# Enhancing PoW Attack Detection: Transitive Collusion Detection, Cooldown Mechanisms, and Improved Heuristics **URL:** https://talk.gridnet.org/t/enhancing-pow-attack-detection-transitive-collusion-detection-cooldown-mechanisms-and-improved-heuristics/996 **Category:** GRIDNET OS - Development **Created:** [October 29, 2024, 11:19am UTC](https://talk.gridnet.org/t/enhancing-pow-attack-detection-transitive-collusion-detection-cooldown-mechanisms-and-improved-heuristics/996 "2024-10-29T11:19:32Z") **Posts on this page:** 3 **Page:** 1
### Author: ![CodesInChaos](https://talk.gridnet.org/letter_avatar_proxy/v4/letter/c/71c47a/32.png) [@CodesInChaos](https://talk.gridnet.org/u/CodesInChaos) #### Post date: [October 29, 2024, 11:19am UTC](https://talk.gridnet.org/t/enhancing-pow-attack-detection-transitive-collusion-detection-cooldown-mechanisms-and-improved-heuristics/996/1 "2024-10-29T11:19:32Z")
## **Introduction** Dear Community, We are excited to share the latest advancements in our Proof-of-Work (PoW) attack detection and assessment heuristics. These enhancements are designed to bolster the security and resilience of our blockchain network against sophisticated mining attacks. This update delves into the technical intricacies of our new detection capabilities, including transitive detection of colluding operators, the implementation of a dynamic cooldown window, and the integration of these mechanisms with our PoW difficulty adjustment algorithm. Our aim is to provide you with a comprehensive understanding of these upgrades, their rationale, and the benefits they bring to the network’s integrity. We believe these improvements will significantly enhance our ability to detect and mitigate PoW wave attacks, ensuring a more secure and robust blockchain ecosystem. * * * ## **Background** PoW wave attacks pose a significant threat to blockchain networks. In such attacks, malicious operators or groups of operators exploit the difficulty adjustment mechanism to manipulate the mining process for personal gain. They may rapidly mine blocks to reduce the average block interval, causing the difficulty to spike, or halt mining to let the difficulty drop, disrupting the network’s stability. Detecting these attacks is challenging, especially when operators collude or use sophisticated strategies to avoid detection. Traditional detection mechanisms may not account for transitive relationships among colluding operators or adapt to the dynamic nature of the network’s difficulty adjustments. * * * ## **Enhancements Overview** Our recent enhancements focus on four key areas: 1. **Transitive Detection Capabilities** 2. **Colluding Operators Detection** 3. **Dynamic Cooldown Window** 4. **Integration with PoW Difficulty Adjustment Algorithm** * * * ## **1. Transitive Detection Capabilities** ### **What is Transitive Detection?** Transitive detection refers to the ability to identify not just direct collusion between operators but also indirect relationships where operators are connected through a chain of overlapping activities. This means that if Operator A colludes with Operator B, and Operator B colludes with Operator C, our detection mechanism can infer that Operators A and C are part of the same colluding group. ### **Implementation Details** We implemented transitive detection using the **Union-Find (Disjoint Set Union) data structure**. This efficient algorithm allows us to group operators based on overlapping mining times during anomalous intervals. **Algorithm Steps:** - **Collect