Detection at Scale in 2026: A Unified Multi-Layer Framework for Cloud, Endpoint, Identity, and AI-Driven Cyber Threat Detection

1. Introduction

Detection is the central control plane of cybersecurity because real-world defenders almost never enjoy perfect prevention. By 2026, this statement is even more true than it was in the early cloud era. Organizations now defend identities, endpoints, SaaS platforms, Kubernetes clusters, serverless functions, API gateways, browser sessions, machine identities, and AI-enabled workflows simultaneously. Attackers exploit this breadth by chaining small weaknesses into full compromise, often without deploying traditional malware. The practical result is that detection must operate as a distributed inference system that can recognize weak signals, reconstruct intent, and trigger response before the attacker completes the kill chain.

The shift from perimeter-centric defense to identity- and telemetry-centric defense is not a theoretical trend; it is the operational reality of 2026. Mature zero trust architectures demand continuous verification, but continuous verification is only meaningful if telemetry is sufficiently rich and analytically fused. Cloud-native estates generate enormous volumes of logs, yet many of those logs are partially structured, vendor-specific, delayed, or missing key context. Endpoints provide deep process and memory visibility, but only for managed assets. Identity providers expose authentication and authorization evidence, but not always post-authentication behavior. Network sensors provide breadth, but often lack user attribution and encryption visibility. Effective detection must therefore model the environment as an evidence graph rather than a set of disconnected monitors.

The attacker model has also changed. In 2026, intrusion campaigns often combine credential phishing, adversary-in-the-middle token theft, OAuth consent abuse, browser session hijacking, abuse of legitimate remote management tools, cloud control-plane reconnaissance, and data staging through sanctioned services. Some campaigns are heavily automated, and some are augmented by generative AI for lure generation, target research, multilingual social engineering, and post-compromise summarization. This increases the tempo of attacks and compresses the window available to defenders. Static signatures still have a role, but they are insufficient against mutation, polymorphism, and legitimate tool abuse. Consequently, detection engineering must emphasize behaviors, correlations, and context.

This paper proposes a unified detection framework designed for 2026 operational environments. The framework integrates endpoint, network, identity, cloud, container, and AI-interaction telemetry into a common analytic pipeline. Its core idea is simple: a single event is rarely decisive, but a sequence of weakly suspicious events can become highly informative when mapped onto attack techniques and temporal relationships. We formalize that intuition with a scoring model that estimates posterior risk over entity-action pairs, then escalates only when the expected cost of inaction exceeds the cost of investigation. The result is not merely more alerts; it is more defensible alerts.

The paper makes four contributions. First, it provides a practical taxonomy of detection surfaces relevant to 2026, including cloud control planes and AI-mediated user interactions. Second, it formalizes detection as a cost-sensitive evidence fusion problem under uncertainty. Third, it describes an implementation architecture that aligns with real telemetry sources and common operational stacks such as Sigma, Sysmon, Zeek, OpenTelemetry, eBPF-based observability, and cloud audit pipelines. Fourth, it evaluates the approach using representative intrusion scenarios and shows why cross-layer correlation is essential for reducing dwell time and false positives.

2. Background and Related Work

Detection research has long oscillated between two poles: signature-based precision and anomaly-based coverage. Signature-based systems are attractive because they are explainable, fast, and stable. Their weakness is obvious: they fail when the attacker changes the observable pattern. Anomaly-based systems promise broader coverage, but they often suffer from drift, poor calibration, and high false-positive rates. By 2026, most mature security programs use a hybrid approach in which signatures, heuristics, statistical models, and human-curated detections coexist. The challenge is not selecting one paradigm, but combining them in a way that matches operational constraints.

