Habituation — HOSA Documentation

1. The False Positive Problem

A recurring problem in anomaly detection systems is chronic false positive fatigue: when the legitimate workload changes permanently — a new version is deployed that consumes more memory, a microservice is migrated to the node, the user base grows organically — the detector continues signaling anomaly indefinitely, because the current state deviates from a baseline that no longer represents reality.

Without Habituation

Deploy v2.0 uses 20% more memory
D_M rises and stays elevated
Alert fires — operator investigates
"It's the new version, ignore it"
Alert fires again tomorrow…
Operator silences the alert
Real anomaly occurs — nobody notices
→ Alert fatigue → missed incident

With Habituation

Deploy v2.0 uses 20% more memory
D_M rises and stays elevated
HOSA detects stable plateau
Pre-conditions verified (30 min)
Baseline recalibrated to new normal
D_M returns to low values
Real anomaly → immediately detected
→ Zero alert fatigue → full sensitivity

The challenge is distinguishing between two superficially identical states:

Legitimate plateau shift — the workload genuinely changed, the system is healthy at its new operating point, and the baseline should be updated (Regime +1).
Pathological stabilization — an attacker has established persistent presence and is consuming resources at a steady rate, or a progressive failure has reached a plateau just before collapse (Regime +3 or +4).

Both produce the same signature: elevated D_M with derivative near zero. The difference lies in the structural indicators — the covariance structure, the syscall distribution, the propagation index — which distinguish benign change from pathology. These indicators form the formal pre-conditions for habituation.

2. Biological Inspiration — Neuroplasticity

In neuroscience, habituation is the simplest form of non-associative learning: a decrease in response to a stimulus that is repeatedly presented without reinforcement [1]. When you put on a watch, you feel it on your wrist for a few minutes. Then the sensation fades — not because the watch was removed, but because your nervous system learned that the stimulus is persistent, non-threatening, and can be safely ignored.

The biological mechanism is synaptic depression: repeated activation of the same sensory pathway reduces the synaptic transmission efficiency, effectively raising the threshold for that stimulus. Critically, habituation is stimulus-specific: habituating to the watch on your wrist does not reduce sensitivity to a bee sting on the same wrist.

HOSA's habituation mechanism mirrors these properties:

Biological Property	HOSA Implementation
Repeated, non-threatening stimulus	Elevated D_M with derivative ≈ 0 for sustained period, no system failures (no OOM, no crash, no timeout)
Specificity	Habituation recalibrates μ and Σ — sensitivity to new deviations from the updated baseline is fully preserved
Dishabituation	If a novel stimulus appears (covariance deformation, syscall entropy shift), habituation is blocked and full sensitivity is restored
Context-dependence	Habituation can occur within a specific temporal segment without affecting other segments (seasonal profiles)

"HOSA adapts to legitimate variation but refuses to normalize pathology. The distinction is not philosophical — it is mathematical: pathology deforms the covariance structure; legitimate change preserves it."

3. Mechanism — Weighted Welford Decay

3.1. Exponential Decay of Historical Weights

HOSA's standard baseline accumulation uses the Welford algorithm (see §3 — Welford), which treats all historical samples with equal weight. For habituation, HOSA switches to a weighted variant that applies exponential decay to older samples:

w(t, τ) = e^{−λ(t − τ)}

Equation 1 — Exponential Decay Weight

Where:

t — current time
τ — time at which the sample was collected
λ — decay rate, controlling how quickly old samples lose influence (higher λ = faster adaptation, lower λ = more conservative)

The effect is that recent samples receive progressively more weight in the computation of μ and Σ, while older samples (from the pre-change baseline) gradually lose influence. The baseline drifts toward the new operating point over a configurable time horizon.