Mining Times:** For each operator active during an anomalous interval, we collect the timestamps of the blocks they mined. - **Sort Timestamps:** We sort these timestamps for efficient comparison. - **Compare for Overlaps:** We compare the mining times of each pair of operators to detect overlaps within a specified threshold (e.g., 2 minutes). - **Union Operators:** If an overlap is found, we unite the operators into the same group using the Union-Find structure. - **Transitive Grouping:** Through this process, any operators connected directly or indirectly via overlaps are grouped together. ### **Benefits** - **Comprehensive Detection:** Captures complex collusion scenarios involving multiple operators. - **Efficiency:** The Union-Find algorithm operates with near-linear time complexity, ensuring minimal performance impact. - **Scalability:** Capable of handling large numbers of operators and blocks without degradation. * * * ## **2. Colluding Operators Detection** ### **Detecting Collusion** Colluding operators can significantly disrupt the network by coordinating their mining activities to manipulate the difficulty adjustment mechanism. Our enhanced detection mechanism identifies groups of operators whose combined mining activity exceeds a specified threshold during anomalous intervals. ### **Key Components** - **Anomalous Interval Detection:** We monitor the average block interval over a sliding window (aligned with the difficulty adjustment window) to detect when blocks are being mined significantly faster than expected. - **Group Activity Ratio:** We calculate the combined activity of operator groups as a ratio of the total blocks mined during the anomalous interval. - **Threshold Comparison:** If the group activity ratio exceeds the predefined threshold (e.g., 30%), the group is flagged for potential collusion. ### **Reporting and Consequences** When a colluding group is detected: - **Detailed Reporting:** We generate comprehensive reports outlining the operators involved, their mining activities, and the severity of the detected collusion. - **Incrementing Offense Counts:** Operators within the group have their PoW wave attack counts incremented, subject to the cooldown mechanism. * * * ## **3. Dynamic Cooldown Window** ### **Rationale for Cooldown Period** In our previous implementation, operators could accumulate excessively high offense counts due to overlapping detections in consecutive blocks. To prevent this, we introduced a **cooldown period** —a window during which an operator’s offense count will not be incremented again for the same type of offense. ### **Optimizing the Cooldown Period** - **Initial Approach:** We initially set the cooldown period equal to the difficulty adjustment window (144 key blocks, approximately 24 hours). - **Issue Identified:** This period was too long, potentially allowing operators to perform multiple attacks within the cooldown window without additional penalties. - **Revised Strategy:** We adjusted the cooldown period to a fraction of the difficulty adjustment window—specifically, **one-sixth** of the window size (24 key blocks, approximately 4 hours). ### **Implementation Details** - **Cooldown Calculation:** ![image](https://talk.gridnet.org/uploads/default/original/1X/9b79ce1af2f28eccf9f4cea3ff0a25c0470f3ae8.png) - **Condition Check:** Before incrementing an operator’s offense count, we check if the cooldown period has elapsed since their last recorded offense. ### **Benefits** - **Granularity:** Allows for multiple