CAUSAL-LAG NEURAL EVIDENCE FUSION FOR TEMPORAL TELEMETRY ATTACKS

Abstract

Streaming telemetry can remain cryptographically valid while its temporal meaning is corrupted by clock drift, replay, selective delay, or low-and-slow cross-layer manipulation. This paper proposes Causal-Lag Neural Evidence Fusion (CL-NEF), a specialized detection method that treats event time and causal order as first-class security evidence. The method jointly processes source and receive timestamps, sequence and epoch identifiers, synchronization uncertainty, freshness, policy version, and context predicates from access, TCP/QUIC, SDN, and application layers. A robust affine clock estimator and online change-point engine produce uncertainty-bounded residuals; an admissible-lag graph then constrains a temporal graph-attention model with per-layer GRU-D encoders. An evidential output head separates gradual or stepwise clock drift, replay, delayed/reordered observations, slow cross-layer manipulation, and legitimate operating-mode changes while retaining an explicit epistemic-uncertainty signal. Evidence is accepted, marked suspect, quarantined, or rejected through a hysteretic state machine with time-to-live, bounded scope, and auditable rollback. The V2-V3 evaluation protocol uses a real messaging stack, SDN/NFV components, edge nodes, TCP/QUIC profiles, controlled synchronization error, observation loss, and gateway compromise. Resource-fair baselines comprise signature validation, a static freshness window, a univariate change detector, and a non-causal multivariate neural detector. F1, false-positive rate during legitimate mode changes, detection delay, calibration error, missing-observation robustness, and threshold transferability are reported on clearly labelled synthetic data produced by a seeded generator (20 seeds per cell) that encodes the author’s design expectations; no field measurement is claimed, and a staged field trial with pre-registered go/no-go gates is proposed to replace every synthetic value. The design operationalizes a clear boundary between admissible telemetry evidence and quarantine without equating a valid signature with a temporally trustworthy state assertion.