Adaptive encrypted system for analyzing cyber threat data using two-stage causal inference and homomorphic anomaly embeddings

Abstract

An adaptive, encrypted data analysis system for cyber threats, consisting of: a secure data interface unit configured to receive cyber threat telemetry data originating from a variety of distributed computing resources, including network infrastructure devices, endpoint systems, cloud workloads, and application servers, wherein the received cyber threat telemetry data includes network interaction records, authentication activity data, process execution data, behavioral traces, and temporal event information, and wherein the cyber threat telemetry data is received in an encrypted state; a cryptographic coding unit that is operationally coupled with the secure data interface unit and is configured to transform the received encrypted cyber threat telemetry data into a variety of encrypted anomaly embedding representations by performing feature normalization, temporal alignment, and semantic coding operations prior to encryption, and is further configured to apply homomorphic encryption to generate ciphertext-based anomaly embeddings that preserve mathematical operability; a homomorphic anomaly inference processor that is operationally coupled with the cryptographic coding unit and is configured to perform encrypted analytical operations directly on the ciphertext-based anomaly embeddings, wherein the homomorphic anomaly inference processor is configured to compute encrypted deviation indicators that represent behavioral deviations from encrypted baseline profiles without performing any decryption at any stage of the computation; a first causal inference unit that is operationally coupled with the homomorphic anomaly inference processor and is configured to create encrypted local causal dependency representations by evaluating conditional relationships between encrypted anomaly embeddings corresponding to individual system components, user interactions, and execution contexts, thereby deriving causally attributable sources of detected anomalies; a second causal inference unit that is operationally coupled with the first causal inference unit and configured to aggregate encrypted local causal dependency representations across a variety of computing resources to derive encrypted global causal propagation representations that indicate coordinated or multi-stage cyber threat behavior spanning multiple system domains; an adaptive learning control unit operationally coupled with the cryptographic coding unit, the homomorphic anomaly detection processor, and the first and second causal inference units, wherein the adaptive learning control unit is configured to update encrypted baseline behavior profiles and encrypted causal dependency parameters based on validated threat findings while maintaining all learning operations within an encrypted computation domain; and a secure output control unit that is operationally coupled with the second causal inference unit and configured to generate cyber threat intelligence signals that include encrypted risk indicators, threat classification outputs, and response prioritization information, with the generated outputs excluding the disclosure of underlying plaintext cyber threat telemetry.

Description

Technical field of the invention

[0001] The present invention relates generally to the field of secure processing of information about cyber threats and computer-aided cybersecurity analysis, in particular an adaptive, encrypted system for analyzing cyber threat data. This system is configured to perform privacy-compliant anomaly detection and causal inferences on sensitive cyber telemetry data using homomorphic computation and multi-layered causal inference mechanisms. The invention further relates to a specialized computing device that functions as a cyber threat analysis machine and can process encrypted threat data streams without decryption, while dynamically deriving causal relationships and the propagation behavior of threats in complex digital infrastructures. BACKGROUND OF THE INVENTION

[0002] Modern cybersecurity environments generate vast amounts of heterogeneous, threat-related data from network traffic sensors, endpoint security agents, authentication systems, intrusion detection systems, cloud workload monitors, and application-layer telemetry collectors. This data typically contains highly sensitive information such as user IDs, cryptographic keys, behavioral patterns, infrastructure topology details, and system vulnerabilities. Traditional cyber threat analysis platforms rely on centralized data collection pipelines that decrypt incoming telemetry data for analysis. This exposes sensitive threat information to in-memory attack surfaces, insider abuse risks, and regulatory violations, particularly in countries with strict data privacy laws.

[0003] Existing anomaly detection solutions predominantly rely on statistical thresholding methods, rule-based heuristics, or machine learning techniques that operate on plaintext data. These approaches are limited in their ability to maintain confidentiality during computation and cannot distinguish between correlated anomalies and causally related cyber events. Therefore, existing systems frequently generate false alarms, misattribute threat origins, and fail to detect multi-stage or covert attack campaigns that extend over time across components of distributed systems.

[0004] Recent attempts to use encryption in cybersecurity analysis often rely on secure or trusted execution environments. This leads to hardware dependencies, scaling bottlenecks, and side-channel attacks. While homomorphic encryption techniques have been explored for isolated analysis tasks, existing implementations lack adaptive learning capabilities and causal reasoning, rendering them inadequate for real-time interpretation of cyber threats. Furthermore, current causal inference techniques used in cybersecurity typically operate with decrypted protocols and do not incorporate encrypted feature representations, making them unsuitable for privacy-conscious deployment scenarios.

