Minimum description length in security operations

The objection that should win

A SOC analyst who has sat through a incident retrospective knows this argument in her bones, even if she has never heard the phrase minimum description length. Here it is, stated as strongly as it deserves: any criterion that rewards a shorter code for the data will, given a stream that never stops and a model class that is even slightly wrong, drift toward a model that is confidently, efficiently, and permanently mistaken. Grünwald and van Ommen showed exactly this — minimum description length can be inconsistent under misspecification. Feed it more data through the wrong lens and the code keeps getting shorter while the model gets further from anything true. Now put that mechanism inside a security operations centre that is already drowning in EDR telemetry, threat intel feeds, identity events and configuration drift, all arriving continuously and none of it curated. A system that recomputes its "best explanation" against every new packet, without a human ever pausing to ask whether the explanation is right, does not sound safer than a static one. It sounds like a way to compound an error faster and hide it better, because the metric itself will report that things are improving. If continuous intake makes the accounting sharper only when the model class is sound, and SOC model classes are notoriously provisional — an attacker technique reclassified, a detection rule that never covered the pivot path, a baseline of "normal" identity behaviour built on six months of an org chart that has since been reshuffled — then the case for a Large Universe Model in this domain looks fragile exactly where it matters most: at the moment the world stops resembling the model.

This is not a strawman. It is the objection that has to be answered honestly, because it targets the load-bearing claim, not a peripheral one.

What the criterion actually prices

Minimum description length treats learning as compression: a model is good to the extent that stating the model, then stating the data given the model, costs fewer bits than any competing encoding. Complexity is not forbidden. It is billed. A detection rule, a behavioural baseline, an identity risk score — each is a parameter, and each earns its place only if it shortens the description of what actually happened by more than it costs to state. This is why the criterion is defined against a specific body of data, and why changing that body changes the winner. A ruleset tuned against last quarter's incident set can lose to a simpler one once this quarter's telemetry arrives, or gain against it if the new traffic finally justifies the extra clauses.

The three generations differ only in what that body of data is. A Large Language Model fixes the corpus before training and finds the shortest code for that frozen string; the answer is optimal for a dataset that, by the time anyone reads the output, no longer describes the world in that form. A Large World Model recomputes the code while a scene is being sensed — telemetry from one investigation window, one on-call rotation, one contained incident — and the minimum genuinely tracks what is observed, but the accounting resets when the scene ends. Nothing carries forward with its source attached. A Large Universe Model applies the same criterion prequentially, without a terminus: each new EDR event, each intel update, each identity anomaly is first predicted against the current code, then charged in bits, then folded in. The code that was cheapest this morning may be dearer by evening, and the change is recorded rather than silently absorbed.

Provenance is not a nicety here; it is arithmetic. In a two-part code, the description of the data must include where the data came from. An EDR alert with no clear sensor lineage, a threat intel indicator with no attribution chain, cannot be priced properly — you don't know whether to charge it as signal or as noise from an unreliable source. Fold it in blind and you are guessing at the bill.

Where the analyst's problem actually lives

The characteristic failure in security operations is not a missing detection. It is dwell time: the interval between one hunt and the next, during which an intrusion that the current model does not describe well simply continues, unbilled, because nobody re-ran the accounting. A hunt is, in this framing, a manual, batch-mode application of minimum description length — an analyst manually asking whether the last month of authentication logs and process trees is better explained by "normal operations" or by "normal operations plus an actor". Between hunts, that question is not being asked at all. The code is not wrong so much as stale; it was fitted to a scene that has since moved on, and the drift accrues as unpriced residual — exactly the gap an intrusion lives in.

This is the honest version of the misspecification objection turned back on itself. A frozen or scene-bounded model does not avoid the inconsistency risk Grünwald and van Ommen describe. It hides it, because nobody is watching the residual once the scene closes. A prequential system, one that predicts each incoming identity event or configuration change before it happens and charges itself in bits when it is wrong, produces a visible signal exactly where the frozen system produces silence: sustained loss above what the code itself predicted. That signal is what a SOC calls anomalous — not a rule firing, but the running bill going up. Provenance tagging lets that excess be localised to a source: a particular EDR sensor under-reporting, a particular identity provider's logs drifting out of schema, a particular intel feed whose indicators have stopped correlating with anything real. Wrongness that is measured, stream by stream, is not the same failure as wrongness that is preserved by never re-checking.

Where the objection still bites

Concede what has to be conceded. Continuous recomputation does not fix a wrong model class. If the baseline of "normal" identity behaviour was built on a flawed premise — say, that service accounts never authenticate interactively — no amount of fresh telemetry corrects that premise on its own; it just makes the wrong code cheaper as more traffic obligingly fits the blind spot. Tempering the update, or switching model classes when residuals misbehave, is a deliberate engineering choice, not something the criterion supplies for free. A SOC that trusts the accounting without an analyst empowered to question the model class has automated the exact failure the objection warns about, only faster.

A second, more technical version of the objection deserves the same honesty. The sharpest form of minimum description length, normalised maximum likelihood, has an infinite normalising constant for many realistic model classes, and the two-part code that approximates it is not unique. Computing any exact version of this over an unbounded, non-stationary flow of EDR telemetry and identity events is not merely expensive. The optimum may not exist. A criterion that cannot be evaluated is not a criterion, and a SOC cannot run its detection stack on a number nobody can compute.

That is correct, and it is why nothing in security operations runs on the exact form. What is computable is the prequential version Philip Dawid described in 1984: predict the next event, record the log-loss when it turns out otherwise, update, move on. That produces an accumulating bill in bits — a running measure of how well the current model is doing — without ever requiring a global optimum to exist. Non-stationarity, which in a SOC means an org restructuring, a new SaaS tenant, an attacker changing tooling mid-campaign, is handled by allowing the code to switch, at a small charged cost per switch, rather than insisting one model must fit all eras. The result is not the shortest possible description of everything that ever happened on the network. It is a bounded-regret approximation, good enough to say, hour by hour, whether the current model is earning its keep.

The narrower claim

Prequential coding is forty years old, and online detection has leaned on some version of it for most of that time. Naming a third generation is not a claim to have invented sequential inference. It is a claim about which argument of the criterion — the dataset, not the model class — has been exhausted. Classical prequential work assumed one stream, one schema, one trustworthy source. A modern SOC has EDR telemetry, threat intel, identity events and configuration drift, arriving at different rates from sources of unequal and changing reliability, and the description length of what happened must include a term for where each fact came from. That is new bookkeeping laid over old mathematics. The terminal claim, once stated this narrowly, is modest: description length is computed over evidence, and once evidence means every stream still arriving, there is no larger dataset left to widen the criterion toward. What remains — choosing the right model class, tempering against misspecification, deciding when a switch is worth its cost — is the analyst's job, not the axis's.