HLSF Improves Cyber Anomaly Detection with Fusion Framework

Detecting malicious anomalous activity is a persistent challenge in cybersecurity. Both tensor decomposition methods, like CANDECOMP-PARAFAC alternating Poisson regression (CP-APR), and normalizing flows have shown promise as unsupervised machine learning techniques for modeling multi-dimensional data and capturing complex behavioral profiles. This research introduces the Hybrid Latent-Structural Fusion (HLSF) framework, which combines the strengths of these two distinct approaches. HLSF integrates structural anomaly scores derived from CP-APR with latent-space density scores obtained from normalizing flows, using a weighted fusion mechanism. Experiments conducted on a dataset of real-world compromised user credentials from Los Alamos National Laboratory (LANL) demonstrated that the HLSF framework significantly enhances anomaly detection performance. It outperformed using CP-APR or normalizing flows in isolation, indicating that the fusion of structural and latent-space insights provides a more robust and accurate detection capability for cyber threats.