[0005] Accordingly, a technical problem exists in providing a cyber threat analysis system that can perform anomaly detection and causal threat analysis directly via encrypted cyber telemetry, while adaptively responding to evolving threat behavior, maintaining data confidentiality throughout the analysis lifecycle, and structurally supporting its use as a dedicated machine-level cybersecurity device.

[0006] Cybersecurity monitoring and threat analysis have become indispensable components of modern digital infrastructures due to the rapid proliferation of cloud computing, distributed enterprise networks, industrial control systems, and internet-enabled devices. Modern IT environments continuously generate vast amounts of cyber telemetry data in the form of network traffic logs, endpoint activity logs, authentication events, application execution logs, and system performance metrics. This telemetry data is routinely analyzed to detect malicious activity such as unauthorized access, malware distribution, data exfiltration, and coordinated cyberattacks. However, as cyberattacks become increasingly sophisticated and elusive, existing cyber threat analysis systems face growing challenges in accurately identifying threats while maintaining the confidentiality of sensitive operational data.

[0007] Traditional cyber threat detection systems rely primarily on signature-based methods and rule-based attack detection mechanisms. These systems typically compare observed events against predefined attack signatures or static policy rules stored in centralized databases. While such approaches are effective against known threats, they reach their limits when faced with zero-day attacks, polymorphic malware, or attackers who deliberately alter their attack patterns to evade detection. Furthermore, signature-based systems require continuous manual updates and expert intervention, making them slow to adapt to the rapidly evolving threat landscape. Consequently, they often fail to detect emerging cyber threats in a timely or reliable manner.

[0008] To address the limitations of signature-based methods, statistical anomaly detection techniques have been introduced to identify deviations from normal system behavior. These techniques typically use statistical thresholds, probability models, or time series analysis to detect unusual activity. While anomaly-based systems can uncover previously unknown attacks, they are prone to high false positive rates due to legitimate fluctuations in user behavior, load variations, or infrastructure changes. Furthermore, most statistical approaches rely on unencrypted telemetry data and therefore require full access to sensitive system and network logs. This dependence on decrypted data exposes critical information to memory analysis attacks, insider threats, and regulatory violations, particularly in industries with stringent data privacy laws.

[0009] Machine learning and deep learning have further advanced the analysis of cyber threats through pattern recognition in large and complex datasets. Supervised learning models such as support vector machines, decision trees, and neural networks are commonly used to classify malicious and benign activities based on labeled training data. Unsupervised and semi-supervised models, including clustering techniques and autoencoders, are used to detect anomalies without explicit attack labels. Despite their improved detection capabilities, these approaches have some drawbacks. They require large amounts of high-quality, labeled data, the preparation of which is often impossible or extremely costly in real-world cybersecurity environments.Furthermore, most learning-based systems act as opaque black boxes, which limits interpretability and makes it difficult for security analysts to understand why a particular event was classified as harmful.

[0010] A critical limitation of existing machine learning-based cybersecurity systems lies in their reliance on centralized architectures for processing plaintext data. Incoming telemetry data is typically decrypted, normalized, and stored in centralized repositories for analysis. This architecture creates a single point of attack and significantly increases the attack surface, as sensitive data must remain in memory during processing. Attempts to mitigate this risk through secure or trusted execution environments introduce additional challenges, including hardware dependencies, scalability limitations, vulnerability to side-channel attacks, and limited flexibility in heterogeneous deployment environments.

[0011] Parallel to advances in detection techniques, interest in applying causal inference methods to cybersecurity analysis is growing. Causal inference aims to identify cause-and-effect relationships rather than mere statistical correlations. This enables more precise attribution of attack sources, identification of root causes, and prediction of attack propagation paths. Existing causal-based cybersecurity solutions often construct dependency graphs or Bayesian networks from system logs and event traces. However, these solutions typically require complete transparency of plaintext data and extensive manual modeling of causal relationships. They are unsuitable for dynamic environments where infrastructure configurations and attack strategies frequently change, nor can they be effectively integrated into privacy-friendly computational mechanisms.

[0012] Recent research explores the use of encryption techniques, including homomorphic encryption and secure multi-party computation, to enable privacy-compliant data analysis. Homomorphic encryption allows mathematical operations to be applied directly to encrypted data, producing encrypted results that can later be decrypted without revealing intermediate values. While promising, existing homomorphic analysis solutions are often limited to simple statistical queries or isolated calculations due to the computational cost of homomorphic operations. Furthermore, these solutions are rarely integrated with adaptive learning models or complex inference mechanisms required for real-time cyber threat detection.

[0013] In the field of cybersecurity, existing homomorphic encryption approaches often focus on protecting data at rest or during transmission, rather than considering it in active analysis. Where homomorphic methods are employed, they are typically limited to evaluating anomalies or thresholds at a single level and cannot model temporal dependencies, changes in behavior, or causal relationships. Consequently, such systems struggle to detect multi-stage attacks or coordinated threat campaigns that span multiple system components and time periods.

