Bounded Retained History in a Proxy Flow Replay: A Mixed Predictive Pilot and an Allocation Study

Abstract:We examine bounded retained history through a frozen predictive pilot and a subsequent allocation study on a curated UNSW-NB15 flow mirror. Both use an artificial release-order replay based on raw ltime ticks, with equal-tick records querying a shared prior-group state. In the pilot, the model with added retained relational features had lower reconnaissance recall than the current-flow-plus-counters baseline (43.66% versus 47.84%) and lower benign false-positive rate (3.63% versus 6.68%) at separately frozen operating thresholds, together with lower AUROC. This mixed result did not establish a predictive advantage. A development-only audit subsequently found that capacity eviction dominated expiration in the 256-record, 300-tick FIFO state, with a median completed record lifetime of 11 ticks. A protocol specified before its single execution, but after the pilot and post-hoc mechanism audit, compared five label-blind retention arms on the already-used development trace. Its primary equal-source endpoint averaged retained/reference ratios for service-expanded source out-degree and source-destination service diversity. Source-balanced retention at 256 records exceeded FIFO-256 by a pooled endpoint difference of 0.440738 and met the prespecified materiality and subblock rule. Crucially, the event-weighted ratios for both quantities decreased relative to FIFO-256: the result is specific to the equal-source weighting objective and does not establish uniformly improved retention. The study supplies neither evidence of detection improvement nor an explanation of the pilot result. Reused data, concentrated reconnaissance support, proxy timing, and the absence of a qualified independent corpus bound the interpretation.

Cryptography and Security (cs.CR); Machine Learning (cs.LG); Networking and Internet Architecture (cs.NI)

arXiv:2611.02123 [cs.CR]

(or arXiv:2611.02123v1 [cs.CR] for this version)

https://doi.org/10.48550/arXiv.2611.02123 Focus to learn more arXiv-issued DOI via DataCite (pending registration)

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.