AEGIS: Adversarial Entropy-Guided Immune System -- Thermodynamic State Space Models for Zero-Day Network Evasion Detection

Dimensions overall score 7.0

• AEGIS achieves an F1-score of 0.9952 and 99.50% True Positive Rate for detecting adversarial network traffic.result 95%
  Evidencepartial

  AEGIS achieves an F1-score of 0.9952 and 99.50% True Positive Rate

  Implicationpartial

  Explicitly stated in the abstract with specific numeric results.

  Verificationpartial

  partial

• AEGIS processes 64,000-packet swarms at line-rate with 262 us inference latency on an RTX 4090.technical 90%
  Evidencepartial

  enabling a linear-time O(N) Mamba-3 core to process 64,000-packet swarms at line-rate... at 262 us inference latency on an RTX 4090

  Implicationpartial

  Directly stated in the abstract with specific performance metrics.

  Verificationpartial

  partial

• Traditional Euclidean Transformer-based classifiers (e.g., ET-BERT) are vulnerable to byte-level adversarial morphing, with pre-padding attacks reducing ET-BERT accuracy to 25.68%.limitation 85%
  Evidencepartial

  these models remain vulnerable to byte-level adversarial morphing -- recent pre-padding attacks reduced ET-BERT accuracy to 25.68%

  Implicationpartial

  Directly stated in the abstract as motivation for the work, with specific accuracy degradation cited.

  Verificationpartial

  partial

• AEGIS discards payload bytes in favor of 6-dimensional continuous-time flow physics projected into a non-Euclidean Poincare manifold for detection.method 90%
  Evidencepartial

  AEGIS discards payload bytes in favor of 6-dimensional continuous-time flow physics projected into a non-Euclidean Poincare manifold

  Implicationpartial

  Explicitly described as the core methodological approach in the abstract.

  Verificationpartial

  partial

• AEGIS uses a Thermodynamic Variance Detector to compute sequence-wide Shannon Entropy to expose automated C2 tunnel anomalies.technical 85%
  Evidencepartial

  a Thermodynamic Variance Detector computes sequence-wide Shannon Entropy to expose automated C2 tunnel anomalies

  Implicationpartial

  Directly stated as a key technical component of the system.

  Verificationpartial

  partial

• The system uses a pure C++ eBPF Harvester with zero-copy IPC to bypass the Python GIL limitation.technical 80%
  Evidencepartial

  A pure C++ eBPF Harvester with zero-copy IPC bypasses the Python GIL

  Implicationpartial

  Explicitly mentioned as an implementation detail supporting performance claims.

  Verificationpartial

  partial

• AEGIS was evaluated on a 400GB, 4-tier adversarial corpus spanning backbone traffic, IoT botnets, zero-days, and proprietary VLESS Reality tunnels.method 90%
  Evidencepartial

  Evaluated on a 400GB, 4-tier adversarial corpus spanning backbone traffic, IoT botnets, zero-days, and proprietary VLESS Reality tunnels

  Implicationpartial

  Directly stated evaluation methodology with specific dataset characteristics.

  Verificationpartial

  partial

• VLESS Reality bypasses certificate-based detection entirely, creating a need for new detection approaches.limitation 80%
  Evidencepartial

  VLESS Reality bypasses certificate-based detection entirely

  Implicationpartial

  Stated as motivation for the work, though not quantified beyond the bypass claim.

  Verificationpartial

  partial

Competitive landscape

AEGIS uses thermodynamic physics and non-Euclidean geometry to detect zero-day network evasion attacks with near-perfect accuracy and ultra-low latency.