Home

NagaHana — Adversary Foundation Model for Long-Horizon Threat Forecasting

SIH Team ID: 155021

---

Executive Overview

NagaHana is an AI world model engineered for long-horizon threat forecasting across computer networks and Critical Information Infrastructure (CII). Rather than performing retrospective anomaly detection or isolated alert correlation, NagaHana continuously learns the latent, evolving state of enterprise IT and industrial OT environments directly from passive network telemetry.

By treating the monitored infrastructure as a partially observed, adversarial dynamical system, NagaHana models conflict, coordination, adversarial strategies, and benign dynamics. It projects and evaluates multi-step intrusion trajectories before the attacker's objective completes, providing defensive teams with calibrated, interpretable risk forecasts and verified countermeasure recommendations.

---

Core Pillars & Design Posture

Principle	Architectural Manifestation
100% Passive Sensing	Operates strictly via network taps, SPAN ports, flow collectors, and gateway telemetry. Requires zero host agents or endpoint software.
Unified IT & OT Scope	Simultaneously models enterprise IT protocols (Kerberos, DNS, TLS/JA4, SSH, RDP) and industrial control networks (Modbus, DNP3, IEC 60870-5-104, S7comm, EtherNet/IP).
Forward Simulation	Uses Model Predictive Path Integral (MPPI) rollouts and energy-based reasoning to anticipate attacker routes across lateral network topologies.
Physics as a Boundary	Enforces conservation laws, queueing constraints, and protocol invariants ($\Phi_{\text{phys}}$) to mathematically eliminate impossible hallucinations.
Strict Epistemic Isolation	Distinguishes observed ground truth (Environment) from generated beliefs (Imagination) and regulatory metrics (Monitor).
Advisory & Human-Gated	Provides decision support. All system updates, fine-tuning, and defensive activations require explicit human authorization.

---

High-Level Processing Flow

Passive Network Telemetry (PCAP, NetFlow, Zeek, Suricata, Industrial TAPs)
                                   │
                                   ▼
          Superset Event Ingestion & Observation State Modeling
                                   │
                                   ▼
        Perception: CVG-AE (Heterogeneous Hypergraph Autoencoder)
                                   │
                                   ▼
         Memory: TSTCT (Spatio-Temporal-Causal Transformer)
                         Writes to Environment Cache
                                   │
                                   ▼
     Adversary Analysis: TAAFT (Energy-Based Transformer Engine)
                        Writes to Imagination Cache
                                   │
                                   ▼
  ┌────────────────────────────────┼────────────────────────────────┐
  │                                │                                │
  ▼                                ▼                                ▼
Forecaster                      Advisor                          Verifier
• Multi-Step Infiltration      • D3FEND Mitigations             • Conformal Calibration
• ATT&CK Stage Projection      • Risk-Reduction Ranking         • Trust Scoring
• Dynamic Hazard Curves        • Disruption Cost Analysis       • Poisoning Detection

---

Wiki Navigation

Explore detailed specifications across the system:

• Architecture: Complete information pipeline, memory separation, and information flows.
• Core-Components: Deep dive into the neural and algorithmic engines (CVG-AE, TSTCT, TAAFT, Forecaster, Advisor, Verifier, Decoder).
• Capabilities-and-Workflows: Operational modes (Live Threat Forecasting, Forensic Replay, Countermeasure Evaluation).