3.2. The Recalibration Process

Habituation is not an instantaneous event — it is a gradual process that unfolds over the stabilization period:

Detection of stability. HOSA detects that D_M has been elevated but stable (|dD̄_M/dt| < ε_d) for a sustained period.
Pre-condition verification. All formal pre-conditions (§4) are checked continuously. If any pre-condition fails, the habituation timer resets.
Weighted accumulation begins. Once the minimum stabilization time T_min (default: 30 minutes) is reached with all pre-conditions continuously satisfied, HOSA activates exponential decay weighting on the Welford accumulators.
Gradual convergence. Over the next decay period (typically 2–3× the half-life = ln(2)/λ), the baseline μ and Σ converge toward the statistics of the new operating regime.
Completion. When D_M computed against the updated baseline drops below θ₁, the recalibration is considered complete. The new baseline is the baseline. Normal Welford (equal-weight) accumulation resumes.

Memory Footprint

The weighted Welford variant maintains the same O(n²) memory footprint as the standard algorithm. No data windows are stored — only the running weighted mean, weighted co-moment matrix, and effective sample count are maintained. For n = 10 dimensions, the entire habituation state occupies approximately 900 bytes.

4. Formal Pre-Conditions

Baseline recalibration is permitted if and only if all of the following conditions are satisfied simultaneously and continuously for the entire stabilization period:

Habituation ⟺

  |dD̄_M/dt| < ε_d     (stabilization — derivative near zero)
∧ ρ(t) < ρ_threshold     (covariance structure preserved)
∧ ΔH(t) < ΔH_threshold     (syscall distribution stable)
∧ ICP(t) < ICP_threshold     (no propagation behavior)
∧ D_M(t) < D_M,safety     (plateau below safety ceiling)
∧ t_stable > T_min     (sustained stabilization, default: 30 min)
∧ temporal coherence of φ(t)     (if φ < 0, coherent with seasonal profile)

Equation 2 — Habituation Pre-Conditions (conjunction)

Each pre-condition addresses a specific failure mode of naïve habituation:

Pre-Condition	Failure Mode Prevented	Metric
Stabilization	Habituating to a still-growing anomaly (memory leak that hasn't yet reached plateau)	\|dD̄_M/dt\| < ε_d
Covariance preserved	Habituating to adversarial activity that deforms the correlation structure (cryptominer, DDoS)	ρ(t) < ρ_threshold
Syscalls stable	Habituating to a compromised process that has altered the system call profile	ΔH(t) < ΔH_threshold
No propagation	Habituating to a worm or lateral movement that has established steady-state propagation	ICP(t) < ICP_threshold
Safety plateau	Habituating to a state dangerously close to resource exhaustion (92% memory is not a "new normal")	D_M(t) < D_M,safety
Sustained	Habituating to a transient spike that happens to be briefly stable	t_stable > T_min
Temporal coherence	Habituating to anomalous silence (Regime −3) by misclassifying it as idleness	φ(t) coherent with seasonal profile

If any single pre-condition fails at any point during the stabilization period, the habituation timer resets to zero. The process must restart from the beginning, with all conditions continuously satisfied for the full T_min duration.

The Conjunction is Non-Negotiable

The conjunction (∧) of all pre-conditions is a deliberate design decision. A system where covariance is preserved but the propagation index is elevated must not habituate — the preserved covariance might be coincidental while the propagation behavior represents a real threat. The bar for habituation is intentionally high: all indicators must simultaneously confirm that the deviation is benign.

5. Habituation Across the Regime Spectrum

The interaction between regimes and habituation follows a symmetric pattern centered on homeostasis: habituation is permitted in the central regimes and blocked at the extremes.

5.1. Permitted Regimes (−2 to +2)

Regime	Habituation Policy	Rationale
−2 Structural Idleness	Permitted (with persistent FinOps flag)	The node is permanently over-provisioned. Habituating eliminates false positives from chronic low utilization. However, the FinOps signaling remains active — HOSA stops alerting but continues reporting the waste.
−1 Legitimate Idleness	Incorporated into seasonal profiles	Nighttime idleness is not an anomaly — it is the normalcy of that temporal segment. Each segment accumulates its own baseline.
0 Homeostasis	N/A (is the baseline)	No habituation needed — this is the reference state.
+1 Plateau Shift	Permitted if all pre-conditions satisfied	This is the primary use case for habituation. A new deploy or organic growth has shifted the operating point. The system is stable, healthy, and the covariance structure is preserved.
+2 Seasonality	Intra-segment	Habituation occurs within each temporal segment, not globally. The Monday-morning peak has its own baseline; the Saturday-night valley has its own baseline.

