{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,23]],"date-time":"2026-02-23T10:58:35Z","timestamp":1771844315887,"version":"3.50.1"},"reference-count":0,"publisher":"Slovenian Association Informatika","issue":"8","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IJCAI"],"abstract":"<jats:p>We develop a unified theory for the detectability of network-borne attacks under two canonical observation models: (i) a static graph drawn from an Erd\u0151s\u2013R\u00e9nyi background with a planted anomalous community, and (ii) a temporal interaction network modeled by multivariate point processes (Poisson or Hawkes). Our main contribution is to match, up to universal constants, information-theoretic lower and upper bounds that govern when reliable testing is possible. In the static case, the core quantity is the accumulated edgewise signal k\u00b2\u00b7\u03c7\u00b2(Bern(p+\u0394) \u2016 Bern(p)), where \u03c7\u00b2 \u2248 \u0394\u00b2\/[p(1\u2212p)] for small \u0394; detection is impossible when this falls below c\u00b7log n, and a non-backtracking spectral statistic succeeds above C\u00b7log n. In the temporal case, detectability is controlled by the Kullback\u2013Leibler information rate I contributed by internal edges over a window of length T, yielding a threshold T I \u2273 log n; a likelihood-based cumulative-sum (CUSUM) test achieves first-order optimal delay \u2248 |log \u03b1|\/I at false-alarm level \u03b1. We complement these limits with concrete algorithms and simple experiments. A pruning-based non-backtracking spectral detector for static graphs and a sparsity-aware CUSUM procedure for temporal streams are given with near-linear time and memory complexity. Monte Carlo simulations on Erd\u0151s\u2013R\u00e9nyi graphs with planted dense subgraphs and on Poisson streams illustrate the predicted phase transitions: detection power increases as k\u00b2\u00b7\u03c7\u00b2\/log n crosses a constant-level boundary, and empirical detection delays closely track the log(ARL)\/I prediction. We also discuss robustness under bounded edge perturbations and mild misspecification, and show how these thresholds can be used to dimension practical security monitoring systems.<\/jats:p>","DOI":"10.31449\/inf.v50i8.12249","type":"journal-article","created":{"date-parts":[[2026,2,22]],"date-time":"2026-02-22T11:56:42Z","timestamp":1771761402000},"source":"Crossref","is-referenced-by-count":0,"title":["Information-Theoretic and Algorithmic Thresholds for Network Attack Detection via Spectral and CUSUM Methods"],"prefix":"10.31449","volume":"50","author":[{"given":"Abdulkader","family":"Hajjouz","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Elena","family":"Avksentieva","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"16141","published-online":{"date-parts":[[2026,2,21]]},"container-title":["Informatica"],"original-title":[],"link":[{"URL":"https:\/\/www.informatica.si\/index.php\/informatica\/article\/download\/12249\/6513","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.informatica.si\/index.php\/informatica\/article\/download\/12249\/6513","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,2,23]],"date-time":"2026-02-23T10:01:24Z","timestamp":1771840884000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.informatica.si\/index.php\/informatica\/article\/view\/12249"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,2,21]]},"references-count":0,"journal-issue":{"issue":"8","published-online":{"date-parts":[[2026,2,21]]}},"URL":"https:\/\/doi.org\/10.31449\/inf.v50i8.12249","relation":{},"ISSN":["1854-3871","0350-5596"],"issn-type":[{"value":"1854-3871","type":"electronic"},{"value":"0350-5596","type":"print"}],"subject":[],"published":{"date-parts":[[2026,2,21]]}}}