The Anomaly Detector That Learns by Counting
Conjugate priors (specifically Dirichlet–Categorical) enable exact Bayesian updates through simple integer arithmetic, eliminating the need for MCMC sampling, gradient descent, or numerical integration The approach builds 10,413 independent per-computer anomaly detectors on the LANL authentication dataset (29.4M training events), each updated by incrementing just two counters per event Combining anomaly scores from two complementary models—authentication type and source user—achieves an AUC of 0
Analysis
TL;DR
- Conjugate priors (specifically Dirichlet–Categorical) enable exact Bayesian updates through simple integer arithmetic, eliminating the need for MCMC sampling, gradient descent, or numerical integration
- The approach builds 10,413 independent per-computer anomaly detectors on the LANL authentication dataset (29.4M training events), each updated by incrementing just two counters per event
- Combining anomaly scores from two complementary models—authentication type and source user—achieves an AUC of 0.826 on red-team activity detection
- The prior parameter α controls sensitivity to novelty, with α=1 serving as an effective default that regularizes small per-computer models without distorting global patterns
- The method demonstrates that principled Bayesian inference can scale to billion-event datasets when the right conjugate structure is exploited, producing a deployable anomaly detector with no training loop
Why It Matters
This work shows that sophisticated Bayesian anomaly detection doesn't require expensive deep learning pipelines—conjugate priors can deliver competitive results (AUC 0.826) with trivial computational overhead, making it accessible for resource-constrained environments. For security practitioners, it provides a transparent, interpretable baseline for detecting lateral movement in enterprise networks without the opacity of neural anomaly detectors. The approach also highlights an important design principle: combining multiple complementary probabilistic signals (auth type + user identity) significantly strengthens detection compared to any single feature.
Technical Details
- Dirichlet–Categorical conjugate pair: The likelihood is Categorical (authentication types, user identities) and the prior is Dirichlet, yielding a posterior that is also Dirichlet. Each event update is
counts[obs] += 1andtotal += 1—pure integer arithmetic with no matrix operations. - Posterior predictive scoring: For a new observation of category k, P(k|data) = (α + nₖ) / (K·α + N), where unseen categories trigger a K→K+1 adjustment. Anomaly score is the negative log probability:
score = -log(P(auth_type|computer))andscore = -log(P(source_user|computer)), combined as their average. - Dual-model architecture per computer: Each of the 10,413 computers gets two independent Dirichlet–Categorical models—one over authentication types (6 categories) and one over source users—capturing the machine's protocol fingerprint and social circle respectively.
- Temporal evaluation split: Training uses only pre-attack data; evaluation covers the red-team window. Labels are derived from compromised computer access during the attack period (1,247 suspicious events), since exact timestamp matching recovered only 3 of 749 red-team events.
- Prior sensitivity: α=1 (uniform prior) is used throughout. At the global scale (N=29.4M), α has negligible effect; at the per-computer scale (N=100–10,000), α meaningfully controls novelty sensitivity, with lower α increasing detection of unseen categories.
Industry Insight
- Simplicity as a deployment advantage: For organizations lacking ML infrastructure, conjugate Bayesian models offer a production-ready alternative to deep learning—zero training time, deterministic updates, and trivial maintenance. This is particularly valuable in security operations where model drift and retraining pipelines add operational complexity.
- Complementary signal fusion is underutilized: The 0.826 AUC comes from averaging two independently trained models. Security teams should systematically identify and combine orthogonal behavioral signals (protocol usage, user patterns, time-of-day, geographic context) rather than relying on single-feature detectors.
- The α parameter as a tunable sensitivity knob: In low-data regimes (per-device models with thousands of events), α directly controls false-positive rates by regulating how aggressively unseen categories are flagged. Practitioners should calibrate α against known baseline traffic rather than treating it as a fixed hyperparameter.
Disclaimer: The above content is generated by AI and is for reference only.