5.2. Blocked Regimes (−3, +3 to +5)

Regime	Habituation Policy	Rationale
−3 Anomalous Silence	Blocked	A server that should be active and isn't represents a potential failure or compromise. HOSA does not adapt to unexplained silence.
+3 Adversarial	Blocked	The covariance deformation ratio ρ(t) exceeds the threshold. The structural fingerprint of the system has been altered. An attacker who establishes persistent presence must never be able to "train" the detector into accepting the intrusion as normal.
+4 Local Failure	Blocked while derivative positive	A monotonically growing anomaly (memory leak, disk degradation) is a progressive failure, not a new normal. Habituation is only considered if the failure stabilizes and the system transitions to Regime +1.
+5 Viral Propagation	Categorically blocked	Propagation behavior (ICP > threshold) indicates active threat to other nodes. HOSA never habituates to propagation patterns, regardless of stability or duration.

5.3. The Symmetry Principle

Figure 1 Habituation policy across the bipolar spectrum

−3 −2 −1 0 +1 +2 +3 +4 +5

BLOCKED Permitted Seasonal Baseline Permitted Intra-seg BLOCKED BLOCKED BLOCKED

← Pathological extremes ADAPTS Pathological extremes →

The pattern is symmetric: HOSA adapts to legitimate variation in the center of the spectrum but refuses to normalize pathology at the extremes. This reflects a fundamental principle: homeostasis is bidirectional equilibrium, not passive acceptance of any steady state.

6. Seasonal Profiles — The Digital Circadian Rhythm

Many workloads exhibit periodic temporal patterns: daily peaks and valleys, weekday/weekend differences, monthly cycles (payroll, accounting close), or annual events (Black Friday, holiday season). If HOSA operates with a single global baseline, these predictable variations are misclassified as anomalies — the morning peak triggers Level 1 every day, the overnight valley triggers sub-demand alerts every night.

HOSA solves this with temporal segmentation of the baseline: instead of maintaining a single (μ, Σ) pair, the agent maintains N baseline profiles indexed by temporal context — a digital circadian rhythm.

6.1. Periodicity Detection via Autocorrelation

The segmentation is determined automatically during the first weeks of operation through analysis of the autocorrelation function (ACF) of the D_M time series:

HOSA accumulates the D_M(t) series for a minimum observation period (configurable, default: 7 days to detect weekly cycles).
Computes the autocorrelation function ACF(τ) for the accumulated series.
Identifies lags τ with statistically significant autocorrelation peaks (above a significance threshold derived from the series length).
If a peak at lag = 24h is detected → daily cycle. If peak at lag = 168h → weekly cycle. Both may be present simultaneously.
Segments the baseline profiles ℬ automatically into temporal windows corresponding to the detected periodicities.

6.2. Temporal Segmentation

The set of baseline profiles is formalized as:

ℬ = { (μ_i, Σ_i, w_i) | i = 1, 2, …, N }

Equation 3 — Set of Temporal Baseline Profiles

where w_i represents the temporal window associated with profile i (e.g., "Monday–Friday, 08:00–12:00" or "Saturday, 00:00–08:00").

A typical server with daily and weekly patterns might produce:

Segment	Window	Expected Behavior
1	Mon–Fri 08:00–12:00	Morning peak — highest baseline
2	Mon–Fri 12:00–14:00	Lunch dip — moderate baseline
3	Mon–Fri 14:00–18:00	Afternoon activity — high baseline
4	Mon–Fri 18:00–08:00	Overnight — low baseline
5	Sat–Sun 00:00–24:00	Weekend — minimal activity

Each segment accumulates its own independent μ_i and Σ_i via its own Welford accumulator.

