For years, advanced and novel threat detection in cybersecurity has leaned on traditional machine-learning (ML) techniques such as anomaly detection. These approaches were useful for spotting obvious spikes and outliers, but they struggle with modern, adaptive attackers and the sheer complexity of cloud-scale environments.

Traditional ML anomaly detection assumes attacks stand out from a baseline. Modern attackers do the opposite. They operate inside normal behavior on purpose. They reuse legitimate protocols and progress in sequences that do not look statistically unusual.

DeepTempo is built for this world. It uses a deep learning foundation model called LogLM (“log language model”). It’s a fundamentally different architecture that understands behavior, detects intent at a deep level, and then uses a lightweight classifier to identify attacks early in the kill chain.

The question for detection is no longer “Is this different from baseline?”

The correct question is “What is this activity trying to accomplish?”

Let’s explore the differences.

1. Legacy ML chases deviation. DeepTempo models behavior.

Traditional ML systems detect anomalies by combining many small, independent tools:

• Clustering
• Random forest
• Local outlier factor (LOF)
• Principal component analysis (PCA)
• Hidden Markov models (HMMs)
• XGBoost
• Gaussian mixtures
• Rules and hybrid rules based systems
• Many others

Each tool looks for a tiny set of patterns. Each requires tuning. Each breaks differently when conditions change.

Just deciding which algorithm to apply to which environment is itself a common subject for advanced research in machine learning; many doctoral dissertations consist largely of various algorithms applied to determine which underlying algorithm to apply to a given dataset.

DeepTempo takes a different approach.  Instead of looking for anomalies, it looks to understand intent, specifically malicious intent:

• A single pretrained foundation model deeply understands behavior and classifies long sequences of events into different patterns.
• Small, fast classifiers on top interprets those patterns to determine whether they are malicious, and if they correspond to known or novel attacker intent (e.g. C2). 

This gives you both behavioral detection and attack recognition in one unified system.

Traditional ML: 30+ tools.
DeepTempo’s LogLM: one model + classifiers.

‍

2. Feature engineering breaks. Learned behavior scales.

ML requires defenders to define what matters. It encodes assumptions through thresholds, metrics, and ratios:

• Ports
• Counters
• Thresholds
• Ratios
• Heuristics

This approach is fragile because attackers understand features just as well as defenders do. They avoid the indicators they know systems are watching.

DeepTempo’s LogLM learns representations directly from raw data. The foundation model discovers subtle patterns of normal traffic, timing, relationships, and entity behavior—without humans specifying features.

There is no threshold maintenance or feature design. The behavior representation adapts to the environment itself. This removes an entire category of engineering work and eliminates many sources of brittleness.

3. Adaptation: The long wait and retraining vs minutes 

Traditional ML requires continual retraining as conditions change:

• Collect new data
• Label examples
• Tune thresholds
• Retrain the model

These models degrade when the environment changes because the features are tied to a specific context. And if the results are still poor, reconsider whether the choice of algorithm is still correct or would one of the other dozens of algorithms now do a better job.

This can take weeks or months.

DeepTempo separates representation from interpretation. LogLM produces a stable representation of behavior across environments. The classifier layer evolves as new attack techniques appear, and learns new attack patterns in minutes to hours using very little data.

Representation is fixed. Meaning evolves. The result is dramatically faster adaptation and far less operational overhead.

4. Anomaly detection stops at “unusual.” DeepTempo answers “why.”

This is the critical distinction.

The foundation model inside our LogLM learns understanding of behavior and intent across 512 dimensions. It creates embeddings from raw logs of long duration activities, which when projected in this behavioral space reflect whether sequences fit into patterns of life. 

The classifier layer performs the second step. It separates operational intent from attacker intent and maps malicious behavior to MITRE ATT&CK. These are different tasks treated as separate problems.

While traditional ML answers “This looks different from standard activity”, DeepTempo answers “This is reconnaissance, credential pivoting, lateral movement, or C2.” By detecting attacker intent instead of deviation spikes, the system dramatically reduces false positives.