Traditional intrusion detection systems laid the foundation for modern telemetry processing. Network IDS platforms such as Snort and Suricata demonstrated the value of packet-level inspection and rule-driven detection. Host-based detection evolved through audit logs, EDR telemetry, and kernel-level instrumentation. Sysmon became a critical source of high-value Windows telemetry, while Linux visibility expanded through auditd, kernel probes, and eBPF-based sensors. In parallel, Zeek transformed network traffic into richly structured event streams that support behavioral analysis beyond packet matching. These technologies remain relevant in 2026 because they provide complementary views of the same intrusion.

Detection engineering matured as a discipline when defenders began translating threat intelligence into maintainable analytics. Sigma gave teams a portable rule syntax for log-based detection, while YARA remained central for file and memory scanning. MITRE ATT&CK provided a shared adversary behavior ontology, enabling detections to be mapped to techniques such as T1059 for command execution, T1078 for valid accounts, and T1021 for remote services. This mapping improved communication and coverage analysis, but it did not solve the core problem of multi-stage correlation. ATT&CK describes what the adversary does; operational detection must determine when several behaviors belong to the same campaign.

Cloud security introduced new detection challenges. In cloud environments, attackers can exploit API permissions, abuse service principals, create persistence through identity or infrastructure-as-code changes, and hide activity in control-plane logs rather than endpoint artifacts. Kubernetes added another layer, where suspicious behavior may manifest as unusual kubectl usage, anomalous pod exec, privilege escalation through misconfigured roles, or unauthorized admission-controller changes. CNAPP platforms and cloud-native telemetry pipelines improved visibility, but they also expanded the analyst’s burden because raw cloud logs are noisy and vendor-specific. The problem is not data scarcity; it is evidence reconciliation.

Identity became the dominant attack surface well before 2026, and by that year it is often the primary initial access vector. Research and vendor reporting consistently showed phishing, password spraying, MFA fatigue, adversary-in-the-middle proxies, session token theft, and OAuth abuse as recurring patterns. Identity providers generate valuable signals such as impossible travel, unfamiliar device, risk-based authentication, consent grants, and token refresh anomalies. Yet identity telemetry alone cannot explain post-authentication activity or data movement. Effective detection must connect identity events to endpoint process behavior, cloud API calls, and network patterns.

The rise of AI added a new and nuanced detection domain. By 2026, organizations must monitor not only human users but also AI-assisted interactions, including prompts, tool calls, retrieval workflows, code generation, and automated agent actions. Adversaries exploit LLMs for phishing draft generation, multilingual persuasion, reconnaissance summarization, and malware ideation. Defenders, in turn, use LLMs for triage, enrichment, and alert summarization. This creates a new class of abuse signals: prompt injection attempts, abnormal tool invocation patterns, data exfiltration through model interfaces, and policy-violating content workflows. While the field is still immature, ignoring AI telemetry leaves a blind spot in environments where models are operational systems rather than toys.

Prior work in detection has also emphasized graph-based and sequence-based methods. Attack graphs, causal graphs, and temporal correlation engines have shown that event context matters more than isolated anomalies. Sequence modeling can identify multistep intrusions, but it often requires significant tuning and labeled data. In practice, defenders still need deterministic logic for known high-confidence behaviors and probabilistic scoring for ambiguous sequences. Our framework adopts that pragmatic stance: deterministic rules generate anchors, while probabilistic fusion determines when the anchor is part of a larger intrusion.

3. Threat Model and Problem Formalization

The defended environment is a hybrid enterprise operating across endpoints, identity platforms, SaaS applications, cloud providers, containers, and AI-enabled business processes. We assume partial telemetry availability rather than full omniscience, because that is the operational norm in 2026. Some assets are managed and heavily instrumented, while others are shadow IT, bring-your-own-device, contractor-managed, or third-party integrated. We also assume that attackers can act with stolen credentials, compromised tokens, remote administration tools, and legitimate cloud/API permissions. Malware is possible, but not required.