6.3. Per-Segment Baseline Accumulation

When a new sample x(t) arrives, HOSA routes it to the Welford accumulator of the currently active temporal segment i(t). Only that segment's baseline is updated. This means:

The Monday-morning baseline is only updated with Monday-morning data
The weekend baseline is only updated with weekend data
A permanent increase in Monday traffic recalibrates the Monday profile without affecting the weekend profile

6.4. Context-Indexed D_M Calculation

At each instant t, the Mahalanobis Distance is calculated against the contextually appropriate baseline:

D_M(t) = √[ (x(t) − μ_i(t))ᵀ · Σ_i(t)⁻¹ · (x(t) − μ_i(t)) ]

Equation 4 — Context-Indexed Mahalanobis Distance

where i(t) is the index of the active baseline profile for time t.

Practical implication: The 09:00 Monday peak is compared against the "Monday 08:00–12:00" baseline — not against the "Sunday 03:00" baseline. This eliminates seasonal false positives without sacrificing detection sensitivity.

Benefits to the Negative Semi-Axis

Temporal segmentation equally benefits sub-demand detection. The overnight valley accumulates its own low-activity baseline, allowing Regime −3 (Anomalous Silence) to be detected precisely when activity drops below what is expected for that specific time window. A drop at 03:00 is coherent with the overnight profile (Regime −1). The same drop at 10:00 on a Tuesday is incoherent (Regime −3).

7. Safety Guards Against Premature Habituation

Each formal pre-condition in the conjunction (Equation 2) functions as an independent safety guard against a specific class of premature or dangerous habituation. This section details the mechanism and rationale for each guard.

7.1. Covariance Preservation (ρ)

The Covariance Deformation Ratio ρ(t) measures whether the correlation structure between variables has changed — not just the magnitude of the variables:

ρ(t) = ‖Σ_recent − Σ_baseline‖_F / ‖Σ_baseline‖_F

Equation 5 — Covariance Deformation Ratio

Why this matters: A legitimate workload change (deploy v2.0 uses more memory) typically scales the covariance ellipsoid without deforming it — CPU and memory continue to correlate in the same direction, just at higher magnitude. An adversarial presence (cryptominer) deforms the ellipsoid — CPU rises without corresponding increases in application throughput, creating new correlations that don't exist in the legitimate profile.

When ρ(t) > ρ_threshold, habituation is blocked regardless of stability. The agent will not learn to accept a deformed correlation structure as normal.

7.2. Syscall Stability (ΔH)

The change in Shannon entropy of the syscall distribution ΔH(t) detects whether the behavioral fingerprint of the system has changed at the kernel interface level:

ΔH(t) = |H(S, t) − H_baseline|

where H(S, t) = −Σ pᵢ(t) log₂ pᵢ(t)

Equation 6 — Syscall Entropy Change

A legitimate workload change may alter resource consumption levels but typically preserves the type of operations — the same syscalls are called, just more frequently. Malicious activity often introduces new syscall patterns: connect() and sendto() for exfiltration, mmap() for cryptomining, fork()/exec() for propagation.

7.3. Propagation Absence (ICP)

The Propagation Behavior Index ICP(t) (see §3 — Supplementary Metrics) aggregates indicators of outbound propagation: connection explosion, destination entropy, anomalous forks, and correlation between D_M and outbound traffic. When ICP exceeds its threshold, habituation is categorically blocked.

This guard is the most conservative: even if all other indicators appear benign, a high ICP indicates the node may be spreading a problem to other systems. Accepting this as the "new normal" would make HOSA complicit in the propagation.

7.4. Safety Plateau (D_M,safety)

This guard prevents habituation to a state dangerously close to resource exhaustion. Stabilizing at 92% memory utilization is not a "new normal" — it is a system on the edge that has lost its safety margin.

D_M,safety is set below θ₃ (the Active Containment threshold), ensuring that HOSA will never habituate to a state that would trigger containment if it were reached from homeostasis. The logic: if this state requires active containment when approached from below, it should not be accepted as baseline regardless of how long it persists.

