Get started
Work

A Density–Metric Framework for the Mathematical Separation of Anomalous Events in High-Dimensional Spaces

Year: 2026
Type: article
Abstract: Detecting anomalous events in high-dimensional behavioral data is a fundamental challenge in modern cybersecurity, particularly in scenarios involving stealthy advanced persistent threats (APTs). Traditional anomaly-detection techniques rely on heuristic notions of distance or density, yet rarely offer a mathematically coherent description of how sparse events can be formally separated from the dominant behavioral structure. This study introduces a density-metric manifold framework that unifies geometric, topological, and density-based perspectives into a single analytical model. Behavioral events are embedded in a five-dimensional manifold equipped with a Euclidean metric and a neighborhood-based density operator. Anomalies are formally defined as points whose local density falls below a fixed threshold, and we prove that such points occupy geometrically separable regions of the manifold. The theoretical foundations are supported by experiments conducted on openly available cybersecurity datasets, including ADFA-LD and UNSW-NB15, where we demonstrate that low-density behavioral patterns correspond to structurally rare attack configurations. The proposed framework provides a mathematically rigorous explanation for why APT-like behaviors naturally emerge as sparse, isolated regions in high-dimensional space. These results offer a principled basis for high-dimensional anomaly detection and open new directions for leveraging geometric learning in cybersecurity.
Source: Mathematics
DOI: 10.3390/math14020350
Language: English
Open Access status: gold
Estimated APC paid: $3,137
OpenAlex ID: W7124898410
FWCI:
Cites:
Cited by:
Related to: