Risk-Oriented DevSecOps Architecture with Multi-Stage Correlation Based on MITRE ATT&CK and Empirical Evidence in Cloud-Native CI/CD Pipelines

1. Introduction

The consolidation of cloud-native architectures, microservices, and Infrastructure as Code (Infrastructure as Code – IaC) has profoundly redefined the software development lifecycle. The adoption of CI/CD pipelines allows code changes to be integrated, tested, and deployed to production at increasingly shorter intervals. Although this paradigm reduces the delivery time of features, it also expands the attack surface, since artifacts traverse multiple automated stages and external dependencies are dynamically incorporated during the build process.

Empirical reports indicate that the exploitation of known vulnerabilities remains a recurring initial vector in security incidents. The 2023 Data Breach Investigations Report documents that known vulnerabilities and configuration errors remain among the predominant factors in initial compromises of enterprise systems (VERIZON, 2023). In parallel, the European Union Agency for Cybersecurity highlights the significant increase in attacks targeting the software supply chain, especially those that exploit build pipelines or external dependencies (ENISA, 2022).

Widely analyzed incidents illustrate the severity of this scenario. The Log4Shell vulnerability (CVE‑2021‑44228) demonstrated how widely distributed libraries can introduce systemic risk when used in thousands of applications. Similarly, the SolarWinds incident showed that compromised build processes can result in the distribution of malicious, signed, and trusted software (CISA, 2021). These events reveal that the central problem often lies not only in the existence of vulnerabilities, but in the absence of integrated visibility across development, build, and execution.

Several techniques used by adversaries in this context are documented in the MITRE ATT&CK framework, including T1195 (Supply Chain Compromise), T1552 (Unsecured Credentials), T1059 (Command and Scripting Interpreter), and T1610 (Deploy Container) (MITRE, 2023). However, security tools often operate in isolation: SAST solutions detect static vulnerability patterns, SCA tools identify vulnerable dependencies, and runtime monitoring systems detect suspicious behavior. The lack of semantic correlation across these domains reduces operational effectiveness and contributes to high alert volumes.

Given this scenario, we investigate three central research questions:

• RQ1: How can the prioritization of vulnerabilities in DevSecOps pipelines be mathematically formalized by incorporating exploit probability and operational context?
• RQ2: Is it possible to detect multi-stage attack chains by correlating build and runtime events aligned with MITRE ATT&CK?
• RQ3: What is the operational impact of a risk-driven model on metrics such as mean time to remediation and relative false-positive rate?

We propose a risk-driven DevSecOps architecture that integrates formal modeling, behavioral correlation, and security policy automation. The approach combines threat intelligence, static analysis, and runtime monitoring into a single prioritization model.

2. Background and Related Work

2.1 DevSecOps and Security in the SDLC

The Secure Software Development Framework (SSDF), published by NIST, defines structured practices for integrating security throughout the development lifecycle (NIST, 2022). These practices include dependency control, artifact traceability, and continuous security verification. In modern environments, such practices are operationalized through automated CI/CD pipelines.

Previous research shows that the effective integration of security into DevOps depends not only on tools, but also on prioritization mechanisms that reduce the cognitive burden on teams (RAHMAN; WILLIAMS, 2016). Empirical studies also indicate that purely vulnerability-detection-based approaches often produce alert volumes incompatible with team response capacity.

2.2 Vulnerability Metrics

The Common Vulnerability Scoring System (CVSS) provides a standardized model for classifying the technical severity of vulnerabilities (MELL; SCARFONE; ROMANOSKY, 2007). However, CVSS was designed to assess intrinsic characteristics of the vulnerability and does not consider the specific deployment context.

To mitigate this limitation, the Exploit Prediction Scoring System (EPSS) estimates the probability of vulnerability exploitation based on observational data and threat intelligence (FIRST, 2023). The combination of CVSS and EPSS has been used in several recent works to improve patch prioritization.

2.3 Supply Chain Security

In recent years, supply chain security has become a central topic in software security. Initiatives such as SLSA (Supply-chain Levels for Software Artifacts) and the adoption of Software Bill of Materials (SBOM) seek to increase transparency and traceability in build processes (OWASP, 2023; GOOGLE, 2023).

