Paper deep dive
SwarmReconGuard: Black-Box Detection of Distributed Collective Reconnaissance by Individually Benign-Looking Agent Populations
Vahid Tavakkoli, Kabeh Mohsenzadegan, Kyandoghere Kyamakya
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 97%
Last extracted: 10/8/2026, 6:56:55 AM
Summary
The paper introduces SwarmReconGuard, a black-box benchmark for detecting Distributed Collective Reconnaissance (DCR), where multiple benign-looking agents collectively acquire system knowledge. The study evaluates various detectors (Gaussian, CUSUM, hybrid, etc.) on synthetic telemetry, finding that while Gaussian likelihood-ratio detection is perfect on known attacks, it fails on unseen policies, highlighting a generalization gap.
Entities (7)
Relation Signals (4)
Vahid Tavakkoli → affiliatedwith → University of Klagenfurt
confidence 100% · Affiliation: Institute for Smart System Technologies, University of Klagenfurt
Gaussian likelihood-ratio detection → achieves → 100% detection
confidence 95% · Gaussian likelihood-ratio detection achieves 100% detection with 0% observed false positives on known attacks
hybrid CUSUM → achieves → 85.7% detection
confidence 95% · hybrid CUSUM reaches 85.7% detection with 0% observed false positives at 10,000 identities
SwarmReconGuard → detects → Distributed Collective Reconnaissance
confidence 95% · present SwarmReconGuard, a reproducible black-box benchmark in which the defender observes only service-boundary telemetry... We formalize this threat as Distributed Collective Reconnaissance (DCR)
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Autonomous and agentic clients can distribute reconnaissance across many identities so that each request remains valid, low-rate, and benign-looking while the population collectively acquires broad system knowledge. We formalize this threat as Distributed Collective Reconnaissance (DCR) and present SwarmReconGuard, a reproducible black-box benchmark in which the defender observes only service-boundary telemetry. The Docker-isolated study evaluates 11 benign and attack behaviors across 10-10,000 virtual identities, comprising 440 test runs and 3,666,300 requests, with complete telemetry integrity. We compare semantic, Gaussian, conditional, graph, kernel, hybrid, and CUSUM-based detectors. Gaussian likelihood-ratio detection achieves 100$\%$ detection with 0$\%$ observed false positives on known attacks but only 3$\%$ on unseen policies. CUSUM yields 36.1$\%$ overall detection at 1.25$\%$ false positives, while hybrid CUSUM reaches 85.7$\%$ detection with 0$\%$ observed false positives at 10,000 identities. Results expose a major policy-generalization gap and motivate exposure-aware, scale-aware defenses.
Tags
Links
- Source: https://arxiv.org/abs/2610.09138v1
- Canonical: https://arxiv.org/abs/2610.09138v1
Trouble viewing inline? Open PDF directly →
Full Text
50,538 characters extracted from source content.
Expand or collapse full text
SwarmReconGuard: Black-Box Detection of Distributed Collective Reconnaissance by Individually Benign-Looking Agent Populations Vahid Tavakkoli Affiliation: Institute for Smart System Technologies, University of Klagenfurt, Klagenfurt, Austria*Corresponding author: Vahid Tavakkoli (vahid.tavakkoli@aau.at) Kabeh Mohsenzadegan Affiliation: Institute for Smart System Technologies, University of Klagenfurt, Klagenfurt, Austria*Corresponding author: Vahid Tavakkoli (vahid.tavakkoli@aau.at) Kyandoghere Kyamakya Affiliation: Institute for Smart System Technologies, University of Klagenfurt, Klagenfurt, Austria*Corresponding author: Vahid Tavakkoli (vahid.tavakkoli@aau.at) Abstract Autonomous and agentic clients can distribute reconnaissance across many identities so that each request remains valid, low-rate, and benign-looking while the population collectively acquires broad system knowledge. We formalize this threat as Distributed Collective Reconnaissance (DCR) and present SwarmReconGuard, a reproducible black-box benchmark in which the defender observes only service-boundary telemetry. The Docker-isolated study evaluates 11 benign and attack behaviors across 10–10,000 virtual identities, comprising 440 test runs and 3,666,300 requests, with complete telemetry integrity. We compare semantic, Gaussian, conditional, graph, kernel, hybrid, and CUSUM-based detectors. Gaussian likelihood-ratio detection achieves 100% detection with 0% observed false positives on known attacks but only 3% on unseen policies. CUSUM yields 36.1% overall detection at 1.25% false positives, while hybrid CUSUM reaches 85.7% detection with 0% observed false positives at 10,000 identities. Results expose a major policy-generalization gap and motivate exposure-aware, scale-aware defenses. Keywords: agentic AI security; anomaly detection; collective behavior; CUSUM; distributed reconnaissance; intrusion detection; multi-agent systems; semantic exposure; swarm security. 1 Introduction Modern public services increasingly expose structured application programming interfaces (APIs) to browsers, mobile applications, automation, and software agents. Conventional defenses are effective when harmful behavior is locally conspicuous: a client exceeds a request-rate limit, an exploit signature appears in payloads, authentication fails repeatedly, or resource consumption resembles denial of service. A more difficult regime arises when a large population performs individually acceptable actions that compose into harmful collective knowledge acquisition. A single request may disclose almost nothing; thousands of strategically distributed requests may reconstruct endpoint behavior, identifier structure, diagnostic metadata, or authorization boundaries. The emergence of agentic artificial intelligence increases the practical relevance of this problem. Recent work documents the rapid development of autonomous and multi-agent systems, their use in cyber threat intelligence, automated vulnerability analysis, incident response, and security operations, and the accompanying security risks [1, 2, 3, 4, 5, 6, 7]. At the same time, intrusion-detection research remains dominated by flow-, host-, or identity-level classification, DDoS detection, botnet signatures, learned traffic models, and federated variants [8, 9, 10, 11, 12, 13]. These approaches are valuable but do not directly answer the following question: Can a high-availability service detect coordinated information acquisition when every individual identity remains within ordinary request budgets and the defender cannot observe the agents’ internal coordination? We call this threat class Distributed Collective Reconnaissance (DCR). DCR differs from classical DDoS in objective and observability. The goal is not necessarily to reduce service availability but to maximize cumulative information acquired about the service while keeping marginal behavior plausible. It also differs from a traditional scan performed by one source because attribution can be distributed over many identities, and from a white-box multi-agent monitoring problem because the defender sees only boundary events. This paper introduces SwarmReconGuard, a reproducible Docker-isolated experimental framework for measuring this regime. The framework is intentionally black-box from the defender’s perspective: it observes request/response telemetry at an API gateway but not agent prompts, shared memory, coordination messages, model activations, true swarm membership, or scenario labels. The study uses scripted virtual identities rather than claiming that all 10,000 entities are large-language-model (LLM) agents. Scripted policies provide experimental control at population scale; the threat model is designed to include autonomous agents as a motivating and future deployment class. The paper makes five main contributions. 1. We formalize DCR as a collective information-acquisition problem under per-identity validity, hidden coordination, and service-availability constraints, and state an observability limit that prevents any boundary-only detector from recovering hidden intent when benign and adversarial observable distributions are identical. 2. We present a reproducible benchmark with four benign controls, seven attack policies, four population scales, independent training/calibration/test phases, exact telemetry accounting, raw-event replay, and an internal-only safety boundary. 3. We evaluate ten online detector families and three ablations, ranging from transparent semantic features to distributional, graph, kernel, fusion, and sequential evidence-accumulation methods. 4. We evaluate operational protection with false-positive rate (FPR), detection, precision, discrimination, delay, and Exposure Before Detection (EBD), while counting missed attacks through exposure-at-alarm-or-end rather than excluding them from exposure summaries. 5. We provide a generalization study across known versus unseen attack policies and population scales. The strongest known-policy result is near-perfect, yet unseen-policy recall falls sharply. This negative result is central: excellent known-attack separation does not establish robust DCR defense. The remainder of the paper reviews related work, formalizes the threat model, describes SwarmReconGuard and its detectors, reports the experimental protocol and results, and discusses implications, limitations, and research directions. 2 Related Work and Research Gap 2.1 Network Intrusion, Botnet, and DDoS Detection Recent IEEE literature has substantially advanced machine-learning-based intrusion detection. Surveys have reviewed ML/DL approaches for IoT intrusion prevention [8], IoT botnet detection [12], Internet-of-Drones IDS [14], and adversarial robustness of network IDS [13]. Representative systems use statistical feature selection for botnets [10], source-side collaborative sequence models for DDoS [15], network-traffic visualization [16], explainability frameworks [17, 18], and deep or federated learning [11, 19, 20, 21, 22]. SDN-focused work also includes targeted control-plane defenses [23] and privacy-preserving intrusion detection frameworks [24]. DDoS-specific work emphasizes volumetric or protocol-level anomalies and service degradation [25, 26]. These methods provide important baselines, but DCR may preserve normal aggregate throughput and deliberately distribute semantic exploration across clients. Dataset realism and reproducibility are also recurring concerns. Edge-IIoTset introduced a purpose-built IoT/IIoT cybersecurity testbed [27], while Arifin et al. developed a SCADA dataset generated from a hybrid physical/virtual environment [28]. SwarmReconGuard follows the same principle that controlled, replayable testbeds are necessary, but targets a different dependent variable: collective semantic coverage and information exposure rather than only packet/flow attack class. 2.2 Zero Trust, Context, and Boundary Enforcement Zero-trust architectures emphasize continuous verification, least privilege, and resource-centered policy rather than implicit trust [29]. Later work has explored zero-trust hardware/supply-chain enforcement [30] and session-lifecycle-aware authorization with rapid revocation [31]. These ideas are complementary to DCR defense because contextual authorization can add differentiating information when pure behavioral observation is insufficient. SwarmReconGuard does not implement authorization mitigation; instead it measures what can be inferred from traffic when valid requests have already been admitted. 2.3 Distribution Shift, Graphs, and Explainability Network behavior is rarely stationary or exactly Gaussian. Dynamic graph representation learning provides a general framework for evolving relational structures [32]; log anomaly detection illustrates sequence-level modeling in operational data [33]; and explainable IDS research emphasizes the need to understand model decisions and failure modes [17, 18]. Our detector suite therefore includes both an interpretable heuristic and deliberately simple statistical baselines, while treating Gaussianity as an approximation to be tested rather than assumed. We also include handcrafted temporal bipartite graph descriptors and a kernel distributional baseline to examine whether cross-identity organization is detectable without reconstructing a hidden swarm graph. 