Short-Window Micro-Behavioral Triage for High-Throughput Firewall Telemetry: Limits, Features, and Operational...

Area of Science:

• Cybersecurity
• Network Security
• Data Science

Background:

• High-throughput network environments require real-time data interpretation.
• Traditional methods rely on historical data, which is insufficient for short, dense observation windows.
• Firewall telemetry offers a high-rate stream reflecting device communication behavior.

Purpose of the Study:

• To operationalize behavioral slicing for privacy-preserving analysis of firewall telemetry.
• To evaluate the feasibility of using short-window firewall data for anomaly candidate triage.
• To quantify the limits, feature stability, and complementarity of behavioral slicing.

Main Methods:

• Behavioral slicing extracts micro-behavioral signals (timing, destination dispersion, intensity) from sub-minute traffic segments.
• Unsupervised outlier detection with explainable summaries was applied to anonymized firewall telemetry.
• Synthetic anomaly injection was used for relative validation of findings.

Main Results:

• Behavioral slicing effectively separates scanning and exfiltration anomalies.
• Performance is weak for low-variance C2 beaconing, suggesting it's a pre-filter, not a universal detector.
• The pipeline produces investigation-oriented anomaly candidates without making habit claims.

Conclusions:

• Behavioral slicing is an operationally feasible pre-filtering and triage method for extreme network loads.
• The approach is privacy-preserving and adaptable for IoT and edge-network monitoring.
• Clear trade-offs and limitations exist, emphasizing its role as a triage pre-filter.