7.5. Temporal Coherence (φ direction)

When the Load Direction Index φ(t) is negative (sub-demand), habituation requires that the idleness is coherent with the seasonal profile. Low activity at 03:00 is coherent and can be incorporated into the seasonal baseline. Low activity at 10:00 on a business day — when the seasonal profile predicts peak — is incoherent and may indicate Regime −3 (Anomalous Silence).

This guard prevents the dangerous scenario where a failed upstream stops sending traffic, the node becomes idle, and HOSA habituates to the silence, effectively hiding the failure from detection.

8. The Habituation Decision Flow

The complete decision process, evaluated at each sample cycle:

Figure 2 Habituation decision flowchart

1. Is D_M elevated?

D_M > θ₁ ?If NO → Level 0, no habituation needed

↓ YES

2. Is the derivative stable?

|dD̄_M/dt| < ε_d ?If NO → active anomaly, no habituation

↓ YES

3. All safety guards pass?

ρ < threshold ∧ ΔH < threshold ∧ ICP < threshold ∧ D_M < safety ∧ temporal coherence?If ANY fails → reset timer, no habituation

↓ ALL PASS

4. Sustained for T_min?

t_stable > T_min (30 min default)?If NO → continue waiting

↓ YES

✓ Activate Weighted Welford Decay

Baseline μ, Σ drift toward new operating pointEqual-weight Welford resumes when D_M < θ₁ against updated baseline

9. Walkthrough: Deploy with Higher Memory Footprint

This scenario illustrates the complete habituation lifecycle for a legitimate workload change.

Context:

Node: api-server-12, 16GB RAM, stable for 2 weeks
Event: Application v3.2 deployed — new caching layer adds ~1.5GB sustained memory usage
Baseline: mem_used = 52% ± 4%, D_M ≈ 1.0

Time	Event	HOSA State
t=0	Deploy v3.2 rolls out. Memory jumps from 52% to 61%.	D_M spikes to 3.4. dD_M/dt = +2.3. Level 0→1 (Vigilance). Sampling rate increased.
t=30s	Memory stabilizes at 61%. Application serving normally.	D_M = 3.2. dD_M/dt → 0. Derivative decelerating. Stays Level 1.
t=2min	New steady state confirmed. No errors, no timeouts.	D_M = 3.1 (stable). dD_M/dt ≈ 0. Level 1 maintained. ρ(t) = 0.08 (low — covariance preserved ✓) ΔH(t) = 0.02 (low — syscalls stable ✓) ICP(t) = 0.01 (low — no propagation ✓) D_M < D_M,safety ✓ Habituation timer starts.
t=5min	Brief CPU spike from background job.	dD_M/dt briefly positive. Timer resets. All pre-conditions must be re-satisfied continuously.
t=6min	CPU spike subsides. All metrics stable again.	All pre-conditions re-satisfied. Timer restarts from zero.
t=36min	30 minutes of continuous stability (from t=6min).	T_min satisfied. Habituation activates. Weighted Welford decay begins. μ and Σ start drifting toward new operating point.
t=50min	Baseline converging.	D_M (against updated baseline) = 1.8. Decreasing as baseline adapts.
t=70min	Convergence complete.	D_M (against new baseline) = 0.9 < θ₁. Habituation complete. New baseline: mem_used = 61% ± 3%. Equal-weight Welford resumes. Level 1→0 (Homeostasis). Full detection sensitivity restored against new baseline.

Key outcome: From the operator's perspective, HOSA briefly entered Vigilance during the deploy, confirmed the change was benign, adapted its baseline, and returned to homeostasis — all without human intervention, and without ever losing the ability to detect a genuine anomaly on top of the new workload.

