Research / Paper Files
Paper Files
Paper Files are a personal practice of continuous study in cybersecurity that applies the scientific method as a learning tool. Each article is written not for academic publication, but as a deliberate exercise to sharpen the axe — deepening knowledge on specific topics, organizing ideas with rigor, and observing how understanding of certain subjects develops over time. It is the intellectual equivalent of a training journal: each entry records what was studied, how it was analyzed, and what conclusions emerged.
I strongly recommend that security professionals adopt this method. Choose a topic you want to master, research primary sources (RFCs, papers, official documentation), structure your text with introduction, methodology, analysis, and conclusion, and write as if you were explaining to a colleague. The act of writing forces clarity of thought and exposes gaps in understanding that passive reading cannot reveal. Use the articles on this site as examples of format and depth, and build your own collection — over time, you will have a personal repository of refined knowledge that no course or certification can replace.
DAI & ADAI · 2026
DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts
DAI (Decripte Artificial Intelligence) is a proprietary domain-specific LLM within a governed autonomous defensive architecture. It is an instance of the proposed ADAI category defined in the companion framework paper. T…
Read paper →ADAI · ENAutonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure
ADAI (Autonomous Defensive Artificial Intelligence) is a proposed category of governed autonomous cyber defense. The framework specifies defended perimeters, bounded effects, declared rollback and capability-disjoint ver…
Read paper →22 papers
A Formal and Operational Architecture for Attacker-Oriented AppSec: Risk-Exploitability-Based Prioritization through the Integration of SAST, DAST, SCA, Runtime Telemetry, and ATT&CK Intelligence
TITLE: A Formal and Operational Architecture for Attacker-Oriented AppSec: Risk-Exploitability-Based Prioritization through the Integration of SAST, DAST, SCA, Runtime Telemetry, and ATT&CK Intelligence ABSTRACT: A Formal and Operational Architecture for Attacker-Oriented AppSec: Risk-Exploitability-Based Prioritization through the Integration of SAST, DAST, SCA, Runtime Telemetry, and ATT&CK Intelligence Abstract: The attack surface of modern applications has expanded significantly with the adoption of microservices, APIs, containers, and continuous integration/continuous delivery pipelines. Although application security tools such as Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) are widely used, these mechanisms often operate in isolation and generate large volumes of alerts lacking operational context. As a result, security teams find it difficult to prioritize vulnerabilities based on their likelihood of being actually exploited. In this study, we present a formal and operational architecture for threat-oriented application security that integrates SAST, DAST, and SCA results with runtime telemetry collected in production through network sensors and eBPF-based monitoring. The proposed architecture uses Bayesian model-inspired probabilistic correlation to estimate the risk-exploitability of identified vulnerabilities, incorporating empirical evidence derived from events observed at runtime and aligning that evidence with the MITRE ATT&CK framework. We mathematically formalize the concept of risk-exploitability and show how multiple sources of evidence can be combined to reduce false positives and improve remediation prioritization. Implementation experiments were conducted in a Kubernetes environment integrated into a CI/CD pipeline, using widely adopted industry tools including Semgrep, OWASP ZAP, OWASP Dependency-Check, Falco, and Suricata. Evaluation on a set of vulnerable applications confirmed a significant improvement in the identification accuracy of exploitable vulnerabilities. The experimental results show that while the F1-score for individual approaches ranged from 0.67 to 0.63, the integrated model improved it to 0.85, while also reducing false positives by 37.4% and shortening the mean time for vulnerability triage. We discuss the limitations of the probabilistic model, the operational implications for DevSecOps practices, and extensibility opportunities including integration with exploitability indicators such as EPSS and machine-learning-assisted analysis for adaptive prioritization. The proposed architecture demonstrates that correlating static analysis, dynamic testing, dependency analysis, and operational telemetry is a promising path toward narrowing the gap between vulnerability detection and real-world exploit detection.
Read paper →AppSecA Formal and Operational Architecture for Threat-Driven AppSec: Integration of SAST, DAST, SCA, Runtime Telemetry, and ATT&CK Intelligence for Risk-Based Prioritization Based on Exploitable Risk
TITLE: A Formal and Operational Architecture for Threat-Driven AppSec: Integration of SAST, DAST, SCA, Runtime Telemetry, and ATT&CK Intelligence for Risk-Based Prioritization Based on Exploitable Risk ABSTRACT: The attack surface of modern applications has expanded substantially with the adoption of microservices-based architectures, APIs, containers, and continuous integration and delivery pipelines. Although application security tools such as Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) are widely used, these mechanisms often operate in isolation, producing large volumes of alerts that lack operational context. Consequently, security teams face difficulties in prioritizing vulnerabilities based on the actual probability of exploitation. In this work, we present a formal and operational architecture for threat-driven application security that integrates SAST, DAST, and SCA results with runtime execution telemetry collected through network sensors and eBPF-based monitoring. The proposed architecture uses probabilistic correlation inspired by Bayesian models to estimate the exploitable risk of identified vulnerabilities, incorporating empirical evidence from events observed at runtime and aligning such evidence with the MITRE ATT&CK framework. We mathematically formalize the concept of exploitable risk and demonstrate how multiple sources of evidence can be combined to reduce false positives and improve remediation prioritization. The experimental implementation was carried out in a Kubernetes environment with CI/CD pipeline integration, using widely adopted industry tools, including Semgrep, OWASP ZAP, OWASP Dependency-Check, Falco, and Suricata. We evaluated the approach on a set of vulnerable applications and observed significant improvements in the accuracy of identifying exploitable vulnerabilities. The experimental results indicate an increase in the F1-score from 0.67–0.63 in isolated approaches to 0.85 in the integrated model, along with a 37.4% reduction in false positives and a decrease in mean vulnerability triage time. We discuss limitations of the probabilistic model, operational implications for DevSecOps practices, and possible extensions, including integration with exploitation metrics such as EPSS and machine-learning-assisted analysis for adaptive prioritization. The proposed architecture demonstrates that correlating static analysis, dynamic testing, dependency analysis, and operational telemetry is a promising path to narrowing the gap between vulnerability detection and real exploitation detection.