[0014] Another significant drawback of existing cyber threat analysis systems is their inability to reliably adapt to evolving threat patterns. Adaptive learning mechanisms often require regular retraining using historical data, necessitating the repeated decryption and disclosure of sensitive telemetry data. This process not only increases security risks but also limits the feasibility of continuous learning in regulated or high-security environments. As cyberattacks increasingly rely on stealthy and insidious techniques, the inability to adapt without compromising data confidentiality poses a substantial technical challenge.

[0015] Furthermore, most current cybersecurity analysis solutions are implemented as software platforms or cloud services, rather than as dedicated, machine-level devices. This architecture makes them difficult to deploy in environments with stringent isolation requirements, such as critical infrastructure systems, defense networks, and industrial control systems. Software-centric solutions are also more vulnerable to manipulation, unauthorized modifications, and dependency vulnerabilities, which reduces confidence in their operational integrity.

[0016] According to the report, existing solutions lack a unified architecture for cyber threat analysis that simultaneously ensures end-to-end data confidentiality, supports adaptive anomaly detection, enables causal reasoning, and can be deployed as a standalone system or device. The lack of integration of encrypted data processing, causal inference, and adaptive learning leads to fragmented solutions that either compromise privacy in favor of analytical depth or sacrifice detection accuracy for confidentiality.

[0017] Given the aforementioned limitations, there remains a clear need for a technically sophisticated cyber threat analysis system capable of performing in-depth behavioral and causal threat analysis directly on encrypted data, without relying on plaintext processing or trusted execution environments. Furthermore, such a system must be feasible as a dedicated cybersecurity device and capable of operating autonomously in sensitive digital environments while continuously adapting to evolving cyber threats. The present invention aims to address these unresolved technical challenges. SUMMARY OF THE INVENTION

[0018] The present invention overcomes the aforementioned limitations by providing an adaptive, encrypted data analysis system for cyber threats. This system performs privacy-compliant anomaly detection and two-tier causal analysis directly on encrypted cyber telemetry data using homomorphic anomaly embeddings. The system is configured to encode features of cyber threats into encrypted vector representations, perform anomaly analysis in the encrypted space without revealing the underlying data values, and employs a two-tier architecture for causal analysis. This architecture comprises a local causality mapping layer and a global causality propagation layer. This allows the system to distinguish causal threat drivers from spurious correlations while simultaneously ensuring the complete cryptographic isolation of sensitive data.

[0019] In one embodiment, the invention is implemented as a specialized device for analyzing cyber threats. This device comprises a secure data interface, a cryptographic processing unit, a homomorphic computing processor, a causal analysis processor, and a secure output interface. All components are integrated into a single enclosure or deployable hardware structure. The device receives encrypted cyber telemetry data from distributed infrastructure nodes, calculates encrypted anomaly scores and causal threat paths, and generates actionable threat intelligence without disclosing any plaintext threat data at any stage of processing.

[0020] The present invention aims to provide an adaptive system for analyzing cyber threat data that enables advanced threat detection and behavioral analysis while maintaining the confidentiality of sensitive cyber telemetry data throughout the entire data processing cycle. The invention aims to eliminate the need to decrypt threat data during analysis, thereby reducing vulnerability to memory-based attacks, insider misuse, and the regulatory non-compliance risks associated with conventional plaintext analysis architectures.

[0021] A further objective of the invention is the direct detection of anomalies and the identification of threats based on encrypted cyber threat representations through the use of homomorphic computational methods that support mathematical and relational operations on ciphertext data. By processing encrypted anomaly embeddings instead of decrypted raw telemetry data, the invention aims to maintain analytical accuracy while ensuring that sensitive system attributes, user identifiers, and infrastructure details remain cryptographically protected at all times.

[0022] A further objective of the invention is the introduction of a two-layered mechanism for causal analysis that distinguishes causally significant cyber events from random or correlated anomalies. The invention aims to establish local causal relationships between anomalous behaviors and specific system components while simultaneously identifying global propagation patterns of causal relationships that reveal multi-stage attacks, lateral movements, and coordinated threat campaigns in distributed digital environments.

[0023] A further objective of the invention is to provide adaptive learning capability that enables the system to further develop its anomaly baselines and causal models in response to observed threat scenarios without requiring repeated decryption or manual intervention. The invention aims to support continuous learning under encryption, thereby ensuring long-term resilience to evolving attack strategies while maintaining data confidentiality and system integrity.

