University of Klagenfurt

The authors formalize Distributed Collective Reconnaissance (DCR), where each identity stays valid and low-rate while the population collectively acquires system knowledge under hidden coordination, and build SwarmReconGuard, a Docker-isolated reproducible benchmark observing only service-boundary telemetry; across 11 behaviors, 10–10,000 virtual identities, 440 runs and 3,666,300 requests they compare semantic, Gaussian, conditional, graph, kernel, hybrid and CUSUM detectors, finding Gaussian likelihood-ratio detection reaches 100% detection with 0% observed false positives on known attacks but only 3% on unseen policies, CUSUM reaches 36.1% overall detection, and hybrid CUSUM reaches 85.7% at 10,000 identities.

The authors formalize Distributed Collective Reconnaissance (DCR), where each identity stays valid and low-rate while the population collectively acquires system knowledge under hidden coordination, and build SwarmReconGuard, a Docker-isolated reproducible benchmark observing only service-boundary telemetry; across 11 behaviors, 10–10,000 virtual identities, 440 runs and 3,666,300 requests they compare semantic, Gaussian, conditional, graph, kernel, hybrid and CUSUM detectors, finding Gaussian likelihood-ratio detection reaches 100% detection with 0% observed false positives on known attacks but only 3% on unseen policies, CUSUM reaches 36.1% overall detection, and hybrid CUSUM reaches 85.7% at 10,000 identities.