Discovery Pass 01 — executive summary
_Discovery Engine (Phase 3), first full pass. Deterministic miners → LLM hypothesis framing → validation harness → discovery memory. Seed 1729; source DB git_commit 92a83fc (633 attacks, 15 sources, built 2026-09-19). All verdicts recorded to data/discoveries/*.yaml (24 records). No PRs opened, no detections authored, no attack guidance produced — this pass only produces artifacts._
Funnel: candidates → hypotheses → survivors
| stage | count |
|---|---|
| Raw miner candidates (FP-growth rules) | 4,342 significant, coverage-controlled |
| — of which flagged coverage-artifact by the miner | 1,494 |
| — of the 4,342, flagged structural-coupling (platform↔data_sources) by the miner | 1,835 (→ 2,507 non-structural) |
| Raw miner candidates (link prediction) | 1,408 attack-chain + 43,881 shared-defence pairs |
| Raw miner candidates (HDBSCAN clusters) | 50 clusters (33 cross-category) |
| Raw miner candidates (gaps: hotspots/outliers/detection gaps) | 28 |
| Raw miner candidates (graph centrality) | 30 mitigation + 30 detection choke points |
| Hypotheses escalated to the validation harness | 24 |
| — CONFIRMED (low-risk data findings) | 5 |
| — PENDING-LAB (survive statically; need Phase-4 detonation) | 2 |
| — INCONCLUSIVE | 2 |
| — REFUTED (rejected as artifacts / non-novel / falsified) | 15 |
| Survivors (confirmed + pending-lab) | 7 — all low-risk |
Honesty note: of 24 adjudicated hypotheses, 17 (71%) did not survive — 15 refuted, 2 inconclusive. Every one of the 6 needs-approval items (proposed detections and the one novel attack-chain) was refuted: none produced an actionable detection or chain this pass. The engine's main output is therefore a set of validated negative controls and a handful of confirmed data/coverage findings — not new detections.
Bucket (i): Low-risk data / statistical findings — surfaceable
These passed all four gates (coverage-artifact, statistics, prior-art, adversarial) or, where noted, are confirmed methodological controls. All are pure data findings — no proposed detection or attack chain — and none is claimed novel. They are validated anchors and cautions for the engine.
CONFIRMED
1. Cloud-identity surface (SaaS + office-suite + IdP) is tightly platform-coupled and the best-instrumented region. Coverage-controlled co-occurrence lift ~4.4 (controlled per-pair Fisher p ≤ 1.8e-41 on the 231 platform-covered attacks); identity-credential is the richest category (full-population det_mean 8.45, mit_mean 13.23). Known prior art (MITRE v17 cloud split + ITDR) — recorded as a validated known-truth baseline anchor. pattern-dad8c8d08f69. 2. ICS/OT and mobile techniques carry documented ATT&CK detection strategies but ~zero ruleized Sigma/Elastic content. 100% of assessable ATT&CK-ICS (22/22) and mobile (12/12) attacks have zero public host-log rules vs an enterprise median of 11 — a 100% corpus census (no inferential p reported: a test on a full-population census is not evidential). Known-gap-confirmatory. coverage-gap-ef0ed81c1940. 3. A cloud-control-plane family is well-covered (HIGH detectability) — a calibration cross-check for the OT/ICS gap findings: cloud (n=11) vs pooled OT (n=32) detectability Mann-Whitney p=3.7e-6, SMD 2.54, Cliff's delta 0.878, at comparable mitigation enrichment. Not an independent control — detectability is derived from the same Sigma/Elastic source as the gap findings, so this shows the instrument registers the expected cloud≫OT contrast, not external ground truth. pattern-8608f20762fc. 4. The "60 undetectable high-impact hotspots" collapse to 2 under a coverage control. A methodological negative control: 57/60 lack any detectability facet AND any ATT&CK id, so "no detection" == "not enriched" (P(mit|detect)=0.976 vs 0.045; Fisher p=1.8e-135). Prevents acting on a spurious risk list. coverage-gap-063e3e19daa5. 5. 42% of FP-growth candidate rules are ATT&CK platform↔data-component structural coupling. 1,835/4,342 candidates are pure platform/data_sources couplings; re-mining with those columns excluded drops the pool 4,342→124 (97.1%), leaving 2,507 genuine cross-behavioral candidates. Now implemented in the miner: mine_rules.py flags each rule structural_coupling and reports n_structural_coupling=1,835 / n_candidates_non_structural=2,507, closing the coverage-control blind spot (structural couplings pass the enrichment-presence control but restate ATT&CK's model). Reproduced end-to-end by analysis/validate_structural_coupling.py. pattern-aa876a889c40.