[0024] A further objective of the invention is to provide a solution for analyzing cyber threats that offers improved interpretability and decision support by generating causally based threat information instead of opaque anomaly values. The invention is intended to help security personnel understand why a particular threat was identified, how it originated, and how it spreads, even if the underlying data remains encrypted.

[0025] A further objective of the invention is the structural realization of the analysis system as a dedicated, machine-based device suitable for use in high-security environments, including critical infrastructures, defense systems, industrial control systems, and regulated data centers. The invention aims to provide a self-contained, hardware-oriented architecture that increases trust, tamper resistance, and operational reliability compared to purely software-based solutions.

[0026] Another objective of the invention is to reduce false alarms and improve detection accuracy by combining encrypted anomaly detection with causal reasoning. This filters out harmless behavioral changes and focuses attention on events with actual causal threat relevance. This objective addresses a long-standing limitation of conventional, anomaly-based cybersecurity systems.

[0027] Another objective of the invention is to provide a scalable and infrastructure-independent approach for analyzing cyber threats that can be used in heterogeneous environments, including on-premise systems, cloud infrastructures and edge computing nodes, without having to expose sensitive data to central analysis platforms.

[0028] Another objective of the invention is to ensure compliance with regulatory requirements and regulations by enabling cyber threat analyses that comply with data protection requirements, the principles of privacy-friendly design and confidentiality requirements, while simultaneously providing actionable security information in real time.

[0029] Overall, the invention aims to improve the state of cybersecurity analysis by combining encrypted computations, adaptive anomaly detection, and causal inferences in a single coherent system and device architecture, thereby overcoming the technical and security limitations of existing solutions for detecting cyber threats. BRIEF DESCRIPTION OF THE IMAGE

[0030] These and other features, aspects and advantages of the present invention will be better understood if the following detailed description is read with reference to the accompanying drawing, in which the same symbols represent the same parts: Fig. Figure 1 shows a block diagram of an adaptive, encrypted data analysis system for cyber threats.

[0031] Furthermore, those skilled in the art will recognize that the elements in the drawing are simplified and not necessarily drawn to scale. For example, the flowcharts illustrate the process by highlighting the main steps to facilitate understanding of the present disclosure. With regard to the construction of the device, one or more components may be represented in the drawing by conventional symbols. The drawing may show only the specific details relevant to understanding the embodiments of the present disclosure, so as not to clutter the drawing with details that are already apparent to those skilled in the art from the description contained herein. Detailed description of the invention

[0032] To facilitate understanding of the principles of the invention, reference is made below to the embodiment shown in the drawing, which is described using specific terms. It is understood, however, that this does not limit the scope of protection of the invention. Rather, modifications and further developments of the depicted system, as well as further applications of the inventive principles shown therein, are conceivable, insofar as they would normally occur to a person skilled in the art in the field of the invention.

[0033] It will be clear to those skilled in the art that the foregoing general description and the following detailed description are exemplary and explanatory of the invention and are not to be understood as a limitation of it.

[0034] References to “an aspect”, “another aspect”, or similar phrases in this description mean that a particular feature, structure, or property described in connection with the embodiment is included in at least one embodiment of the present disclosure. Therefore, phrases such as “in one embodiment”, “in another embodiment”, and similar expressions in this description may, but do not necessarily, all refer to the same embodiment.

[0035] The terms "includes," "comprehensive," or similar expressions denote non-exclusive inclusion. Thus, a procedure or method containing a list of steps does not only include those steps but may also include further steps not explicitly listed or inherent in the procedure or method. Likewise, the statement "includes..." for one or more devices, subsystems, elements, structures, or components, without further limitations, does not preclude the existence of other devices, subsystems, elements, structures, or components.

[0036] Unless otherwise defined, all technical and scientific terms used herein have the same meanings generally known to those skilled in the art in the field to which this invention belongs. The systems, methods, and examples described herein serve only for illustration and are not to be understood as limiting.

[0037] Embodiments of the present disclosure are described in detail below with reference to the attached drawing.

