{"id":"1ce8f741-6625-4964-ad36-0e4ae6112b69","arxiv_id":"2508.16847","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":2.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"The paper maps network source revisit probabilities to polar \"cyber orbits\" using r = p^{-1/2} and an ad hoc angle rule, a re-expression of earlier modified Cauchy fits rather than a new derivation.","lead":"This paper turns measured Internet traffic patterns into pictures of \"cyber orbits\", like satellites or rockets circling a planet. Smart generalists might read it to see whether a physical metaphor helps spot malicious Internet scanners, but the orbit is a rescaling of known statistics, not a new law.","discovery_kind":"incremental","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The inverse-square relation is definitional (Eq. 2), and the only new ingredient—the Eq. 3 angle rule—is untested; no experiment shows orbit features improve benign/malicious discrimination beyond the previously fitted p(t).","rationale":"I concur with the reader's mathematical reduction. The central move is Eq. 2, which makes the inverse-square statement definitional; that is not a flaw if the paper's goal is purely illustrative, but the paper goes beyond illustration by claiming the orbit representation may aid in discerning benign from malicious traffic. That claim requires evidence that the orbit geometry—especially the angle rule of Eq. 3—adds discriminative or predictive value over the fitted p(t). The paper supplies no such evidence, and the Eq. 3 rule is admittedly ad hoc. Because the empirical fit parameters are not reported, the 200x gap is also not independently auditable. I do not see an internal inconsistency in the mathematics, but the central research claim is under-validated rather than false. The reader's REJECT is therefore appropriate for the paper as written; a reframed version with discrimination or prediction tests could be CONDITIONAL.","tokens_in":3519,"tokens_out":5296,"duration_ms":64743,"concrete_test":"Reproduce the analysis from the raw source revisit counts in ref. [5]: compute p(t) independently, apply Eq. 2, then measure benign-vs-malicious separation (e.g., AUROC) using orbit-derived features (minimum r, orbital period) on held-out data and compare with the same separation using p(t) directly. If orbit features do not beat or match the direct p(t) baseline, then the claimed '200x gap' is a restatement of the known distributions, and the orbit representation carries no independent empirical weight.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section I defines r(t) via Eq. 2, r(t) ∝ p(t)^{-1/2}; therefore p(t) ∝ 1/r(t)^2 is a tautological restatement, not an empirically derivable law. The Fig. 1 '200x gap' between benign and malicious orbit radii is then a monotone transform of the gap already present in the modified-Cauchy fits of ref. [5]; no new information is added by the orbital radius. The only new geometrical content is Eq. 3, Δθ ≈ sin Δθ = Δt/r(t), which the authors explicitly say is one of many possible choices. Because r(t) is small near probability peaks, Δt/r(t) can exceed the small-angle regime exactly in the 'close approach' regions that give the orbits structure, so the plotted shapes are not robustly defined without a validation criterion. Moreover, the underlying fits are not reproduced: no parameters, goodness-of-fit metrics, or error bars are given for the five categories, so the 200x gap cannot be independently checked. As a purely expository visualization the paper is harmless, but as a research claim its quantitative payload is either definitional or inherited, and the orbital framing is unsupported by any classification or prediction experiment.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a 'cyber orbit' visualization of Internet source revisit probabilities. It states that the probability p(t) of observing a source at temporal 'distance' r(t) follows p(t) ∝ 1/r(t)^2, defines r(t) via Eq. (2) as proportional to p(t)^{-1/2}, and completes the orbit picture with an angle rule Δθ ≈ Δt/r(t) in Eq. (3). The construction is applied to CAIDA telescope and GreyNoise honeyfarm data from the Anonymized Network Sensing Graph Challenge, producing polar 'orbit' plots and a claimed 200x gap between benign and malicious source orbit radii. The paper frames this as a physical analogy that may aid intuition and, potentially, benign/malicious discrimination.","tokens_in":3804,"tokens_out":3752,"duration_ms":44831,"significance":"If the orbital analogy were established as a useful quantitative tool, it could offer a simple visualization of heavy-tailed Internet source behavior and perhaps a new way to separate benign from malicious traffic. The paper draws on real, large-scale datasets and prior modified-Cauchy fits, which is a strength. However, the central quantitative claim is not supported: Eq. (2) makes p(t) ∝ 1/r(t)^2 an identity, not