Read paper →AppSecA Formal and Operational Architecture for Threat-Driven AppSec: Integrating SAST, DAST, SCA, Runtime Telemetry, and ATT&CK Intelligence for Exploitable Risk-Based Prioritization
TITLE: A Formal and Operational Architecture for Threat-Driven AppSec: Integrating SAST, DAST, SCA, Runtime Telemetry, and ATT&CK Intelligence for Exploitable Risk-Based Prioritization ABSTRACT: The attack surface of modern applications has expanded substantially with the adoption of microservice-based architectures, APIs, containers, and continuous integration and delivery pipelines. Although application security tools such as Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) are widely used, these mechanisms often operate in isolation, producing large volumes of alerts that lack operational context. Consequently, security teams face difficulties in prioritizing vulnerabilities based on the actual likelihood of exploitation. In this work, we present a formal and operational architecture for threat-driven application security that integrates SAST, DAST, and SCA results with runtime execution telemetry collected through network sensors and eBPF-based monitoring. The proposed architecture uses probabilistic correlation inspired by Bayesian models to estimate the exploitable risk of identified vulnerabilities, incorporating empirical evidence from observed runtime events and aligning such evidence with the MITRE ATT&CK framework. We mathematically formalize the concept of exploitable risk and demonstrate how multiple sources of evidence can be combined to reduce false positives and improve remediation prioritization. The experimental implementation was carried out in a Kubernetes environment with integration into a CI/CD pipeline, using widely adopted industry tools including Semgrep, OWASP ZAP, OWASP Dependency-Check, Falco, and Suricata. We evaluated the approach on a set of vulnerable applications and observed significant improvements in the accuracy of identifying exploitable vulnerabilities. The experimental results indicate an increase in the F1-score from 0.67–0.63 in isolated approaches to 0.85 in the integrated model, as well as a 37.4% reduction in false positives and a decrease in the average time required for vulnerability triage. We discuss limitations of the probabilistic model, operational implications for DevSecOps practices, and possible extensions, including integration with exploitation metrics such as EPSS and machine learning-assisted analysis for adaptive prioritization. The proposed architecture demonstrates that correlating static analysis, dynamic testing, dependency analysis, and operational telemetry constitutes a promising path to reducing the gap between vulnerability detection and actual exploitation detection.
Read paper →AppSecA Formal and Operational Architecture for Threat-Oriented AppSec: Integration of SAST, DAST, SCA, Runtime Telemetry, and ATT&CK Intelligence for Exploitability-Based Risk Prioritization
TITLE: A Formal and Operational Architecture for Threat-Oriented AppSec: Integration of SAST, DAST, SCA, Runtime Telemetry, and ATT&CK Intelligence for Exploitability-Based Risk Prioritization ABSTRACT: The attack surface of modern applications has expanded substantially with the adoption of microservices-based architectures, APIs, containers, and continuous integration and delivery pipelines. Although application security tools such as Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) are widely used, these mechanisms often operate in isolation, generating large volumes of alerts that lack operational context. Consequently, security teams face difficulties in prioritizing vulnerabilities based on the actual likelihood of exploitation. In this work, we present a formal and operational architecture for threat-oriented application security that integrates SAST, DAST, and SCA findings with runtime execution telemetry collected through network sensors and eBPF-based monitoring. The proposed architecture uses probabilistic correlation inspired by Bayesian models to estimate the exploitability risk of identified vulnerabilities, incorporating empirical evidence from events observed at runtime and aligning such evidence with the MITRE ATT&CK framework. We mathematically formalize the concept of exploitability risk and demonstrate how multiple sources of evidence can be combined to reduce false positives and improve remediation prioritization. The experimental implementation was carried out in a Kubernetes environment with integration into a CI/CD pipeline, using widely adopted industry tools, including Semgrep, OWASP ZAP, OWASP Dependency-Check, Falco, and Suricata. We evaluated the approach on a set of vulnerable applications and observed significant improvements in the accuracy of identifying exploitable vulnerabilities. The experimental results indicate an increase in the F1-score from 0.67–0.63 in isolated approaches to 0.85 in the integrated model, as well as a 37.4% reduction in false positives and a decrease in the average vulnerability triage time. We discuss the limitations of the probabilistic model, operational implications for DevSecOps practices, and possible extensions, including integration with exploitation metrics such as EPSS and machine-learning-assisted analysis for adaptive prioritization. The proposed architecture demonstrates that correlation among static analysis, dynamic testing, dependency analysis, and operational telemetry constitutes a promising path to reducing the gap between vulnerability detection and real exploitation detection.