2.4 Agentic and Multi-Agent Cybersecurity Agentic AI now supports cyber threat intelligence, vulnerability assessment, incident response, scenario generation, and security operations. MAD-CTI uses LLM agents for dark-web threat analysis [4]; Hmimou et al. use multiple agents for threat detection and correlation [5]; Toprani and Madisetti apply agentic workflows to infrastructure-as-code vulnerabilities [6]; Roh and Kim generate cyberattack scenarios with LLMs [34]; AutoBnB studies multi-agent incident response [35]; Cognitive SOC coordinates LLM agents in security operations [36]; and recent studies expose code-injection risks in LLM-based multi-agent software development [7]. Broad surveys now characterize agentic-AI architectures and security risks [3, 1, 2]. Recent multi-agent safety research is closer to our collective-risk setting, but differs in observability. NARCBench studies covert collusion with white-box activation probes and reports a marked transfer gap under structurally different scenarios [37]. RiskLab provides a controlled toolkit for emergent risks such as collusion and resource overreach in LLM multi-agent systems [38], while long-horizon experiments show that undesirable coordination can emerge from repeated agent interaction [39]. ALTEDA detects and attributes multi-agent LLM threats from synchronized application, network, and system logs without reading prompts or responses [40]. These studies establish collective and interaction-level risk as a serious problem. SwarmReconGuard complements them by assuming that the attacker-side runtime, inter-agent messages, and internal logs are inaccessible: the defender receives only the service-boundary footprint of the population. This literature shows both the utility and the attack potential of autonomous agents, but most work observes the agent framework itself or evaluates task performance. SwarmReconGuard instead assumes the attacker-side runtime is inaccessible. The research gap is therefore the boundary-only detection of a harmful collective whose members can each remain policy-compliant. 2.5 Research Gap The closest conventional analogies are low-and-slow scanning, distributed botnets, API enumeration, DDoS, and anomaly detection. None alone captures all four properties that define our target regime: (i) individually valid low-budget actions, (i) hidden coordination or complementary exploration, (i) cumulative semantic coverage rather than availability loss as the attacker objective, and (iv) a service-side defender limited to boundary telemetry. SwarmReconGuard operationalizes this combination and explicitly measures policy generalization rather than only in-distribution accuracy. 3 Threat Model and Problem Formulation 3.1 Service, Agents, and Observables Let a service have hidden state S and an exposed request mechanism M. At step t, an identity iti_t issues an allowed query qtq_t and receives response yt=M(S,qt).y_t=M(S,q_t). (1) The attacker may control a set of identities A and coordinate them outside the defender’s environment. The defender does not observe hidden policy state, prompts, shared memory, internal messages, or the true membership of A. It observes only boundary telemetry ot=ϕ(qt,yt,mt),o_t=φ(q_t,y_t,m_t), (2) where mtm_t denotes timing, synthetic identity, status, body size, endpoint family, and related service metadata. DCR is an attack process in which the population maximizes cumulative information acquisition while each member remains locally plausible. An information-theoretic idealization is maxπAI(S;Y1:T)s.t.Ri(Ai)≤τi,SLA≥SLAmin, _ _AI(S;Y_1:T) .t. R_i(A_i)≤ _i,\;SLA _ , (3) where RiR_i is an individual risk/rate rule. In the synthetic benchmark, exact mutual information is not available; we use measurable semantic coverage and synthetic weakness discovery as proxies. Let Φ(q) (q) be the semantic resource key revealed by a query and obsS_obs the finite synthetic observable namespace. Collective semantic coverage is C(t)=|⋃j≤tΦ(qj)||obs|.C(t)= | _j≤ t (q_j)||S_obs|. (4) The operational defender seeks an alarm rule D that reduces exposure while constraining false alarms and service cost: minD[ED]+αFPR+βΔSLA, _D\;E[E_D]+α\,FPR+β\, , (5) where EDE_D is exposure at alarm, or final exposure when an attack is missed. 3.2 Observability Limit A boundary-only detector cannot infer hidden coordination if the attacker exactly matches the benign observable distribution. Let PB(O)P_B(O) and PA(O)P_A(O) be distributions over complete observable streams. With equal priors, the optimal classification accuracy is Acc∗=12(1+TV(PA,PB)),Acc^*= 12 (1+TV(P_A,P_B) ), (6) where TVTV is total variation distance. If PA=PBP_A=P_B, then TV=0TV=0 and no detector restricted to O can outperform chance. This elementary decision-theoretic limit is important: successful DCR defense must exploit an observable distributional difference, introduce new differentiating context (e.g., stronger authorization or proof-of-context), reduce disclosure, or accept residual leakage. SwarmReconGuard evaluates the first option. 3.3 Attacker and Defender Assumptions The benchmark attacker can distribute valid HTTP GET requests among virtual identities and, depending on scenario, coordinate complementary namespace exploration. It cannot access host shells, real secrets, external systems, or the detector. The defender owns the gateway and target service and sees complete synthetic boundary telemetry. It does not receive scenario labels at inference time, and mixed-swarm membership is evaluator-only. Trial boundaries are supplied by the laboratory; continuous production-stream segmentation remains outside this work. 4 SwarmReconGuard Architecture Figure 1: SwarmReconGuard architecture. Attacker-side policy and coordination are hidden. The defender receives only API-boundary telemetry, from which window-level semantic, graph, distributional, and sequential evidence is derived. Figure 1 summarizes the design. The environment comprises an internal Docker network, a synthetic municipal-style API, a gateway that records telemetry, a Redis event stream, online detectors, an experiment runner, and an evaluator/reporting pipeline. No public target port is exposed, the experiment runner rejects arbitrary non-lab hosts, Linux capabilities are dropped, no Docker socket is mounted, and the target contains no shell-execution or real-exploitation path. 4.1 Synthetic Information Channels The service contains three harmless information surfaces selected because they admit measurable ground truth without real exploitation: • V001 – ticket enumeration: valid and invalid synthetic ticket identifiers reveal existence/status structure; • V002 – permit-prefix oracle: a two-character prefix query returns a synthetic aggregate count over a finite namespace; • V003 – diagnostic disclosure: a valid diagnostic view returns unnecessary synthetic backend metadata. The system records discovery of these conditions and population/attacker semantic coverage. Coverage is explicitly interpreted as a proxy for information acquisition, not as a percentage of real secrets reconstructed. 