Risk-Driven DevSecOps Architecture with Multi-Stage, MITRE ATT&CK-Based Correlation and Empirical Evidence in Cloud-Native CI/CD Pipelines

1. Introduction

The consolidation of cloud-native architectures, microservices, and Infrastructure as Code (IaC) has fundamentally redefined the software development lifecycle. The introduction of CI/CD pipelines makes it possible to integrate, test, and deploy code changes into production environments at ever shorter intervals. Although this paradigm shortens time-to-feature, it also expands the attack surface, as artifacts pass through multiple automated stages and external dependencies are dynamically incorporated during the build process.

Empirical reports show that the exploitation of known vulnerabilities remains a recurring initial vector in security incidents. The 2023 Data Breach Investigations Report documents that known vulnerabilities and configuration errors continue to be among the predominant factors in initial compromises of enterprise systems (VERIZON, 2023). In parallel, the European Union Agency for Cybersecurity highlights the marked increase in targeted attacks on the software supply chain, especially those that exploit build pipelines or external dependencies (ENISA, 2022).

Widely analyzed incidents illustrate the severity of this scenario. The Log4Shell vulnerability (CVE‑2021‑44228) showed how widely used libraries can introduce systemic risk when deployed in thousands of applications. Likewise, the SolarWinds incident made it clear that compromised build processes can lead to the distribution of malicious, signed, and therefore trusted software (CISA, 2021). These events show that the central problem often lies not solely in the presence of vulnerabilities, but in the absence of integrated transparency across development, build, and execution.

Several techniques used by attackers in this context are documented in the MITRE ATT&CK framework, including T1195 (Supply Chain Compromise), T1552 (Unsecured Credentials), T1059 (Command and Scripting Interpreter), and T1610 (Deploy Container) (MITRE, 2023). However, security tools often operate in isolation: SAST solutions detect static vulnerability patterns, SCA tools identify vulnerable dependencies, and runtime monitoring systems detect suspicious behavior. The lack of semantic correlation across these domains reduces operational effectiveness and contributes to high alert volumes.

Against this background, we investigate three central research questions:

• RQ1: How can vulnerability prioritization in DevSecOps pipelines be mathematically formalized by considering exploitability probability and operational context?
• RQ2: Is it possible to detect multistage attack chains by correlating build and runtime events aligned with MITRE ATT&CK?
• RQ3: What operational impact does a risk-oriented model have on metrics such as mean time to remediation and the relative false positive rate?

We propose a risk-oriented DevSecOps architecture that integrates formal modeling, behavioral correlation, and security policy automation. The approach combines threat intelligence, static analysis, and runtime monitoring in a unified prioritization model.

2. Background and Related Work

2.1 DevSecOps and Security in the SDLC

The Secure Software Development Framework (SSDF) published by NIST defines structured practices for integrating security throughout the development lifecycle (NIST, 2022). These practices include dependency control, artifact traceability, and continuous security verification. In modern environments, such practices are operationalized through automated CI/CD pipelines.

Prior research shows that the effective integration of security into DevOps depends not only on tools, but also on prioritization mechanisms that reduce the cognitive load on teams (RAHMAN; WILLIAMS, 2016). Empirical studies also indicate that approaches based solely on vulnerability detection often generate alert volumes incompatible with team responsiveness.

2.2 Vulnerability Metrics

The Common Vulnerability Scoring System (CVSS) provides a standardized model for classifying the technical severity of vulnerabilities (MELL; SCARFONE; ROMANOSKY, 2007). However, CVSS was designed to assess intrinsic characteristics of the vulnerability and does not account for the specific deployment context.

To mitigate this limitation, the Exploit Prediction Scoring System (EPSS) estimates the likelihood of vulnerability exploitation based on observable data and threat intelligence (FIRST, 2023). The combination of CVSS and EPSS has been used in several recent works to improve remediation prioritization.

2.3 Supply Chain Security

In recent years, supply chain security has become a central topic in software security. Initiatives such as SLSA (Supply-chain Levels for Software Artifacts) and the introduction of Software Bills of Materials (SBOM) aim to increase transparency and traceability in build processes (OWASP, 2023; GOOGLE, 2023).