Read paper →AppSecEvidence-Oriented AppSec: A Formal and Scalable Framework for Application Security Orchestration Based on Threat Modeling and Continuous Hybrid Analysis
TITLE: Evidence-Oriented AppSec: A Formal and Scalable Framework for Application Security Orchestration Based on Threat Modeling and Continuous Hybrid Analysis ABSTRACT: Application security has become a central component of modern cybersecurity due to the growing reliance on distributed architectures, microservices, public APIs, and complex open-source dependency chains. The attack surface of contemporary systems grows proportionally to the interconnectivity among components, rendering traditional approaches that analyze vulnerabilities in isolation insufficient. In contemporary DevSecOps environments, tools such as static analysis (SAST), dynamic analysis (DAST), and software composition analysis (SCA) produce large volumes of alerts, often characterized by high false-positive rates and inadequate risk prioritization. This work proposes a formal framework called EO-AppSec (Evidence-Oriented Application Security), which integrates multiple sources of security evidence into a unified probabilistic model for vulnerability prioritization. We formalize the problem using Bayesian inference combined with contextualized CVSS metrics and dependency modeling of components represented by directed graphs. The framework correlates outputs from SAST, DAST, and SCA tools, as well as operational telemetry, to estimate the likelihood of vulnerability exploitation and compute a conditional risk score. The proposed architecture integrates CI/CD pipelines and cloud-native infrastructures, including Kubernetes environments and observability platforms based on eBPF and modern telemetry stacks. We evaluate the system in an industrial environment comprising 47 applications and approximately 3.2 million lines of code, comparing it with traditional approaches based on isolated analysis. The results demonstrate a significant improvement in vulnerability prioritization accuracy (0.89) and a 42.3% reduction in false positives, as well as a reduction in mean remediation time from 14.2 to 8.7 days. We discuss practical implications for software security governance and integration with contemporary security frameworks, including the NIST Secure Software Development Framework and modern security practices in DevSecOps pipelines. We also analyze methodological limitations and implications for environments that incorporate artificial intelligence components and large language models in modern applications. The results indicate that evidence-based orchestration offers a viable path to reducing operational noise and improving the effectiveness of AppSec programs at industrial scale.
Read paper →AppSecEvidence-Driven AppSec: A Formal and Scalable Framework for Application Security Orchestration Based on Threat Modeling and Continuous Hybrid Analysis
TITLE: Evidence-Driven AppSec: A Formal and Scalable Framework for Application Security Orchestration Based on Threat Modeling and Continuous Hybrid Analysis ABSTRACT: Application security has become a central component of modern cybersecurity due to the growing reliance on distributed architectures, microservices, public APIs, and complex open-source dependency chains. The attack surface of contemporary systems grows in proportion to the interconnectivity among components, making traditional approaches that analyze vulnerabilities in isolation insufficient. In contemporary DevSecOps environments, tools such as static analysis (SAST), dynamic analysis (DAST), and software composition analysis (SCA) generate large volumes of alerts, often characterized by high false-positive rates and inadequate risk prioritization. This work proposes a formal framework called EO-AppSec (Evidence-Oriented Application Security), which integrates multiple security evidence sources into a unified probabilistic model for vulnerability prioritization. We formalize the problem using Bayesian inference combined with contextualized CVSS metrics and component dependency modeling represented by directed graphs. The framework correlates results from SAST, DAST, and SCA tools, as well as operational telemetry, to estimate the probability of vulnerability exploitation and compute a conditional risk score. The proposed architecture integrates CI/CD pipelines and cloud-native infrastructures, including Kubernetes environments and observability platforms based on eBPF and modern telemetry stacks. We evaluated the system in an industrial environment containing 47 applications and approximately 3.2 million lines of code, comparing it with traditional approaches based on isolated analysis. The results demonstrate a significant increase in vulnerability prioritization accuracy (0.89) and a 42.3% reduction in false positives, in addition to a reduction in mean remediation time from 14.2 to 8.7 days. We discuss practical implications for software security governance and integration with contemporary security frameworks, including the NIST Secure Software Development Framework and modern security practices in DevSecOps pipelines. We also analyze methodological limitations and implications for environments that incorporate artificial intelligence components and large language models in modern applications. The results indicate that evidence-based orchestration offers a viable path to reduce operational noise and improve the effectiveness of AppSec programs at industrial scale.