5. Small windows miss attacks. Sequences reveal purpose.

Most ML systems for anomaly detection operate in small windows such as single rows, sliding windows, or aggregated counters. These tools typically have 10–10,000 parameters.  This makes it challenging to see how attackers behave over long sequences.

DeepTempo analyzes sequences up to approximately 1,500 events using a model that executes:

• Approximately 150 million parameters
• Approximately 279 billion operations per sequence

This gives it enormous contextual understanding—like reading a whole paragraph instead of guessing from a single word. The system sees how attackers progress across flows rather than examining individual events. It identifies attack patterns long before the activity appears suspicious in baseline metrics.

Attackers operate across sequences. Detection must model sequences as well.

6. Explainability must reflect attacker logic, not metrics.

ML explains alerts by pointing to numerical deviation. It reports that a port spiked, a threshold was exceeded, or a cluster boundary changed.

• “Flow count exceeded threshold”
• “Port 22 spike”
• “Cluster distance exceeded”

These signals identify differences, not meaning. An analyst still needs to determine what the activity was trying to accomplish.

DeepTempo produces explanations in attacker logic. LogLM identifies the behavioral cluster. The classifier layer maps it to intent. The output contains context such as MITRE mapping, behavioral neighbors in the embedding space, and evidence of progression over time.

• Similarity to past sequences
• Mapped MITRE TTP
• Progression across flows
• Behavioral neighbors in the embedding space

Instead of describing a metric, the system explains the behavior. Analysts receive an explanation of what the system saw and why it matters. This eliminates guesswork and accelerates triage.

7. Generalization is the new requirement, not tuning.

Typical ML systems degrade when deployed into new environments or when conditions change. They require new baselines and new thresholds because the representation is tied to one network.

• Different traffic patterns
• Different baselines
• Different behaviors

DeepTempo avoids this failure mode because LogLM models the structure of communication itself. It understands workflows such as authentication, replication, orchestration, and east west movement that appear across every environment and deployment.

The classifier layer adapts to new attacks without retraining LogLM.

Traditional systems change themselves to fit the environment. DeepTempo does not. The interpretation layer adapts while the representation remains constant.

8. Detection coverage must span MITRE ATT&CK

Traditional ML usually covers 10-20% of the network-visible ATT&CK techniques:

• Scanning
• Volume anomalies

DeepTempo’s LogLM has been proven to show more than 70% of the TTPs that appear in logs, including:

• Reconnaissance
• Credential pivoting
• Lateral movement
• Persistence
• Command and control

DeepTempo identifies the malicious intent instead of the behavioral spike or deviation. It detects the part of the attacks that matters most and it detects it early.

9. A unified system replaces a collection of detectors.

ML architectures grow in complexity over time. They add more detectors, tuning workflows, and rules. The system becomes more difficult to operate.

DeepTempo simplifies detection by separating the behavioral engine and the interpretation layer. LogLM clusters behavior. The classifier layer interprets behavior and labels attacks. The system consolidates malicious sequences into a single attack.

• LogLM learns and clusters behavior
• The classifier assigns intent and maps to MITRE
• The system groups malicious sequences into one attack

Traditional systems grow more complex to cover more cases. DeepTempo solves the problem with one pipeline and one representation.

Conclusion

Traditional ML anomaly detection assumes attackers reveal themselves through deviation. As a result, prior ML, when applied to anomaly detection for cyber security, requires endless tuning, retraining, and human babysitting.

Modern attackers operate inside normal behavior. This breaks the legacy model.

DeepTempo’s LogLM offers a modern evolution:

• A foundation model for deep understanding of operational behavior
• A lightweight classifier layer for attack identification
• Massive context, fast adaptation, and much stronger generalization

As a result, systems require no ongoing tuning, they detect attacks earlier in their kill chain, achieve better MITRE ATT&CK coverage, and deliver more actionable insights.

This is not anomaly detection with better math. It is a different architecture built for today’s AI-driven threats. Want to try it on your flow logs to see what your current systems missed? Talk to us. 

‍