4.2 Traffic Regimes Table 1 lists the 11 evaluation scenarios. Four benign workloads are designed to prevent convenient shortcuts: legitimate diagnostic access removes an exclusive diagnostic cue; benign exploration creates broad semantic novelty; and benign bulk access creates a high-volume hard negative. Seven attack policies include two known training policies and five unseen variants. The matched-swarm control approximately aligns individual resource marginals while changing collective sampling structure. The mixed-swarm scenario embeds a hidden 20% attacker subset inside benign traffic. Table 1: Benchmark Scenarios Scenario Label Purpose benign_flash Benign Locality, popular resources, and repeated ordinary access. benign_diagnostic Benign Legitimate diagnostic access; removes an attack-exclusive metadata cue. benign_explorer Benign Independent broad exploration with low diagnostic probability. benign_bulk Benign Broad repetitive batch workflow and high-volume hard negative. independent_recon Known attack Independent uniform reconnaissance; one of two attack policies used for fitting. coordinated_swarm Known attack Randomized stratified partitioning that reduces duplicate work. swarm_no_diagnostic Unseen attack Coordinated exploration without the diagnostic channel. matched_swarm Unseen attack Approximate per-identity marginal matching with coordinated collective sampling. camouflaged_swarm Unseen attack Mixes hot-resource requests with coordinated exploration. low_and_slow_swarm Unseen attack Adds seeded inter-request delay to reduce temporal conspicuity. mixed_swarm Unseen attack Hides a seeded 20% attacker subset inside benign population traffic. 5 Detection Methods All online methods score identical non-overlapping event windows. The first window contains 16 events where available; subsequent publication windows contain up to 64 events with a one-second time limit, and the terminal tail is explicitly scored so events are never silently discarded. 5.1 Transparent Semantic Heuristic For a window, SwarmReconGuard computes novelty ratio N, normalized namespace span S, gap uniformity G, diagnostic ratio D, endpoint-family entropy H, and semantic coverage pressure C. The transparent baseline is Rh=0.18N+0.22S+0.20G+0.15D+0.15H+0.10C.R_h=0.18N+0.22S+0.20G+0.15D+0.15H+0.10C. (7) The purpose is not to claim optimal weights but to provide an auditable baseline that embodies the hypothesis that systematic exploration has semantic structure beyond request volume. 5.2 Gaussian and Conditional Distribution Models Bounded features are clipped and logit transformed. The unconditional benign model is a shrinkage-regularized multivariate Gaussian ∼(B,B), x ( μ_B, _B), (8) with squared Mahalanobis OOD score dB2()=(−B)TB−1(−B).d_B^2( x)=( x- μ_B)^T _B^-1( x- μ_B). (9) Known attack policies are represented as a mixture, producing a likelihood-ratio score Λ()=logpA()−logpB(). ( x)= p_A( x)- p_B( x). (10) Because benign behavior changes with workload and scale, the conditional models regress transformed features on context =[1,log(1+nw),log(1+iw),log(1+nc),log(1+ic)], c=[1, (1+n_w), (1+i_w), (1+n_c), (1+i_c)], (11) where nw/iwn_w/i_w and nc/icn_c/i_c are window/cumulative request and identity counts. Gaussian residual models are then fitted per training regime. This yields conditional OOD and conditional LLR scores. 5.3 Collective Graph Descriptors A temporal bipartite identity–resource-region graph is built over each window. Descriptors include cross-identity novelty, region balance and entropy, identity specialization, temporal namespace progression, connected-component fraction, and cumulative variants. The graph detector is deliberately a statistical model over interpretable descriptors rather than a graph neural network. It tests whether organization such as complementary exploration is observable without access to a true attacker coordination graph. 5.4 Kernel Distribution Shift To relax Gaussian assumptions, benign conditional residuals are embedded with random Fourier features approximating a Gaussian kernel. The detector compares the recent residual-feature mean with a benign reference mean, yielding an approximate kernel maximum mean discrepancy (MMD) score. This is a computational distribution-shift signal rather than an exact permutation-test p-value; the conceptual connection is to kernel two-sample testing [41]. 5.5 Hybrid and Sequential Evidence The pointwise hybrid standardizes and averages three training-derived signals: Rhyb=z(Rh)+z(Λc)+z(Rg)3,R_hyb= z(R_h)+z( _c)+z(R_g)3, (12) where Λc _c is conditional LLR and RgR_g is graph OOD evidence. Three ablations remove graph, LLR, or heuristic evidence. Sequential methods accumulate weak evidence. The LLR CUSUM is Ct=max(0,Ct−1+Λc,t),C_t= (0,C_t-1+ _c,t), (13) and hybrid CUSUM uses Cthyb=max(0,Ct−1hyb+Rhyb,t−κ),C_t^hyb= (0,C_t-1^hyb+R_hyb,t-κ), (14) with drift allowance κ=0.5κ=0.5. CUSUM follows the classical principle of sequential change accumulation [42] but is applied here to collective semantic evidence. 5.6 Independent Calibration Training and alarm calibration are separate. Model parameters are fitted on 72 measured HTTP training streams. Thresholds are then calibrated using 299 independent benign HTTP streams. For method m, let Mj(m)M_j^(m) be the maximum score over calibration stream j. With target α=0.01α=0.01, the rank threshold is τm=M(k)(m),k=⌈(n+1)(1−α)⌉. _m=M^(m)_(k), k= (n+1)(1-α) . (15) For n=299n=299, k=297k=297 and the empirical rank resolution is 1/(n+1)=0.003331/(n+1)=0.00333. This calibration controls one alarm decision per complete stream under exchangeability and comparable horizons; it is not a claim of a universal 1% production FPR at every population scale. 6 Experimental Design 6.1 Study Matrix and Integrity The test matrix contains 11 scenarios, four population sizes N∈10,100,1000,10000N∈\10,100,1000,10000\, and 10 repetitions, yielding 440 test runs. Every identity receives three requests. The study therefore generates 3,666,300 test requests. Training and calibration are independent and add 3,066,990 measured reference HTTP requests. The experiment was executed in a Linux/WSL2 environment with 16 logical CPUs and Python 3.12.12; all containers run on the internal Docker network. Strict telemetry is a design invariant. A run is valid only when the client logical-request count, gateway forwarded count, and detector-processed event count agree and no telemetry failure or unrecovered transport error occurs. The final study contains 440/440 valid runs and exactly 3,666,300 processed events for 3,666,300 test requests, with zero telemetry failures. Bounded transport retry and idempotent logical request identifiers protect measurement integrity without accepting incomplete traces. 