an empirically derived law. The only new geometric ingredient, Eq. (3), is explicitly admitted to be one of many possible choices, and no validation shows that the orbit representation adds discriminative or predictive information beyond the underlying p(t) fits. As a research contribution in physics of sociotechnical systems, the paper's payload is either definitional or inherited from Ref. [5].","major_comments":[{"comment":"The central assertion that 'the probability of observing a source at a temporal distance r(t) is p(t) ∝ 1/r(t)^2' is not an independent law. Immediately afterward, Eq. (2) defines r(t) ∝ p(t)^{-1/2}, which makes the inverse-square relation a tautological restatement. No physical model or statistical derivation is given that would predict this scaling from network mechanisms. This is load-bearing because the paper's novelty claim rests on presenting this as a discovery. The authors must either derive the scaling from an independent model or explicitly recharacterize Eq. (2) as a chosen coordinate transformation and restrict claims to visualization.","section":"Section I, Eq. (2)"},{"comment":"The angle rule Δθ ≈ sin(Δθ) = Δt/r(t) is ad hoc. The text states 'Various functions can be used' and selects this one without criteria. Moreover, the small-angle approximation is not valid throughout the orbit: near probability peaks r(t) is small, so Δt/r(t) can be large, exactly in the 'close approach' regions that give the orbits their structure. Consequently, the plotted orbit shapes, including the claimed 200x gap, depend on an unvalidated choice. A sensitivity analysis or an independent criterion for θ(t) is required before the orbital geometry can be considered robust.","section":"Section I, Eq. (3) and Fig. 1"},{"comment":"The 200x gap between benign and malicious orbit radii is presented with no underlying fit parameters, goodness-of-fit metrics, error bars, or confidence intervals for the five categories. The fits are said to be computed as in Ref. [5] but are not reproduced here. Since r(t) is a monotone transform of p(t), the gap is a rescaling of a gap already present in the previously fitted modified-Cauchy distributions; no evidence shows that the orbit representation adds value over directly plotting p(t). To support the 'aiding in discerning benign from malicious traffic' claim, the paper needs at least a quantitative classification/detection experiment or a direct comparison with the baseline p(t) discrimination.","section":"Section III and Fig. 1"}],"minor_comments":[{"comment":"The formula as typeset, 'r(t) ∝ 1p p(t)', appears garbled; it should read r(t) ∝ p(t)^{-1/2}.","section":"Eq. (2)"},{"comment":"'several hundred 230 packet collections' likely means 'several hundred 2^30 packet collections'; please fix the exponent formatting.","section":"Section II"},{"comment":"The polar plots lack clear axis labels, units for radius and angle, and a legend explaining the '200x gap.' The Greek symbols Δt and Δθ are also garbled in the figure inset.","section":"Fig. 1"},{"comment":"The statement that 'the units of distance are measured in time' is unclear. Please specify the intended dimensional conversion or state that natural units are used.","section":"Section I"},{"comment":"'Visualizing ... as orbits opens new possibilities for considering how to reason about and explain these phenomena a quasi-periodic systems' is ungrammatical; likely 'as quasi-periodic systems' was intended.","section":"Section III"}],"recommendation":"reject","confidential_remarks":"This manuscript is very short and reads like an extended abstract. The core issue is not presentation but substance: the inverse-square relation is definitional, the angle rule is ad hoc, and no validation supports the benign/malicious discrimination claim. A major revision would require recharacterizing the contribution as a visualization heuristic and adding substantial experiments, which is beyond the scope of the current paper. The authors may wish to consider a workshop or short-exposition venue rather than a full research paper in physics.soc-ph."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Jeremy,\n\nShort take: this is a two-page visualization note, not a research result. The inverse-square “law” in Eq. 2 is a coordinate inversion: r(t) is defined as p(t)^-1/2, so p∝1/r^2 is an identity. The orbit plots are a polar re-rendering of previously published modified-Cauchy fits, and the 200x benign/malicious gap is just the gap already present in those fits. The only genuinely new ingredient is the angle rule Eq. 3, which the authors openly say is one of many possible choices. No experiment shows that orbit features distinguish benign from malicious traffic better than the underlying p(t) curves.