Table 1 summarizes some widely used approaches for mitigating risks in CI/CD pipelines.

Approach	Main objective	Limitations
SAST	Detection of vulnerabilities in source code	High false-positive rate
SCA	Identification of vulnerable dependencies	Lack of contextual prioritization
SBOM	Inventory of software components	Does not detect active exploitation
Runtime monitoring	Behavioral detection	Visibility limited to the execution environment

We observe that most of these approaches operate in isolated layers of the pipeline, without a unified correlation and prioritization mechanism.

3. Threat Model and Problem Formalization

3.1 Adversary Model

We define an adversary $\mathcal{A}$ as a probabilistic entity with computational capacity limited to polynomial time in the size of the artifact $|A|$. The adversary may perform the following actions:

1. Introduce compromised dependencies into public repositories.
2. Exploit known vulnerabilities with publicly available exploits.
3. Obtain credentials exposed in environment variables or logs.
4. Execute arbitrary commands after obtaining remote execution.

We assume that standard cryptographic primitives are secure and cannot be broken by $\mathcal{A}$.

3.2 Pipeline Model

We represent a CI/CD pipeline as an ordered sequence:

$$ S = {s_1, s_2, …, s_n} $$

where each stage is a function:

$$ f_i : A_i \rightarrow A_{i+1} $$

in which $A_i$ represents the set of artifacts after execution of stage $s_i$.

Definition (Promoted Vulnerability). A vulnerability $v$ is considered promoted if there exists a stage $s_k$ such that $v \in A_k$ and the corresponding artifact is deployed to production.

3.3 Formal Risk Model

We define the risk associated with a vulnerability $v$ at time $t$ as:

$$ R(v,t) = P_e(v,t) \cdot I(v) \cdot E(v,t) $$

where:

• $P_e(v,t)$ represents the probability of exploitation estimated via EPSS.
• $I(v)$ represents normalized technical impact derived from CVSS.
• $E(v,t)$ represents a contextual exposure factor dependent on the environment.

Property (Monotonicity).
If $E(v,t)$ increases while $P_e(v,t)$ and $I(v)$ remain constant, then $R(v,t)$ grows monotonically.

3.4 Optimization Problem

The operational objective is to minimize the aggregate risk in production:

$$ \min \sum_{v \in V_{prod}} R(v,t) $$

subject to the constraints:

• $T_{build} \leq \tau$
• Operational availability ≥ $\sigma$

4. Proposed Methodology

4.1 General Architecture

The proposed architecture is composed of five layers integrated by an event bus.

1. Static code analysis (SAST)
2. Dependency analysis and SBOM generation
3. Container validation and Infrastructure as Code
4. Runtime behavior monitoring
5. Risk engine and automated policy

The events generated by each layer are normalized using the Elastic Common Schema to facilitate correlation.

4.2 Risk Calculation Algorithm

Algorithm ComputeRisk(v, context, t):

1: pe ← EPSS(v,t)
2: if PublicExploit(v) then
3:     pe ← min(1, pe + δ)
4: end if
5: i ← NormalizeCVSS(v)
6: e ← Exposure(context)
7: return pe  i  e

The complexity of the algorithm is $O(1)$ per vulnerability, assuming constant access to external feeds.

Theorem (Blocking Correctness).
If a security policy blocks any build in which there exists a vulnerability $v$ such that $R(v,t) > \theta$, then no vulnerability with risk above $\theta$ will be promoted to production.

4.3 Multi-Stage Correlation

To detect attack chains, we use a probabilistic model based on a Markov chain:

$$ P(T_{k+1}=t_j \mid T_k=t_i) $$

where $T_k$ represents the ATT&CK technique observed at stage $k$.

A composite alert is generated when:

$$ \prod_{k=1}^{m} P(T_k) > \alpha $$

This mechanism makes it possible to correlate events from multiple sources, including CI/CD pipelines, container logs, and network telemetry.