6.2 Metrics We report AUROC and average precision (AP) as threshold-independent ranking measures, and detection rate, FPR, precision, F1, and Wilson 95% intervals at the independently calibrated operating point. Repeated continuous metrics use sample standard deviation and Student-t intervals. Hedges’ g is reported for selected effect-size contrasts. Exposure Before Detection is EBD=C(talarm).EBD=C(t_alarm). (16) However, averaging EBD only over detected attacks is selection-biased. We therefore also report exposure at alarm or end, defined as C(talarm)C(t_alarm) if detected and C(T)C(T) otherwise. Event-prefix alarm exposure is distinguished from wall-clock exposure audited at the actual observer alarm time; backlog can make the latter larger. Service metrics include client p50/p95/p99 latency, throughput, transport errors, matched benign SLA deltas, detector processing time per event, and processing lag. The detector is observational and does not block requests, so these measurements quantify benchmark overhead and traffic effects rather than mitigation benefit. 6.3 Offline Generalization Analysis Completed-run Gaussian baselines are also evaluated with leave-repeat-out, leave-scale-out, and leave-attack-policy-out folds. An inner benign repetition is excluded from model fitting and used only for threshold calibration. Because independently fitted folds need not share a common score scale, macro-fold AUROC/AP are primary. These smaller folds are supportive analyses; they do not establish the online 1% FPR target. 7 Results 7.1 Overall Online Operating Points Table 2 summarizes selected online methods. The central result is not a single universally dominant detector. Different methods occupy different precision–recall–exposure trade-offs. The transparent heuristic achieves AUROC 0.828 with 32.1% detection at 0.625% FPR. Gaussian LLR produces zero observed benign alarms and 30.7% attack detection. CUSUM gives the highest overall detection rate (36.1%) and F1 (0.527), at 1.25% FPR and 98.1% precision. Hybrid CUSUM is more conservative overall but becomes much stronger at the largest population scale. Table 2: Selected Online Results Across 440 Test Runs Method AUROC AP FPR Detection Precision F1 Exposure alarm/end Median delay Heuristic 0.828 0.895 0.625% 32.1% 98.9% 0.485 6.15% 0.90 s Gaussian LLR 0.820 0.890 0.000% 30.7% 100% 0.470 6.15% 6.45 s Conditional LLR 0.789 0.867 0.625% 21.1% 98.3% 0.347 6.04% 0.85 s CUSUM 0.787 0.873 1.250% 36.1% 98.1% 0.527 4.89% 1.11 s Hybrid CUSUM 0.752 0.855 0.625% 29.3% 98.8% 0.452 5.69% 35.74 s Hybrid without graph 0.842 0.901 0.625% 28.9% 98.8% 0.448 6.16% 0.70 s Figure 2: Observed operating-point trade-off between false positives and attack detection. Threshold-independent discrimination and calibrated recall are distinct properties. Figure 2 emphasizes that high AUROC does not automatically translate to high recall at a conservative calibrated threshold. This distinction is central for safety-critical deployment: discrimination, calibration, and early protection must be reported separately. 7.2 Known Versus Unseen Attack Policies The clearest result is the generalization gap shown in Table 3 and Fig. 3. Gaussian LLR perfectly detects the two known attack policies with no observed benign false positives, yet detects only 3.0% of the five unseen policies. The heuristic falls from 93.75% known-policy detection to 7.5% unseen detection. Sequential accumulation partially recovers this gap: CUSUM detects 75.0% known and 20.5% unseen attacks, while hybrid CUSUM detects 48.75% known and 21.5% unseen attacks. The unseen-policy precision of hybrid CUSUM remains 97.7%, indicating that the difficulty is recall rather than alarm purity. Table 3: Known-Policy Versus Unseen-Policy Generalization Method Known policies (80 attacks) Unseen policies (200 attacks) Detection FPR AUROC Detection FPR AUROC Heuristic 93.75% 0.625% 0.996 7.50% 0.625% 0.761 Gaussian LLR 100% 0% 1.000 3.00% 0% 0.748 CUSUM 75.00% 1.250% 0.996 20.50% 1.250% 0.703 Hybrid CUSUM 48.75% 0.625% 0.813 21.50% 0.625% 0.728 Hybrid without graph 86.25% 0.625% 0.998 6.00% 0.625% 0.780 Figure 3: Detection rate on known and unseen attack policies. Near-perfect known-policy performance does not imply robustness to policy shift. This result argues against reporting only in-distribution accuracy. DCR strategies can alter coordination, diagnostic usage, timing, or attacker fraction while preserving the high-level objective of collective information acquisition. 7.3 Population Scale Figure 4 shows that scale affects methods differently. Hybrid CUSUM is ineffective at 10 and 100 identities, reaches 31.4% detection at 1,000, and 85.7% at 10,000 with zero observed benign false positives at that scale. CUSUM detects 52.9% at 100, 34.3% at 1,000, and 57.1% at 10,000. The pointwise heuristic performs best at 100 identities but does not improve monotonically. Thus, “more agents means easier detection” is not a universal law; detectability depends on the interaction between policy, windowing, cumulative structure, and calibration. Nevertheless, the largest population produces strong sequential collective evidence. Figure 4: Detection rate by population scale for selected methods. The response to scale is detector-dependent; hybrid CUSUM becomes especially effective at 10,000 identities. 7.4 Ablation: Graph Evidence Is Not Yet Helpful Ablation results are intentionally reported even though they weaken the proposed fusion. Removing graph evidence increases pointwise hybrid AUROC from 0.674 to 0.842 and detection from 8.2% to 28.9%, whereas removing heuristic or LLR evidence collapses performance (Table 4). This shows that the present handcrafted graph representation is not sufficiently transferable under the hard benign controls and should not be presented as a solved contribution. The result is useful: collective graph structure is theoretically attractive, but the chosen descriptors require refinement before they improve operational detection. Table 4: Pointwise Hybrid Ablation Variant AUROC Detection FPR Full hybrid 0.674 8.2% 0.0% No graph 0.842 28.9% 0.625% No heuristic 0.603 1.4% 0.0% No LLR 0.660 7.9% 0.0% Figure 5: AUROC for the pointwise hybrid and component-removal ablations. Removing graph evidence improves performance, identifying a concrete limitation of the current graph descriptor set. 7.5 Offline Leave-Attack-Out Validation The completed-run offline analysis independently supports the presence of policy shift. In leave-attack-out evaluation, hybrid ranking reaches pooled AUROC 0.841 and macro AUROC 0.846, but its calibrated detection is 39.3% at 4.46% FPR. Gaussian LLR yields AUROC 0.809 with 19.6% detection at 1.79% FPR. These values are not directly comparable to the stronger 299-stream online calibration because the offline folds have far fewer calibration observations. They reinforce the main conclusion: ranking remains informative under unseen policy, but robust low-FPR operating-point calibration is difficult. 