Read paper →AppSecA Quantitative and Operational Application Security Architecture Based on the Integration of SAST, DAST, SCA, and Threat Intelligence in the DevSecOps Lifecycle
TITLE: A Quantitative and Operational Application Security Architecture Based on the Integration of SAST, DAST, SCA, and Threat Intelligence in the DevSecOps Lifecycle ABSTRACT: Application security (Application Security – AppSec) has become a central component of risk management in modern digital environments. The growing adoption of architectures based on microservices, exposed APIs, containers, and continuous delivery pipelines has significantly expanded organizations’ attack surface. Although various security analysis tools are widely available, many organizations still face difficulties in prioritizing vulnerabilities based on the actual risk of exploitation. Static analysis (SAST), dynamic analysis (DAST), and software composition analysis (SCA) tools frequently produce large volumes of findings, many of which have low operational impact or a high false positive rate. This paper proposes a quantitative architecture for risk-oriented AppSec programs, integrating SAST, DAST, and SCA results with external threat intelligence sources. We present a formal prioritization model based on a risk function that combines CVSS scores, evidence of public exploits, application exposure context, and mapping to techniques in the MITRE ATT&CK framework. The proposed architecture is integrated into DevSecOps pipelines and uses vulnerability correlation and normalization mechanisms through management platforms such as DefectDojo. We empirically evaluate the approach on a set of 42 real applications developed in Java, Python, and Node.js. The results indicate a significant reduction in duplicate vulnerabilities, a decrease in the false positive rate, and a substantial improvement in mean time to remediation (MTTR). A 63% reduction in MTTR and a 44.7% decrease in the volume of findings after correlation between scanners were observed. We further demonstrate that incorporating threat intelligence — including the presence of public exploits and observation of adversary activity — improves remediation prioritization and directs resources to vulnerabilities that are effectively exploitable. The results suggest that risk-driven AppSec programs, when integrated into the DevSecOps lifecycle, offer measurable gains in reducing attack surface and improving the operational efficiency of security teams.
Read paper →AppSecA Quantitative and Operational Architecture for Application Security Based on Integrating SAST, DAST, SCA, and Threat Intelligence in the DevSecOps Lifecycle
TITLE: A Quantitative and Operational Architecture for Application Security Based on Integrating SAST, DAST, SCA, and Threat Intelligence in the DevSecOps Lifecycle ABSTRACT: A Quantitative and Operational Architecture for Application Security Based on Integrating SAST, DAST, SCA, and Threat Intelligence in the DevSecOps Lifecycle Abstract: Application Security (AppSec) has become a central component of risk management in modern digital environments. The growing adoption of microservices-based architectures, exposed APIs, containers, and continuous delivery pipelines has significantly expanded organizations’ attack surface. Although many security analysis tools are widely available, many organizations still face difficulties in prioritizing vulnerabilities based on the actual risk of exploitation. Static analysis tools (SAST), dynamic analysis (DAST), and software composition analysis (SCA) often generate large volumes of findings, many of which have low operational impact or a high rate of false positives. This work proposes a quantitative architecture for risk-driven AppSec programs, integrating SAST, DAST, and SCA results with external Threat Intelligence sources. We present a formal prioritization model based on a risk function that combines CVSS scores, evidence of public exploit availability, the application’s exposure context, and mapping to MITRE ATT&CK techniques. The proposed architecture is integrated into DevSecOps pipelines and uses vulnerability correlation and normalization mechanisms through management platforms such as DefectDojo. We empirically evaluated the approach across a set of 42 real-world applications developed in Java, Python, and Node.js. The results indicate a significant reduction in duplicate vulnerabilities, a decrease in the false positive rate, and a substantial improvement in mean time to remediation (MTTR). A 63% reduction in MTTR and a 44.7% decrease in findings volume were observed after correlating scans. We also demonstrated that integrating Threat Intelligence—including the presence of public exploits and observation of adversary activity—improves remediation prioritization and directs resources toward vulnerabilities that are actually exploitable. The findings indicate that risk-driven AppSec programs, when integrated into the DevSecOps lifecycle, provide measurable benefits in reducing the attack surface and improving the operational efficiency of security teams.
Read paper →AppSecA Quantitative and Operational Architecture for Application Security Based on the Integration of SAST, DAST, SCA, and Threat Intelligence in the DevSecOps Lifecycle
Title: A Quantitative and Operational Architecture for Application Security Based on the Integration of SAST, DAST, SCA, and Threat Intelligence in the DevSecOps Lifecycle Abstract: Application Security (AppSec) has become a central component of risk management in modern digital environments. The growing adoption of microservices-based architectures, exposed APIs, containers, and continuous delivery pipelines has significantly expanded organizations’ attack surface. Although many security analysis tools are widely available, many organizations still struggle to prioritize vulnerabilities based on the actual risk of exploitation. Static Analysis (SAST), Dynamic Analysis (DAST), and Software Composition Analysis (SCA) tools often generate large volumes of findings, many of which have low operational impact or a high rate of false positives. This work proposes a quantitative architecture for risk-oriented AppSec programs, integrating SAST, DAST, and SCA results with external Threat Intelligence sources. We present a formal prioritization model based on a risk function that combines CVSS scores, evidence of public exploit availability, the application’s exposure context, and mapping to MITRE ATT&CK framework techniques. The proposed architecture is integrated into DevSecOps pipelines and uses vulnerability correlation and normalization mechanisms via management platforms such as DefectDojo. We empirically evaluated the approach across a set of 42 real applications developed in Java, Python, and Node.js. The results indicate a significant reduction in duplicate vulnerabilities, a decrease in the false positive rate, and a substantial improvement in mean time to remediation (MTTR). A 63% reduction in MTTR and a 44.7% decrease in the volume of findings were observed after correlation across scanners. We also demonstrated that integrating Threat Intelligence — including the presence of public exploits and observation of adversary activity — improves remediation prioritization and directs resources toward vulnerabilities that are actually exploitable. The findings indicate that risk-oriented AppSec programs, when integrated into the DevSecOps lifecycle, provide measurable benefits in reducing the attack surface and improving the operational efficiency of security teams.
