BEAD: A Benford-Entropic Anomaly Detector for Mimicry-Resistant Intrusion Detection in Encrypted Network Traffic
Abstract
Current intrusion detection systems lack the ability to monitor TLS-encrypted data which now constitutes most enterprise network traffic yet they need to identify malicious activities that differ from normal operations. The statistical detectors which use Benford's Law to track leading-digit frequencies provide non-dependent payload detection methods but they possess one major limitation. An adversary who draws packet sizes from a log-uniform distribution can produce Benfordconforming traffic that fools a single-metric detector entirely. The same manipulation process leads to Shannon Entropy changes which cause size distribution movement away from Benford standards that show neither practical value of 3.134 bits. The attacker needs to fulfill two opposing requirements which demand both matching the digit-frequency profile and matching the expected entropy as their combined requirements create two distinct operational demands which produce measurable flowbased costs and generate visible timing patterns. We exploit this tension in BEAD (Benford-Entropic Anomaly Detector), a labelfree, training-free NIDS that scores each sliding window of packet metadata using a weighted combination of MAD conformity and entropy deviation, requiring no payload decryption. The fourlayer pipeline capture, flow preprocessing, conformity testing, and alerting runs at $O(n)$ complexity per window. On NSL-KDD, BEAD retains F1 = 0.891 under synthetic mimicry conditions where a Benford-only detector falls to 0.612, while sustaining 148,000 pps on a commodity ARM Cortex-A72 processor.