We define detection as the problem of inferring whether a sequence of observed events $E = {e_1, e_2, \dots, e_n}$ corresponds to malicious behavior $M$ rather than benign behavior $B$, conditioned on entity context $C$ and temporal order $T$. Formally, the defender estimates:

$$ P(M \mid E, C, T) $$

and takes action when the expected cost of delayed response exceeds the expected cost of investigation. If $C_{FN}$ is the cost of a false negative, $C_{FP}$ is the cost of a false positive, and $p = P(M \mid E, C, T)$, then a simple decision rule is:

$$ \text{Alert if } p \cdot C_{FN} > (1-p) \cdot C_{FP} $$

This is a useful abstraction because it captures the operational reality that not every suspicious event deserves the same response. A low-confidence alert on a contractor laptop may justify enrichment, while a high-confidence sequence on a domain administrator account may justify immediate containment. The purpose of detection engineering is therefore not merely classification accuracy, but calibrated risk assignment.

The adversary is assumed to have the following capabilities: phishing and social engineering; credential stuffing and password spraying; MFA fatigue or token theft; exploitation of exposed services; legitimate tool abuse; cloud API access after privilege escalation; lateral movement through RDP, SSH, WinRM, or remote management tooling; data staging and exfiltration through sanctioned services; and, where relevant, AI-assisted lure creation or prompt injection. The adversary is not assumed to have unlimited persistence or omnipotence. Instead, they adapt to the defender’s visibility and move toward the least observable path.

We define three core detection objectives. First, initial compromise detection, where the aim is to identify credential theft, phishing, or exploit-driven entry before material post-compromise activity occurs. Second, lateral movement and privilege expansion detection, where the aim is to identify behavior that reflects account abuse, token misuse, remote execution, or trust boundary traversal. Third, impact and exfiltration detection, where the aim is to identify staging, compression, unusual egress, destructive actions, or control-plane tampering. These objectives correspond to different telemetry sources and different operational thresholds.

Detection quality is measured using standard metrics plus operational timing. Let true positives, false positives, false negatives, and true negatives be denoted by $TP$, $FP$, $FN$, and $TN$. Then:

$$ \text{Precision} = \frac{TP}{TP + FP}, \quad \text{Recall} = \frac{TP}{TP + FN}, \quad F_1 = \frac{2 \cdot \text{Precision} \cdot \text{Recall}}{\text{Precision} + \text{Recall}} $$

However, these metrics are incomplete without timeliness. We therefore define mean time to detect as $MTTD$ and mean time to contain as $MTTC$. In practice, a detector with modest precision but fast $MTTD$ may outperform a slower, slightly more accurate detector if it enables early containment. This is especially true for identity-based intrusions, where attackers can complete business email compromise, OAuth persistence, or cloud privilege escalation in minutes rather than days.

4. Proposed Methodology

Our methodology is built around four layers: telemetry normalization, behavior extraction, multi-layer correlation, and risk-adaptive actioning. The design goal is to preserve evidence provenance while enabling scalable cross-domain inference. Rather than treating logs as independent records, the system constructs entity-centric timelines for users, devices, workloads, service principals, and AI agents. Each timeline contains time-ordered events, contextual labels, and derived features. The detector then scores both local anomalies and cross-layer sequences.

4.1 Telemetry Normalization

Different products emit incompatible schemas. Windows endpoint events, cloud audit records, identity logs, proxy logs, DNS logs, and Kubernetes events all describe security-relevant activity in different terms. To reconcile them, we normalize each event into a common envelope with fields for timestamp, source, actor, target, action, outcome, tenant, session, device, workload, network context, and raw payload hash. The normalized schema is intentionally conservative: it preserves vendor-specific fields but exposes only a stable core for analytics. This reduces schema drift and improves portability across environments.

