# CSTS: A Canonical Security Telemetry Substrate for AI-Native Cyber Detection

arXiv: https://arxiv.org/abs/2603.23459 · HTML: https://mlsanity.com/paper/2603.23459/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 11 of its 35 references that are in the map.
- First posted on arXiv 24 Mar 2026.

## Builds on (most cited first, 11 of 11)

- [Supervised Contrastive Learning](https://mlsanity.com/paper/2004.11362/) (2020)
- [Towards an Open Format for Scalable System Telemetry](https://mlsanity.com/paper/2101.10474/) (2021)
- [Zero Day Threat Detection Using Graph and Flow Based Security Telemetry](https://mlsanity.com/paper/2205.02298/) (2022)
- [EG-ConMix: An Intrusion Detection Method based on Graph Contrastive Learning](https://mlsanity.com/paper/2403.17980/) (2024)
- [Self-Supervised Transformer-based Contrastive Learning for Intrusion Detection Systems](https://mlsanity.com/paper/2505.08816/) (2025)
- [Lateral Movement Detection Using User Behavioral Analysis](https://mlsanity.com/paper/2208.13524/) (2022)
- [Zero Day Threat Detection Using Metric Learning Autoencoders](https://mlsanity.com/paper/2211.00441/) (2022)
- [Cross-temporal Detection of Novel Ransomware Campaigns: A Multi-Modal Alert Approach](https://mlsanity.com/paper/2309.00700/) (2023)
- [SETC: A Vulnerability Telemetry Collection Framework](https://mlsanity.com/paper/2406.05942/) (2024)
- [Learning in Multiple Spaces: Few-Shot Network Attack Detection with Metric-Fused Prototypical Networks](https://mlsanity.com/paper/2501.00050/) (2024)
- [A Novel Contrastive Loss for Zero-Day Network Intrusion Detection](https://mlsanity.com/paper/2601.09902/) (2026)

## Abstract (arXiv)

Cybersecurity data remains fragmented across vendors, formats, schemas, and deployment environments, forcing AI and analytics programs to spend disproportionate effort on ingestion, normalization, and brittle source-specific engineering. This paper introduces the Canonical Security Telemetry Substrate (CSTS), a canonical, AI-ready telemetry foundation designed to harmonize heterogeneous cyber data into a common representation over persistent entities, typed relations, events, temporal state, and provenance. CSTS is intended to move cybersecurity analytics beyond ad hoc record normalization toward a reusable substrate that supports anomaly detection, graph learning, forecasting, behavior-based modeling, and agentic cyber AI. We formalize the core design principles of CSTS, define its representational components, and explain how it preserves source-specific nuance through explicit mappings and extensible metadata while still enabling portable downstream inference. We further position CSTS as a cloud-agnostic and deployment-agnostic substrate suitable for on-prem, hybrid, and multi-cloud environments. The result is a unifying telemetry model that reduces the blue-collar burden of cyber data engineering and creates a clearer path to scalable, interoperable, and model-agnostic cyber AI.