Hybrid Latent-Structural Fusion (HLSF) for Cyber Anomaly Detection

Cyber security systems face the persistent challenge of identifying malicious activity, such as compromised credentials, within massive, sparse datasets. Traditional methods often rely on either structural analysis—like tensor factorization—to model relationships between users and devices, or generative models—like normalizing flows—to estimate the probability density of observed data. This paper introduces Hybrid Latent-Structural Fusion (HLSF), an unsupervised framework that integrates these two approaches. By first using CANDECOMP-PARAFAC alternating Poisson regression (CP-APR) to decompose sparse tensors into latent factors, the authors then apply a normalizing flow (RealNVP) to model the density of these latent representations. This hybrid approach aims to capture both the structural anomalies identified by tensor decomposition and the subtle behavioral deviations detected by density estimation.

The authors evaluated HLSF using real-world authentication data from the Los Alamos National Laboratory (LANL) network, specifically targeting compromised user credentials during a red-teaming exercise. The experimental results demonstrate that HLSF consistently outperforms both standalone CP-APR and standalone normalizing flows. By operating on the structured, continuous latent factors produced by CP-APR rather than raw, sparse tensor data, the normalizing flow avoids the common bias toward low-complexity inputs, leading to more robust anomaly detection.

This research provides a novel way to bridge the gap between relational modeling and deep generative density estimation. By fusing these techniques, security analysts can detect a broader spectrum of threats—ranging from events that violate known structural patterns to those that are structurally plausible but behaviorally suspicious. This methodology offers a scalable and effective path for improving unsupervised anomaly detection in complex, multi-dimensional cyber environments.