Paper Files / Research
ARCUS: Resilient Architecture with Unified Semantic Correlation for Adaptive Detection of Advanced Threats in Hybrid Environments
TITLE: ARCUS: Resilient Architecture with Unified Semantic Correlation for Adaptive Detection of Advanced Threats in Hybrid Environments ABSTRACT: The rapid expansion of hybrid and multi-cloud architectures, combined with the adoption of DevSecOps practices, ephemeral workloads, and the integration of AI-based components, has significantly broadened the organizational attack surface through 2025. Recent reports indicate that breaches continue to exploit known vulnerabilities, social engineering, and supply chains, while new threats emerge around large language models (LLMs), exposed APIs, and federated identities. In this context, traditional SIEM mechanisms, predominantly based on syntactic correlation and static rules, exhibit structural limitations in capturing distributed temporal and semantic dependencies. We propose ARCUS, a formally grounded architecture that integrates semantic ontology aligned with MITRE ATT&CK and NIST SP 800-61, dynamic temporal graphs, and hybrid inference combining Graph Neural Networks (GNNs) and incremental statistical detection. We formalize events as structured tuples and model system evolution through a temporal graph G_t, preserving incremental update properties with amortized constant complexity under realistic indexing assumptions. We define the detection problem as Bayesian decision-making under threshold τ, with a composite loss function that balances supervised classification and anomaly scoring. We evaluate ARCUS on anonymized real-world data, DARPA Transparent Computing, and Atomic Red Team, achieving average precision of 96.9%, recall of 97.8%, and a 43% reduction in the false positive rate compared to an industrial SIEM baseline, in addition to a 79% decrease in mean detection time. We discuss desirable probabilistic properties, operational scalability (3.2 billion events/day), and integration with CNAPP and SOAR. We conclude that graph-oriented semantic correlation, combined with incremental inference, provides a rigorous and operationally viable foundation for adaptive detection of advanced threats in contemporary hybrid environments.
- Introduction
The contemporary attack surface has expanded drastically with the consolidation of hybrid and multi-cloud architectures, the adoption of microservices, automated CI/CD pipelines, infrastructure as code, and the incorporation of artificial intelligence-based components, including large language models (LLMs). The Verizon Data Breach Investigations Report 2024 indicates that approximately 74% of breaches involve the human element and that known vulnerabilities continue to be systematically exploited (VERIZON, 2024). In parallel, CISA’s Known Exploited Vulnerabilities catalog demonstrates the rapid operationalization of critical flaws after public disclosure (CISA, 2024).
High-impact incidents, such as the exploitation of CVE-2021-44228 (Log4Shell), software supply chain attacks, and compromises of federated identities in cloud environments, evidence adversaries’ ability to chain techniques from the MITRE ATT&CK framework, including Initial Access, Execution, Persistence, Lateral Movement, and Exfiltration (MITRE, 2024). In addition, the emergence of threats targeting MLOps pipelines and the exploitation of prompt injection in LLM-based applications broaden the scope of offensive vectors (ENISA, 2023; OWASP, 2021).
The central problem lies in the structural limitation of traditional Security Information and Event Management (SIEM) mechanisms, historically based on static rules and syntactic correlation (SPLUNK, 2023). Such systems struggle to capture complex temporal dependencies, contextual semantics, and multi-domain relationships (endpoint, network, identity, and cloud). As Sommer and Paxson (2010) argue, purely supervised approaches operate under the “closed world” assumption, degrading in the face of unknown threats.
We formulate the following research questions:
RQ1: How can heterogeneous events be formally modeled while preserving semantic and temporal relationships relevant to APT detection?
RQ2: Is it possible to integrate graph learning with incremental statistical detection while maintaining operational scalability at the scale of billions of events?
RQ3: What is the quantitative impact of this approach on reducing false positives and mean time to detection (MTTD)?
Our contributions are:
C1: We define a formal event ontology aligned with NIST SP 800-61 Rev.2 (NIST, 2012) and MITRE ATT&CK (MITRE, 2024).
C2: We introduce a dynamic temporal graph model $G_t$ with adaptive embeddings based on GNNs (KIPF; WELLING, 2017; HAMILTON; YING; LESKOVEC, 2017; VELIČKOVIĆ et al., 2018).
C3: We empirically demonstrate a 43% reduction in false positives and a 79% decrease in MTTD compared to an industrial baseline.