7.6 Gaussian Assumption Diagnostics The benign pooled feature distribution is decisively non-Gaussian. After logit transformation, Shapiro–Wilk tests reject univariate normality for every non-constant feature (p<10−8p<10^-8 for semantic coverage and much smaller for several others); family entropy is constant in the pooled run-level diagnostic. Mardia skewness has p=5.81×10−92p=5.81× 10^-92 and kurtosis has p=5.09×10−12p=5.09× 10^-12. These diagnostics validate our decision to treat single-Gaussian OOD/LLR as interpretable baselines rather than literal traffic laws. The conditional mixtures and kernel baseline address some heterogeneity, although the kernel method’s calibrated threshold is too conservative to produce attacks alarms in this study. 7.7 Service Behavior and Detector Overhead Figure 6 separates semantic reconnaissance from volumetric denial of service. At 10 and 100 identities, mean p95 latency is approximately 7.5 and 20.7 ms. At 1,000 and 10,000 identities, the single synthetic service saturates and mean p95 latency increases to approximately 2.78 and 3.06 s, with mean throughput near 271 and 261 requests/s. Importantly, the attack-vs-matched-benign mean p95 delta at 10,000 identities is only about 1.3%, indicating that the attack regimes do not require substantial incremental service degradation once load is matched. This supports the conceptual distinction from DDoS, but it does not justify claiming that the 10,000-identity service is itself within a production SLA; it is capacity-limited in this laboratory configuration. The detector’s average processing cost decreases from roughly 178 μ /event at the smallest scale to 61 μ /event at 10,000 identities because fixed per-window overhead is amortized. Mean p95 processing lag remains around 5–7 ms. No test run has a transport error after bounded retry recovery, and all telemetry integrity checks pass. Figure 6: Measured service p95 latency and throughput versus population size. The synthetic service saturates at high scale; security conclusions therefore compare attacks with matched benign load rather than claiming a production SLA. 8 Discussion 8.1 What the Results Establish The strongest evidence is that collective semantic behavior can be distinguishable even when the experimental per-identity budget rule never needs to be the primary signal. The two fitted reconnaissance policies are almost perfectly separable from four diverse benign controls. This confirms the core hypothesis that population-level semantic organization can expose behavior that request volume alone does not explain. The larger contribution, however, is the failure mode. A detector trained on independent and coordinated reconnaissance does not automatically generalize to diagnostic-free, marginal-matched, camouflaged, low-and-slow, or mixed-membership strategies. Gaussian LLR is the clearest example: 100% known-policy detection at zero observed FPR falls to 3% unseen-policy detection. This gap is not an implementation inconvenience; it is a realistic security property. An adaptive adversary can change how a goal is achieved while preserving the goal itself. Sequential accumulation is the most promising direction in the present results. CUSUM achieves the best overall recall and F1, and hybrid CUSUM substantially improves at 10,000 identities. This supports the idea that DCR may be better modeled as weak evidence accumulated over time than as a single anomalous window. Future work should calibrate sequential detectors under variable stream horizons and use explicit time-to-harm objectives. 8.2 Exposure Matters More Than AUROC Alone A detector with high AUROC can still be operationally weak if the alarm occurs after substantial semantic acquisition. Conversely, a conservative detector may miss many attacks but alarm very early on those it detects. Reporting EBD only for detected attacks would favor such methods. Exposure-at-alarm-or-end corrects this selection effect by assigning final exposure to misses. Future evaluation should go further and define service-specific harm thresholds ChC_h or knowledge predicates, then measure whether talarm<tharmt_alarm<t_harm. 8.3 Implications for API Defense The observability limit in Section 3 implies that no traffic classifier can solve DCR when adversarial and benign observable distributions are identical. A complete architecture should therefore combine detection with at least one mechanism that changes information available to either side: contextual authorization, task-scoped capabilities, selective challenges, response minimization, uncertainty injection where semantically acceptable, or service-level exposure budgets. Zero-trust and session-aware access-control research provides complementary mechanisms [29, 31]. SwarmReconGuard is designed to quantify the residual observable signal and the cost of relying on behavioral detection alone. 8.4 Agentic AI Relevance Without Overclaiming The motivating threat includes LLM and planner agents capable of adaptive reconnaissance, but this benchmark intentionally uses scripted policies for controlled population-scale experiments. This distinction matters. The results demonstrate a property of distributed behavioral policies, not a property unique to LLM reasoning. Agentic systems make the threat more plausible because they can plan, delegate, share state, and adapt [1, 2]; validating transfer from scripted swarms to real constrained LLM agents is future work. 9 Threats to Validity and Limitations External validity: one synthetic municipal-style API cannot establish general performance across production services. A second independently implemented service is the highest-priority extension. Cross-service calibration and evaluation should precede deployment claims. Policy realism: attack and benign behaviors are controlled scripted policies. They create difficult controls but do not reproduce all properties of real users, bots, or autonomous agents. The matched-swarm construction approximates marginal matching rather than proving equality of complete individual distributions. Boundary segmentation: the lab supplies trial boundaries. Production detection would require