用几何结构变化提前预警匿名网络异常，比传统阈值法更早发现故障。
Latent Geometry as a Structural Monitor: Eigenspace Alignment for Anomaly Detection in Anonymity Networks
- 将用户行为看作几何能量场，通过子空间对齐监测结构变形。
- 在67天观测中识别出稳定的9维承载子空间，信噪比达16.8σ。
- 适用于有充足数据的群体行为监控，尤其适合匿名网络故障检测。
传统异常检测依赖信号超过预设阈值，仅捕捉突变瞬间，忽略其前的结构性压力。本文提出将大规模行为群体视为几何能量景观，其形变可在重大转变前被测量。核心观点是：结构先于几何——群体的组织结构是信号本身，几何度量则是探测工具。应用于67个连续日的Tor匿名网络，双观察者流程识别出跨期稳定的九维承载子空间，并通过蒙特卡洛模拟验证其稳定性，信噪比达16.8σ。主检测门在24个确认稳定窗口上实现0%误报率。对2026年2月20日已确认基础设施事件的溯源分析，否定了中继退出假设，揭示了无拓扑变化下的连通性退化是一种可检测的网络故障模式。结果为具备充分遥测数据的行为群体提供了候选的结构监测框架。
原文摘要 · Abstract (English)
Traditional anomaly detection marks events when measured signals cross predefined thresholds. This captures the moment of transition but not the structural pressure that precedes it. We propose treating large behavioral populations as geometric energy landscapes whose deformation can be measured before and during major transitions. The central thesis is that structure precedes geometry: the structural organization of the population is the signal, and geometric metrics are instruments for measuring it. Applied to the Tor anonymity network across 67 consecutive daily observation windows, the dual-observer pipeline identifies a stable nine-dimensional load-bearing subspace invariant across the observation period and validates this structure by Monte Carlo simulation at 16.8 sigma above the noise floor. Primary detection gates achieve 0.0% false positive rate on 24 confirmed stable windows. Forensic analysis of the February 20, 2026 confirmed infrastructure event formally falsifies the relay-departure hypothesis, identifying connectivity degradation without topology change as a detectable network failure mode. The result is a candidate structural-monitoring framework for behavioral populations with sufficient telemetry.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。