offenses to be detected and penalized within a reasonable time frame. - **Prevention of Excessive Counts:** Avoids rapid inflation of offense counts due to overlapping detections. - **Alignment with Attack Patterns:** Reflects the typical duration of PoW wave attacks, enhancing detection accuracy. * * * ## **4. Integration with PoW Difficulty Adjustment Algorithm** ### **Understanding the Difficulty Adjustment** Our PoW difficulty adjustment algorithm uses a **Simple Moving Average (SMA)** over a window of **144 key blocks** to adjust the mining difficulty dynamically. The goal is to maintain a stable block production rate despite fluctuations in mining power. ### **Aligning Detection with Difficulty Adjustment** - **Window Size Synchronization:** We set the detection window size equal to the difficulty adjustment window size (144 key blocks) to ensure our analysis covers the same period. - **Targeted Block Interval:** We utilize the same targeted block interval (e.g., 600 seconds) in both the difficulty adjustment and attack detection mechanisms. - **Anomaly Detection:** By analyzing block intervals over this synchronized window, we can more effectively detect anomalies indicative of PoW wave attacks. ### **Benefits** - **Consistency:** Ensures that our detection mechanism is in harmony with the network’s core difficulty adjustment logic. - **Enhanced Detection Accuracy:** By focusing on the same period used for difficulty adjustments, we can more precisely identify manipulations affecting difficulty. - **Responsive Adjustments:** Enables quicker detection and response to attacks that exploit the difficulty adjustment mechanism. * * * ## **Rationale Behind the Upgrades** ### **Addressing Advanced Threats** As blockchain technology evolves, so do the tactics employed by malicious actors. These enhancements are designed to stay ahead of sophisticated attack strategies, particularly those involving collusion and exploitation of the difficulty adjustment algorithm. ### **Improving Network Security** By enhancing our detection capabilities, we aim to: - **Protect Network Integrity:** Prevent disruptions caused by PoW wave attacks, ensuring consistent and reliable block production. - **Maintain Fairness:** Deter operators from engaging in unfair practices that could disadvantage honest miners. - **Increase Trust:** Build confidence among network participants by demonstrating a strong commitment to security. ### **Balancing Sensitivity and Practicality** - **Avoiding False Positives:** Adjusting thresholds and cooldown periods carefully to prevent honest operators from being incorrectly flagged. - **Resource Efficiency:** Implementing algorithms that are efficient and scalable to avoid unnecessary strain on network resources. - **Adaptive Mechanisms:** Designing detection methods that can adapt to changing network conditions and attack patterns. * * * ## **Conclusion** These upgrades represent a significant step forward in our ongoing efforts to enhance the security and robustness of our blockchain network. By introducing transitive detection capabilities, improving colluding operators detection, implementing a dynamic cooldown window, and aligning our detection mechanisms with the PoW difficulty adjustment algorithm, we are better equipped to identify and mitigate PoW wave attacks. We believe these changes will strengthen the network against malicious activities and promote a fair and secure environment for all participants. We are committed to continuous improvement and welcome