Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

INTACT: Intent-Aware Representation Learning for Cryptographic Traffic Violation Detection

Rahul D Ray

TL;DR

INTACT (INTent-Aware Cryptographic Traffic), a policy-conditioned framework that reformulates violation detection as conditional constraint learning, is introduced, demonstrating that explicit intent conditioning improves discrimination, interpretability, and robustness in cryptographic monitoring.

Abstract

Security monitoring systems typically treat anomaly detection as identifying statistical deviations from observed data distributions. In cryptographic traffic analysis, however, violations are defined not by rarity but by explicit policy constraints, including key reuse prohibition, downgrade prevention, and bounded key lifetimes. This fundamental mismatch limits the interpretability and adaptability of conventional anomaly detection methods. We introduce INTACT (INTent-Aware Cryptographic Traffic), a policy-conditioned framework that reformulates violation detection as conditional constraint learning. Instead of learning a static decision boundary over behavioral features, INTACT models the probability of violation conditioned on both observed behavior and declared security intent. The architecture factorizes representation learning into behavioral and intent encoders whose fused embeddings produce a violation score, yielding a policy-parameterized family of decision boundaries. We evaluate the framework on a real-world network flow dataset and a 210,000-trace synthetic multi-intent cryptographic dataset. INTACT matches or exceeds strong unsupervised and supervised baselines, achieving near-perfect discrimination (AUROC up to 1.0000) in the real dataset and consistent superiority in detecting relational and composite violations in the synthetic setting. These results demonstrate that explicit intent conditioning improves discrimination, interpretability, and robustness in cryptographic monitoring.

INTACT: Intent-Aware Representation Learning for Cryptographic Traffic Violation Detection

TL;DR

INTACT (INTent-Aware Cryptographic Traffic), a policy-conditioned framework that reformulates violation detection as conditional constraint learning, is introduced, demonstrating that explicit intent conditioning improves discrimination, interpretability, and robustness in cryptographic monitoring.

Abstract

Security monitoring systems typically treat anomaly detection as identifying statistical deviations from observed data distributions. In cryptographic traffic analysis, however, violations are defined not by rarity but by explicit policy constraints, including key reuse prohibition, downgrade prevention, and bounded key lifetimes. This fundamental mismatch limits the interpretability and adaptability of conventional anomaly detection methods. We introduce INTACT (INTent-Aware Cryptographic Traffic), a policy-conditioned framework that reformulates violation detection as conditional constraint learning. Instead of learning a static decision boundary over behavioral features, INTACT models the probability of violation conditioned on both observed behavior and declared security intent. The architecture factorizes representation learning into behavioral and intent encoders whose fused embeddings produce a violation score, yielding a policy-parameterized family of decision boundaries. We evaluate the framework on a real-world network flow dataset and a 210,000-trace synthetic multi-intent cryptographic dataset. INTACT matches or exceeds strong unsupervised and supervised baselines, achieving near-perfect discrimination (AUROC up to 1.0000) in the real dataset and consistent superiority in detecting relational and composite violations in the synthetic setting. These results demonstrate that explicit intent conditioning improves discrimination, interpretability, and robustness in cryptographic monitoring.
Paper Structure (58 sections, 21 equations, 2 figures, 3 tables)

This paper contains 58 sections, 21 equations, 2 figures, 3 tables.

Table of Contents

  1. Introduction
  2. Dataset Preparation and Experimental Protocol
  3. Real-World Network Flow Dataset
  4. Data Cleaning and Feature Selection
  5. Temporal Ordering and Data Partitioning
  6. Definition of Lifetime Violation
  7. Feature Normalization
  8. Construction of Controlled Distribution Shift
  9. Synthetic Intent-Anomaly Dataset
  10. Generative Assumptions and Operational Model
  11. Noise Injection and Distribution Matching
  12. Controlled Violation Mechanisms
  13. Dataset Composition
  14. Expansion to Tabular Representation
  15. Automatic Violation Annotation
  16. ...and 43 more sections

Figures (2)

  • Figure 1: INTACT architecture: behavioral encoder, intent encoder, fusion layer, and violation prediction output.
  • Figure 2: Performance evaluation on the real-world network flow dataset. (Left) ROC curve on the test set; (Right) Precision–Recall curve on the test set.