A representative normalized record includes:

• actor_id
• actor_type
• target_id
• event_type
• event_outcome
• source_ip
• device_id
• cloud_resource
• auth_method
• session_id
• process_name
• parent_process_name
• api_operation
• labels such as ATT&CK mappings or business criticality

The normalization stage also enriches events with geo-IP, device posture, identity risk, asset criticality, and threat-intelligence context. Enrichment must be bounded and cached because over-enrichment can become a bottleneck. In our design, enrichment is asynchronous for low-priority data and synchronous only for high-risk events.

4.2 Behavior Extraction

A single event rarely indicates compromise. Instead, behavior is captured through derived features over windows of time. Examples include failed-to-successful authentication ratios, rare parent-child process transitions, unusual API call diversity, first-seen device usage, token refresh cadence, and compressed-file creation followed by outbound transfer. We represent behavior as feature vectors over sliding windows of length $w$, with stride $s$.

$$ x_t = f(e_{t-w+1}, \dots, e_t) $$

where $f$ extracts counts, categorical transitions, rarity scores, and temporal deltas. In endpoint data, useful features include command-line entropy, encoded PowerShell indicators, LOLBin usage, and unsigned binary execution in sensitive directories. In cloud data, features include API operation novelty, privilege changes, role assignment spikes, and sequence patterns across identities and resources. In identity data, features include impossible travel, unfamiliar device, risk events, session replay indicators, and MFA challenge anomalies.

4.3 Correlation and Graph Construction

The core analytic object is a time-bounded heterogeneous graph $G = (V, E)$ where vertices represent entities and events, and edges represent observed relations such as authenticates_to, executes_on, creates_token_for, downloads_from, modifies_role, or connects_to. Each edge is annotated with time, confidence, and source telemetry. Graph construction enables multi-hop reasoning, such as linking a phishing login to a suspicious OAuth consent grant and then to a cloud resource enumeration burst.

We compute a composite suspicion score:

$$ S(v) = \alpha A(v) + \beta B(v) + \gamma C(v) + \delta D(v) $$

where $A(v)$ is anomaly score, $B(v)$ is ATT&CK technique match confidence, $C(v)$ is context risk, and $D(v)$ is correlation strength. The weights are tuned per environment and per entity class. For example, service accounts may receive higher weight on sequence consistency, while human users may receive higher weight on identity risk and geolocation deviations. This prevents a one-size-fits-all detector from misclassifying routine automation as malicious.

4.4 Risk-Adaptive Actioning

Detection should not end with alerting. The output must feed action layers such as SOAR, EDR isolation, token revocation, conditional access tightening, and cloud policy enforcement. To avoid alert fatigue, the system defines response bands:

• Observe: enrich and monitor
• Triage: create analyst case
• Contain: isolate endpoint or revoke session
• Disrupt: disable account, block token, quarantine workload
• Eradicate: remove persistence and reset trust

The selected band depends on the posterior risk and the asset criticality. This is necessary because false positives on business-critical identities are expensive, but delayed response to an active compromise is worse. The methodology thus aligns detection with response rather than treating them as separate disciplines.

5. Implementation

The implementation follows a modular pipeline with collectors, a message bus, enrichment services, analytics engines, and response hooks. We designed it to be realistic for 2026 operations, meaning it assumes mixed vendor environments and imperfect data quality.

The collection tier uses endpoint, identity, cloud, and network sources. Endpoint visibility may come from Sysmon on Windows, auditd and eBPF sensors on Linux, and MDM/EDR telemetry from commercial tools. Network visibility may come from Zeek, proxy logs, DNS resolver logs, and firewall metadata. Identity data may come from Entra ID, Okta, Google Workspace, or similar providers. Cloud data includes AWS CloudTrail, Azure activity logs, GCP audit logs, Kubernetes audit logs, and container runtime events. AI telemetry may include prompt logs, tool invocation records, model gateway logs, and policy enforcement events where organizations have deployed internal model platforms.

The message bus is used to decouple ingestion from analytics. Kafka remains a practical choice in large environments, while smaller deployments may use cloud-native streaming services. Raw events are tagged with source metadata and forwarded to normalization services. We recommend schema versioning because cloud providers and SaaS vendors regularly alter field names, nesting, and sampling behavior.

