644b9a48fb
New scene 2 (between intro and stack) framing the operational case for a per-host detector. Three consequence cards on the stage — network-level trust scoring, containment before pivot, fast post-attack reset — backed by a prose section that cites IEEE document 9881803 for the trust-aggregation argument. Sidecar md for the paper lands in references/ as a citation note; when the PDF is dropped in with a matching stem it'll show up in the references viewer automatically. Link added to links.md too. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1.6 KiB
1.6 KiB
Per-device trust from network behaviour
IEEE Xplore document 9881803 (https://ieeexplore.ieee.org/document/9881803).
This paper is the citation behind the motivation scene in the deck — specifically the claim that a per-host detector becomes much stronger when its output is combined with network-level behaviour signals (peer observations, gateway traffic patterns, cross-host relationships) to compute a fleet-wide trust score.
What we borrow
- Trust as a multi-source aggregate. A single host's classifier is noisy by itself; the paper makes the case that trust should be computed from local verdicts plus network behaviour, not either alone. Our per-host detector is positioned as one input to that broader signal — not a final verdict.
- Fast-recovery framing. Detection time gates how quickly a device can be reset to a known-good snapshot. The motivation scene borrows this framing to argue that low detection latency directly shrinks both blast radius (containment) and forensic dwell time (recovery).
Where it differs
- Their focus is the trust-aggregation layer above per-device classifiers; this project focuses on the per-device classifier itself. The paper's argument is what makes our local model worth building well — even a lossy on-host signal is useful when it's combined with the rest of the fleet's view.
If/when the PDF is dropped into this directory with a matching stem, the references viewer in the deck will pick it up automatically. Until then this sidecar stands alone as the citation note.