HoSig-Align I: Edge-Native Threat Attribution using Homology Blocks in IoT-Pervasive Networks

A primary challenge in network defense is to mine potential attack campaigns from massive, continuously arriving alerts and telemetry data in real time. This paper presents HoSig-Align I, an edge side unsupervised method designed for network streams to discover homologous blocks. Our approach innovatively fuses heterogeneous features like Internet Protocol (IP) and Payload into a unified representation while strictly excluding temporal information from it, only incorporating time via a dual time scale decay model during graph construction to capture temporal proximity. A density robust similarity is computed using an isolation style random partition forest, leading to a sparse k-Nearest Neighbors (k-NN) graph. The stream is then accurately segmented into internally cohesive and mutually isolated homologous blocks through spectral ordering and contrastive change point detection. Each block is encoded into a lightweight HoSig signature, forming the basis for cross organizational collaboration. Experiments on real network streams show that HoSig-Align I identifies coherent attack campaign blocks and improves separation and boundary clarity over baselines, while meeting low-latency and low-overhead requirements for edge processing.