Capabilities and Workflows

Capabilities & Operational Workflows

During active operations, NagaHana ingests continuous streaming network updates:

Event State Update: Incoming network records trigger an incremental state update in the CVG-AE and TSTCT modules.
Periodic Forecaster Cadence: On designated time cadences or priority triggers, TAAFT initiates energy refinement over active entity tokens and adversary slots.
Trajectory Generation: The Forecaster simulates distinct attack routes across forward time steps into the future.
Actionable Outputs:
- $P_{\text{inf}}(k)$ Hazard Curves: Non-decreasing curve displaying the probability of compromise over time.
- Target Attribution & Lead Time: Identified compromised devices, anticipated next targets, and estimated lead time prior to objective execution.
- D3FEND Advice: Actionable defensive measures ranked by net risk reduction and operational disruption cost.

When investigating past incidents or analyzing recorded packet captures:

Full Timeline Reconstruction: Replays network state progression step-by-step, pinpointing the initial intrusion vector (Patient Zero).
Kill-Chain Narrative: Maps observed events directly to the MITRE ATT&CK framework with confidence intervals.
Counterfactual Simulation: Analysts can test counterfactual scenarios (e.g., "If the affected workstation had been isolated at 14:20, would exfiltration have succeeded?"), providing evidence for incident debriefs and architectural hardening.

Leveraging statistical physics principles, NagaHana tracks early-warning signals that precede network transitions:

Thermodynamic Metrics: Free energy, ensemble entropy, and heat capacity calculated over network state distributions.
Critical Slowing Down: Measures rising variance, lag-1 autocorrelation, and spectral density anomalies that indicate an infrastructure approaching operational phase changes or coordinated disruption.

NagaHana — Adversary Foundation Model for Long-Horizon Threat Forecasting | SIH Team ID: 155021