Core Components & Neural Modules

NagaHana is composed of specialized neural and algorithmic components working in concert:

---

1. FieldEncoder (Input Layer)

Transforms heterogeneously structured, multi-source telemetry records into standardized update vectors:

• Observation Status Integration: Every field explicitly encodes its evidence status (OBSERVED, NOT_OBSERVED, NOT_SUPPLIED, LOW_RELIABILITY, STALE). The model treats absence as a structural sensor property, never as zero.
• Continuous Embeddings: Continuous quantities (durations, byte rates, intervals) are mapped using signed logarithmic scaling coupled with learnable periodic embeddings.
• Categorical & Hash Tables: High-cardinality fields (ports, protocols, service identifiers) use deterministic universal hashing.

---

2. CVG-AE (Complex Variational Graph AutoEncoder)

The spatial and structural perception module:

• Multi-layer heterogeneous hypergraph transformer operating across parallel relation planes.
• Employs typed cross-plane attention and Random Walk Structural Embeddings (RWSE).
• Generates a hybrid latent representation $z = [z_{\text{continuous}}, z_{\text{categorical}}]$ capturing traffic volume, entropy, topological centrality, and protocol state.

---

3. TSTCT (Topological Spatio-Temporal Causal Transformer)

The temporal and relational world model that maintains the Environment:

• Three Specialized Head Groups:
  1. Spatial Heads: Multi-hop neighborhood attention over hypergraph topology.
  2. Temporal Heads: Rotary continuous-time self-attention over an entity's historical states.
  3. Causal Heads: Neural Granger-causality gated attention enforcing strict backward-in-time precedence.
• Two-Stream Weight-Tied Loop: Separates memory formation from iterative thinking passes, guaranteeing stable inference scaling.

---

4. TAAFT (Topological Anti-Adversary Foundation Transformer)

The adversary-analysis core that populates Imagination:

• Refines adversarial hypotheses through continuous energy descent over a multi-lens energy function: $$E_{\text{total}} = E_{\text{belief}} + E_{\text{game}} + E_{\text{info}} + E_{\text{topo}} + E_{\text{time}} + E_{\text{cause}} + \lambda \Phi_{\text{phys}}$$
• Energy Lenses:
  • Belief & Trust: Outlier-robust likelihood penalizing unverified suspicion.
  • Game Theory: Models adversary utility, bounded rationality, and strategic payoff.
  • Information Theory: Penalizes hypotheses unsupported by signal-to-noise dynamics and traffic periodicity.
  • Topology & Causal: Propagates threat probabilities along reachable network conduits.

---

5. Forecaster

Generates actionable threat trajectories:

• Employs Model Predictive Path Integral (MPPI) rollouts over learnable adversary transition policies.
• Computes cumulative infiltration probability curves $P_{\text{inf}}(k)$ over forward time steps.
• Projects adversary ATT&CK stages (Reconnaissance → Lateral Movement → Exfiltration → Impact) and candidate attack paths.

---

6. Advisor (Advisory Defense Engine)

• Evaluates candidate countermeasure sequences using MITRE D3FEND taxonomy actions (Isolate, Block, Deceive, Evict, Harden).
• Performs counterfactual simulations against the Forecaster's adversary models.
• Ranks defensive plans using Conditional Value at Risk (CVaR), balancing threat mitigation against operational disruption and feasibility.

---

7. Verifier (Human-Gated Regulator)

• Serves as the system's governance and reliability engine.
• Computes conformal prediction intervals and Platt / isotonic calibration temperatures.
• Maintains a ledger of human analyst feedback, using verified human input as ground truth.
• Monitors drift and flags adversarial data poisoning attempts.