# CyberCScope: Mining Skewed Tensor Streams and Online Anomaly Detection in Cybersecurity Systems

arXiv: https://arxiv.org/abs/2503.00871 · HTML: https://mlsanity.com/paper/2503.00871/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 14 references that are in the map.
- First posted on arXiv 2 Mar 2025.

## Builds on (most cited first, 5 of 5)

- [MSTREAM: Fast Anomaly Detection in Multi-Aspect Streams](https://mlsanity.com/paper/2009.08451/) (2020)
- [DenseAlert: Incremental Dense-Subtensor Detection in Tensor Streams](https://mlsanity.com/paper/1706.03374/) (2017)
- [MemStream: Memory-Based Streaming Anomaly Detection](https://mlsanity.com/paper/2106.03837/) (2021)
- [Fast and Multi-aspect Mining of Complex Time-stamped Event Streams](https://mlsanity.com/paper/2303.03789/) (2023)
- [Bayesian estimators of the Gamma distribution](https://mlsanity.com/paper/1607.03302/) (2016)

## Built on by (most cited first, 2 of 2)

- [Multi-Aspect Mining and Anomaly Detection for Heterogeneous Tensor Streams](https://mlsanity.com/paper/2602.04917/) (2026)
- [DQE: A Semantic-Aware Evaluation Metric for Time Series Anomaly Detection](https://mlsanity.com/paper/2603.06131/) (2026)

## Abstract (arXiv)

Cybersecurity systems are continuously producing a huge number of time-stamped events in the form of high-order tensors, such as {count; time, port, flow duration, packet size, . . . }, and so how can we detect anomalies/intrusions in real time? How can we identify multiple types of intrusions and capture their characteristic behaviors? The tensor data consists of categorical and continuous attributes and the data distributions of continuous attributes typically exhibit skew. These data properties require handling skewed infinite and finite dimensional spaces simultaneously. In this paper, we propose a novel streaming method, namely CyberCScope. The method effectively decomposes incoming tensors into major trends while explicitly distinguishing between categorical and skewed continuous attributes. To our knowledge, it is the first to compute hybrid skewed infinite and finite dimensional decomposition. Based on this decomposition, it streamingly finds distinct time-evolving patterns, enabling the detection of multiple types of anomalies. Extensive experiments on large-scale real datasets demonstrate that CyberCScope detects various intrusions with higher accuracy than state-of-the-art baselines while providing meaningful summaries for the intrusions that occur in practice.