Read paper →AppSecA Quantitative Architecture for Application Security Based on Formal Threat Modeling, Integration of SAST/DAST/SCA, and Runtime Telemetry in DevSecOps Environments
TITLE: A Quantitative Architecture for Application Security Based on Formal Threat Modeling, Integration of SAST/DAST/SCA, and Runtime Telemetry in DevSecOps Environments ABSTRACT: A Quantitative Architecture for Application Security Based on Formal Threat Modeling, Integration of SAST/DAST/SCA, and Runtime Telemetry in DevSecOps Environments ABSTRACT: A Quantitative Architecture for Application Security Based on Formal Threat Modeling, Integration of SAST/DAST/SCA, and Runtime Telemetry in DevSecOps Environments ABSTRACT: The growing reliance on web applications, APIs, and microservice-based architectures has significantly expanded the attack surface of modern systems. Recent incident reports indicate that the exploitation of Internet-facing applications remains among the most frequent intrusion vectors, often leveraging known vulnerabilities in libraries, input validation flaws, or misconfigurations. Although application security tools such as static analysis (SAST), dynamic analysis (DAST), and software composition analysis (SCA) are widely used in DevSecOps pipelines, these mechanisms typically operate in a fragmented manner and without a quantitative framework that enables estimation of the system’s residual risk. This work proposes an integrated Application Security architecture based on formal threat modeling, aggregation of results from multiple analysis sources, and incorporation of real-time execution telemetry. We formalize the problem of vulnerability prioritization as a weighted residual-risk minimization process, in which each vulnerability is evaluated based on metrics of exploitability probability, potential impact, and operational context. The proposed architecture integrates static, dynamic, and dependency analysis tools with security observability mechanisms, including runtime behavioral detection and continuous event collection. We experimentally evaluate the approach in an environment composed of deliberately vulnerable applications and real microservices running on containerized infrastructure. The results indicate a significant improvement in the ability to identify effectively exploitable vulnerabilities, with an average increase in recall to 91.3% and a 63.4% reduction in mean time to detect (MTTD) compared with isolated approaches. The observed computational overhead remained below 20%, compatible with the operational requirements of modern CI/CD pipelines. In addition, we discuss implications for corporate AppSec programs, highlighting the importance of integrating code analysis, operational monitoring, and threat intelligence. The proposed architecture demonstrates that combining formal modeling with runtime telemetry provides a solid foundation for contextual vulnerability prioritization and the effective reduction of residual risk in contemporary software systems.
Read paper →AppSecA Quantitative Application Security Architecture Based on Formal Threat Modeling, SAST/DAST/SCA Integration, and Runtime Telemetry in DevSecOps Environments
TITLE: A Quantitative Application Security Architecture Based on Formal Threat Modeling, SAST/DAST/SCA Integration, and Runtime Telemetry in DevSecOps Environments ABSTRACT: The growing dependence on web applications, APIs, and microservice-based architectures has significantly expanded the attack surface of modern systems. Recent incident reports indicate that exploitation of internet-exposed applications remains among the most frequent intrusion vectors, often leveraging known vulnerabilities in libraries, input validation flaws, or misconfigurations. Although application security tools such as static analysis (SAST), dynamic analysis (DAST), and software composition analysis (SCA) are widely used in DevSecOps pipelines, these mechanisms typically operate in a fragmented manner and without a quantitative framework that enables estimation of the system’s residual risk. This work proposes an integrated Application Security architecture based on formal threat modeling, aggregation of results from multiple analysis sources, and incorporation of real-time execution telemetry. We formalize the problem of vulnerability prioritization as a weighted residual risk minimization process, in which each vulnerability is assessed based on exploit probability metrics, potential impact, and operational context. The proposed architecture integrates static, dynamic, and dependency analysis tools with security observability mechanisms, including behavioral detection at runtime and continuous event collection. We experimentally evaluate the approach in an environment composed of deliberately vulnerable applications and real microservices running on containerized infrastructure. The results indicate a significant improvement in the ability to identify effectively exploitable vulnerabilities, with an average recall increase to 91.3% and a 63.4% reduction in mean time to detection (MTTD) compared with isolated approaches. The observed computational overhead remained below 20%, compatible with the operational requirements of modern CI/CD pipelines. In addition, we discuss implications for enterprise AppSec programs, highlighting the importance of integration between code analysis, operational monitoring, and threat intelligence. The proposed architecture demonstrates that combining formal modeling with runtime telemetry provides a solid basis for contextualized vulnerability prioritization and effective reduction of residual risk in contemporary software systems.