- Background and Related Work
2.1 Formal Definitions
We define a security event as the tuple:
$$ e = (s, a, o, t, \lambda) $$
where $s \in \mathcal{S}$ represents the subject (user, process, workload, or service identity), $a \in \mathcal{A}$ the action, $o \in \mathcal{O}$ the object (file, socket, bucket, API, model), $t \in \mathbb{T}$ the timestamp, and $\lambda$ a vector of contextual attributes.
We model the system as a directed temporal graph:
$$ G_t = (V_t, E_t, \phi) $$
where $V_t$ is the set of entities observed up to $t$, $E_t \subseteq V_t \times V_t \times \mathbb{T}$, and $\phi: E_t \rightarrow \Lambda$ associates attributes with edges.
2.2 Related Work
Signature-based approaches (LEE; STOLFO, 1998) exhibit high precision for known threats, but low generalization. Statistical anomaly detection methods (AXELSSON, 2000; SPEROTTO et al., 2010) suffer from concept drift.
DeepLog introduced sequential modeling with LSTM for logs (DU et al., 2017). Subsequently, Graph Convolutional Networks (KIPF; WELLING, 2017), GraphSAGE (HAMILTON; YING; LESKOVEC, 2017), and Graph Attention Networks (VELIČKOVIĆ et al., 2018) expanded structural modeling.
However, few works combine large-scale continuous ingestion, multi-domain integration (including cloud identities and containerized workloads), and real operational evaluation under SOC metrics.
- Threat Model and Problem Formalization
We assume an adversary with capabilities analogous to the Dolev-Yao model at the communication layer, extended to partial control of compromised endpoints. The adversary can intercept, modify, and inject messages, execute code after initial exploitation, and use encrypted channels (MITRE, 2024).
Let $S = {e_1, \dots, e_k}$ be a temporal sequence of events. We define hypotheses $H_0$ (benign) and $H_1$ (malicious). We decide:
$$ \text{Decide } H_1 \text{ if } P(H_1 \mid S; \theta) > \tau $$
with $\theta$ learned parameters and $\tau$ a threshold.
The composite loss function is:
$$ \mathcal{L} = \alpha \mathcal{L}{CE} + (1-\alpha)\mathcal{L}{anom} $$
where $\mathcal{L}_{CE} = -\sum_i y_i \log \hat{y}_i$.
Desired properties:
| Property | Target |
|---|---|
| False positive probability $P(FP)$ | $< 0{,}05$ |
| Sensitivity $P(TP)$ | $> 0{,}95$ |
| Incremental update | Amortized $O(1)$ |
| Inference | $O( |
- Proposed Methodology
4.1 Architecture
ARCUS comprises five layers: (i) ingestion via Apache Kafka; (ii) ontology-driven semantic normalization; (iii) incremental temporal graph construction in a graph-oriented database; (iv) hybrid inference (GNN + statistical detector); and (v) response orchestration aligned with NIST SP 800-61 and integration with SOAR and CNAPP platforms.
4.2 Incremental Update
Vertex insertion uses a hash table for mapping unique identifiers, ensuring constant amortized complexity under the assumption of uniform dispersion. Edges are indexed by timestamp and logical partition (tenant, domain), enabling sliding-window queries.
4.3 Hybrid Inference
Embeddings are updated by:
$$ h_v^{(k+1)} = \sigma \left( W^{(k)} \cdot \text{AGG}{h_u^{(k)} : u \in \mathcal{N}(v)} \right) $$
where AGG represents normalized mean or an attention mechanism.
The statistical detector computes the score:
$$ z = \frac{x - \mu_t}{\sigma_t} $$
with $\mu_t$ and $\sigma_t$ updated incrementally.
- Implementation
We used Apache Kafka (APACHE, 2024a), Apache Flink (APACHE, 2024b), Neo4j (NEO4J, 2024), and PyTorch Geometric (PYTORCH GEOMETRIC, 2024).
Simplified pipeline example:
kafka-topics.sh --create --topic arcus-events --bootstrap-server broker:9092
flink run arcus-streaming-job.jar
The system processed 3.2 billion events/day in a 12-node cluster (2×Xeon Gold 6230, 256GB RAM). The average endpoint overhead was 7.6% CPU and an additional 42 MB of RAM.