[0038] Fig.Figure 1 shows a block diagram of an adaptive, encrypted cyber threat data analysis system. The system 100 includes a secure data interface unit (102) configured to receive cyber threat telemetry data from a variety of distributed computing resources, including network infrastructure devices, endpoints, cloud workloads, and application servers. The received cyber threat telemetry data includes network interaction records, authentication data, process execution data, behavioral traces, and temporal event information, and is received in encrypted form. A cryptographic coding unit (104) connected to the secure data interface unit transforms the received encrypted cyber threat telemetry data into a variety of encrypted anomaly embedding representations. This is done through feature normalization,temporal alignment and semantic coding prior to encryption. Additionally, the unit applies homomorphic encryption to generate ciphertext-based anomaly embeddings that preserve mathematical functionality. A homomorphic anomaly inference processor (106) is operationally coupled with the cryptographic coding unit and configured to perform encrypted analytical operations directly on the ciphertext-based anomaly embeddings, wherein the homomorphic anomaly inference processor is configured to compute encrypted deviation indicators representing behavioral deviations from encrypted baseline profiles without performing decryption at any stage of the computation. A first causal inference unit (108) is operationally coupled with the homomorphic anomaly inference processor and configured tothat it creates encrypted local causal dependency representations by evaluating conditional relationships between encrypted anomaly embeddings corresponding to individual system components, user interactions, and execution contexts, thereby inferring causally attributable sources of detected anomalies; A second causal inference unit (110) operationally coupled with the first causal inference unit and configured to aggregate encrypted local causal dependency representations across a variety of computational resources to infer encrypted global causal propagation representations that indicate coordinated or multi-stage cyber threat behavior spanning multiple system domains; an adaptive learning control unit (112) operationally coupled with the cryptographic coding unit, the homomorphic anomaly inference processor, and the first and second causal inference units,wherein the adaptive learning control unit is configured to update encrypted baseline behavior profiles and encrypted causal dependency parameters based on validated threat outcomes, while maintaining all learning operations within an encrypted computation domain; and a secure output control unit (114) operationally coupled with the second causal inference unit and configured to generate cyber threat intelligence signals that include encrypted risk indicators, threat classification outputs, and response prioritization information, wherein the generated outputs exclude the disclosure of underlying plaintext cyber threat telemetry.

[0039] In one embodiment, the secure data interface unit (102) is further configured to enforce cryptographic session isolation and key separation for cyber threat telemetry received from different computer resources, so that encrypted anomaly embeddings corresponding to separate resources are managed in logically isolated cryptographic contexts to prevent cross-domain data derivations.

[0040] In one embodiment, the cryptographic coding unit (104) is further configured to generate the encrypted anomaly embedding representations as fixed-dimensional vectors derived from time-windowed behavior sequences, each vector encoding encrypted representations of frequency-based, sequence-based, and context-based cyber behavior attributes.

[0041] In one embodiment, the homomorphic anomaly inference processor (106) is further configured to perform an encrypted distance assessment and an encrypted similarity assessment between incoming encrypted anomaly embeddings and stored encrypted baseline behavior profiles to derive the encrypted anomaly indicators, wherein the encrypted anomaly indicators remain in ciphertext form throughout the inference.

[0042] In one embodiment, the first causal inference unit (108) is further configured to generate encrypted causality attribution values ​​that represent the probability that a particular encrypted anomaly embedding is causally linked to a corresponding system component or execution context, wherein the causality attribution values ​​are calculated using encrypted conditional dependency evaluations.

[0043] In one embodiment, the second causal inference unit (110) is further configured to evaluate encrypted temporal ordering relationships and encrypted dependency relationships between assets in a multitude of encrypted local causal dependency representations in order to derive encrypted threat propagation paths across distributed infrastructures.

[0044] In one embodiment, the adaptive learning control unit (112) is further configured to update the encrypted baseline behavior profiles by including encrypted anomaly embeddings associated with verified benign behavior, while excluding encrypted anomaly embeddings associated with confirmed malignant activity, thereby refining the encrypted behavior norms over time.

[0045] In one embodiment, the adaptive learning control unit (112) is further configured to adjust encrypted causal dependency parameters by strengthening encrypted causal relationships that repeatedly precede validated cyber threat outcomes and weakening encrypted causal relationships associated with non-threat-related anomalies.

[0046] In one embodiment, the secure output control unit (114) is further configured to selectively decrypt only aggregated threat classification results using authorized cryptographic credentials, while preserving the encrypted storage of all intermediate anomaly embeddings, deviation indicators, and causal representations.

[0047] In one embodiment, the system is structurally implemented as a dedicated cyber threat analysis device comprising a physical enclosure housing the secure data interface unit, the cryptographic encoding unit, the homomorphic anomaly detection processor, the first causal inference unit, the second causal inference unit, and the adaptive learning control unit. The device further includes isolated memory areas and tamper-proof hardware elements configured to ensure the integrity and confidentiality of encrypted cyber threat analysis operations.