10. Known Limitations

Sophisticated adversarial evasion. An attacker who understands HOSA's architecture and manages to execute malicious activity that perfectly preserves the covariance structure, syscall distribution, and propagation indicators will evade the safety guards and may cause the detector to habituate to the intrusion. Formal adversarial resistance analysis (security games, theoretical evasion bounds) is a future research topic.
T_min calibration. The 30-minute default minimum stabilization period is a heuristic. Too short, and HOSA may habituate to transient anomalies; too long, and legitimate workload changes cause extended periods of false positive alerts. The experimental phase will evaluate sensitivity across workload types.
Non-stationary multimodality. When the system alternates between modes randomly (not on a temporal schedule), the seasonal profiles mechanism does not apply — there is no temporal pattern to segment. Extension to Mixture of Gaussians with streaming EM is documented as future research (see §3 — Known Limitations).
Decay rate λ sensitivity. The exponential decay rate controls how quickly old samples lose influence. An aggressive λ adapts quickly but may cause the baseline to "forget" important historical patterns. A conservative λ preserves history but slows adaptation. The experimental phase will quantify the optimal λ range for common workload classes.
Seasonal profile cold start. Temporal segmentation requires at least 7 days of data (for weekly cycle detection) or 30 days (for monthly cycles). During this accumulation period, seasonal false positives are expected. The graduated response system mitigates the impact: Level 1 (Vigilance) does not execute any intervention, so seasonal false positives produce log entries, not destructive actions.
Interaction with containment. If HOSA is actively containing at Level 2+ when a legitimate workload change occurs, the containment actions (throttling) may mask the true steady-state of the new workload. Habituation does not activate while containment is active — the system must first de-escalate to Level 0 or 1, at which point the true new operating point becomes visible.

11. References

Kandel, E. R. (2001). The Molecular Biology of Memory Storage: A Dialogue Between Genes and Synapses. Science, 294(5544), 1030–1038.
Thompson, R. F., & Spencer, W. A. (1966). Habituation: A Model Phenomenon for the Study of Neuronal Substrates of Behavior. Psychological Review, 73(1), 16–43.
Welford, B. P. (1962). Note on a Method for Calculating Corrected Sums of Squares and Products. Technometrics, 4(3), 419–420.
Mahalanobis, P. C. (1936). On the generalized distance in statistics. Proceedings of the National Institute of Sciences of India, 2(1), 49–55.
Chandola, V., Banerjee, A., & Kumar, V. (2009). Anomaly Detection: A Survey. ACM Computing Surveys, 41(3), Article 15.
Hellerstein, J. L., Diao, Y., Parekh, S., & Tilbury, D. M. (2004). Feedback Control of Computing Systems. John Wiley & Sons.
Forrest, S., Hofmeyr, S. A., & Somayaji, A. (1997). Computer immunology. Communications of the ACM, 40(10), 88–96.

1. The False Positive Problem

Without Habituation

With Habituation

2. Biological Inspiration — Neuroplasticity

3. Mechanism — Weighted Welford Decay

3.1. Exponential Decay of Historical Weights

3.2. The Recalibration Process

4. Formal Pre-Conditions

5. Habituation Across the Regime Spectrum

5.1. Permitted Regimes (−2 to +2)

5.2. Blocked Regimes (−3, +3 to +5)

5.3. The Symmetry Principle

6. Seasonal Profiles — The Digital Circadian Rhythm

6.1. Periodicity Detection via Autocorrelation

6.2. Temporal Segmentation

6.3. Per-Segment Baseline Accumulation

6.4. Context-Indexed DM Calculation

7. Safety Guards Against Premature Habituation

7.1. Covariance Preservation (ρ)

7.2. Syscall Stability (ΔH)

7.3. Propagation Absence (ICP)

7.4. Safety Plateau (DM,safety)

7.5. Temporal Coherence (φ direction)

8. The Habituation Decision Flow

1. Is DM elevated?

2. Is the derivative stable?

3. All safety guards pass?

4. Sustained for Tmin?

✓ Activate Weighted Welford Decay

9. Walkthrough: Deploy with Higher Memory Footprint

10. Known Limitations

11. References

6.4. Context-Indexed D_M Calculation

7.4. Safety Plateau (D_M,safety)

1. Is D_M elevated?

4. Sustained for T_min?