Table 1 summarizes some widely used approaches to mitigating risk in CI/CD pipelines.

Approach	Main goal	Limitations
SAST	Detection of vulnerabilities in source code	High false positive rate
SCA	Identification of vulnerable dependencies	Lack of contextual prioritization
SBOM	Inventory of software components	Does not detect active exploitation
Runtime monitoring	Behavior-based detection	Limited visibility into the execution environment

We observe that most of these approaches operate at isolated layers of the pipeline, without a unified mechanism for correlation and prioritization.

3. Threat Model and Problem Formalization

3.1 Adversary Model

We define an adversary $\mathcal{A}$ as a probabilistic entity with computational capacity bounded by polynomial time in the size of the artifact $|A|$. The adversary can perform the following actions:

1. Introduce compromised dependencies into public repositories.
2. Exploit known vulnerabilities with publicly available exploits.
3. Obtain credentials exposed in environment variables or logs.
4. Execute arbitrary commands after obtaining remote code execution.

We assume that standardized cryptographic primitives are secure and cannot be broken by $\mathcal{A}$.

3.2 Pipeline Model

We represent a CI/CD pipeline as an ordered sequence:

$$ S = {s_1, s_2, …, s_n} $$

where each stage is the function:

$$ f_i : A_i \rightarrow A_{i+1} $$

where $A_i$ denotes the set of artifacts after execution of stage $s_i$.

Definition (Promoted Vulnerability). A vulnerability $v$ is considered promoted if there exists a stage $s_k$ such that $v \in A_k$ and the corresponding artifact is transferred into production.

3.3 Formal Risk Model

We define the risk associated with a vulnerability $v$ at time $t$ as:

$$ R(v,t) = P_e(v,t) \cdot I(v) \cdot E(v,t) $$

where:

• $P_e(v,t)$ represents the exploitation probability estimated via EPSS.
• $I(v)$ represents the normalized technical impact based on CVSS.
• $E(v,t)$ represents a context-dependent exposure factor determined by the environment.

Property (Monotonicity).
If $E(v,t)$ increases while $P_e(v,t)$ and $I(v)$ remain constant, then $R(v,t)$ grows monotonically.

3.4 Optimization Problem

The operational objective is to minimize the aggregate risk in production:

$$ \min \sum_{v \in V_{prod}} R(v,t) $$

subject to the constraints:

• $T_{build} \leq \tau$
• Operational availability ≥ $\sigma$

4. Proposed Methodology

4.1 Overall Architecture

The proposed architecture consists of five layers integrated via an event bus.

1. Static code analysis (SAST)
2. Dependency analysis and SBOM generation
3. Container and Infrastructure as Code validation
4. Runtime behavioral monitoring
5. Risk engine and automated policy

The events generated by each layer are normalized using the Elastic Common Schema to facilitate correlation.

4.2 Risk Calculation Algorithm

Algorithm ComputeRisk(v, context, t):

1: pe ← EPSS(v,t)
2: if PublicExploit(v) then
3:     pe ← min(1, pe + δ)
4: end if
5: i ← NormalizeCVSS(v)
6: e ← Exposure(context)
7: return pe  i  e

The complexity of the algorithm is $O(1)$ per vulnerability, assuming constant access to external feeds.

Theorem (Blocking Correctness).
If a security policy blocks every build for which a vulnerability $v$ exists such that $R(v,t) > \theta$, then no vulnerability with risk above $\theta$ will be promoted into production.

4.3 Multistage Correlation

To detect attack chains, we use a probabilistic model based on a Markov chain:

$$ P(T_{k+1}=t_j \mid T_k=t_i) $$

where $T_k$ denotes the ATT&CK technique observed at step $k$.

A composite alert is generated when:

$$ \prod_{k=1}^{m} P(T_k) > \alpha $$

This mechanism enables correlation of events from multiple sources, including CI/CD pipelines, container logs, and network telemetry.