feedback from the community to further refine our security measures. * * * ## **Call to Action** We encourage all community members to: - **Review the Changes:** Examine the updated detection mechanisms and understand how they impact network operations. - **Provide Feedback:** Share your thoughts, suggestions, or concerns regarding these enhancements. - **Stay Informed:** Keep abreast of future updates as we continue to improve our network’s security and performance. Together, we can build a stronger, more secure decentralized operating system backed by blockchain technology. * * * **Thank you for your continued support and dedication to the network’s success.** Sincerely, _GRIDNET OS Development Team (Wizards)_ ---
### Author: ![Major](https://talk.gridnet.org/letter_avatar_proxy/v4/letter/m/b3f665/32.png) [@Major](https://talk.gridnet.org/u/Major) #### Post date: [October 29, 2024, 11:23am UTC](https://talk.gridnet.org/t/enhancing-pow-attack-detection-transitive-collusion-detection-cooldown-mechanisms-and-improved-heuristics/996/2 "2024-10-29T11:23:42Z")
It might be interesting to see some of the results. Below are results of an earlier revision of the algorithm which which acted at a very high granularity without proper cooldown period taken into account: ```auto ------------------------------------------Global Security Report (Page 1 of 5)------------------------------------------ [Operator ID] [Timestamp Manipulations] [PoW Wave Attacks] [Total Score] [Detailed Reports] 199U8ExZnHpxypYk1QJRHvqEbyWq21B7qZ 0 33759 33759 Operator 199U8Ex ZnHpxypYk1QJRHvq Eb.. 1FPxQHSUsFMvQ5TZ1VbdWAKsVpyXxtXno4 0 12435 12435 Operator 1FPxQHS UsFMvQ5TZ1VbdWAK sV.. 16re6rfDwGM9byvcq3xWiS7jBsqDoyEQha 1 11485 11486 Possible collusi on detected amon g .. 1D4KvAj8xja6STYLpfqopinBa3cPYEuoPw 0 8142 8141 Operator 1D4KvAj 8xja6STYLpfqopin Ba.. 1F3Y7xhxLzKBxag9GkgT1Q5yhXJ24qsxs3 2 6476 6478 Block at height 29563 contains 2 s.. 16NruZPxjdgUqQtcmGy9qdkWRinA1b3HH9 0 6225 6225 Operator 16NruZP xjdgUqQtcmGy9qdk WR.. 1LhojoFsinC2a2hg371oXpcCsvNtWF3w43 0 6212 6212 Operator 1LhojoF sinC2a2hg371oXpc Cs.. 1FKzTmPbDAGmpkpRVofaBHrsxoQzfv2PSv 4 6138 6142 Block at height 30521 contains 4 s.. 1KGAkPPVBoDum9XXjatkpqftCcuwabvPeA 0 5936 5936 Operator 1KGAkPP VBoDum9XXjatkpqf tC.. 1BJgVCMKvji3ARpeUscNEhm96nKPRS9hBu 0 5914 5914 Operator 1BJgVCM Kvji3ARpeUscNEhm 96.. 18bd8vEFuyEMMYk8Dy9uiMxCGe5TAVSuAA 0 5913 5913 Operator 18bd8vE FuyEMMYk8Dy9uiMx CG.. 12gFPq2UJJCEEQhWiMBSq9AsEh9V2SHETA 0 5910 5910 Operator 12gFPq2 UJJCEEQhWiMBSq9A sE.. 1EKAJajpuCMCQNvU78UQ2sjdAxR2Hzz195 0 5885 5885 Operator 1EKAJaj puCMCQNvU78UQ2sj dA.. 1BQ1ZUw4MkWrMF2eWwmYuaTeoh2b6LvKcV 0 5857 5857 Operator 1BQ1ZUw 4MkWrMF2eWwmYuaT eo.. 1GV31Cfz8hrHNC4aThQcBTr8LGYKRMTMAA 0 5799 5799 Operator 1GV31Cf z8hrHNC4aThQcBTr 8L.. 19jGokY5p3W3emDdT7jkT5rZv8e5g6yb6c 0 5733 5733 Operator 19jGokY 5p3W3emDdT7jkT5r Zv.. 14UiJSjuwV91YS8fU1y4pLhU3vMmeFE3kn 0 5712 5712 Operator 14UiJSj uwV91YS8fU1y4pLh U3.. 1AnYtKviFLCsy98YXFKbCxqG2ybcN4Xg1q 6 4998 5004 Possible collusi on detected amon g .. 1M64yLHV6DAVbcNXnLNjy28rkyTTpJ3Hnn 7 4777 4784 Block at height 31826 contains 3 s.. 1EsJavAHEuuaXv9eAhraCejeGqTLRDxR5U 0 4675 4675 Operator 1EsJavA HEuuaXv9eAhraCej eG.. 16eRYpXdFz8APy8yg5ovDrzoxUT1V7b9Fg 0 4668 4668 Possible collusi on detected amon g .. 16qhNYPPSs7xics7GQWuEgDgJWsfHiqa4e 0 4668 4668 Possible collusi on detected amon g .. 1Ny4wQicnZHs2HFYb4HZH6iCGfujLi7CYU 3 4614 4617 Possible collusi on detected amon g .. 