PENDING-LAB (survive statistically/structurally; empirical claim deferred to Phase 4)
6. OT/firmware/mobile attacks are a real public-detection blind spot, not an enrichment artifact. On the mitigation>0 subset, wireless-mobile-iot-ot det_mean 1.34 (sigma_mean 0.00) vs ~10× higher for named IT categories; survives an enrichment-coverage control. Caveat honestly recorded: OT is not unique (ai-ml equally starved), and det_count measures public-rule-repo coverage, not SIEM detectability — so the "undetectable" step is what Phase 4 must test. coverage-gap-abbc5171a39f. 7. Session/token theft-and-reuse is one cross-taxonomy detection surface scattered across 6 taxonomy categories. Stable HDBSCAN cluster (logon-session lift 9.38, enrichment-controlled 7.13, cross-seed Jaccard 0.951). The unifying axis already exists (ATT&CK DS0028; D3-UGLPA) so it is a re-derivation, not a new detection; the operational "one analytic covers the ~8-member reuse core" claim needs Phase-4 confirmation. pattern-60daa494c541.
INCONCLUSIVE (real numbers, but fail a gate as stated — recorded so they are not re-tread)
- Agentic-AI attacks show zero behavioral detection content even where enriched. True and reproducible (all 54 ai-ml det==0) but the det=0 is structurally guaranteed by ATT&CK-technique keying (ai-ml is ATLAS/OWASP-keyed), so it is an instrument-coverage limitation, not a measured void.
coverage-gap-fb0509920af1. - The "unauthenticated network-reachable RCE" CVSS cluster is real but coverage-fragile. Raw lift ~26× is an enrichment-sparsity artifact (only 39/633 carry CVSS facets); controlled lift 1.625. Near-tautological with the CVSS critical-RCE definition.
pattern-c6fdfef278f8.
Bucket (ii): Needs-approval items — proposed detections / defensive attack-chains
Per hybrid-autonomy policy these would require human review and Phase-4 lab validation before any action. This pass produced none worth advancing — all six were refuted by the harness. They are recorded so the engine does not re-propose them, with the salvageable Phase-4 kernel noted.
| item | verdict | why rejected | salvageable Phase-4 kernel (needs approval) |
|---|---|---|---|
Single session-token detection covering 6 categories (detection) | refuted | "disjoint detections" premise is false locally (one Sigma already spans 5 members/4 categories); mechanism keys on logon-creation but replay generates no new logon | measure whether one session-usage-anomaly analytic (device/token-source mismatch) covers the ~9-member reuse core at acceptable FP rate |
Post-auth cloud-identity token-theft attack chain (attack-chain) | refuted | edges are shared-ATT&CK-technique near-duplicates, not sequencing; full path is not phase-monotone (own falsification met) | none new — the real-world chain is published prior art |
Impact/availability needs correlated host+network telemetry (detection) | refuted | data-source co-occurrence is imported ATT&CK metadata; 15 attacks collapse to ~3 parent techniques (pseudo-replication) | known engineering backlog item, not a discovery |
Impact-phase dual network+host signature requires correlation (detection) | refuted | ATT&CK already prescribes both sources; volumetric DDoS is reliably network-only-detectable | as above |
Three ATT&CK controls as cross-category choke points (pattern, flagged needs-approval) | refuted | breadth below random; betweenness ≤ degree-preserving null | none — degree-and-enrichment artifact |
62 attacks "genuine ruleization gap incl. Splunk" (coverage-gap, needs-approval framing) | refuted | corpus-scope + sub-technique confound; public OT analytics exist outside ingested corpora; Splunk never counted | reframed worklist (restrict to ingested corpora, drop parent-ruleized sub-techniques) for detection-engineering triage |
Caveats & selection bias (read before surfacing anything)
- Curated-dataset selection bias is the dominant confound. The 633 attacks and their enrichment were hand-seeded and importer-driven; absence of a facet is missing data, not a measured negative. Most refutations trace to this.
- Detectability is a derived, instrument-bounded facet (Sigma/Elastic counts keyed to ATT&CK technique IDs). Categories keyed to ATLAS/OWASP/CVE/CWE (agentic-AI, web-app, hardware side-channel) are structurally unmeasurable — read cautiously.
- Multiple-comparison surface is large: 5,828/5,838 mined rules are "significant" on n=633. Raw q-values are not to be over-read; the survivors are those that also passed permutation/split/ prior-art/adversarial gates.
- Nothing here is asserted empirically confirmed. Detection/attack-chain claims needing detonation are
pending-lab; the two pending-lab survivors carry explicit Phase-4 test criteria. - No novel discoveries this pass. All seven survivors are
known-detectionorpublished-technique— validated anchors and controls that calibrate the engine, plus honest coverage-gap quantifications on this corpus.
Files written
analysis/reports/coverage-gaps.md,choke-points.md,risk-hotspots.md(standing analyses)analysis/reports/discovery-pass-01.md(this summary)data/discoveries/*.yaml— 24 discovery-memory records (5 confirmed, 2 pending-lab, 2 inconclusive, 15 refuted)analysis/record_discoveries.py— deterministic, idempotent recorder (re-runnable)