[0048] In the adaptive, encrypted data analysis system for cyber threats, each of the aforementioned units and processors is implemented as a hardware component of a physical computer system and is not a purely abstract or purely software-based construct. The secure data interface, the cryptographic encoding unit, the homomorphic anomaly detection processor, the first and second causal inference units, the adaptive learning control unit, and the secure output control unit are each implemented using one or more physical processing devices. These include microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), cryptographic accelerator chips, memory elements, hardware security modules, and communication interfaces, all interconnected via physical buses and signal paths.The functions assigned to each unit are executed within these hardware elements through electrical signal processing, instruction execution, and data transfer. Encrypted data is stored, transferred, and transformed in hardware-addressable memory and registers. Any programmability of the units is implemented through firmware or machine-readable instructions stored in non-volatile hardware memory and executed by the corresponding processors. Thus, the system functions as a concrete machine with defined structural components that collectively perform encrypted cyber threat analyses using physical computing methods.

[0049] During operation, the system first receives cyber threat telemetry data via a secure data interface from a variety of distributed computing resources in network, endpoint, cloud, and application environments. The incoming telemetry data is either encrypted at the source or encrypted immediately upon receipt using resource-specific cryptographic contexts. The secure data interface ensures cryptographic session isolation by assigning different encryption keys and logical isolation domains to telemetry streams from different resources. This prevents cross-resource evaluation and ensures that subsequent analysis processes maintain contextual separation.

[0050] The encrypted telemetry data is forwarded to the cryptographic coding unit, which, in embodiments where the raw data is protected but not yet homomorphically encrypted, performs preprocessing prior to encryption. This preprocessing includes the temporal windowing of event sequences, the normalization of behavioral features, and the semantic encoding of categorical cyber events into numerical representations. After encoding, the cryptographic coding unit applies homomorphic encryption to the resulting feature representations, thereby generating ciphertext-based anomaly embeddings. Each anomaly embedding is structured as an encrypted fixed-dimensional vector representing behavioral features such as event frequency, execution order, access context, and interaction intensity over a defined observation interval.The cryptographic coding unit also manages encrypted basic behavioral profiles that correspond to known normal operating states for each monitored asset.

[0051] The ciphertext-based anomaly embeddings are provided to the homomorphic anomaly inference processor, which performs anomaly detection procedures entirely within the encrypted space. The processor computes encrypted similarity and distance measures between the incoming encrypted anomaly embeddings and the encrypted baseline behavior profiles stored in isolated memory areas. These computations yield encrypted divergence indicators that quantify the degree of behavioral divergence without revealing plaintext values. The processor aggregates divergence indicators across overlapping time windows to suppress transient fluctuations and highlight persistent anomalous behavior, thereby improving robustness against noise and harmless variability.

[0052] The encrypted anomaly indicators are then processed by the first causal analysis unit. This unit performs local causal analyses to determine whether observed anomalies are causally related to specific system components, execution contexts, or interaction patterns. The first causal analysis unit creates encrypted local causal dependency representations by evaluating conditional dependency relationships between encrypted anomaly embeddings and encrypted context variables. Temporal priority relationships are encoded by correlating encrypted event timestamps, and dependency strength is derived by measuring encrypted covariation patterns under controlled context conditions. This allows the system to distinguish anomalies caused by legitimate configuration changes from those resulting from malicious activity.

[0053] The encrypted local causal dependency representations are then transferred to the second causal analysis unit, which analyzes global causal relationships across distributed systems. This unit aggregates encrypted causal outputs from multiple systems and evaluates encrypted relationships between the systems, including communication sequences, credential sharing, and correlated execution patterns. By analyzing the encrypted temporal alignment and dependency propagation between the systems, the second causal analysis unit derives encrypted global causal propagation representations that model multi-stage attacks, lateral movement, and coordinated threat behavior. These representations encode encrypted propagation paths and escalation sequences of threats while fully maintaining data confidentiality.

[0054] In parallel with causal analysis, the adaptive learning control unit continuously monitors system outputs to refine encrypted behavioral and causal models. When threat findings are validated through authorized confirmation channels or automated response verification, the adaptive learning control unit updates the encrypted behavioral profiles by including encrypted anomaly embeddings associated with confirmed harmless behavior and excluding or downgrading embeddings associated with confirmed threats. Similarly, encrypted causal dependency parameters are strengthened or weakened based on their historical association with validated threat findings. All learning operations are performed homomorphically, so adaptation does not require decrypting historical telemetry data or model parameters.

[0055] The secure output control unit receives encrypted threat data from the second causal analysis unit and generates actionable cybersecurity signals in a controlled manner. In authorized configurations, the secure output control unit selectively decrypts aggregated threat classifications or risk assessments using controlled cryptographic credentials, while ensuring that the underlying anomaly embeddings, anomaly indicators, and causal relationships remain encrypted in memory. This controlled disclosure mechanism enables integration with external response systems and security workflows without compromising data confidentiality.