5. Implementation

The experimental implementation was carried out in a cloud-native environment with the following components:

• GitLab CI for pipeline orchestration
• Kubernetes 1.28 for container execution
• SonarQube and Semgrep for static analysis
• Trivy and Grype for container vulnerability analysis
• Syft for generating SBOM in CycloneDX format
• OWASP ZAP for dynamic testing
• Falco for eBPF-based behavioral detection
• Suricata for network traffic monitoring
• Open Policy Agent for security policies

Example of an OPA policy

package cicd.security

deny[msg] {
  some v
  input.vulnerabilities[v].risk > 0.7
  msg := sprintf("Build blocked due to elevated risk: %v", [input.vulnerabilities[v].risk])
}

6. Experimental Evaluation

6.1 Experimental Environment

The evaluation was conducted in a Kubernetes cluster consisting of twelve homogeneous compute nodes and running forty-two microservices. The observation period was six months, and approximately twenty thousand builds were analyzed.

6.2 Comparative Baselines

Configuration	Tools	Risk-based prioritization
Baseline A	SAST only	No
Baseline B	SAST + SCA	No
Proposed architecture	SAST + SCA + Runtime + Correlation	Yes

6.3 Evaluated Metrics

Metric	Baseline B	Proposed architecture
Average MTTR	8.4 days	3.1 days
Relative false positives	High	Moderate
Average build overhead	3%	9%

The observed reduction in mean time to remediation was statistically significant according to a Mann-Whitney test at a 5% significance level.

7. Case Studies

7.1 Fintech

In a financial institution environment, the system automatically identified a vulnerable dependency associated with CVE‑2023‑38545 in the curl utility. The calculated risk exceeded the policy-defined threshold, resulting in automatic build blocking. The fix was applied before the artifact was promoted into production.

Suspicious execution events correlated with ATT&CK technique T1059 increased the alert criticality and enabled early investigation.

7.2 Healthcare

In a hospital organization with container-based electronic health records, the architecture was used to monitor access to directories containing sensitive clinical data. Falco monitoring detected anomalous access correlated with ATT&CK technique T1005 (Data from Local System).

The analysis uncovered an administrative script with excessive privileges, making it possible to apply a preventive fix before any external exploitation.

8. Discussion

The results show that contextual, risk-based prioritization significantly reduces the volume of irrelevant alerts and improves the allocation of remediation resources. By integrating data from multiple layers of the pipeline, the system enables the identification of attack chains that would not be visible in isolated tools.

However, some limitations must be considered. The accuracy of the model depends on the quality of external threat intelligence feeds, including EPSS data and information on public exploits. In addition, incomplete attack chains may lead to false negatives if intermediate events are not observed.

Despite these limitations, the empirical results show that integrating formal modeling and operational automation is feasible in large-scale enterprise environments.

9. Conclusion

We presented a risk-oriented DevSecOps architecture that integrates static analysis, dependency analysis, runtime monitoring, and multistage correlation based on the MITRE ATT&CK framework. We formally modeled risk calculation and demonstrated correctness properties for the automatic build-blocking mechanism.

The empirical evaluation conducted in an enterprise environment showed a significant reduction in mean time to remediation and an improvement in the quality of vulnerability prioritization. The results suggest that risk-oriented approaches can substantially increase the effectiveness of DevSecOps programs in cloud-native environments.

Future research directions include the formal verification of security policies, integration with cryptographic attestation mechanisms for artifacts, and improved probabilistic models for predicting vulnerability exploitation.

References

ALLEN, J.; BARNUM, S. Common Attack Pattern Enumeration and Classification (CAPEC). MITRE, 2023. Available at: https://capec.mitre.org/. Accessed on: 10 Mar. 2024.

BEHL, A.; BEHL, K. Cyberwar, Cyberterror, Cybercrime and Cyberactivism. Cham: Springer, 2017. Available at: https://link.springer.com/book/10.1007/978-3-319-47647-6. Accessed on: 10 Mar. 2024.

CISA. SolarWinds Cyber Incident Advisory. 2021. Available at: https://www.cisa.gov/news-events/alerts/aa20-352a. Accessed on: 12 Mar. 2024.

