Detecting coordinated stealthy reconnaissance by large agent groups
SwarmReconGuard: Black-Box Detection of Distributed Collective Reconnaissance by Individually Benign-Looking Agent Populations
Cryptography and SecurityArtificial IntelligenceMultiagent Systems
Summary
Some attackers spread their probing activities across many separate identities, so each action looks harmless but together they gather lots of information. The authors call this Distributed Collective Reconnaissance (DCR). They created a tool called SwarmReconGuard that watches only the service’s usual data to spot such attacks without knowing their specifics. They tested many detection methods and found that while some detectors work perfectly on known attacks, they struggle with new ones, highlighting the need for new defenses that adapt to scale and exposure.
What this means in practice
- •For network defenders: Identify stealthy, large-scale reconnaissance attacks that use many low-profile identities to evade detection based on normal traffic monitoring data.
- •For cloud service operators: Deploy defenses that can detect distributed probing activities without requiring access to internal data, using only boundary telemetry.
Authors
Vahid Tavakkoli, Kabeh Mohsenzadegan, Kyandoghere Kyamakya
Abstract
Autonomous and agentic clients can distribute reconnaissance across many identities so that each request remains valid, low-rate, and benign-looking while the population collectively acquires broad system knowledge. We formalize this threat as Distributed Collective Reconnaissance (DCR) and present SwarmReconGuard, a reproducible black-box benchmark in which the defender observes only service-boundary telemetry. The Docker-isolated study evaluates 11 benign and attack behaviors across 10-10,000 virtual identities, comprising 440 test runs and 3,666,300 requests, with complete telemetry integrity. We compare semantic, Gaussian, conditional, graph, kernel, hybrid, and CUSUM-based detectors. Gaussian likelihood-ratio detection achieves 100$\%$ detection with 0$\%$ observed false positives on known attacks but only 3$\%$ on unseen policies. CUSUM yields 36.1$\%$ overall detection at 1.25$\%$ false positives, while hybrid CUSUM reaches 85.7$\%$ detection with 0$\%$ observed false positives at 10,000 identities. Results expose a major policy-generalization gap and motivate exposure-aware, scale-aware defenses.