continuous segmentation, decay, sessionization, or a rolling-horizon alarm policy. Calibration of maxima also assumes comparable monitoring horizons. Calibration: the 299-stream rank procedure targets a stream-level false-alarm probability under exchangeability; workload, scale, or seasonal shifts can violate this assumption. Observed FPR and Wilson intervals are therefore reported and should supersede nominal claims. Synthetic exposure: semantic coverage counts unique synthetic resource keys; it is not an information-theoretic estimate of actual secrets learned by a real adversary. The three vulnerability-discovery predicates are harmless benchmark markers. Service capacity: the target saturates at 1,000–10,000 identities on the experiment host. We compare matched benign and attack load to avoid conflating DCR with DDoS, but a separate capacity study is required to make strict SLA-preservation claims. Graph method: handcrafted graph evidence does not improve the current hybrid and should be regarded as a negative ablation result rather than a validated component. No active mitigation: detectors are observational. They do not throttle, redact, challenge, or alter service responses. Therefore the study measures detection/exposure, not prevention benefit or user-friction cost. 10 Reproducibility, Safety, and Artifact Availability SwarmReconGuard is available at https://github.com/vtavakkoli/swarm-recon-guard. The repository provides Docker Compose profiles, source code, deterministic scenario seeds, calibration configuration, statistical reports, raw event traces, fitted detector bundles, and replay verification. The publication profile creates HTML, CSV, JSON/JSONL, compressed event traces, integrity metadata, and exact calibration artifacts. Replay re-scores saved events and verifies peak scores, alarm decisions, request counts, and exposure without reissuing HTTP requests. The benchmark is intentionally confined to an internal Docker network. It rejects arbitrary external targets, exposes no public target port, drops Linux capabilities, mounts no Docker socket, and contains no real exploit engine, credential theft, persistence, or destructive actions. The synthetic target contains only harmless proof conditions. 11 Future Research The results suggest five concrete extensions. First, evaluate a second and third API domain and perform train-on-A/test-on-B cross-service transfer. Second, replace global Gaussian assumptions with scale/load-conditioned mixtures, robust density estimation, and calibrated conformal or sequential alternatives. Third, introduce constrained LLM/planner agents at smaller scale while retaining scripted policies for causal and population-scale controls. Fourth, formulate an adaptive attacker–defender game in which the swarm maximizes information gain while penalizing detector score, allowing explicit evaluation of evasion. Fifth, connect detection to selective disclosure controls and quantify the joint objective min(ED+αFPR+βΔSLA+γFriction). (E_D+ +β + ). (17) The research target should not be another perfect known-policy AUROC. A more meaningful goal is high unseen-policy recall at sub-1% FPR, low exposure-at-alarm-or-end, and negligible incremental SLA impact under a service operating below its saturation knee. 12 Conclusion This paper formalized Distributed Collective Reconnaissance and introduced SwarmReconGuard, a boundary-only benchmark for detecting harmful collective exploration from individually low-budget identities. The final study executed 440 measured test runs and 3.66 million test requests with exact telemetry integrity, following independent measured training and 299-stream benign calibration. Known reconnaissance policies can be detected with extremely high accuracy: Gaussian LLR achieved 100% known-policy detection with zero observed false positives. The more important finding is that this success does not transfer automatically to unseen attack policies. Sequential evidence accumulation improves unseen-policy recall and becomes especially effective at the largest population scale, but no evaluated method solves generalization. The current graph descriptor also fails its ablation test, and the service saturates at high load, both of which are reported explicitly. These results support a cautious conclusion: collective semantic behavior is a measurable security signal, but robust DCR defense requires exposure-aware sequential detection, stronger policy-shift generalization, and complementary authorization or disclosure controls. SwarmReconGuard provides a reproducible basis for that research rather than a claim of production-ready intrusion prevention. Data and Code Availability The implementation, scenario definitions, Docker configuration, and reproducibility tooling are publicly available at https://github.com/vtavakkoli/swarm-recon-guard. The complete final report bundle used for the tables and figures is included with the manuscript submission package; the experiment can be regenerated from the public repository and the publication scenario configuration. References [1] A. Chhabra, S. Datta, S. K. Nahin, and P. Mohapatra, “Agentic AI security: Threats, defenses, evaluation, and open challenges,” IEEE Access, vol. 14, p. 49455–49482, 2026. [2] R. Addis et al., “LLM-based intelligent agents for cybersecurity: A tutorial and survey of automated vulnerability discovery,” IEEE Access, vol. 14, p. 100884–100917, 2026. [3] C. Moralles, L. A. L. F. Da Costa, S. J. Rigo, R. Kunst, V. C. De Souza, E. P. Silva, G. L. E. Prado, T. D. C. Schardosim, and A. Roehrs, “A systematic literature review of agentic AI: Definitions, architectures, and challenges,” IEEE Access, vol. 14, p. 36176–36190, 2026. [4] S. Shah and V. K. Madisetti, “MAD-CTI: Cyber threat intelligence analysis of the dark web using a multi-agent framework,” IEEE Access, vol. 13, p. 40158–40168, 2025. [5] Y. Hmimou, M. Tabaa, A. Khiat, and Z. Hidila, “A multi-agent system for cybersecurity threat detection and correlation using large language models,” IEEE Access, vol. 13, p. 150199–150215, 2025. [6] D. Toprani and V. K. Madisetti, “LLM agentic workflow for automated vulnerability detection and remediation in infrastructure-as-code,” IEEE Access, vol. 13, p. 69175–69181, 2025. [7] B. Bowers, S. Khapre, and J. Kalita, “Analyzing code injection attacks on LLM-based multi-agent systems in software development,” in Proc. IEEE Int. Conf. Machine Learning and Applications (ICMLA), 2025, p. 1131–1136. [8] P. L. S. Jayalaxmi, R. Saha, G. Kumar, M. Conti, and T.