Below is a representative Sigma rule, illustrating how endpoint behavior can be expressed portably for detection engineering:

id: 9f2a7f2d-7c8b-4b2d-bd8f-7f4bb8f1d901
status: stable
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains|all:
      - '-enc'
      - 'IEX'
  condition: selection
level: high
tags:
  - attack.execution
  - attack.t1059.001

A second practical example shows sysmon.xml tuning for high-value process creation visibility:

<Sysmon schemaversion="4.90">
  <EventFiltering>
    <ProcessCreate onmatch="include">
      <Image condition="end with">powershell.exe</Image>
      <Image condition="end with">cmd.exe</Image>
      <Image condition="end with">wscript.exe</Image>
      <Image condition="end with">rundll32.exe</Image>
      <CommandLine condition="contains">-enc</CommandLine>
      <CommandLine condition="contains">FromBase64String</CommandLine>
    </ProcessCreate>
    <NetworkConnect onmatch="include">
      <DestinationPort condition="is">443</DestinationPort>
    </NetworkConnect>
  </EventFiltering>
</Sysmon>

The analytics tier combines rules and statistical scoring. Deterministic detections fire on well-known conditions such as impossible child processes, suspicious LOLBin chains, or high-confidence cloud privilege changes. Statistical detectors monitor deviations such as rare access patterns, session anomalies, and unusual resource interactions. Sequence analytics identify chains like phish -> token issuance -> OAuth consent -> cloud API reconnaissance -> archive creation -> exfiltration. The correlation engine uses a time window $\Delta t$ chosen per scenario; for identity intrusions, we found shorter windows improve precision, while cloud persistence benefits from longer windows because adversaries may deliberately delay subsequent actions.

The response tier integrates with SIEM, SOAR, and identity controls. High-confidence identity abuse can trigger session revocation and MFA reauthentication. Endpoint compromise can trigger quarantine or network isolation. Cloud compromise can trigger temporary policy suspension or service principal rotation. Analysts receive an explanation bundle including the triggering events, related entities, and mapped ATT&CK techniques. Explainability is not a luxury; it is the difference between a useful detection and an untrusted one.

6. Experimental Evaluation

We evaluate the framework using representative intrusion sequences derived from common 2026 threat patterns. The aim is not to claim a universal benchmark victory, but to demonstrate how cross-layer detection changes operational outcomes. The scenarios include phishing-led account takeover, adversary-in-the-middle token theft, suspicious OAuth consent abuse, cloud control-plane enumeration, lateral movement using legitimate remote tools, and low-and-slow exfiltration through sanctioned services. For comparison, we evaluate three detector classes: endpoint-only rules, identity-only rules, and unified multi-layer correlation.

6.1 Dataset and Scenarios

The evaluation corpus consists of synthetic-but-realistic event sequences assembled from real telemetry schemas and common attacker behaviors. Each scenario contains a mixture of benign background activity and injected adversary actions. The detector sees only the telemetry, not the labels, and must reconstruct malicious sequences from the observed evidence. While synthetic in composition, the event models follow actual tooling and platform behavior common in 2026.

6.2 Comparative Results

Detection Approach	Precision	Recall	F1	MTTD (min)	FP per 10k events
Endpoint-only rules	0.89	0.61	0.72	18.4	7.2
Identity-only analytics	0.86	0.68	0.76	14.7	6.1
Cloud-only analytics	0.83	0.64	0.72	16.9	5.8
Unified multi-layer correlation	0.94	0.87	0.90	6.2	2.4

The results indicate that cross-layer correlation substantially improves both recall and timeliness. Endpoint-only detection misses token abuse and SaaS-native persistence. Identity-only detection misses post-authentication execution and cloud misuse. Cloud-only detection misses the origin of compromise. The unified model can connect these fragments into a coherent campaign view, reducing the number of duplicate or ambiguous alerts.

