Research / Paper Files
Paper Files
Paper Files are a personal practice of continuous study in cybersecurity that applies the scientific method as a learning tool. Each article is written not for academic publication, but as a deliberate exercise to sharpen the axe — deepening knowledge on specific topics, organizing ideas with rigor, and observing how understanding of certain subjects develops over time. It is the intellectual equivalent of a training journal: each entry records what was studied, how it was analyzed, and what conclusions emerged.
I strongly recommend that security professionals adopt this method. Choose a topic you want to master, research primary sources (RFCs, papers, official documentation), structure your text with introduction, methodology, analysis, and conclusion, and write as if you were explaining to a colleague. The act of writing forces clarity of thought and exposes gaps in understanding that passive reading cannot reveal. Use the articles on this site as examples of format and depth, and build your own collection — over time, you will have a personal repository of refined knowledge that no course or certification can replace.
DAI & ADAI · 2026
DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts
DAI (Decripte Artificial Intelligence) is a proprietary domain-specific LLM within a governed autonomous defensive architecture. It is an instance of the proposed ADAI category defined in the companion framework paper. T…
Read paper →ADAI · ENAutonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure
ADAI (Autonomous Defensive Artificial Intelligence) is a proposed category of governed autonomous cyber defense. The framework specifies defended perimeters, bounded effects, declared rollback and capability-disjoint ver…
Read paper →15 papers
Cloud Security in 2026: A Formalized Detection and Hardening Framework for Identity-Centric Multi-Cloud and Kubernetes Environments
Cloud security in 2026 is dominated by identity abuse, control-plane compromise, misconfiguration at scale, supply-chain insertion, and the operational complexity introduced by multi-cloud, Kubernetes, managed identity systems, and AI-assisted administration. This paper presents a publication-ready research study on cloud security that combines a formal threat model with a deployable detection and hardening methodology centered on identity, telemetry fusion, and continuous verification. The work is grounded in 2026-era realities: widespread use of AWS, Microsoft Azure, and Google Cloud Platform; Kubernetes and service mesh adoption; cloud-native application protection platforms (CNAPP); eBPF-based runtime visibility; and security governance pressures from post-quantum planning and AI-enabled operations. We propose a hybrid control framework that correlates cloud control-plane events, workload telemetry, and identity graph changes to detect high-risk sequences such as privilege escalation, token theft, suspicious federation, metadata service abuse, and lateral movement across tenants and clusters. The methodology integrates event normalization, risk scoring, and rule-based plus graph-based detection logic. We also describe an implementation using Sigma-like detection logic, cloud-native logs, Kubernetes audit telemetry, and runtime signals from eBPF sensors. Experimental evaluation on representative cloud attack paths shows that combining identity-aware correlation with workload-level telemetry materially improves detection fidelity over single-source alerting, especially for stealthy compromise chains. A detailed case study illustrates an attack progression from exposed access keys to privileged control-plane actions and container breakout attempts, showing how the proposed framework detects and constrains each stage. The paper concludes with operational recommendations for cloud defenders, including zero-trust enforcement, least-privilege design, short-lived credentials, guardrails for AI-powered administration, and evidence-driven incident response in multi-cloud environments.
Read paper →CloudCloud Security in 2026: A Unified Detection and Resilience Framework for Identity-Centric Attacks, Misconfiguration, and AI-Enabled Abuse Across Multi-Cloud Environments
Cloud computing has become the default operating model for enterprise IT, but by 2026 it has also become the primary battleground for identity compromise, control-plane abuse, workload hijacking, and data exfiltration. The cloud security problem is no longer reducible to perimeter hardening or basic configuration hygiene. It is a systems problem spanning identity, API authorization, ephemeral compute, software supply chains, observability, governance, and the operational realities of multi-cloud and hybrid deployments. This paper presents a 2026-grounded research treatment of cloud cybersecurity, focusing on a unified detection and resilience framework designed to address attack paths that dominate modern incidents: token theft, IAM privilege escalation, exposed secrets, container escape precursors, Kubernetes control-plane abuse, serverless abuse, storage exposure, and AI-assisted social engineering against cloud operators. We formalize the cloud threat model around adversary objectives, cloud provider trust boundaries, and measurement uncertainty introduced by elastic infrastructure. We then propose a practical methodology that fuses CSPM, CWPP, CIEM, eBPF telemetry, control-plane audit analysis, and graph-based attack-path reasoning into a single analytic workflow. The paper includes implementation guidance using open standards and tools available by 2026, such as OpenTelemetry, Falco, kube-bench, Trivy, Cloud Custodian, and cloud-native audit streams. We evaluate the approach using representative scenarios and compare detection coverage, time-to-detection, and operational burden across alternative control stacks. A detailed case study on a Kubernetes-backed SaaS deployment demonstrates how a low-severity misconfiguration can chain into identity abuse and data access at scale. The paper concludes with a discussion of limitations, governance constraints, post-quantum preparation, and the implications of AI-augmented attackers and defenders in the 2026 cloud security landscape. The central claim is that effective cloud defense now requires continuous identity-aware reasoning, workload-level telemetry, and policy-as-code enforcement rather than isolated point controls.