\n\nThat said, the paper is not nonsense. The polar visualization is intuitive, and the distinction between slowly orbiting benign sources and fast-dipping malicious ones is a nice way to communicate t0.5 differences to operators. The authors are restrained in the conclusion, framing this as an aid to understanding, not a new law. If the paper were explicitly reframed as an expository visualization, it would be a decent short workshop note.\n\nThe soft spots are where the stress-test lands. Eq. 3 uses Δθ ≈ sin Δθ = Δt/r(t), but in the close-approach regions where r(t) is small, Δt/r(t) can be large, so the small-angle assumption fails exactly where the orbit structure is interesting. There is no validation of the shape against a different angle rule. And the underlying fits are not reproduced: no parameters, no goodness-of-fit, no error bars for the five categories, so the 200x gap is untestable from this paper. The citation to ref. [5] is fine, but the current paper needs to at least show the fits or state that the gap is inherited.\n\nFor peer review: I would not send this to a serious journal as a research paper; the central quantitative claim is definitional. But it could go to a visualization or security workshop if the authors add a few sentences admitting the identity and test the angle rule's sensitivity. As is, the abstract's “revealed new models” overstates what is a clever repackaging.\n\nYou can ignore this one for your own reading list unless you need an example of how a tautology can be dressed up as a physical law.","headline":"A two-page visualization note whose central inverse-square relation is a definitional identity, not a discovery; fine as an expository aid but too thin for a research claim.","tokens_in":4379,"tokens_out":3155,"would_cite":false,"duration_ms":38533,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Internet source revisit probabilities can be expressed as p(t) ∝ 1/r(t)^2, turning temporal correlation into polar 'cyber orbits' with a 200x gap between benign and malicious sources.","keywords":["cyber orbits","network traffic","source correlation","heavy-tailed distributions","Cauchy distribution","internet telescope","honeyfarm","anonymized network sensing"],"falsifier":"Recompute p(t) from the raw source-revisit counts without relying on the earlier fits, then plot orbits under an alternative angle rule (for example, θ = t/r(t)) on the same five traffic classes; if the radial benign/malicious separation shrinks by an order of magnitude or the polar trajectories become difficult to distinguish, the claimed 200x orbit gap is an artifact of the fitting and angle choices.","tokens_in":3344,"feed_emoji":"🛰️","tokens_out":6443,"duration_ms":60363,"temperature":0.7,"pith_summary":"The paper proposes that the probability p(t) of an internet source being seen again after a time t can be read through an inverse-square law, p(t) ∝ 1/r(t)^2, where r(t) is a temporal 'distance.' This turns source-revisit statistics into planar 'cyber orbits': radius r(t)=1/√p(t) and angle increments Δθ=Δt/r(t). Applied to large anonymized observatory and honeyfarm datasets, the construction separates sources into wide, slow orbits (benign) and tight, fast orbits (malicious), with about a 200x gap in orbit radius. The paper offers this as a simpler physical metaphor than the earlier Gull's-Lighthouse differential equation approach, and suggests it can make quasi-periodic internet behavior easier to see and explain.","feed_headline":"Traffic orbits expose 200x gap between benign and malicious","feed_subtitle":"A simple polar plot separates benign from malicious sources by a 200x orbit radius.","key_machinery":"The carrying object is the inverse-square temporal distance identity r(t)=1/√p(t), which translates each probability value into a polar radius. The companion rule Δθ≈Δt/r(t) (small-angle approximation) converts elapsed time into angular motion, completing the polar coordinate system (r, θ). The work this machinery does: any measured p(t) curve, whether from a telescope, honeyfarm, or other heavy-tailed process, becomes an orbit; probability peaks appear as inward dents, and the asymptotic growth of r(t) follows the square root of the modified Cauchy denominator.","core_discovery":"The paper's central claim is that observed source reappearance probabilities follow the modified Cauchy form p(t) ∝ 1/(t^α_0.5 + t^α), and that these probabilities can be reinterpreted as an inverse-square temporal distance law, p(t) ∝ 1/r(t)^2. Defining r(t)=1/√p(t) and using the small-angle rule Δθ≈sin Δθ=Δt/r(t) produces closed polar orbits. When plotted for five traffic classes, the orbits reveal a 200x radial separation between benign and malicious sources, with the long-term orbit radius growing as √(t^α_0.5 + t^α). The authors frame this as an intuitive physical analogy—sources behave like objects in orbit, mostly drifting apart and occasionally dipping inward during bursts of interac","pith_inferences":["Because r(t)=1/√p(t) is a definition, the paper's empirical core is the 200x separation; a useful check is whether that separation persists