Read paper →AppSecA Formal Architecture for Continuous AppSec Based on Hybrid Analysis, Quantitative Threat Modeling, and Risk-Driven Orchestration
TITLE: A Formal Architecture for Continuous AppSec Based on Hybrid Analysis, Quantitative Threat Modeling, and Risk-Driven Orchestration ABSTRACT: The growing complexity of modern software ecosystems — composed of microservices, publicly exposed APIs, open-source dependencies, and highly automated CI/CD pipelines — has substantially expanded the attack surface of applications. Vulnerabilities such as Log4Shell (CVE-2021-44228) and recurring injection and improper access control flaws demonstrate that traditional application security (AppSec) approaches remain insufficient against adaptive adversaries. In this work, we propose an integrated continuous AppSec architecture that combines static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and quantitative threat modeling, coupled through a risk-driven orchestration mechanism. We formalize the vulnerability prioritization problem as a multi-objective optimization under operational constraints, modeling risk as R = P(E) × I, where P(E) is the estimated probability of exploitation based on threat intelligence and I is the impact measured via CVSS metrics and asset criticality. We implemented a prototype on a DevSecOps pipeline integrated with GitHub Actions, SonarQube, OWASP ZAP, and dependabot, evaluating it across 47 real-world open-source applications. Our results demonstrate an average reduction of 38.7% in mean time to remediation (MTTR), a 24.3% increase in the detection rate of critical vulnerabilities, and a 41.2% reduction in incorrectly prioritized false positives, compared to conventional risk-agnostic pipelines. The central contribution lies in the mathematical formalization of prioritization and the continuous operational integration, providing measurable guarantees of improved security posture. The results indicate that incorporating quantitative models into the orchestration of AppSec tools constitutes a substantial advance in security maturity for modern development environments.
Read paper →AppSecA Formally Grounded Architecture for Continuous Application Security: Threat Modeling, Hybrid Analysis, and Quantitative Risk Prioritization in DevSecOps Pipelines
TITLE: A Formally Grounded Architecture for Continuous Application Security: Threat Modeling, Hybrid Analysis, and Quantitative Risk Prioritization in DevSecOps Pipelines ABSTRACT: The growing complexity of software ecosystems, characterized by distributed architectures, microservices, third-party dependencies, and continuous delivery cycles, has substantially expanded the attack surface of modern applications. Recent reports from the Verizon Data Breach Investigations Report (DBIR) indicate that more than 43% of breaches exploit vulnerabilities in web applications, while the NVD recorded more than 28,000 CVEs in 2023, many associated with remotely exploitable flaws. In this work, we investigate application security (AppSec) from a formal and systematic perspective, proposing an integrated architecture for continuous detection, prioritization, and mitigation of vulnerabilities in DevSecOps pipelines. Our methodology combines static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and probabilistic risk modeling based on CVSS and organizational contextual metrics. We introduce a mathematical model for vulnerability prioritization based on the function $R(v) = P_e(v) \cdot I(v) \cdot C(v)$, where $P_e$ represents the probability of exploitation, $I$ the technical impact, and $C$ the contextual criticality. We evaluated our approach on 42 open source applications and 8 real-world enterprise systems, totaling 3.2 million lines of code. The results demonstrate an average reduction of 37.4% in remediation time (MTTR), a 29.1% increase in the detection rate of critical vulnerabilities, and a 41.8% reduction in false positives when compared to traditional pipelines based solely on SAST. The proposed architecture presents an average overhead of 8.6% in build time, while maintaining operational viability. We conclude that the formally oriented integration of hybrid techniques, combined with contextual quantitative prioritization, substantially improves the effectiveness of AppSec programs in high-velocity development environments.
Read paper →AppSecEvidence-Oriented AppSec: A Formal and Scalable Framework for Continuous Vulnerability Analysis in DevSecOps Pipelines
TITLE: Evidence-Oriented AppSec: A Formal and Scalable Framework for Continuous Vulnerability Analysis in DevSecOps Pipelines ABSTRACT: Application Security (AppSec) has become one of the primary risk vectors in the contemporary digital ecosystem, driven by the massive adoption of microservices architectures, continuous integration, and open-source dependencies. Vulnerabilities exploited at large scale, such as Log4Shell (CVE-2021-44228) and Spring4Shell (CVE-2022-22965), reveal structural limitations of traditional approaches to static analysis (SAST), dynamic analysis (DAST), and software composition analysis (SCA). In this work, we propose a formal and evidence-oriented framework for continuous AppSec, named EASE (Evidence-Aware Security Enforcement), which integrates incremental static analysis, formal modeling of data flows, and probabilistic risk prioritization based on operational telemetry. Our methodology combines a mathematical risk model R(v) = P_e(v) · I(v) · E(v), where P_e represents the probability of exploitation estimated through statistical learning, I denotes contextual impact, and E represents dynamic exposure measured through runtime data. We implemented the framework in real CI/CD pipelines containing 312 repositories (Java, Python, and Node.js), totaling 48 million lines of code. Experimental results indicate an average reduction of 37.4% in false positives compared to conventional SAST tools, a 42.1% decrease in mean time to remediation (MTTR), and early detection of 91% of vulnerabilities later cataloged as critical (CVSS ≥ 9.0). In addition, incremental analysis reduced execution time by 58% compared to full scans. We contribute (i) a rigorous formalization of the vulnerability prioritization problem in DevSecOps environments, (ii) efficient algorithms for incremental analysis with correctness guarantees, and (iii) a large-scale empirical evaluation demonstrating substantial gains in accuracy and performance. The proposed framework establishes quantitative foundations for AppSec grounded in real risk, bringing application security closer to evidence-oriented engineering practices.
