mlsanityData to 7 Oct 2026

CSTS: A Canonical Security Telemetry Substrate for AI-Native Cyber Detection

arXiv 2603.23459 ↗First posted 24 Mar 2026cs.CR cs.LGcited by 0

Not on the map. Why?

Abstract (arXiv)

Cybersecurity data remains fragmented across vendors, formats, schemas, and deployment environments, forcing AI and analytics programs to spend disproportionate effort on ingestion, normalization, and brittle source-specific engineering. This paper introduces the Canonical Security Telemetry Substrate (CSTS), a canonical, AI-ready telemetry foundation designed to harmonize heterogeneous cyber data into a common representation over persistent entities, typed relations, events, temporal state, and provenance. CSTS is intended to move cybersecurity analytics beyond ad hoc record normalization toward a reusable substrate that supports anomaly detection, graph learning, forecasting, behavior-based modeling, and agentic cyber AI. We formalize the core design principles of CSTS, define its representational components, and explain how it preserves source-specific nuance through explicit mappings and extensible metadata while still enabling portable downstream inference. We further position CSTS as a cloud-agnostic and deployment-agnostic substrate suitable for on-prem, hybrid, and multi-cloud environments. The result is a unifying telemetry model that reduces the blue-collar burden of cyber data engineering and creates a clearer path to scalable, interoperable, and model-agnostic cyber AI.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 11 of its 35 references that are in the map. First posted on arXiv 24 Mar 2026.

Builds on

11 of 35 references.

References · 11

  1. 2020Supervised Contrastive Learningcited by 2,803
  2. 2021Towards an Open Format for Scalable System Telemetrycited by 2
  3. 2022Zero Day Threat Detection Using Graph and Flow Based Security Telemetrycited by 2
  4. 2024EG-ConMix: An Intrusion Detection Method based on Graph Contrastive Learningcited by 2
  5. 2025Self-Supervised Transformer-based Contrastive Learning for Intrusion Detection Systemscited by 2
  6. 2022Lateral Movement Detection Using User Behavioral Analysiscited by 1
  7. 2022Zero Day Threat Detection Using Metric Learning Autoencoderscited by 1
  8. 2023Cross-temporal Detection of Novel Ransomware Campaigns: A Multi-Modal Alert Approachcited by 1
  9. 2024SETC: A Vulnerability Telemetry Collection Frameworkcited by 1
  10. 2024Learning in Multiple Spaces: Few-Shot Network Attack Detection with Metric-Fused Prototypical Networkscited by 1
  11. 2026A Novel Contrastive Loss for Zero-Day Network Intrusion Detectioncited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026A Graph-Based Approach for Mapping Kernel-Level Telemetry to MITRE ATT&CK
  2. 2026BlueSTAR: Tiered Agentic Architecture for Autonomous Cyber Defense
  3. 2025The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelines
  4. 2026AVDA: Autonomous Vibe Detection Authoring for Cybersecurity
  5. 2026AgenticTwin: An Agentic LLM Framework Integrated with Digital Twin for Anomaly Detection
  6. 2026CyTReX: Explainable AI-Based Cybersecurity Threat Reasoning Framework for DER Networks
  7. 2026On the Effectiveness of Kernel-Level Evidence for Agent Security
  8. 2025Temporal Attack Pattern Detection in Multi-Agent AI Workflows: An Open Framework for Training Trace-Based Security Models