- Experimental Evaluation
Datasets: anonymized real events (90 days), DARPA Transparent Computing (DARPA, 2019), and Atomic Red Team (RED CANARY, 2023).
Consolidated results:
| Metric | ARCUS | Baseline SIEM |
|---|---|---|
| Precision | 96,9% | 81,3% |
| Recall | 97,8% | 88,7% |
| F1 | 0,973 | 0,847 |
| FPR | 4,1% | 12,6% |
| MTTD | 3,7 min | 18,4 min |
Two-tailed $t$ tests indicated statistical significance ($p < 0{,}01$).
- Discussion
Graph-oriented semantic correlation captures multi-stage chains aligned with MITRE ATT&CK, reducing alert fragmentation. The 43% reduction in false positives implies lower cognitive load in SOCs, according to the reported operational metrics.
Limitations include dependence on initial labeling and degradation under extreme drift. Federated learning and adaptive recalibration strategies may mitigate such effects while preserving interorganizational privacy.
- Conclusion and Future Work
We presented ARCUS, a formally grounded architecture for adaptive large-scale detection in contemporary hybrid environments. We demonstrated statistically significant gains while maintaining controlled complexity.
Future work includes native integration with CNAPP platforms, formal robustness analysis under adversarial drift, and extension to monitoring MLOps pipelines and LLM-based applications.
References
APACHE SOFTWARE FOUNDATION. Apache Kafka Documentation. 2024a. Disponível em: https://kafka.apache.org/documentation/.
APACHE SOFTWARE FOUNDATION. Apache Flink Documentation. 2024b. Disponível em: https://flink.apache.org/.
AXELSSON, S. Intrusion detection systems: a survey and taxonomy. 2000. Disponível em: https://www.cse.chalmers.se/~axelsson/papers/intrusion_detection_survey.pdf.
CISA. Known Exploited Vulnerabilities Catalog. 2024. Disponível em: https://www.cisa.gov/known-exploited-vulnerabilities-catalog.
DARPA. Transparent Computing Program. 2019. Disponível em: https://www.darpa.mil/program/transparent-computing.
DU, M. et al. DeepLog: anomaly detection and diagnosis from system logs. In: USENIX Security Symposium, 2017. Disponível em: https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/du.
ENISA. Threat Landscape 2023. 2023. Disponível em: https://www.enisa.europa.eu/publications/enisa-threat-landscape-2023.
HAMILTON, W.; YING, R.; LESKOVEC, J. Inductive representation learning on large graphs. 2017. Disponível em: https://arxiv.org/abs/1706.02216.
KIPF, T.; WELLING, M. Semi-supervised classification with graph convolutional networks. 2017. Disponível em: https://arxiv.org/abs/1609.02907.
LEE, W.; STOLFO, S. Data mining approaches for intrusion detection. In: IEEE Symposium on Security and Privacy, 1998. Disponível em: https://ieeexplore.ieee.org/document/709428.
MITRE. ATT&CK Framework. 2024. Disponível em: https://attack.mitre.org/.
NEO4J INC. Neo4j Graph Data Platform. 2024. Disponível em: https://neo4j.com/.
NIST. Computer Security Incident Handling Guide (SP 800-61 Rev.2). 2012. Disponível em: https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final.
OWASP FOUNDATION. OWASP Top 10 – 2021. 2021. Disponível em: https://owasp.org/Top10/.
PYTORCH GEOMETRIC TEAM. PyTorch Geometric Documentation. 2024. Disponível em: https://pytorch-geometric.readthedocs.io/.
RED CANARY. Atomic Red Team. 2023. Disponível em: https://atomicredteam.io/.
SOMMER, R.; PAXSON, V. Outside the closed world: on using machine learning for network intrusion detection. In: IEEE Symposium on Security and Privacy, 2010. Disponível em: https://ieeexplore.ieee.org/document/5504793.
SPEROTTO, A. et al. An overview of IP flow-based intrusion detection. IEEE Communications Surveys & Tutorials, 2010. Disponível em: https://ieeexplore.ieee.org/document/5432190.
SPLUNK INC. Splunk Enterprise Security. 2023. Disponível em: https://www.splunk.com/.
VELIČKOVIĆ, P. et al. Graph attention networks. 2018. Disponível em: https://arxiv.org/abs/1710.10903.
VERIZON. 2024 Data Breach Investigations Report. 2024. Disponível em: https://www.verizon.com/business/resources/reports/dbir/.