1H7VbJWfsdiW9GkqSzrsmiL7yqrqXsW8gp 0 4566 4566 Operator 1H7VbJW fsdiW9GkqSzrsmiL 7y.. 1Jk3oBBJsiRXSZRus8LPjLGur1PDTU6T26 4 4533 4537 Block at height 31798 contains 3 s.. 1JNMUtKCh24G4vUZcRETTBZbuMBKB4pUxp 104 4430 4534 Possible collusi on detected amon g .. 1HxTCGD2dAV2NoVWXRXMNCEwuKxoczvWD7 2 4503 4505 Possible collusi on detected amon g .. 19vBgwPCFFF8ZdRLjkHkpCFAjeVuAfSfY1 5 4495 4500 Operator 19vBgwP CFFF8ZdRLjkHkpCF Aj.. 14bPihvB4q93TnM2u22XfKXVP4NibRwMi9 15 4418 4433 Block at height 33003 contains 1 s.. 1AAnDKagDrkC4pFEz7mGbtj8wd7NE5a6Jc 9 4407 4416 Possible collusi on detected amon g .. 17cftWUd9PTHP5eAg35rRL3E6hHcbxL66h 5 4361 4366 Operator 17cftWU d9PTHP5eAg35rRL3 E6.. 13jNssvQcQH86xZgnczTBLoq8UJ3WbrESC 12 4296 4308 Block at height 33122 contains 6 s.. 1DUgF6mgbaLe1Nu1D8JhJ6V6qezQoCtg9i 0 4258 4257 Possible collusi on detected amon g .. 1GBLxarkmi7vWHfSh8b93bgwRqH4fpu4R8 23 4225 4248 Block at height 31800 contains 3 s.. 1N6YqUj9BNmLSyXUMNxqUwfBBozv8NeZoX 70 4157 4227 Possible collusi on detected amon g .. 1G2Uq4fHy3mJj3xX96RPwfUGDA5mPXVHB1 10 4114 4124 Block at height 32875 contains 1 s.. 1G4s4Yh4n1xdgW9gwupAV9mpYhuU9QtXYW 28 3981 4009 Possible collusi on detected amon g .. 15E6uMpCTsKXR5vxJt4TboFg1CPt5X9dhJ 16 3758 3774 Operator 15E6uMp CTsKXR5vxJt4TboF g1.. 15MRccqGs33UkXRArRsap4PkBhk7xCaX77 7 3765 3772 Possible collusi on detected amon g .. 1AqbrXEntEx36Eq9rafW7nuY2vRipCQhZs 0 3752 3752 Possible collusi on detected amon g .. 1FUw28gS6qjb1uNppmaF7PqLmRfp4MNZHk 11 3476 3487 Possible collusi on detected amon g .. 1PWmdHCaH9szMRNFB8dHWJkhhn1BhidPgE 121 3254 3375 Operator 1PWmdHC aH9szMRNFB8dHWJk hh.. 1MokyjLH9sY21HwvUoo63gijTxQWJcb1DZ 33 3247 3280 Block at height 33382 contains 2 s.. 1A9g7D1FEiDR5nPTqJhebes4TTc4TUXPhP 16 3256 3272 Block at height 33900 contains 4 s.. 1P1e1A8M2r3Hh48HpoQn3omymcPfmjnpbY 61 3198 3259 Possible collusi on detected amon g .. 1JxmgocSjPEt5hxTxwpKGmw5yheLrgYC74 19 3214 3233 Possible collusi on detected amon g .. 1APY4bRMW4gsEQZkWJBGhFvojkDwhuPj5j 4 3221 3225 Block at height 32604 contains 1 s.. 1HSQb274kL4CDdtRdjK5yyEa97d2S9AyQz 3 3123 3126 Block at height 35036 contains 1 s.. 16touWfQLoi4isPLDUapFpnRaehgJH8pjN 8 3062 3070 Block at height 36160 contains 1 s.. 1cadR5yVvbvPPD1aR943TiFmF72SUVCUW 82 2962 3044 Possible collusi on detected amon g .. 1NBQ4cfsoExBSzoi1Ly3YBD7G6dzCVhmUg 3 2983 2986 Block at height 36128 contains 1 s.. 197dECBmyTqMChdu9gqtCepL2kYsXFEn8z 15 2910 2925 Block at height 36084 contains 1 s.. 18w6MGfiqDVhLJp24WBK67obP3q5TRgZ8A 49 2863 2912 Block at height 35567 contains 1 s.. ``` and now latest revision with cooldown period and other changes as described above: ```auto $ chain -sec -size 200 ------------------------------------------Global Security Report (Page 1 of 6)------------------------------------------ [Operator ID] [Timestamp Manipulations] [PoW Wave Attacks] [Total Score] [Detailed Reports] 17eqVViNB6oPJ7ZCToSsduCbjQLvvj67SZ 1 1752 1753 Operator 17eqVVi NB6oPJ7ZCToSsduC bj.. 1LPh4PNBY8HEus74X7bAKnBdqoWHEF5n5k 0 1681 1681 Operator 1LPh4PN BY8HEus74X7bAKnB dq.. 199U8ExZnHpxypYk1QJRHvqEbyWq21B7qZ 0 1680 1680 Operator 199U8Ex ZnHpxypYk1QJRHvq Eb.. 1BLvPRi7756BBMj43jKidGRY4HCVCK4RjJ 1 1214 1215 Operator 1BLvPRi 7756BBMj43jKidGR Y4.. 1GbJ3TK9ubHf9iiFcjnccQ4FyKky5MW73Q 1 1144 1145 Block at height 15238 contains 1 s.. 187y5ndgmv6rRAAxnY6p5CkYVQsNozTGTh 0 1069 1069 Operator 187y5nd gmv6rRAAxnY6p5Ck YV.. 1BpSpSsXJah2CaMxCLq86tLUe2AUQixCCA 0 899 899 Operator 1BpSpSs XJah2CaMxCLq86tL Ue.. 1FPxQHSUsFMvQ5TZ1VbdWAKsVpyXxtXno4 0 788 788 Operator 1FPxQHS UsFMvQ5TZ1VbdWAK sV.. 16re6rfDwGM9byvcq3xWiS7jBsqDoyEQha 1 748 749 Operator 16re6rf DwGM9byvcq3xWiS7 jB.. 1MUvMouwFtTDfQvgDLs2w9zECZH4PwbBbr 0 728 728 Possible collusi on detected amon g .. 