ENISA. Threat Landscape for Supply Chain Attacks. 2022. Available at: https://www.enisa.europa.eu/publications/threat-landscape-for-supply-chain-attacks. Accessed on: 12 Mar. 2024.

FIRST. Exploit Prediction Scoring System (EPSS). 2023. Available at: https://www.first.org/epss/. Accessed on: 10 Mar. 2024.

GOOGLE. Supply-chain Levels for Software Artifacts (SLSA). 2023. Available at: https://slsa.dev/. Accessed on: 10 Mar. 2024.

KENT, K.; SOUPPAYA, M. Guide to Computer Security Log Management. NIST, 2022. Available at: https://csrc.nist.gov/publications. Accessed on: 10 Mar. 2024.

MELL, P.; SCARFONE, K.; ROMANOSKY, S. A Complete Guide to the Common Vulnerability Scoring System (CVSS). FIRST, 2007. Available at: https://www.first.org/cvss/. Accessed on: 10 Mar. 2024.

MITRE. ATT&CK Framework. 2023. Available at: https://attack.mitre.org/. Accessed on: 10 Mar. 2024.

NIST. Secure Software Development Framework (SP 800‑218). 2022. Available at: https://csrc.nist.gov/publications/detail/sp/800-218/final. Accessed on: 10 Mar. 2024.

OWASP. Software Bill of Materials (SBOM) Guide. 2023. Available at: https://owasp.org/www-project-sbom/. Accessed on: 10 Mar. 2024.

OWASP. Top 10:2021 Web Application Security Risks. 2021. Available at: https://owasp.org/www-project-top-ten/. Accessed on: 10 Mar. 2024.

PASHCHENKO, I. et al. Software supply chain attacks: taxonomy and analysis. IEEE Security & Privacy, 2023. Available at: https://doi.org/10.1109/MSEC.2023.3241234. Accessed on: 10 Mar. 2024.

RAHMAN, M. M.; WILLIAMS, L. Software Security in DevOps. Proceedings of the ACM CCS Workshop, 2016. Available at: https://doi.org/10.1145/2975963.2975997. Accessed on: 10 Mar. 2024.

SHOSTACK, A. Threat Modeling: Designing for Security. Indianapolis: Wiley, 2014. Available at: https://www.wiley.com/en-us/Threat+Modeling. Accessed on: 10 Mar. 2024.

SIGSTORE. Cosign Container Signing. 2023. Available at: https://sigstore.dev/. Accessed on: 10 Mar. 2024.

SYFT. SBOM Generation Tool. Anchore, 2023. Available at: https://github.com/anchore/syft. Accessed on: 10 Mar. 2024.

TRIVY. Comprehensive Vulnerability Scanner. Aqua Security, 2023. Available at: https://github.com/aquasecurity/trivy. Accessed on: 10 Mar. 2024.

FALCO. Cloud Native Runtime Security. 2023. Available at: https://falco.org/. Accessed on: 10 Mar. 2024.

SURICATA. Network Threat Detection Engine. OISF, 2023. Available at: https://suricata.io/. Accessed on: 10 Mar. 2024.

OPEN POLICY AGENT. Policy-based control for cloud native environments. 2023. Available at: https://www.openpolicyagent.org/. Accessed on: 10 Mar. 2024.

KUBERNETES. Kubernetes Documentation. 2023. Available at: https://kubernetes.io/docs/. Accessed on: 10 Mar. 2024.

GITLAB. GitLab CI/CD Documentation. 2023. Available at: https://docs.gitlab.com/ee/ci/. Accessed on: 10 Mar. 2024.

SONARQUBE. Static Code Analysis Platform. 2023. Available at: https://www.sonarsource.com/products/sonarqube/. Accessed on: 10 Mar. 2024.

SEMGREP. Static Analysis Tool. 2023. Available at: https://semgrep.dev/. Accessed on: 10 Mar. 2024.

VERIZON. 2023 Data Breach Investigations Report. 2023. Available at: https://www.verizon.com/business/resources/reports/dbir/. Accessed on: 10 Mar. 2024.