from a security perspective: Could an attacker exploit BRIGHTs adaptive nature by generating stable-looking malicious traffic to trick the Bayesian model into lowering its monitoring intensity, thereby hiding a slow-rate attack?
This is an excellent and practically important security concern. The short answer is yes, such an attack is theoretically feasible, and the paper does not address this threat at all.
How the attack would work. BRIGHTs core logic is that stable, low-variance flows get probed less frequently. An attacker who understands this could deliberately craft malicious traffic to mimic a stable mouse flow — maintaining a steady, low rate over time to build up a trustworthy posterior in the Bayesian model. Once the stability score is high and entropy is low, BRIGHT would naturally reduce the probing frequency for that flow, creating a window during which slow-rate malicious activity (such as data exfiltration, slow port scanning, or covert channel communication) could proceed with minimal monitoring scrutiny.
Why BRIGHT is particularly vulnerable. The Bayesian model is designed to trust historical observations — that is its strength for efficiency, but also its weakness against adversarial manipulation. A patient attacker who operates below the burst detection threshold would never trigger the event flag, never elevate their stability score, and never appear in the high-priority probing queue. The system would essentially learn to ignore them.
What the paper offers as partial protection. The temporal urgency component of the scoring function ensures that even stable flows are eventually revisited after sufficient time has passed. So a flow can never be permanently ignored — but the probing interval could be stretched long enough to make detection practically difficult.
What is missing. BRIGHT has no adversarial awareness whatsoever. It lacks mechanisms such as randomized probing to prevent predictable blind spots, anomaly detection based on cumulative behavioral patterns rather than short-term variance, or any notion of a minimum probing floor for security-sensitive flows regardless of their apparent stability.
In summary, BRIGHTs adaptive efficiency and its security robustness are in direct tension, and this represents a meaningful gap that future work would need to address, perhaps by incorporating a security-aware probing floor or integrating with dedicated intrusion detection systems.