under different time windows or when the angle map is changed to, say, θ=t/r(t).","If the inverse-square mapping is robust, any event stream with a heavy-tailed revisit distribution becomes an orbit; comparing orbit radii across users or devices could become a lightweight anomaly detector without training labels.","The small-angle rule Δθ≈Δt/r(t) presumes events are sparse relative to r(t); for high-rate sources the finite-angle correction could change the polar shape, so the orbit shapes of the busiest malicious sources should be re-examined."],"forward_implications":["Source revisit curves that fit the modified Cauchy form can be plotted as orbits directly from p(t), with no differential equation solving.","The 200x radius gap gives a simple visual threshold that may help distinguish benign from malicious sources in real time.","The orbit picture lends a quasi-periodic interpretation to internet behavior: sources slowly drift outward and periodically swing inward when interactions spike.","The same construction can be applied to other heavy-tailed event correlations, turning arbitrary p(t) curves into geometric orbits."],"supporting_citations":[{"why":"Establishes the temporal correlation measurements for internet observatories/outposts that motivate the p(t) curves.","marker":"[4]"},{"why":"Provides the best-fit modified Cauchy distributions and the method for computing p(t) from source revisit counts; the entire orbit calculation is built on these fits.","marker":"[5]"},{"why":"Supplies the 'what is normal' observational model of anonymized internet traffic that frames the benign/malicious distinction.","marker":"[6]"},{"why":"The Gull's Lighthouse problem that originally produced the Cauchy distribution; the paper's inverse-square analogy is offered as a replacement for this geometry.","marker":"[8]"},{"why":"Defines the anonymized network sensing graph challenge dataset used to compute the orbits.","marker":"[9]"}],"fun_headline_variants":["Cyber orbits reveal 200x benign-malicious divide","Polar orbits separate benign and malicious by 200x","Simple orbit law marks 200x network traffic gap","Benign vs malicious: 200x orbit radius gap","Orbital view spots 200x traffic source gap"],"cache_read_input_tokens":2688,"weakest_assumption_plain":"The orbit picture depends on the paper's choice to define temporal distance as r(t)=1/√p(t) and to turn time into angle with Δθ=Δt/r(t); if either the preliminary modified Cauchy fits are wrong or the angle rule is arbitrary, the orbits and the 200x gap lose their meaning.","fun_headline_variants_meta":{"raw":{"variants":["Cyber orbits reveal 200x benign-malicious divide","Polar orbits separate benign and malicious by 200x","Simple orbit law marks 200x network traffic gap","Benign vs malicious: 200x orbit radius gap","Orbital view spots 200x traffic source gap"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00016,"raw_usage":{"total_tokens":1058,"prompt_tokens":722,"completion_tokens":336,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":466,"completion_tokens_details":{"reasoning_tokens":256}},"tokens_in":466,"tokens_out":336,"duration_ms":4270,"temperature":1.0,"reasoning_tokens":256,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T17:08:02.398685+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Recompute p(t) from the raw source-revisit counts without relying on the earlier fits, then plot orbits under an alternative angle rule (for example, θ = t/r(t)) on the same five traffic classes; if the radial benign/malicious separation shrinks by an order of magnitude or the polar trajectories become difficult to distinguish, the claimed 200x orbit gap is an artifact of the fitting and angle choices.","supporting_citations":[{"cited_title":"Temporal correlation of internet observatories and out- posts,","cited_arxiv_id":null,"evidence_quote":"Establishes the temporal correlation measurements for internet observatories/outposts that motivate the p(t) curves."},{"cited_title":"Mapping of internet “coastlines","cited_arxiv_id":null,"evidence_quote":"Provides the best-fit modified Cauchy distributions and the method for computing p(t) from source revisit counts; the entire orbit calculation is built on these fits."},{"cited_title":"What is normal? a big data observational science model of anonymized internet traffic,","cited_arxiv_id":null,"evidence_quote":"Supplies the 'what is normal' observational model of anonymized internet traffic that frames the benign/malicious distinction."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The Gull's Lighthouse problem that originally produced the Cauchy distribution; the paper's inverse-square analogy is offered as a replacement for this geometry."},{"cited_title":"Anonymized network sensing graph challenge,","cited_arxiv_id":null,"evidence_quote":"Defines the anonymized network sensing graph challenge dataset used to compute the orbits."}],"review_version":1}