Working paper • Ref: RIDS-WP-2020-002
Negative Space Methodology
Negative Space is an internal RIDS analytical term describing patterns that become visible through spacing, absence, recurrence, or irregular distribution rather than through strong single-event signatures.
Conceptual basisSignificance may emerge through gaps, repeated near-events, irregular intervals, or the persistence of low-confidence anomalies across different environments.
Indicators consideredIrregular spacing, clusters around key dates, distributed anomalies with incomplete attribution, and behaviour adjacent to standard thresholds.
Analytical roleThe methodology supplements conventional intrusion analysis by preserving ambiguous activity for comparison over time.
Programme relevanceWithin the RIDS framework, Negative Space provides a useful shorthand for anomaly fields that appear inconsistent at the event level but acquire value in aggregate.