Read paper →AppSecEvidence-Driven AppSec: A Formal and Scalable Framework for Continuous Vulnerability Analysis in DevSecOps Pipelines
TITLE: Evidence-Driven AppSec: A Formal and Scalable Framework for Continuous Vulnerability Analysis in DevSecOps Pipelines ABSTRACT: Application Security (AppSec) has become one of the main risk vectors in the contemporary digital ecosystem, driven by the massive adoption of microservice architectures, continuous integration, and open-source code dependencies. Vulnerabilities exploited at scale, such as Log4Shell (CVE-2021-44228) and Spring4Shell (CVE-2022-22965), reveal structural limitations of traditional static analysis (SAST), dynamic analysis (DAST), and software composition analysis (SCA) approaches. In this work, we propose a formal, evidence-driven framework for continuous AppSec, called EASE (Evidence-Aware Security Enforcement), which integrates incremental static analysis, formal modeling of data flows, and probabilistic risk prioritization based on operational telemetry. Our methodology combines a mathematical risk model R(v) = P_e(v) · I(v) · E(v), where P_e represents exploitation probability estimated by statistical learning, I the contextual impact, and E the dynamic exposure measured from execution data. We implemented the framework in real CI/CD pipelines containing 312 repositories (Java, Python, and Node.js), totaling 48 million lines of code. The experimental results indicate an average reduction of 37.4% in false positives compared to conventional SAST tools, a 42.1% decrease in mean time to remediation (MTTR), and early detection of 91% of the vulnerabilities later cataloged as critical (CVSS ≥ 9.0). In addition, incremental analysis reduced execution time by 58% compared to full scans. We contribute (i) a rigorous formalization of the vulnerability prioritization problem in DevSecOps environments, (ii) efficient algorithms for incremental analysis with correctness guarantees, and (iii) a large-scale empirical evaluation demonstrating substantial gains in precision and performance. The proposed framework establishes quantitative foundations for risk-based AppSec, bringing application security closer to evidence-driven engineering practices.
Read paper →AppSecA Formal and Scalable Architecture for Application Security (AppSec) Based on Graph-Oriented Hybrid Analysis and Quantitative Risk Prioritization
TITLE: A Formal and Scalable Architecture for Application Security (AppSec) Based on Graph-Oriented Hybrid Analysis and Quantitative Risk Prioritization ABSTRACT: The growing complexity of distributed applications, based on microservices and integrated with extensive open-source dependency chains, has significantly expanded the attack surface and the frequency of exploitable vulnerabilities. Recent incidents associated with flaws such as Log4Shell (CVE-2021-44228) and insecure deserialization vulnerabilities highlight the inadequacy of traditional Application Security (AppSec) approaches that rely exclusively on isolated static or dynamic scans. In this work, we propose a formal and scalable AppSec architecture based on graph-oriented hybrid analysis, combining static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and automated threat modeling through semantic dependency graphs and interprocedural data-flow graphs. We introduce a mathematical model for quantitative risk prioritization that integrates CVSS metrics, estimated exploitability probability via statistical learning, and structural centrality in the call graph. We implemented a distributed prototype capable of analyzing applications with more than 5 million lines of code, processing 1.2 million graph nodes with an average latency of 38 minutes per CI/CD pipeline. We evaluated the system on 42 critical open-source projects (including Apache Struts, Spring PetClinic, and NodeGoat), totaling 9,317 known vulnerabilities. Our approach reduced false positives by 37.4% compared with traditional SAST tools and increased the detection of real exploitable flows by 28.9%. The prioritization mechanism increased the remediation rate of critical vulnerabilities in controlled test environments by 41% within two-week sprint cycles. The results demonstrate that the formal integration of multiple techniques under a unified graph-oriented model provides substantial gains in precision, scalability, and operational relevance, contributing to the advancement of the state of the art in AppSec and to the effective integration of security into the DevSecOps lifecycle.