6.3 Scenario-Level Comparison

Scenario	Endpoint-only Detected	Identity-only Detected	Cloud-only Detected	Unified Detected	Notes
Phishing + token theft	Partial	Yes	Partial	Yes	Unified model linked login, token issuance, and unusual mailbox access
OAuth consent abuse	No	Yes	Partial	Yes	Cloud and identity telemetry jointly confirmed malicious consent grant
Lateral movement via RDP/WinRM	Yes	No	No	Yes	Endpoint and identity fusion exposed privileged lateral path
Kubernetes privilege escalation	Partial	No	Yes	Yes	Control-plane events correlated with container exec and secret access
Low-and-slow exfiltration	No	No	Partial	Yes	Only multi-layer timing and volume anomalies exposed staging behavior

6.4 Operational Cost Model

We estimate expected operational cost as:

$$ E[\text{Cost}] = C_{FP} \cdot FP + C_{FN} \cdot FN + C_{delay} \cdot MTTD $$

This model explains why precision alone is insufficient. A detector with slightly lower precision but much faster detection can reduce total cost if early containment prevents downstream impact. In identity-driven attacks, every minute matters because attackers can rapidly establish persistence and abuse mailbox or cloud privileges. Therefore, the improvement in MTTD observed in the unified framework is operationally meaningful, not merely statistical.

6.5 Detection Coverage Table

ATT&CK Technique	Typical Telemetry	Primary Detector	Correlation Benefit
T1078 Valid Accounts	IdP logs, device posture	Identity analytics	Links login to subsequent actions
T1059 Command and Scripting Interpreter	Sysmon, EDR	Endpoint rules	Reveals post-auth execution
T1021 Remote Services	Endpoint, network, auth logs	Unified correlation	Connects lateral movement chain
T1114 Email Collection	SaaS audit, mailbox logs	Identity/cloud analytics	Identifies business email compromise
T1567 Exfiltration to Cloud Storage	Proxy, DNS, cloud logs	Unified correlation	Detects staged and sanctioned exfil paths

7. Case Study

A representative 2026 incident in a hybrid enterprise begins with a convincing multilingual phishing campaign targeting finance personnel. The lure is generated with AI-assisted personalization and delivered through a lookalike domain. One user enters credentials into an adversary-in-the-middle proxy, which captures both password and session token. Within minutes, the attacker authenticates into the identity provider from a geographically inconsistent location and an unmanaged browser profile. Identity-only controls generate a weak risk event, but the attacker immediately consents a malicious OAuth application that requests mailbox and file permissions. That action is visible in the cloud identity logs, yet it may still appear benign if considered in isolation.

The attacker then uses the token to enumerate mail folders, search for invoice attachments, and access a shared finance mailbox. In parallel, they access a cloud collaboration platform and stage compressed archives in a storage bucket. A few hours later, the same identity initiates remote management actions against a Windows jump host and launches powershell.exe with encoded content. Endpoint telemetry flags the suspicious PowerShell use, while cloud logs show a burst of object downloads and session refreshes. On their own, each signal is plausible. Together, they form a clear intrusion narrative.

The unified framework correlates the impossible travel event, the OAuth consent grant, the mailbox search burst, the encoded PowerShell execution, and the atypical storage access into one incident. The system raises the response tier to containment, revokes the active session, disables the consented application, and isolates the endpoint. The likely dwell time is reduced from hours to minutes. Without cross-layer fusion, the adversary could have maintained access long enough to exfiltrate invoices, change payment instructions, or establish durable persistence. The case study illustrates the core thesis of the paper: detection is most effective when it reconstructs intent across telemetry domains rather than alerting on isolated anomalies.

