Apr 27, 2026, cs.AIJ/K move · Enter open · S save
Hikmat Karimov, Rahid Zahid Alekberli
Institute of Defense Technologies and Cybersecurity„ Azerbaijan Technical University, Azerbaijan
Runtime monitoring of stochastic systems must distinguish nominal distributional relaxation from regime departure while controlling repeated-test false alarms under explicit validity assumptions. This paper links relative-entropy dissipation, information geometry, and sequential inference in a bounded first-passage monitoring architecture. For reversible Fokker--Planck dynamics, relative entropy to an invariant density is non-increasing; under exogenous forcing, its derivative decomposes into nominal dissipation and an information-space forcing term. The runtime layer uses Gaussian window surrogates, nominal-relative covariance shrinkage, a coordinate-consistent relative precision diagnostic, and randomized conformal ranks aggregated by a mixture power-martingale process. Analytical Ornstein--Uhlenbeck validation gives zero positive nominal Kullback--Leibler increments, forcing-identity residuals below 3.31 x 10^-6, and coordinate-invariance errors at numerical roundoff. On NSL-KDD, the monitor yields 0/100 alarms on internal nominal streams but 63/100 on official test-normal streams; post-change detection is 99.0% for seen and 98.53% for test-only attack types with median one-window delay. On UNSW-NB15, internal-null alarms are 0/100, whereas official test-normal alarms rise to 90/100; post-change detection is 81.33%, with 18.67% pre-change alarms. In these evaluations, calibration transport emerges as a major deployment constraint. No universal benchmark superiority, causal inference, or physical-work interpretation is claimed.