AnamorphLayer7 (AL7) is an out-of-band, stateful supplement to existing API defenses. By mapping session behavior to spatial geometry, we use Topological Data Analysis (TDA) to catch structural logic abuse that traditional ML and atomic WAF inspection miss.
What is AL7?
Below are 3-Dimensional examples of different session types mapped into geometric space. In this example, the three axes are mapped to datapoints that align with user action, repetition, and endpoint traversal.
Each graph contains 50 overlaid examples of the session type. Visually, the difference is obvious: human behavior is random and high-entropy, while efficient attacks are linear and rigid.
Normal Human Browsing
Directory Scraping Attack
Timing-Obfuscated BOLA Scraper
Topological Data Analysis (TDA) is an advanced branch of applied mathematics that leverages algebraic topology to extract structural information from complex, high-dimensional datasets.
To understand TDA, it helps to understand topology. Topology is often described as “rubber-sheet geometry".” Unlike traditional geometry, which relies on rigid coordinates, exact lengths, and precise angles, topology studies the properties of a space that survive continuous deformation. If you stretch, twist, or bend a shape without tearing or gluing it, its topology remains the same.
In traditional data science and machine learning, models rely heavily on statistical aggregates or exact coordinate boundaries. TDA takes a fundamentally different approach by treating data points as a continuous shape. It analyzes the global structure of the data, identifying mathematical invariants, such as connected components, loops, and higher-dimensional voids, that persist across different scales.
Because TDA is coordinate-free and focuses on relative shape rather than absolute values, it is highly resilient to noise and immune to superficial distortions.
Coordinate Invariance: It does not depend on the coordinate system chosen to represent the data.
Deformation Invariance: It ignores superficial twisting or stretching in the data space.
Noise Resilience: It distinguishes between true, persistent structural features and transient, localized noise.
What is Topological Data Analysis?
The Math Behind the Curtain: Persistent Homology
To actually “measure” the shape of a point cloud, TDA uses a mathematical framework called Persistent Homology.
Imagine placing a tiny sphere around every individual point in a point cloud. Initially, these spheres are isolated. As we gradually and simultaneously expand the radius of all of the spheres, they begin to intersect.
When spheres intersect, we draw mathematical lines, or “edges” between the points. As the radius continues to grow, these edges form triangles, then tetrahedrons, and eventually complex, high-dimensional geometries known as Simplicial Complexes.
Throughout this expansion, Persistent Homology tracks the exact moment critical structural features appear and disappear:
Birth: The radius at which a new topological feature (like a connected cluster or a loop) forms.
Death: The radius at which that feature is filled in and absorbed by the growing shapes around it.
The lifespan of a feature (Death minus Birth) is called its persistence.
Features with short lifespans are mathematically considered transient noise. Features with long, highly persistent lifespans represent the true, underlying geometric signature of a shape. By extracting these lifespans into a mathematical barcode, TDA can analyze the structural geometry of a dataset, finding correlations that human observation and traditional ML could not.
How does discrete data become a shape?
Applying TDA to cybersecurity is notoriously difficult because commonly available data isn’t natively geometric.
HTTP logs, for example, are primarily qualitative and categorical. They consist of text strings, URLs, user agents, and HTTP verbs like GET or POST. To build a point cloud, we require distance. However, categorical data has no inherent spatial distance; you cannot geometrically measure the distance between a GET request and a POST request, or between a /login endpoint and a /checkout cart. For these reasons, if you feed raw text logs into a topological engine, the resulting geometry will be useless.
To solve this, Anamorphic Labs built a proprietary preprocessing layer that discards raw categorical strings entirely. Instead of inspecting the syntax of the payload, we map the intent of the traffic using continuous mathematical proxies.
