What question did this study set out to answer?

To develop a system that detects advanced threats without traditional training methods.

March 22, 2026Open Access

Not a Single Bit: Zero-Shot Detection of Advanced Persistent Threats, Spyware, and Zero-Day Exploits via the Maximum Entropy Principle.

Key Points

To develop a system that detects advanced threats without traditional training methods.
Utilizes the Maximum Entropy Principle for detection
Operates without prior knowledge of attack patterns
Applies statistical techniques for spyware detection
Achieves an F1-score of 97.9% on CICIDS2017 dataset
Surpasses performance of many supervised models
Effectively detects malware through behavioral analysis

Abstract

We present DGRH-MaxEnt, a revolutionary zero-shot behavioral detection system designed to identify Advanced Persistent Threats (APTs), spyware (including Pegasus-class implants), and zero-day exploits without the need for labeled training data or signature databases. The framework is built on a fundamental shift from empirical pattern matching to Physical Law Enforcement. By applying the Maximum Entropy Principle (Jaynes 1957), the system derives universal reference distributions (Q^*) directly from international communication standards such as RFC 5101 (Network), POSIX. 1-2017 (Endpoint), RFC 1034 (DNS), and RFC 8446 (TLS). Key Features: Zero-Shot Detection: Operates with zero prior knowledge of attack patterns, neutralizing the "cold-start" problem of traditional security systems. Pegasus-Class Recognition: Detects sophisticated nation-state spyware via SNI mismatch analysis with a statistical confidence of z = +20. Temporal Drift Engine: Utilizes a Non-Markovian memory architecture and CUSUM analysis to detect "low-and-slow" attacks and dormant implants. Proven Performance: Achieves an F1-score of 97. 9% on the CICIDS2017 dataset and 87. 1% on ADFA-LD, surpassing many supervised deep learning models while remaining mathematically grounde The central claim of this research is that since every malware must communicate to function, it must inevitably deviate from the physical laws of normal network behavior. Therefore, not a single bit of exfiltrated data can leave a monitored system undetected.

Perguntar à IA

Bookmark

View Full Paper