 47.84%) and lower benign false-positive rate (3.63% versus 6.68%) at separately frozen operating thresholds, together with lower AUROC. This mixed result did not establish a predictive advantage. A development-only audit subsequently found that capacity eviction dominated expiration in the 256-record, 300-tick FIFO state, with a median completed record lifetime of 11 ticks. A protocol specified before its single execution, but after the pilot and post-hoc mechanism audit, compared five label-blind retention arms on the already-used development trace. Its primary equal-source endpoint averaged retained/reference ratios for service-expanded source out-degree and source-destination service diversity. Source-balanced retention at 256 records exceeded FIFO-256 by a pooled endpoint difference of 0.440738 and met the prespecified materiality and subblock rule. Crucially, the event-weighted ratios for both quantities decreased relative to FIFO-256: the result is specific to the equal-source weighting objective and does not establish uniformly improved retention. The study supplies neither evidence of detection improvement nor an explanation of the pilot result. Reused data, concentrated reconnaissance support, proxy timing, and the absence of a qualified independent corpus bound the interpretation.
The authors’ abstract, as arXiv lists it. arXiv’s listings, abstracts included, are free for anyone to reuse.
Read it on ReadSearch
Each opens after you create an account, and brings you back to this paper.
More in Cryptography & Security
Token-as-a-Utility: A Model-Agnostic Architecture for Metering and Provisioning AI Inference Services
Networked AI: Architecture, Theory, and Applications
State-Augmented Learning for Post-Deployment Adaptation of Coexisting O-RAN Applications
DynSL: Resource-Adaptive Model Training across Heterogeneous Edge Devices
RadPose: ISAC-based RF 3D Human Pose Estimation
Get the few papers worth your time in Cryptography & Security every morning.
ReadSearch reads the new papers in your field each day and brings you the few worth reading, each with its key finding in a sentence.