1HZfqvRcJ2ofQWy4VAL9Z7TNbCsqqiRuiA 0 691 691 Operator 1HZfqvR cJ2ofQWy4VAL9Z7T Nb.. 12Xromwz6Bb2VNFZfSrGjNTzM3f8saLnu4 0 664 664 Operator 12Xromw z6Bb2VNFZfSrGjNT zM.. 1BoN8SxxgUj4gofc9CKwZqZ1L82nZaGwgD 0 664 664 Operator 1BoN8Sx xgUj4gofc9CKwZqZ 1L.. 1CrYK2gB9Crnicqdemss3fcG57MAGKnigs 83 580 663 Operator 1CrYK2g B9Crnicqdemss3fc G5.. 1GDykuHZJJZxP18FrDhebfcRydksVuRbfo 0 663 663 Operator 1GDykuH ZJJZxP18FrDhebfc Ry.. 16SZNC2RqnwUmrUf77q4AD41PKz9L2PAU7 189 455 644 Possible collusi on detected amon g .. 197VW25T3KmEyaNZrfTvZNn3HwbYgnNWNt 5 629 634 Operator 197VW25 T3KmEyaNZrfTvZNn 3H.. 18EqyaUjjzRm6u1Ld15jpQufpTWn6XvTT5 0 616 616 Operator 18EqyaU jjzRm6u1Ld15jpQu fp.. 18Meb8W6VPouN2PZuYBP5yWiqhkJjSvgfV 171 441 612 Possible collusi on detected amon g .. 1F7hgmnvR4Sd88pY3YdXChzGKf3kYSRHjL 1 608 609 Operator 1F7hgmn vR4Sd88pY3YdXChz GK.. 1941Kn72F1wUVtBCrkJpVZTypMGvMRGUZq 1 608 609 Operator 1941Kn7 2F1wUVtBCrkJpVZT yp.. 1D4KvAj8xja6STYLpfqopinBa3cPYEuoPw 0 601 601 Operator 1D4KvAj 8xja6STYLpfqopin Ba.. 15jXTVXjA75S2tLfUSwQaAWXYG4n842R5G 3 586 589 Block at height 28770 contains 1 s.. 1A5vfgR5FUVizyi6B36er9AKp9ASacBk6a 3 581 584 Possible collusi on detected amon g .. 1Pa5zpHoRjmvu1p9YR6BmT8MXYTeL1jQCn 1 581 582 Possible collusi on detected amon g .. 1Wy2oF4Hw6iwS3PJBaZuf5nbNVUEy98X7 5 573 578 Block at height 28831 contains 2 s.. 1HapKMTXV8vLZUEcttcsxVjTQ2WeMYngrE 3 574 577 Possible collusi on detected amon g .. 14ZmNGez6PYC4PB6nePXeGVHmbtX14VQ2e 6 570 576 Possible collusi on detected amon g .. 1LeELWaBcKWCRXwaMeBvXKW8XbGL6Mdecf 8 557 565 Operator 1LeELWa BcKWCRXwaMeBvXKW 8X.. 17xQr1s6sVLnutY7s9dTSTmsyFUVPBEK3f 4 554 558 Block at height 29451 contains 2 s.. 1JaRKx5mpRkUAwNV9pKqidMnz8RYNSUh7E 2 550 552 Block at height 29528 contains 2 s.. 18JCNstf79Z2sZmUwA2UgQSddDyWeX16qh 2 549 551 Block at height 29515 contains 2 s.. 1CJ93czzDQTxUm14Tb4qh4mmYQ8hf5oA7o 93 457 550 Possible collusi on detected amon g .. 1oznhcbNiACenncsUNgrtq4r4mzUXDWBZ 94 454 548 Operator 1oznhcb NiACenncsUNgrtq4 r4.. 17RsEiHa5WfhXFKZyD8j9LQ1xwJmfsT5FQ 84 461 545 Possible collusi on detected amon g .. ``` Full reports attached [two reports.zip](https://talk.gridnet.org/uploads/short-url/ffFtsy8O0xauEPw62Ufr57nJfZD.zip) (17.3 KB) ---
### Author: ![PauliX](https://talk.gridnet.org/letter_avatar_proxy/v4/letter/p/f0a364/32.png) [@PauliX](https://talk.gridnet.org/u/PauliX) #### Post date: [October 29, 2024, 11:33am UTC](https://talk.gridnet.org/t/enhancing-pow-attack-detection-transitive-collusion-detection-cooldown-mechanisms-and-improved-heuristics/996/3 "2024-10-29T11:33:03Z")
and let me provide statystical cross reference analysis between the two reports down below. ### PoW Wave Attack Detection Algorithm Adjustment Analysis ### Key Findings - Average score reduction: 93.7% - Highest score reduced from 33759 to 1680 - Overall detection ratio: 20.1x more selective ### Algorithm Improvements - More precise attack pattern recognition - Reduced false positive detections - Better handling of transitive relationships Detailed cross validation report of top 50 Perpetrators (between the prior and current heuristics ![image](https://talk.gridnet.org/uploads/default/original/1X/a6af124b3d2e31a8a654a0bfb90880b730b3c43f.png) Full report attached: [cross validation report top 50.zip](https://talk.gridnet.org/uploads/short-url/ynzA6pEy9eosIs0pfoXCQnYrGFm.zip) (1.8 KB)