{"id":"https://openalex.org/W7225460607","doi":"https://doi.org/10.5281/zenodo.24044901","title":"Defense in Superposition: Deferred Collapse of Configuration, Threat State, Deception, and Model State in Autonomous Network Defense","display_name":"Defense in Superposition: Deferred Collapse of Configuration, Threat State, Deception, and Model State in Autonomous Network Defense","publication_year":2026,"publication_date":"2026-11-07","ids":{"openalex":"https://openalex.org/W7225460607","doi":"https://doi.org/10.5281/zenodo.24044901"},"language":"en","primary_location":{"id":"doi:10.5281/zenodo.24044901","doi":"https://doi.org/10.5281/zenodo.24044901","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24044901","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.5281/zenodo.24044901","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5134247007","display_name":"Alexander W. Smith","orcid":"https://orcid.org/0009-0005-3837-6112","observed_orcids":["https://orcid.org/0009-0005-3837-6112"]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Smith, Alexander W.","raw_affiliation_strings":["Independent"],"raw_orcid":"https://orcid.org/0009-0005-3837-6112","affiliations":[{"raw_affiliation_string":"Independent","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5134247007"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9922000169754028,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9922000169754028,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.002199999988079071,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0008999999845400453,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/superposition","display_name":"superposition","score":0.6119999885559082},{"id":"https://openalex.org/keywords/decision-making-under-uncertainty","display_name":"decision making under uncertainty","score":0.45399999618530273},{"id":"https://openalex.org/keywords/deception","display_name":"deception","score":0.4090000092983246},{"id":"https://openalex.org/keywords/hidden-markov-models","display_name":"hidden Markov models","score":0.8709999918937683},{"id":"https://openalex.org/keywords/model-degeneracy","display_name":"model degeneracy","score":0.4959999918937683},{"id":"https://openalex.org/keywords/attestation","display_name":"attestation","score":0.7200000286102295},{"id":"https://openalex.org/keywords/network-isolation","display_name":"network isolation","score":0.3959999978542328}],"concepts":[{"id":"https://openalex.org/C117797892","wikidata":"https://www.wikidata.org/wiki/Q286363","display_name":"Shadow (psychology)","level":2,"score":0.654699981212616},{"id":"https://openalex.org/C2780704645","wikidata":"https://www.wikidata.org/wiki/Q9251458","display_name":"Observer (physics)","level":2,"score":0.5400000214576721},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5271000266075134},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5011000037193298},{"id":"https://openalex.org/C2777735758","wikidata":"https://www.wikidata.org/wiki/Q817765","display_name":"Path (computing)","level":2,"score":0.4242999851703644},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.41940000653266907},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.3635999858379364},{"id":"https://openalex.org/C98763669","wikidata":"https://www.wikidata.org/wiki/Q176645","display_name":"Markov chain","level":2,"score":0.33309999108314514},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3264999985694885},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.3199999928474426},{"id":"https://openalex.org/C166357818","wikidata":"https://www.wikidata.org/wiki/Q3735938","display_name":"Recapitalization","level":2,"score":0.31439998745918274},{"id":"https://openalex.org/C2777267654","wikidata":"https://www.wikidata.org/wiki/Q3519023","display_name":"Test (biology)","level":2,"score":0.3093000054359436},{"id":"https://openalex.org/C106131492","wikidata":"https://www.wikidata.org/wiki/Q3072260","display_name":"Filter (signal processing)","level":2,"score":0.2948000133037567},{"id":"https://openalex.org/C159886148","wikidata":"https://www.wikidata.org/wiki/Q176645","display_name":"Markov process","level":2,"score":0.2890999913215637},{"id":"https://openalex.org/C3309909","wikidata":"https://www.wikidata.org/wiki/Q864155","display_name":"Binary decision diagram","level":2,"score":0.26159998774528503},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.260699987411499},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.2549000084400177},{"id":"https://openalex.org/C2775936607","wikidata":"https://www.wikidata.org/wiki/Q466845","display_name":"Tracking (education)","level":2,"score":0.2533000111579895}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.5281/zenodo.24044901","doi":"https://doi.org/10.5281/zenodo.24044901","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24044901","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.24044902","doi":"https://doi.org/10.5281/zenodo.24044902","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24044902","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.5281/zenodo.24044901","doi":"https://doi.org/10.5281/zenodo.24044901","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24044901","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7169731505","https://openalex.org/W7155210322","https://openalex.org/W7163764852","https://openalex.org/W7224779002","https://openalex.org/W2964408693","https://openalex.org/W2034393457","https://openalex.org/W7168263030","https://openalex.org/W7169832815","https://openalex.org/W7168545060","https://openalex.org/W7203796205"],"abstract_inverted_index":{"Earlier":[0],"live-network":[1],"soaks":[2],"of":[3,70,72,202,215,300],"the":[4,16,26,51,76,86,102,128,136,150,198,203,216,242,287,291,301],"TACET":[5],"network":[6],"defense":[7],"platform":[8,17,95],"traced":[9],"several":[10,97],"measured":[11],"errors":[12],"to":[13,28,54,135,156,212],"one":[14,33,106,157,255],"habit:":[15],"settled":[18],"on":[19,127,250],"a":[20,44,112,138,192,207,213,225,264,268,283,296],"single":[21],"answer":[22],"before":[23],"it":[24,185,293],"had":[25],"evidence":[27,114],"choose":[29],"one.":[30],"It":[31],"ran":[32],"configuration":[34],"per":[35],"detector,":[36],"recorded":[37],"each":[38],"actor\u2019s":[39],"furthest":[40],"attack":[41,147],"phase":[42],"as":[43,63,175,274],"label":[45],"that":[46,68,123,160,169],"could":[47],"only":[48,110],"rise,":[49],"showed":[50],"same":[52,77,103,129],"decoys":[53,154],"every":[55,59,80],"observer":[56,158],"and":[57,108,167,183,188,254],"counted":[58],"trained":[60],"anomaly":[61],"model":[62,142],"working.":[64],"An":[65],"audit":[66],"found":[67],"40":[69],"61":[71],"those":[73],"models":[74,172],"returned":[75],"score":[78],"for":[79,90],"input.":[81],"This":[82],"paper":[83,289],"describes":[84],"superposition,":[85,187],"approach":[87],"we":[88,180,189],"adopted":[89],"all":[91,232],"four":[92],"decisions.":[93],"The":[94,219,278],"keeps":[96],"candidates,":[98],"updates":[99],"them":[100],"from":[101,173],"observations,":[104],"lets":[105],"act":[107],"commits":[109],"when":[111,149],"stated":[113],"test":[115],"is":[116,195],"met.":[117],"We":[118,177,223],"describe":[119,190],"shadow":[120],"detector":[121],"branches":[122],"run":[124],"alternative":[125],"configurations":[126],"live":[130,284],"events":[131],"with":[132,270],"no":[133,271],"path":[134],"network,":[137],"per-actor":[139],"hidden":[140],"Markov":[141],"whose":[143],"belief":[144],"in":[145,228,290],"an":[146],"decays":[148],"actor":[151],"goes":[152],"quiet,":[153],"assigned":[155],"so":[159],"use":[161],"by":[162],"another":[163],"reveals":[164],"shared":[165],"reconnaissance,":[166],"tests":[168],"stop":[170],"degenerate":[171],"counting":[174],"coverage.":[176],"explain":[178],"why":[179,184],"built":[181],"self-mutation":[182],"required":[186],"how":[191],"winning":[193],"branch":[194],"promoted":[196],"through":[197],"attested":[199],"mutation":[200],"plane":[201],"previous":[204],"paper,":[205],"including":[206],"second":[208],"signing":[209],"authority":[210],"bound":[211],"measurement":[214],"decision":[217],"code.":[218],"mechanisms":[220,280],"are":[221],"implemented.":[222],"report":[224],"70-day":[226],"soak":[227],"which":[229],"detection":[230],"across":[231],"families":[233],"except":[234],"low-and-slow":[235],"scanning":[236],"was":[237],"91.7":[238],"percent":[239],"after":[240],"rescoring,":[241],"go-dark":[243],"gate":[244],"pinned":[245],"non-attacker":[246],"addresses":[247],"13":[248],"times":[249],"false":[251],"corroborating":[252],"evidence,":[253],"innocent":[256],"host":[257],"drew":[258],"about":[259],"420":[260],"isolation":[261],"recommendations":[262],"because":[263],"spoofing":[265],"playbook":[266],"treated":[267],"device":[269],"attestation":[272],"agent":[273],"having":[275],"failed":[276],"attestation.":[277],"superposition":[279],"themselves":[281],"await":[282],"evaluation.":[285],"As":[286],"last":[288],"series,":[292],"also":[294],"includes":[295],"complete":[297],"reference":[298],"description":[299],"platform.":[302]},"counts_by_year":[],"updated_date":"2026-11-09T13:22:03.289127","created_date":"2026-11-08T00:00:00"}