A Density–Metric Framework for the Mathematical Separation of Anomalous Events in High-Dimensional Spaces

Detecting anomalous events in high-dimensional behavioral data is a fundamental challenge in modern cybersecurity, particularly in scenarios involving stealthy advanced persistent threats (APTs). Traditional anomaly detection techniques rely on heuristic notions of distance or density yet rarely offer a mathematically coherent description of how sparse events can be formally empirically separated from the dominant behavioral structure. This study introduces a density–metric geometric space framework that unifies geometric, topological, and density-based perspectives into a single analytical model. Behavioral events are embedded in a five-dimensional Euclidean geometric space equipped with a neighborhood-based density operator. Anomalies are formally defined as points whose local density falls below a fixed threshold, and we show that such points occupy empirically distinct low-density regions of the induced metric space. The theoretical foundations are supported by experiments conducted on openly available cybersecurity datasets, including ADFA-LD and UNSW-NB15, where we demonstrate that low-density behavioral patterns correspond to structurally rare attack configurations. The proposed framework provides a mathematically grounded framework with empirical validation for why APT-like behaviors naturally emerge as sparse and weakly coherent regions in high-dimensional space. These results offer a principled basis for high-dimensional anomaly detection and open new directions for leveraging geometric learning in cybersecurity.