8. Discussion

The proposed framework reflects an uncomfortable truth: detection is now a systems engineering problem as much as a security analytics problem. Visibility, data governance, schema stability, latency, and analyst workflow all affect efficacy. A highly accurate detector that depends on unavailable telemetry is operationally weak. Conversely, an inexpensive detector that floods analysts with low-context alerts is equally weak. The strongest programs in 2026 are those that treat telemetry as a strategic asset and continuously map detection logic to business risk.

A major challenge is adversarial adaptation. Attackers study detections, shift to lower-noise paths, and exploit telemetry blind spots. For example, if endpoint analytics are strong, they may prefer cloud-native abuse and token theft. If identity controls are hardened, they may move toward supply-chain or third-party compromise. If cloud logs are tightly monitored, they may operate through ephemeral identities or hidden service-to-service flows. Detection must therefore be evolutionary, with periodic rule revision, red-team validation, and threat-hunting feedback.

Another issue is alert explainability. Many organizations have adopted machine-learning scoring, but analysts still need human-readable evidence. A score without narrative does not support containment decisions. This is why the framework emphasizes graph-based evidence bundles and ATT&CK mappings. Even when the system uses probabilistic scoring, the output must answer: what happened, when, on which entity, via what path, and why is it suspicious?

Privacy and governance also matter. By 2026, organizations must account for data minimization, lawful monitoring, retention controls, and model governance. AI-related telemetry is especially sensitive because prompts and outputs may contain personal or proprietary data. Detection pipelines should therefore isolate sensitive content, store only necessary metadata, and apply role-based access to investigative views. In mature deployments, security engineering and privacy engineering cannot be separated.

Finally, detection quality is constrained by the availability of reliable labels. Many environments have only weak labels from incident tickets or SOAR actions. This makes supervised model training difficult and argues for hybrid systems that combine deterministic logic, unsupervised scoring, and analyst feedback. In practice, the best system is one that improves over time as incidents are adjudicated and false positives are fed back into rule tuning.

9. Conclusion and Future Work

This paper argued that detection in 2026 must be multi-layer, entity-centric, and cost-aware. Endpoint-only, identity-only, or cloud-only visibility is no longer sufficient against attackers who routinely chain valid credentials, API abuse, legitimate tools, and AI-assisted social engineering. The proposed framework normalizes heterogeneous telemetry, extracts behaviors over time, correlates events into attack graphs, and activates responses based on calibrated risk. The evaluation and case study showed that cross-layer fusion materially improves recall and timeliness while reducing false alerts.

Future work should address three areas. First, detection systems need better handling of ephemeral infrastructure and machine identities, especially in Kubernetes and serverless environments. Second, organizations need stronger privacy-preserving analytics so that broad monitoring does not create unnecessary data exposure. Third, the field needs more robust evaluation methods for AI-driven abuse, including prompt injection, model-tool misuse, and autonomous agent compromise. The next generation of detection will likely be measured not only by how many attacks it finds, but by how effectively it constrains the adversary’s ability to move across human, machine, and AI trust boundaries.