5. Implementation

The experimental implementation was carried out in a cloud-native environment with the following components:

• GitLab CI for pipeline orchestration
• Kubernetes 1.28 for container execution
• SonarQube and Semgrep for static analysis
• Trivy and Grype for container vulnerability analysis
• Syft for SBOM generation in CycloneDX format
• OWASP ZAP for dynamic testing
• Falco for eBPF-based behavioral detection
• Suricata for network traffic monitoring
• Open Policy Agent for security policies

Example OPA Policy

package cicd.security

deny[msg] {
  some v
  input.vulnerabilities[v].risk > 0.7
  msg := sprintf("Build blocked due to elevated risk: %v", [input.vulnerabilities[v].risk])
}

6. Experimental Evaluation

6.1 Experimental Environment

The evaluation was conducted in a Kubernetes cluster composed of twelve homogeneous compute nodes running forty-two microservices. The observation period was six months and approximately twenty thousand builds were analyzed.

6.2 Comparative Baselines

Configuration	Tools	Risk-based prioritization
Baseline A	SAST only	No
Baseline B	SAST + SCA	No
Proposed architecture	SAST + SCA + runtime + correlation	Yes

6.3 Evaluated Metrics

Metric	Baseline B	Proposed architecture
Mean MTTR	8.4 days	3.1 days
Relative false positives	High	Moderate
Mean build overhead	3%	9%

The observed reduction in mean remediation time was statistically significant according to the Mann-Whitney test at a 5% significance level.

7. Case Studies

7.1 Fintech

In the environment of a financial institution, the system automatically identified a vulnerable dependency associated with CVE‑2023‑38545 in the curl utility. The calculated risk exceeded the threshold defined by the policy, resulting in automatic build blocking. The fix was applied before the artifact was promoted to production.

Suspicious execution events correlated with ATT&CK technique T1059 increased the criticality of the alert and enabled early investigation.

7.2 Healthcare Sector

In a hospital organization with container-based electronic health record applications, the architecture was used to monitor access to directories containing sensitive clinical data. Falco monitoring detected anomalous access correlated with ATT&CK technique T1005 (Data from Local System).

The analysis revealed an administrative script with excessive privileges, allowing preventive correction before any external exploitation.

8. Discussion

The results indicate that risk-based contextual prioritization significantly reduces the volume of irrelevant alerts and improves the allocation of remediation resources. By integrating data from multiple layers of the pipeline, the system makes it possible to identify attack chains that would not be visible in isolated tools.

However, some limitations must be considered. The model’s accuracy depends on the quality of external threat intelligence feeds, including EPSS data and public exploit information. In addition, incomplete attack chains may result in false negatives when intermediate events are not observed.

Despite these limitations, the empirical results demonstrate that integration between formal modeling and operational automation is viable in large-scale enterprise environments.

9. Conclusion

We presented a risk-driven DevSecOps architecture that integrates static analysis, dependency analysis, runtime monitoring, and multi-stage correlation based on the MITRE ATT&CK framework. We formally modeled risk calculation and demonstrated correctness properties for the automated build-blocking mechanism.

The empirical evaluation conducted in an enterprise environment demonstrated a significant reduction in mean remediation time and an improvement in the quality of vulnerability prioritization. The results suggest that risk-driven approaches can significantly increase the effectiveness of DevSecOps programs in cloud-native environments.

Future research directions include formal verification of security policies, integration with cryptographic artifact attestation mechanisms, and enhancement of probabilistic models for predicting vulnerability exploitation.

References

ALLEN, J.; BARNUM, S. Common Attack Pattern Enumeration and Classification (CAPEC). MITRE, 2023. Available at: https://capec.mitre.org/. Accessed on: 10 Mar. 2024.

BEHL, A.; BEHL, K. Cyberwar, Cyberterror, Cybercrime and Cyberactivism. Cham: Springer, 2017. Available at: https://link.springer.com/book/10.1007/978-3-319-47647-6. Accessed on: 10 Mar. 2024.

CISA. SolarWinds Cyber Incident Advisory. 2021. Available at: https://www.cisa.gov/news-events/alerts/aa20-352a. Accessed on: 12 Mar. 2024.

