When rare observations destabilise security verification

I was second author of this paper, published in 2017 in the proceedings of the 20th IFAC World Congress. We examined how security monitoring infers hidden network states from noisy, incomplete and infrequent observations.

A hidden Markov model represents network dynamics and the information available to an observer. The analysis shows how a rare observation can substantially change a previously confident assessment of past or current states. Very small observation noise does not automatically preserve that confidence.

Simulations explored random, random-regular and scale-free networks, revealing similar patterns of fragility across different topologies. Applications discussed include intrusion detection, failure recovery and digital forensics.

The result identifies a limitation of security verification under partial observation. Translating the model into monitoring rules for a deployed network requires additional assumptions and empirical validation.

Original publication: Mardavij Roozbehani, Armanas Povilionis, Christian Schunck and Maurizio Talamo. “On the Fragility of Network Security Verification in Rare-Observation Regimes.” IFAC-PapersOnLine 50(1), 411–418 (2017). DOI: 10.1016/j.ifacol.2017.08.188.