INTACT: Intent-Aware Representation Learning for Cryptographic Traffic Violation Detection

1. Problem Statement

The paper addresses a fundamental conceptual mismatch in current cryptographic traffic analysis.

• The Limitation of Current Methods: Traditional anomaly detection systems treat violations as statistical outliers (rare deviations from observed data distributions). They rely on learning static decision boundaries based on behavioral features alone ($g(x) \approx P(y=1|x)$).
• The Reality of Security: In real-world enterprise networks, security violations are defined not by rarity, but by explicit policy constraints (e.g., key reuse prohibitions, algorithm downgrade prevention, bounded key lifetimes). A behavior that is "normal" statistically might be a violation under a specific policy, and vice versa.
• The Gap: Existing deep learning models for encrypted traffic lack a mechanism to incorporate formal security constraints (intent) directly into the representation learning process. They cannot adapt to changing policy parameters without retraining.

2. Methodology: INTACT Framework

The authors propose INTACT (INTent-Aware Cryptographic Traffic), a policy-conditioned framework that reformulates violation detection as conditional constraint learning.

Core Concept

Instead of estimating a static anomaly score, INTACT models the probability of a violation conditioned on both observed behavior ($x$) and declared security intent ($z$):
$$f(x, z) \approx P(\text{violation} | x, z)$$
This allows the model to learn a family of decision boundaries parameterized by the policy, rather than a single static boundary.

Architectural Design

INTACT utilizes a dual-branch neural architecture:

1. Behavioral Encoder: Processes observable traffic features (e.g., flow duration, packet counts, throughput). It uses fully connected layers with ReLU activations to produce a behavioral embedding ($h_b$).
2. Intent Encoder: Processes structured policy information (e.g., lifetime thresholds, specific violation types like "reuse" or "downgrade"). It transforms these constraints into a semantic embedding ($h_z$).
3. Fusion & Decision Layer: The behavioral and intent embeddings are concatenated and passed through a fusion layer to produce a final violation probability score.

Learning Objective

The model is trained using binary cross-entropy loss with labeled supervision. Unlike unsupervised baselines that only see normal data, INTACT learns the joint interaction between behavior and policy constraints, enabling it to identify relational and composite violations.

3. Experimental Setup

The evaluation employs a dual-dataset strategy to cover both ecological validity and controlled theoretical testing:

• Real-World Dataset:
  • Source: 2.8 million enterprise network flow records.
  • Task: Detecting "lifetime violations" (flows exceeding a 95th-percentile duration threshold).
  • Challenge: Evaluated under covariate shift (scaling flow durations by 2x and 3x) to test robustness.
• Synthetic Dataset:
  • Source: 210,000 cryptographic traces (4.2M operations) generated with precise ground truth.
  • Task: Multi-intent detection including Key Reuse, Algorithm Downgrade, and Lifetime Exceedance, including composite violations.
  • Advantage: Allows for fine-grained control over violation mechanisms and testing of relational semantics (e.g., key reuse across different traces).

4. Key Results

INTACT was benchmarked against strong unsupervised baselines (Isolation Forest, Deep SVDD, Autoencoders) and supervised neural networks.

• Real-World Dataset (Lifetime Violations):
  • INTACT achieved near-perfect discrimination (AUROC = 1.0000) on the test set, matching the fully supervised baseline.
  • Under distribution shift (duration scaling), INTACT maintained high AUROC (0.96–0.97), demonstrating robustness, though F1 scores dropped slightly due to calibration sensitivity (a common issue in shift scenarios).
• Synthetic Dataset (Multi-Intent):
  • Reuse Detection: Unsupervised methods failed significantly (AUROC ~0.50–0.60) because reuse is a relational property, not a magnitude anomaly. INTACT achieved AUROC = 0.7820, significantly outperforming unsupervised methods and matching the supervised baseline.
  • Downgrade & Lifetime: INTACT achieved perfect or near-perfect scores (AUROC = 1.0000 and 0.9797), matching supervised baselines.
  • Composite Violations: INTACT successfully handled complex scenarios where multiple policy constraints were violated simultaneously.

5. Key Contributions

1. Conceptual Reframing: The paper identifies and addresses the gap between statistical anomaly detection and constraint-based security monitoring, proposing that violations should be modeled as conditional constraints.
2. Policy-Conditioned Architecture: Introduction of a dual-encoder framework that explicitly incorporates security intent ($z$) as a first-class input variable, allowing a single model to adapt to different policy definitions without retraining.
3. Dual-Dataset Evaluation: A comprehensive evaluation strategy combining large-scale real-world traffic with a synthetic corpus designed to isolate specific violation types (relational, magnitude, and composite).
4. Demonstrated Robustness: Evidence that explicit intent conditioning improves discrimination, particularly for relational violations (like key reuse) that traditional magnitude-based anomaly detectors miss.

6. Significance and Impact

• Interpretability: By separating behavior and intent, the model's decision process is more transparent, aligning with formal policy validation systems.
• Adaptability: The framework offers a pathway to handle policy drift (e.g., changing key lifetime thresholds or regulatory requirements) simply by updating the input intent vector, rather than retraining the entire model.
• Beyond Density Estimation: The work shifts the paradigm from "learning what is rare" to "learning what violates the rules," which is more aligned with the actual goals of security operations.
• Future Directions: The authors note that while INTACT handles policy conditioning well, future work is needed to address formal generalization bounds under joint distribution shifts and to integrate graph-based architectures for more complex relational reasoning in real-world deployments.

In summary, INTACT provides a scalable, interpretable foundation for cryptographic monitoring that moves beyond static statistical anomalies to dynamic, policy-aware violation detection.