Reachability, Not Observation: Containing Systems Whose Wiring Changes
Theoretical study shows snapshot-based containment vastly underestimates required blocks when wiring changes, proposing reachability-based declared capability maps instead.
The paper analyzes what network-structure snapshots miss when connectivity changes over time, showing on a rotating hypercube that defenders see 2 crossing edges where 8,194 must be blocked, a factor of 4,097. On the real Internet the gap is only x1.5-2.0, indicating the blind spot is introduced by design, as with round-robin optical datacenter fabric schedules. A declared capability map validated by static call-graph reachability catches all 8 planted holes versus 2 for a deny-list, and the framework extends to frequency hopping, air gaps, and coding-agent tool surfaces.
- Snapshot-based containment can underestimate required blocks by up to 4,097x
- Real-Internet blind spot is x1.5-2.0 once growth is removed
- Declared capability maps caught all 8 planted holes vs 2 for deny-lists
- Framework covers frequency hopping, air gaps, and coding-agent channels
From the original article
1 min read at arxiv.orgContainment decisions -- where to put a firewall, which links to monitor, what a program may reach -- are computed from an observed structure, and observation is a snapshot. We ask what a snapshot misses when the wiring changes over time.
By Yoshiaki Takashita · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.