SwarmReconGuard: detecting distributed agent reconnaissance

A new study formalizes Distributed Collective Reconnaissance (DCR), where hundreds or thousands of autonomous agents with valid credentials collectively map an API while each stays under per-identity rate limits. SwarmReconGuard is a black-box detector using only service-boundary telemetry; across 440 runs and 3,666,300 requests, hybrid CUSUM reached 85.7% detection at 10,000 identities.

• DCR: each agent stays under limits while the swarm maps the API
• Benchmark: 10–10,000 identities, 440 runs, 3.67M requests
• Hybrid CUSUM: 85.7% detection with 0% false positives
• Gaussian detector: 100% on known attacks, 3% on unseen ones