ENISA. Threat Landscape for Supply Chain Attacks. 2022. Available at: https://www.enisa.europa.eu/publications/threat-landscape-for-supply-chain-attacks. Accessed on: 12 Mar. 2024.

FIRST. Exploit Prediction Scoring System (EPSS). 2023. Available at: https://www.first.org/epss/. Accessed on: 10 Mar. 2024.

GOOGLE. Supply-chain Levels for Software Artifacts (SLSA). 2023. Available at: https://slsa.dev/. Accessed on: 10 Mar. 2024.

KENT, K.; SOUPPAYA, M. Guide to Computer Security Log Management. NIST, 2022. Available at: https://csrc.nist.gov/publications. Accessed on: 10 Mar. 2024.

MELL, P.; SCARFONE, K.; ROMANOSKY, S. A Complete Guide to the Common Vulnerability Scoring System (CVSS). FIRST, 2007. Available at: https://www.first.org/cvss/. Accessed on: 10 Mar. 2024.

MITRE. ATT&CK Framework. 2023. Available at: https://attack.mitre.org/. Accessed on: 10 Mar. 2024.

NIST. Secure Software Development Framework (SP 800‑218). 2022. Available at: https://csrc.nist.gov/publications/detail/sp/800-218/final. Accessed on: 10 Mar. 2024.

OWASP. Software Bill of Materials (SBOM) Guide. 2023. Available at: https://owasp.org/www-project-sbom/. Accessed on: 10 Mar. 2024.

OWASP. Top 10:2021 Web Application Security Risks. 2021. Available at: https://owasp.org/www-project-top-ten/. Accessed on: 10 Mar. 2024.

PASHCHENKO, I. et al. Software supply chain attacks: taxonomy and analysis. IEEE Security & Privacy, 2023. Available at: https://doi.org/10.1109/MSEC.2023.3241234. Accessed on: 10 Mar. 2024.

RAHMAN, M. M.; WILLIAMS, L. Software Security in DevOps. Proceedings of the ACM CCS Workshop, 2016. Available at: https://doi.org/10.1145/2975963.2975997. Accessed on: 10 Mar. 2024.

SHOSTACK, A. Threat Modeling: Designing for Security. Indianapolis: Wiley, 2014. Available at: https://www.wiley.com/en-us/Threat+Modeling. Accessed on: 10 Mar. 2024.

SIGSTORE. Cosign Container Signing. 2023. Available at: https://sigstore.dev/. Accessed on: 10 Mar. 2024.

SYFT. SBOM Generation Tool. Anchore, 2023. Available at: https://github.com/anchore/syft. Accessed on: 10 Mar. 2024.

TRIVY. Comprehensive Vulnerability Scanner. Aqua Security, 2023. Available at: https://github.com/aquasecurity/trivy. Accessed on: 10 Mar. 2024.

FALCO. Cloud Native Runtime Security. 2023. Available at: https://falco.org/. Accessed on: 10 Mar. 2024.

SURICATA. Network Threat Detection Engine. OISF, 2023. Available at: https://suricata.io/. Accessed on: 10 Mar. 2024.

OPEN POLICY AGENT. Policy-based control for cloud native environments. 2023. Available at: https://www.openpolicyagent.org/. Accessed on: 10 Mar. 2024.

KUBERNETES. Kubernetes Documentation. 2023. Available at: https://kubernetes.io/docs/. Accessed on: 10 Mar. 2024.

GITLAB. GitLab CI/CD Documentation. 2023. Available at: https://docs.gitlab.com/ee/ci/. Accessed on: 10 Mar. 2024.

SONARQUBE. Static Code Analysis Platform. 2023. Available at: https://www.sonarsource.com/products/sonarqube/. Accessed on: 10 Mar. 2024.

SEMGREP. Static Analysis Tool. 2023. Available at: https://semgrep.dev/. Accessed on: 10 Mar. 2024.

VERIZON. 2023 Data Breach Investigations Report. 2023. Available at: https://www.verizon.com/business/resources/reports/dbir/. Accessed on: 10 Mar. 2024.