The Mathematics of Deterministic Network Defense

Jeff Gray · July 20, 2026 · 12 min read
Analysis · Cyborama OT Intelligence · ENTIRELY AUDITABLE

Entirely auditable. If an engineer wants to know why the alert went off, they don't have to parse an unreadable neural network weight matrix. They can look directly at the logs and see that the local residual energy surged to a massive value while the squared entropy deviation added an undeniable layer of systemic confirmation. It's transparent, it's deterministic, and it strips the AI marketing fluff completely out of network defense.

Step 1: Verify the Local Energy Surge

The engineer pulls the raw value x_i of the flagged feature at the exact timestamp of the alert. By extracting the pre-configured mean μ_i, standard deviation σ_i, and assigned weight w_i from the configuration logs, they re-verify the arithmetic of the local energy surge.

Step 2: Verify Systemic Entropy Deviation

The engineer reviews the raw traffic histogram during the active time window to re-calculate the active Shannon Entropy H(T). Subtracting the static baseline H_baseline, squaring the difference, and multiplying by the explicit scalar λ confirms whether a systemic structural shift occurred.

Step 3: Replay the Final Decision

The engineer sums the outputs of Step One and Step Two. If the final score meets or exceeds the fixed system threshold τ, the alert is mathematically validated:

Alert Triggered ↔ S(x) ≥ τ

(Note: If a probabilistic reading is preferred by the facility, the score can be passed through a simple algebraic sigmoid: P(Intrusion) = 1 ⁄ 1 + e^−S(x).)

Operational Advantages in Critical Infrastructure

Deterministic Guarantee: Identical network telemetry inputs will always produce identical detection scores. There is no stochastic drift or erratic model behavior.

No Explanation Tools Required: Frameworks like SHAP or LIME are entirely obsolete here. The mathematical weights w_i, λ explicitly define exactly how much each metric contributed to the final alert.

Log-Centric Architecture: The explanation lives entirely within the telemetry that operators already collect. No separate, resource-heavy AI explanation model needs to run alongside the network tap.

By grounding intrusion detection in explicit, closed-form mathematics, this formulation returns absolute control to the operator. It delivers the sensitivity required to catch sophisticated cyber attacks alongside the absolute transparency demanded by the industrial control room.

References

Shannon, C.E. (1948) — A Mathematical Theory of Communication. Bell System Technical Journal
NERC CIP-012 — Communications Security for Critical Infrastructure Protection
NIST SP 800-82 Rev. 3 — Guide to Industrial Control Systems (ICS) Security
IEC 62443-2-1 — Security for industrial automation and control systems

Analysis by Jeff Gray, Cyborama OT Intelligence
Published: July 20, 2026
Basis: Closed-form mathematical detection + deterministic OT monitoring
For defensive use by OT security professionals.

← Back to Control Systems Security · Previous: CISA Log Everything