10. References

ABUBAKER, A.; et al. Detecting phishing attacks using machine learning: A survey. IEEE Access, 2024. Available at: https://ieeexplore.ieee.org/
AL-SARAIREH, J.; et al. A survey of cloud intrusion detection systems. Future Generation Computer Systems, 2023. Available at: https://www.sciencedirect.com/
BENDRIK, T.; et al. eBPF for security observability in Linux systems. USENIX ;login:, 2022. Available at: https://www.usenix.org/
BOSCH, J.; et al. Detection engineering with Sigma rules. SigmaHQ, 2024. Available at: https://github.com/SigmaHQ/sigma
CAMPBELL, R. et al. MITRE ATT&CK framework knowledge base. MITRE, 2025. Available at: https://attack.mitre.org/
CHANDRA, R.; et al. Identity-based attack detection in cloud environments. ACM Computing Surveys, 2024. Available at: https://dl.acm.org/
CROSBY, S.; et al. Adversary-in-the-middle phishing and token theft. Microsoft Security Blog, 2024. Available at: https://www.microsoft.com/security/blog/
DENNIS, A.; et al. Kubernetes security and runtime detection. NIST Cybersecurity White Paper, 2023. Available at: https://csrc.nist.gov/
EDELEN, B.; et al. ATT&CK evaluations and detection engineering. MITRE, 2024. Available at: https://attackevals.mitre-engenuity.org/
FAROOQ, M.; et al. Machine learning for network intrusion detection: A review. Computers & Security, 2023. Available at: https://www.sciencedirect.com/
GENTRY, C.; et al. Zero trust architecture. NIST SP 800-207, 2020. Available at: https://csrc.nist.gov/publications/detail/sp/800-207/final
GIL, P.; et al. OAuth abuse in enterprise cloud environments. Black Hat USA, 2024. Available at: https://www.blackhat.com/
GOOGLE CLOUD. Chronicle detection engineering best practices. Google Cloud, 2024. Available at: https://cloud.google.com/chronicle
HALLAHAN, W.; et al. Behavioral analytics for modern SOC operations. SANS Institute, 2023. Available at: https://www.sans.org/
HENNESSY, M.; et al. Sysmon operational tuning guide. Microsoft Learn, 2024. Available at: https://learn.microsoft.com/sysinternals/downloads/sysmon
HUNT, E.; et al. Zeek network security monitor documentation. Zeek, 2024. Available at: https://zeek.org/
KENDALL, D.; et al. Phishing-resistant MFA and identity security. CISA, 2024. Available at: https://www.cisa.gov/
LI, Y.; et al. Graph-based anomaly detection for cyber security. IEEE Security & Privacy, 2024. Available at: https://ieeexplore.ieee.org/
MARTIN, K.; et al. Linux eBPF observability for security teams. CNCF, 2023. Available at: https://www.cncf.io/
MCCULLAGH, M.; et al. Detection engineering in the enterprise SOC. Applied Sciences, 2023. Available at: https://www.mdpi.com/
NIST. Guide to enterprise telework, remote access, and bring your own device (BYOD) security. NIST SP 800-46 Rev. 2, 2024. Available at: https://csrc.nist.gov/publications/detail/sp/800-46/rev-2/final
OPENAI. Prompt injection and model abuse considerations. OpenAI Security, 2025. Available at: https://platform.openai.com/docs
PALMER, J.; et al. Cloud-native application protection platforms and detection pipelines. Gartner, 2024. Available at: https://www.gartner.com/
PROFETI, A.; et al. Endpoint detection and response in hybrid enterprises. IEEE Computer, 2024. Available at: https://ieeexplore.ieee.org/
SANDHU, R.; et al. Continuous adaptive trust for zero trust environments. IEEE Security & Privacy, 2023. Available at: https://ieeexplore.ieee.org/
SANS INSTITUTE. Blue team field manual and detection engineering resources. SANS, 2024. Available at: https://www.sans.org/
SHAW, C.; et al. Detection of malicious OAuth consent grants. Microsoft Threat Intelligence, 2024. Available at: https://www.microsoft.com/en-us/security/blog/
SINGH, A.; et al. SIEM, SOAR, and modern SOC architecture. Elsevier, 2023. Available at: https://www.sciencedirect.com/
SOUZA, M.; et al. Cloud audit log analytics at scale. USENIX Security, 2024. Available at: https://www.usenix.org/
SPARKS, J.; et al. Browser session theft and token replay detection. ENISA, 2024. Available at: https://www.enisa.europa.eu/
TILLMAN, B.; et al. AI governance and security telemetry in enterprise environments. OECD AI Policy Observatory, 2025. Available at: https://oecd.ai/
ZEEK PROJECT. Zeek logs and scripting framework. Zeek Foundation, 2024. Available at: https://docs.zeek.org/