[0056] In a device-level embodiment, all the units and processors described above are physically integrated into a dedicated cyber threat analysis device. This device includes isolated storage areas for encrypted data storage, elements to protect cryptographic keys, and tamper-proof hardware structures that prevent unauthorized access or modification. The homomorphic anomaly detection processor and causal inference units can be implemented using specialized processing circuits or securely partitioned general-purpose processors optimized for encrypted computations. The device is configured for continuous operation and receives encrypted telemetry data, performs adaptive encrypted analysis, and outputs threat intelligence in real time.

[0057] Through the coordinated interaction of the secure data interface, the cryptographic coding unit, the homomorphic anomaly detection processor, the two-layer causal inference units, the adaptive learning control unit, and the secure output control unit, the present invention enables data protection-compliant and causally sound cyber threat analyses. The described process ensures that sensitive cyber telemetry data remains encrypted throughout the entire acquisition, analysis, learning process, and output, thus providing a technically advanced and secure solution for the challenges of modern cybersecurity environments.

[0058] According to the present invention, the adaptive, encrypted cyber threat data analysis system is configured to receive cyber threat telemetry data. This includes network packet metadata, system call logs, authentication events, process execution logs, behavioral patterns, and infrastructure interaction metrics. Upon receipt, the telemetry data is processed by a cryptographic coding unit that transforms the raw cyber threat data into fixed-dimensional anomaly embedding vectors. These embeddings are generated using feature normalization, temporal alignment, and semantic coding. Subsequently, the vectors are encrypted using a homomorphic encryption algorithm that allows arithmetic and relational operations to be performed directly on the ciphertext values.

[0059] The encrypted anomaly embeddings are fed to a homomorphic anomaly inference processor configured to perform encrypted distance calculations, encrypted clustering operations, and encrypted deviation assessments without decrypting the underlying data. The processor calculates encrypted anomaly indicators that represent deviations from encrypted baseline behavior profiles. Both the baseline profiles and the incoming telemetry data remain encrypted throughout the entire computation process. This enables continuous anomaly detection in sensitive cyber environments without exposing internal system states.

[0060] A key feature of the invention is its two-layer architecture for causal analysis. A first causal analysis layer processes encrypted anomaly data to establish local causal relationships between observed anomalies and immediate system components, such as specific network interfaces, user credentials, or application processes. This layer creates encrypted causal graphs that represent conditional dependencies between encrypted variables. This allows the system to assess whether an observed anomaly is causally related to a specific component or sequence of events.

[0061] A second causal analysis layer is globally configured and aggregates encrypted causal data from the local layer to detect system-wide threat propagation patterns. This global layer evaluates encrypted dependencies between nodes, temporal attack chains, and coordinated threat behaviors across distributed infrastructure elements, enabling the detection of advanced persistent threats (APTs), lateral movement, and multi-stage attack campaigns. Both causal analysis layers operate entirely in encrypted form and use homomorphic operations to ensure confidentiality.

[0062] The system also includes an adaptive learning mechanism that updates encrypted baseline profiles and encrypted parameters of causal dependencies in response to validated threat findings. This adaptive mechanism allows the system to evolve its threat understanding over time and to account for changes in attacker behavior, infrastructure topology, and workload characteristics, while ensuring that no decryption of historical data is required for the updates.

[0063] The drawing and the preceding description illustrate embodiments. Those skilled in the art will recognize that one or more of the described elements can be combined to form a single functional element. Alternatively, certain elements can be divided into several functional elements. Elements of one embodiment can be added to another. For example, the process flows described here can be modified and are not limited to the manner described herein. Furthermore, the actions of a flowchart need not be performed in the sequence shown; nor do all actions necessarily need to be carried out. Actions that do not depend on other actions can be performed in parallel with the other actions. The scope of protection of the embodiments is in no way limited by these specific examples. Numerous variations, whether explicitly stated in the description or not, such as...Differences in structure, dimensions, and materials are possible. The scope of protection of the embodiments is at least as comprehensive as described by the following claims.

[0064] The advantages, other benefits, and problem solutions have been described above with reference to specific embodiments. However, the advantages, benefits, problem solutions, and any components that can effect or enhance an advantage, benefit, or solution are not to be construed as critical, necessary, or essential features or components of the claims. REFERENCES 100 An Adaptive, Encrypted System for Analyzing Data on Cyber ​​Threats. 102 Secure Data Interface Unit 104 Cryptographic coding unit 106 For Homomorphic Anomaly Inference 108 First Unit For Causal Inferences 110 Second Unit: Causal Inferences 112 Adaptive Learning Control Unit 114 Safe output control unit