We project chronological requests across multi-dimensional axes representing behavior, such as:
Traversal: structural depth and navigational progression through the API architecture
Volume & Repetition: frequency and chronology of endpoint access; volume of data passed to and from the server
Action: categorical intent of the behavior
When we think of data, we usually picture rows and columns in a 2D spreadsheet. If you assign numeric values to those columns, you can plot each row as a point floating in multi-dimensional space. This collection of points is called a “point cloud.” By assigning discrete real-time session data numeric values, we can map a user’s behavior into a point cloud, which we can then analyze like a fingerprint.
Won’t attackers just slow down their traffic to evade detection?
They can try, but AL7 is not a fancy rate limiter.
Traditional Web Application Firewalls and rate-limiters rely on speed and volume thresholds. Attackers easily bypass these by using massive residential proxy networks to execute “low-and-slow” distributed attacks.
AL7 doesn’t care about time. By mapping the chronological requests into a multi-dimensional point cloud, we evaluate the geometric shape of the session. A linear data-scraping script executed over five hours forms the same structure as one executed in five seconds.
To evade AL7, an attacker cannot simply obfuscate their timing. They must blindly reverse-engineer what “normal” looks like for a particular target and manually build custom bot flows to mimic human behavior. Achieving this is nearly impossible without access to the target’s large-scale network logs and the specific behavioral dimensions AL7 evaluates for that target.
Ultimately, forcing attackers to drastically increase their time and compute investments for the exact same outcome destroys their potential ROI.
If TDA is such a valuable tool for mapping behavior, why isn’t it already common in cybersecurity?
There are two primary reasons: The application of the theoretical mathematics is relatively new, and traditionally, it has been far too computationally expensive.
Applied topology, specifically using Persistent Homology for data science, is a relatively recent breakthrough in mathematics. While standard statistical models and legacy machine learning algorithms have been refined for decades, TDA has only recently made the leap from theoretical academia into practical data application. The cybersecurity industry is just beginning to understand its potential.
The far more significant barrier is computational overhead. Calculating Persistent Homology requires building and evaluating massive matrices of intersecting points. In traditional data science, calculating a simplicial complex scales at O(M³) computational complexity. As the amount of data grows, the processing time required to extract the topology grows exponentially.
Historically, TDA in cybersecurity has been relegated to academic research and niche applications of specialized functionality with time-irrelevant goals.
The Anamorphic Labs Engine:
We refused to accept this limitation. We conducted reviews of foundational literature in Persistent Homology and benchmarked existing topological libraries against production-scale workloads. When it became clear that plug-and-play academic codebases were insufficient, we began building hardware-optimized custom libraries of theoretical algorithms from foundational papers, translating complex matrix operations into custom data structures.
The result of this work is a proprietary pipeline capable of processing real-time data at sub-millisecond speeds. AL7 is the first deployment of this engine, targeting live session data to detect and prevent business logic abuse and distributed residential proxy attacks.
Why has no one done this before?
We didn’t start as theoretical mathematicians looking for a problem to solve; we come from extensive backgrounds in enterprise IT and security.
The catalyst for Anamorphic Labs came during our founder’s tenure as an AppSec engineer for a digital payments SaaS platform. The infrastructure was continuously under attack from distributed proxy attacks on targeted endpoints. Reviewing logs manually, the fraudulent sessions were obvious, but existing tooling simply couldn’t translate “behavior” into automated blocking rules.
The breakthrough came through collaboration with a researcher in theoretical topology. We realized that TDA was the mathematical framework needed to measure the structural behavior of data in cybersecurity. It was a “solution looking for the right problems” that fit perfectly with the problems we were trying to solve.
Anamorphic Labs was founded by Coby Glass, a security architect and CISSP. With a B.S. in Computer Science and a minor in Mathematical Sciences alongside a career spanning from DevSecOps to executive cyber consulting, Coby built AL7 with a deep understanding of enterprise cybersecurity.
In conjunction with a team featuring a senior cloud architect, an AppSec SME, and a theoretical topologist, Anamorphic Labs is building enterprise-ready, secure-by-design SaaS tools that solve the problems we have personally lived.