AEGIS: Adversarial Entropy-Guided Immune System -- Thermodynamic State Space Models for Zero-Day Network Evasion Detection
Organizations: Faculty of Computer Science & Information Technology Universiti Malaysia Sarawak (UNIMAS), Kota Samarahan, Malaysia · Founder & Lead Architect, Vixero Technology Enterprise, Kuching, Sarawak, Malaysia
Abstract
As TLS 1.3 encryption limits traditional Deep Packet Inspection (DPI), the security community has pivoted to Euclidean Transformer-based classifiers (e.g., ET-BERT) for encrypted traffic analysis. However, these models remain vulnerable to byte-level adversarial morphing -- recent pre-padding attacks reduced ET-BERT accuracy to 25.68%, while VLESS Reality bypasses certificate-based detection entirely. We introduce AEGIS: an Adversarial Entropy-Guided Immune System powered by a Thermodynamic Variance-Guided Hyperbolic Liquid State Space Model (TVD-HL-SSM). Rather than competing in the Euclidean payload-reading domain, AEGIS discards payload bytes in favor of 6-dimensional continuous-time flow physics projected into a non-Euclidean Poincare manifold. Liquid Time-Constants measure microsecond IAT decay, and a Thermodynamic Variance Detector computes sequence-wide Shannon Entropy to expose automated C2 tunnel anomalies. A pure C++ eBPF Harvester with zero-copy IPC bypasses the Python GIL, enabling a linear-time O(N) Mamba-3 core to process 64,000-packet swarms at line-rate. Evaluated on a 400GB, 4-tier adversarial corpus spanning backbone traffic, IoT botnets, zero-days, and proprietary VLESS Reality tunnels, AEGIS achieves an F1-score of 0.9952 and 99.50% True Positive Rate at 262 us inference latency on an RTX 4090, establishing a new state-of-the-art for physics-based adversarial network defense.
Figures & tables
| Architecture | Feature Space | Adv. Padding | Temporal Morphing |
|---|---|---|---|
| ET-BERT [ 2 ] | Euclidean Bytes | Vulnerable | N/A |
| Standard SSMs | Euclidean Time | Immune | Vulnerable |
| AEGIS (Proposed) | Hyperbolic Physics | Immune | Resistant (Entropy) |
| Tier | Source Datasets / Protocols | Class | Sequences ( ) | Thermodynamic Profile |
| Tier I: Planetary Baselines | WIDE MAWI [ 11 ] , CIC-IDS-2017 [ 12 ] , DoHBrw | Benign (0) | 618,145 | High stochastic variance, natural TCP congestion |
| Tier II: Automated Swarm | IoT-23 [ 13 ] (Mirai, Torii), CTU-13 [ 14 ] | Malicious (1) | 112,400 | Highly rigid IAT, automated sequence timing profiles |
| Tier III: Zero-Day Vault | MTA [ 15 ] , BCCC-Mal-NetMem [ 16 ] | Malicious (1) | 94,350 | Memory-resident rootkits and high-variance C2 beacons |
| Tier IV: Cryptographic Evasion | VLESS Reality, GhostBear, AMOI Morphing | Malicious (1) | 83,142 | Forced volumetric anchoring, manifold shattering |
| Total Evaluated Sequences: | 908,037 | Extracted from 400GB PCAPs (10GB 6D Tensors) | ||
| Metric | Score |
|---|---|
| True Positive Rate (TPR) | 99.50% |
| False Positive Rate (FPR) | 0.2141% |
| F1-Score | 0.9952 |
| Inference Latency | 262.27 s |
| Validation Loss | 0.0052 |
Network Intrusion Detection
Network intrusion detection identifies malicious or abnormal network activity to help protect computers, connected devices, and critical infrastructure.
See all 165 papers