-H. Kim, “Machine and deep learning solutions for intrusion detection and prevention in IoTs: A survey,” IEEE Access, vol. 10, p. 121173–121192, 2022. [9] H. Suryotrisongko, Y. Musashi, A. Tsuneda, and K. Sugitani, “Robust botnet DGA detection: Blending XAI and OSINT for cyber threat intelligence sharing,” IEEE Access, vol. 10, p. 34613–34624, 2022. [10] R. Kalakoti, S. Nomm, and H. Bahsi, “In-depth feature selection for the statistical machine learning-based botnet detection in IoT networks,” IEEE Access, vol. 10, p. 94518–94535, 2022. [11] A. B. Z. Mahmoodi, S. Sheikhi, E. Peltonen, and P. Kostakos, “Autonomous federated learning for distributed intrusion detection systems in public networks,” IEEE Access, vol. 11, p. 121325–121339, 2023. [12] T. A. Shurbaji, M. Anbar, S. Manickam, I. H. Hasbullah, et al., “Deep learning-based intrusion detection system for detecting IoT botnet attacks: A review,” IEEE Access, vol. 13, p. 11792–11822, 2025. [13] S. Ennaji, F. de Gaspari, D. Hitaj, A. Kbidi, and L. V. Mancini, “Adversarial challenges in network intrusion detection systems: Research insights and future prospects,” IEEE Access, vol. 13, p. 148613–148645, 2025. [14] M. Ogab, S. Zaidi, A. Bourouis, and C. T. Calafate, “Machine learning-based intrusion detection systems for the Internet of Drones: A systematic literature review,” IEEE Access, vol. 13, p. 96681–96714, 2025. [15] S. Yeom, C. Choi, and K. Kim, “LSTM-based collaborative source-side DDoS attack detection,” IEEE Access, vol. 10, p. 44033–44045, 2022. [16] D. Arnold, M. Gromov, and J. Saniie, “Network traffic visualization coupled with convolutional neural networks for enhanced IoT botnet detection,” IEEE Access, vol. 12, p. 73547–73560, 2024. [17] O. Arreche, T. R. Guntur, J. W. Roberts, and M. Abdallah, “E-XAI: Evaluating black-box explainable AI frameworks for network intrusion detection,” IEEE Access, vol. 12, p. 23954–23988, 2024. [18] D. Gaspar, P. Silva, and C. Silva, “Explainable AI for intrusion detection systems: LIME and SHAP applicability on multi-layer perceptron,” IEEE Access, vol. 12, p. 30164–30175, 2024. [19] M. Venkatasubramanian, A. H. Lashkari, and S. Hakak, “IoT malware analysis using federated learning: A comprehensive survey,” IEEE Access, vol. 11, p. 5004–5018, 2023. [20] M. Baich and N. Sael, “A federated learning-based intrusion detection system using dynamic ensemble aggregation for IoT networks,” IEEE Access, vol. 13, p. 205826–205839, 2025. [21] C. Gutti, K. Thumula, and P. Balbudhe, “Federated learning for distributed IoT security: A privacy-preserving approach to intrusion detection,” IEEE Access, vol. 13, p. 135863–135875, 2025. [22] N. A. Hamad, K. A. A. Bakar, F. Qamar, A. M. Jubair, R. R. Mohamed, and M. A. Mohamed, “Systematic analysis of federated learning approaches for intrusion detection in the Internet of Things environment,” IEEE Access, vol. 13, p. 95410–95444, 2025. [23] Y. Liu, Y. Wang, and H. Feng, “POAGuard: A defense mechanism against preemptive table overflow attack in software-defined networks,” IEEE Access, vol. 11, p. 123659–123676, 2023. [24] A. Kamaruddin, S. C. Tan, J. Galán-Jiménez, I.-U. Awan, and M. Younas, “The F-ELV-based privacy-preserving framework for intrusion detection in SDN-IoT network,” IEEE Access, vol. 14, p. 92671–92696, 2026. [25] A. Hirsi, M. A. Alhartomi, L. Audah, et al., “Comprehensive analysis of DDoS anomaly detection in software-defined networks,” IEEE Access, vol. 13, p. 23013–23071, 2025. [26] K. Taniguchi and N. Kamiyama, “Detection method for CDN-spoofing DDoS attacks using ECS-based LDNS log tracing,” IEEE Access, vol. 14, p. 48956–48963, 2026. [27] M. A. Ferrag, O. Friha, D. Hamouda, L. Maglaras, and H. Janicke, “Edge-IIoTset: A new comprehensive realistic cyber security dataset of IoT and IIoT applications for centralized and federated learning,” IEEE Access, vol. 10, p. 40281–40306, 2022. [28] M. A. S. Arifin, D. Stiawan, B. Y. Suprapto, et al., “A novel dataset for experimentation with intrusion detection systems in SCADA networks using IEC 60870-5-104 standard,” IEEE Access, vol. 12, p. 170553–170569, 2024. [29] N. F. Syed, S. W. Shah, A. Shaghaghi, A. Anwar, Z. A. Baig, and R. Doss, “Zero Trust Architecture (ZTA): A comprehensive survey,” IEEE Access, vol. 10, p. 57143–57179, 2022. [30] A. Kulkarni, N. A. Hazari, and M. Y. Niamat, “A zero trust-based framework employing blockchain technology and ring oscillator physical unclonable functions for security of field programmable gate array supply chain,” IEEE Access, vol. 12, p. 89322–89338, 2024. [31] P. Chang and G. Xu, “Design and implementation of a zero trust access control model driven by session lifecycle,” IEEE Access, vol. 14, p. 33819–33827, 2026. [32] L. Yang et al., “Dynamic graph representation learning with neural networks: A survey,” IEEE Access, vol. 12, p. 43460–43484, 2024. [33] A. Aziz and K. Munir, “Anomaly detection in logs using deep learning,” IEEE Access, vol. 12, p. 176124–176135, 2024. [34] S. Roh and T.-S. Kim, “LLM-based automated generation and tri-modal representation of cyber attack scenario,” IEEE Access, vol. 13, p. 146150–146168, 2025. [35] Z. Liu et al., “AutoBnB: Multi-agent incident response with large language models,” in Proc. 13th Int. Symp. Digital Forensics and Security (ISDFS), 2025. [36] S. Sheikhi, P. Kostakos, and L. Loven, “Cognitive SOC: Evidence-backed narrative generation for security operations with multi-agent LLM architecture,” in Proc. IEEE Int. Conf. Big Data (BigData), 2025, p. 7027–7036. [37] A. Rose, C. Cullen, B. G. Kaplowitz, and C. Schroeder de Witt, “Detecting multi-agent collusion through multi-agent interpretability,” arXiv:2604.01151, 2026. [38] Y. Jiang, W. Wang, Y. Huang, Y. Wang, Z. Zhou, X. Chen, Y. Liu, P.-Y. Chen, W. Wang, and X. Zhang, “RiskLab: A controlled toolkit for probing emergent risks in LLM-based multi-agent systems,” in Proc. 64th Annu. Meeting Assoc. Comput. Linguistics (ACL), Syst. Demonstrations, San Diego, CA, USA, 2026, p. 167–177. [39] X. Shi, Y. Zhang, and D. Yang, “Emergent collusion in long-horizon LLM agent interaction,” arXiv:2609.24967, 2026. [40] E. Rabieinejad, F. Zarrinkalam, and A. Dehghantanha, “Beyond the prompt: Log-based threat detection and attribution for multi-agent LLMs,” Inf. Process. Manage., vol. 63, no. 7, Art. no. 104768, 2026. [41] A. Gretton, K. M. Borgwardt, M. J. Rasch, B. Schölkopf, and A. Smola, “A kernel two-sample test,” J. Mach. Learn. Res., vol. 13, p. 723–773, 2012. [42] E. S. Page, “Continuous inspection schemes,” Biometrika, vol. 41, nos. 1–2, p. 100–115, 1954.