Read paper →AppSecFormal and Scalable Architecture for Application Security (AppSec) Based on Graph-Oriented Hybrid Analysis and Quantitative Risk Prioritization
TITLE: Formal and Scalable Architecture for Application Security (AppSec) Based on Graph-Oriented Hybrid Analysis and Quantitative Risk Prioritization ABSTRACT: The growing complexity of distributed applications, based on microservices and integrated with extensive open source dependency chains, has significantly expanded the attack surface and the frequency of exploitable vulnerabilities. Recent incidents associated with flaws such as Log4Shell (CVE-2021-44228) and insecure deserialization vulnerabilities demonstrate the inadequacy of traditional Application Security (AppSec) approaches centered exclusively on isolated static or dynamic scans. In this work, we propose a formal and scalable AppSec architecture based on graph-oriented hybrid analysis, combining static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and automated threat modeling through semantic dependency graphs and interprocedural data-flow analysis. We introduce a mathematical model for quantitative risk prioritization that integrates CVSS metrics, estimated exploitability probability through statistical learning, and structural centrality in the call graph. We implemented a distributed prototype capable of analyzing applications with more than 5 million lines of code, processing 1.2 million graph nodes with an average latency of 38 minutes per CI/CD pipeline. We evaluated the system on 42 critical open source projects (including Apache Struts, Spring PetClinic, and NodeGoat), totaling 9,317 known vulnerabilities. Our approach reduced false positives by 37.4% compared to traditional SAST tools and increased the detection of real exploitable flows by 28.9%. The prioritization mechanism increased the remediation rate of critical vulnerabilities in controlled test environments by 41% within two-week sprint cycles. The results demonstrate that the formal integration of multiple techniques under a unified graph-oriented model offers substantial gains in accuracy, scalability, and operational relevance, contributing to the advancement of the state of the art in AppSec and to the effective integration of security into the DevSecOps lifecycle.
Read paper →AppSecOperationalizing Application Security in the AI‑Augmented Software Supply Chain: Practical AppSec Architecture, Threat Modeling, and Empirical Evaluation (2026)
DeploymentVerification DeploymentVerification --> RuntimeMonitoring RuntimeMonitoring --> [] ``` Each transition includes verification predicates ensuring integrity and compliance. Correctness Proof Sketch Theorem 1: Pipeline Integrity Preservation Given cryptographically signed artifacts and verified stage transitions, the pipeline preserves artifact integrity. Proof Assume: 1. Initial artifact $A_0$ is trusted. 2. Each stage verifies artifact signature before transformation. 3. New artifacts are signed after transformation. Then for stage $i$: $$ Verify(Sign(A_i)) = True $$ and af
Read paper →AppSecA Formally Grounded Architecture for Continuous AppSec: Integration of Static Analysis, Dynamic Analysis, and Threat-Oriented Observability with Quantifiable Guarantees
1. Introduction The digital transformation of the last two decades has substantially altered the nature of the application attack surface. Monolithic architectures have progressively been replaced by distributed ecosystems composed of microservices, REST APIs, message queues, serverless functions, and multiple external dependencies originating from public repositories. Each new component introduces additional interfaces, transitive dependencies, and internal states whose manual analysis becomes impractical. Widely recognized reports indicate that the exploitation of vulnerabilities in web ap
Read paper →AppSecA Formal and Scalable Architecture for Continuous AppSec: Integration of Model-Guided Static Analysis, Adaptive Dynamic Instrumentation, and Policy Verification with Quantifiable Guarantees
DynamicInstrumentation DynamicInstrumentation --> RuntimeMonitoring RuntimeMonitoring --> PolicyViolation RuntimeMonitoring --> SecureOperation PolicyViolation --> Remediation Remediation --> CodeCommit ``` This model ensures that no artifact enters runtime execution without satisfying both static policy constraints and dynamic instrumentation verification. Formal Safety Property We define a core safety property: $$ \forall t \in ExecutionTrace, \neg Exploit(t) $$ where $ExecutionTrace$ represents the ordered sequence of runtime events captured by instrumentation. The
Read paper →AppSecA Formal and Scalable Architecture for Continuous AppSec Based on Hybrid Analysis, MITRE ATT&CK–Oriented Threat Modeling, and Quantitative Risk Prioritization
load_transition_model("auth_model.json") property_spec = "G(!Authenticated -> !ResourceAccess)" result = modelcheck(model, property_spec) if not result.safe: print("Counterexample found:", result.trace) ``` Verification results are incorporated into the risk prioritization framework. A vulnerability discovered in formally verified components receives lower exploit probability due to the increased assurance level. Quantitative Verification Confidence We define verification confidence $C_v$ as a function of model coverage and proof completeness: $$ C_v = \alpha \cdot Cov_{model} + \bet
Read paper →AppSecA Formally Grounded, Risk-Adaptive Continuous Application Security Framework for Cloud-Native Systems: Architecture, Algorithms, and Large-Scale Empirical Evaluation
1. Introduction Modern application ecosystems differ fundamentally from the monolithic architectures that dominated enterprise computing two decades ago. Contemporary systems are cloud-native, microservice-oriented, API-driven, and continuously deployed. This architectural transformation has expanded the attack surface, redistributed trust boundaries, and introduced complex interdependencies among source code, third-party dependencies, container images, infrastructure configurations, and runtime environments. Application Security (AppSec), historically centered on code-level vulnerability d
Read paper →