← 研踪 PaperTrailarXiv:2611.02123 · v1
Bounded Retained History in a Proxy Flow Replay: A Mixed Predictive Pilot and an Allocation Study
首次提交 2026-11-02 02:56
版本更新 2026-11-02 02:56
雷达观测 2026-11-04 23:43
摘要
We examine bounded retained history through a frozen predictive pilot and a subsequent allocation study on a curated UNSW-NB15 flow mirror. Both use an artificial release-order replay based on raw ltime ticks, with equal-tick records querying a shared prior-group state. In the pilot, the model with added retained relational features had lower reconnaissance recall than the current-flow-plus-counters baseline (43.66% versus 47.84%) and lower benign false-positive rate (3.63% versus 6.68%) at separately frozen operating thresholds, together with lower AUROC. This mixed result did not establish a predictive advantage. A development-only audit subsequently found that capacity eviction dominated expiration in the 256-record, 300-tick FIFO state, with a median completed record lifetime of 11 ticks. A protocol specified before its single execution, but after the pilot and post-hoc mechanism audit, compared five label-blind retention arms on the already-used development trace. Its primary equal-source endpoint averaged retained/reference ratios for service-expanded source out-degree and source-destination service diversity. Source-balanced retention at 256 records exceeded FIFO-256 by a pooled endpoint difference of 0.440738 and met the prespecified materiality and subblock rule. Crucially, the event-weighted ratios for both quantities decreased relative to FIFO-256: the result is specific to the equal-source weighting objective and does not establish uniformly improved retention. The study supplies neither evidence of detection improvement nor an explanation of the pilot result. Reused data, concentrated reconnaissance support, proxy timing, and the absence of a qualified independent corpus bound the interpretation.
作者备注：15 pages, 0 figures, 6 tables
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v1 · 2026-11-02 02:56 · 最新观测版本
Bounded Retained History in a Proxy Flow Replay: A Mixed Predictive Pilot and an Allocation Study
We examine bounded retained history through a frozen predictive pilot and a subsequent allocation study on a curated UNSW-NB15 flow mirror. Both use an artificial release-order replay based on raw ltime ticks, with equal-tick records querying a shared prior-group state. In the pilot, the model with added retained relational features had lower reconnaissance recall than the current-flow-plus-counters baseline (43.66% versus 47.84%) and lower benign false-positive rate (3.63% versus 6.68%) at separately frozen operating thresholds, together with lower AUROC. This mixed result did not establish a predictive advantage. A development-only audit subsequently found that capacity eviction dominated expiration in the 256-record, 300-tick FIFO state, with a median completed record lifetime of 11 ticks. A protocol specified before its single execution, but after the pilot and post-hoc mechanism audit, compared five label-blind retention arms on the already-used development trace. Its primary equal-source endpoint averaged retained/reference ratios for service-expanded source out-degree and source-destination service diversity. Source-balanced retention at 256 records exceeded FIFO-256 by a pooled endpoint difference of 0.440738 and met the prespecified materiality and subblock rule. Crucially, the event-weighted ratios for both quantities decreased relative to FIFO-256: the result is specific to the equal-source weighting objective and does not establish uniformly improved retention. The study supplies neither evidence of detection improvement nor an explanation of the pilot result. Reused data, concentrated reconnaissance support, proxy timing, and the absence of a qualified independent corpus bound the interpretation.
查看此版本解读 →查看此版本原文 ↗