Step 1
Flow Metering
Network flows → 5 CICFlowMeter features: packets/sec, packet length mean, flow duration, fwd/bwd packet counts. No DPI required.
Step 2
Tokenize
flow_to_tokens() maps features to security vocabulary. 10 token types encode behavioral semantics of network activity.
AUTH_BRUTE · NET_FLOOD · NET_PORTSCAN
NET_SLOW_CONN · NET_LARGE_SEND · NET_SEND
NET_RECV · NET_CONNECT · SYS_READ · SYS_WRITE
Step 3
Dual-Signal OR
Signal A: structural distance exceeds calibrated detection threshold derived from benign calibration traces. Signal B: attack-token fraction exceeds calibrated detection threshold of benign baseline. Intrusion detected if A OR B.
Step 4
Alert
Attack type classified from token distribution. Confidence, structural distance from benign baseline, and structural divergence all reported in the alert.