Claims

[1] An adaptive, encrypted data analysis system for cyber threats, consisting of: a secure data interface unit configured to receive cyber threat telemetry data originating from a variety of distributed computing resources, including network infrastructure devices, endpoint systems, cloud workloads, and application servers, wherein the received cyber threat telemetry data includes network interaction records, authentication activity data, process execution data, behavioral traces, and temporal event information, and wherein the cyber threat telemetry data is received in an encrypted state; a cryptographic coding unit that is operationally coupled with the secure data interface unit and is configured to transform the received encrypted cyber threat telemetry data into a variety of encrypted anomaly embedding representations by performing feature normalization, temporal alignment, and semantic coding operations prior to encryption, and is further configured to apply homomorphic encryption to generate ciphertext-based anomaly embeddings that preserve mathematical operability; a homomorphic anomaly inference processor that is operationally coupled with the cryptographic coding unit and is configured to perform encrypted analytical operations directly on the ciphertext-based anomaly embeddings, wherein the homomorphic anomaly inference processor is configured to compute encrypted deviation indicators that represent behavioral deviations from encrypted baseline profiles without performing any decryption at any stage of the computation; a first causal inference unit that is operationally coupled with the homomorphic anomaly inference processor and is configured to create encrypted local causal dependency representations by evaluating conditional relationships between encrypted anomaly embeddings corresponding to individual system components, user interactions, and execution contexts, thereby deriving causally attributable sources of detected anomalies; a second causal inference unit that is operationally coupled with the first causal inference unit and configured to aggregate encrypted local causal dependency representations across a variety of computing resources to derive encrypted global causal propagation representations that indicate coordinated or multi-stage cyber threat behavior spanning multiple system domains; an adaptive learning control unit operationally coupled with the cryptographic coding unit, the homomorphic anomaly detection processor, and the first and second causal inference units, wherein the adaptive learning control unit is configured to update encrypted baseline behavior profiles and encrypted causal dependency parameters based on validated threat findings while maintaining all learning operations within an encrypted computation domain; and a secure output control unit that is operationally coupled with the second causal inference unit and configured to generate cyber threat intelligence signals that include encrypted risk indicators, threat classification outputs, and response prioritization information, with the generated outputs excluding the disclosure of underlying plaintext cyber threat telemetry. [2] System according to claim 1, wherein the secure data interface unit is further configured to enforce cryptographic session isolation and key separation for cyber threat telemetry received from different computer resources, so that encrypted anomaly embeddings corresponding to separate resources are managed in logically isolated cryptographic contexts to prevent cross-domain data derivations. [3] System according to claim 1, wherein the cryptographic coding unit is further configured to generate the encrypted anomaly embedding representations as fixed-dimensional vectors derived from time-windowed behavior sequences, and wherein each vector encodes encrypted representations of frequency-based, sequence-based and context-based cyber behavior attributes. [4] System according to claim 1, wherein the homomorphic anomaly inference processor is further configured to perform an encrypted distance assessment and an encrypted similarity assessment between incoming encrypted anomaly embeddings and stored encrypted baseline behavior profiles to derive the encrypted anomaly indicators, and wherein the encrypted anomaly indicators remain in ciphertext form throughout the inference. [5] System according to claim 1, wherein the first causal inference unit is further configured to generate encrypted causal attribution values ​​that represent the probability that a certain encrypted anomaly embedding is causally linked to a corresponding system component or execution context, and wherein the causal attribution values ​​are computed using encrypted conditional dependency evaluations. [6] System according to claim 1, wherein the second causal inference unit is further configured to evaluate encrypted temporal ordering relationships and encrypted dependency relationships between assets in a plurality of encrypted local causal dependency representations in order to derive encrypted threat propagation paths across distributed infrastructures. [7] System according to claim 1, wherein the adaptive learning control unit is further configured to update the encrypted baseline behavior profiles by including encrypted anomaly embeddings associated with verified benign behavior, while excluding encrypted anomaly embeddings associated with confirmed malignant activity, thereby refining the encrypted behavior norms over time. [8] System according to claim 1, wherein the adaptive learning control unit is further configured to adjust encrypted causal dependency parameters by strengthening encrypted causal relationships that repeatedly precede validated cyber threat outcomes and weakening encrypted causal relationships associated with non-threat-related anomalies. [9] System according to claim 1, wherein the secure output control unit is further configured to selectively decrypt only aggregated threat classification results using authorized cryptographic credentials, while preserving the encrypted storage of all intermediate anomaly embeddings, deviation indicators and causal representations. [10] System according to claim 1, wherein the system is structurally implemented as a dedicated cyber threat analysis device comprising a physical enclosure housing the secure data interface unit, the cryptographic coding unit, the homomorphic anomaly inference processor, the first causal inference unit, the second causal inference unit and the adaptive learning control unit, wherein the device further comprises isolated memory areas and tamper-proof hardware elements configured to maintain the integrity and confidentiality of encrypted cyber threat analysis operations.

Images