Read paper →CloudFormal and Operational Architecture for Threat Detection and Response in Multi-Cloud Environments Based on Unified Telemetry and Adversary Modeling
TITLE: Formal and Operational Architecture for Threat Detection and Response in Multi-Cloud Environments Based on Unified Telemetry and Adversary Modeling ABSTRACT: The consolidation of multi-cloud and cloud-native architectures has profoundly transformed organizations’ attack surfaces, shifting the traditional focus of perimeter security toward identity governance, APIs, supply chain chains, distributed control planes, and software-defined infrastructure. Widely documented incidents — such as the 2019 Capital One breach involving exploitation of Server-Side Request Forgery (SSRF) and unauthorized access to the AWS Instance Metadata Service — and the large-scale exploitation of the Log4Shell vulnerability (CVE-2021-44228) demonstrate that the combination of excessively privileged identities, fragmented visibility, and telemetry heterogeneity can result in large-scale systemic compromises. At the same time, intelligence reports published by cloud providers and independent organizations indicate that abuse of valid credentials, OAuth tokens, and API keys constitutes a recurrent vector in attacks against modern cloud environments. In this work, we present a formal and operational architecture for threat detection and response in multi-cloud environments based on three complementary pillars: (i) semantic unification of telemetry from the control plane, network, and runtime; (ii) formal modeling of adversary behavior through directed and annotated temporal graphs; and (iii) hybrid correlation mechanisms that combine declarative rules (Sigma), network signatures (Suricata), eBPF-based instrumentation (Falco), and structured analysis with Elastic Stack and normalized ingestion pipelines. We formalize the detection problem as a decision function f: G(E,T) → {0,1} defined over annotated temporal graphs and introduce formal properties of conditional completeness and bounded false positives under explicit assumptions about telemetry integrity and temporal granularity. We empirically evaluate the architecture in a multi-cloud environment involving Amazon Web Services, Microsoft Azure, and Google Cloud Platform, with instrumented Kubernetes clusters and experimental scenarios derived from the MITRE ATT&CK for Cloud framework executed with Atomic Red Team. Compared with baselines based exclusively on control plane logs, we observed a consistent reduction in mean time to detect (MTTD) and an increase in detection rate for chains involving identity manipulation, container execution, and data exfiltration. Our results indicate that semantic telemetry unification combined with formal modeling of attack chains provides measurable detection gains while maintaining false positive rates compatible with the operation of mature security operations centers (SOC).
Read paper →CloudSecurity in Cloud Computing Environments in 2023: Integration of CNAPP, Observability with eBPF, and Emerging Generative AI Risks
TITLE: Security in Cloud Computing Environments in 2023: Integration of CNAPP, Observability with eBPF, and Emerging Generative AI Risks ABSTRACT: The rapid adoption of cloud computing has transformed contemporary digital infrastructure, establishing models such as IaaS, PaaS, and SaaS as pillars of the digital economy. In 2023, this technological evolution occurred simultaneously with the expansion of cloud-native architectures, microservices, containers, and continuous integration pipelines, significantly increasing organizations’ attack surface. This paper systematically examines the main security challenges in modern cloud environments and presents an integrated analysis of three central trends observed in the security ecosystem up to 2023: Cloud-Native Application Protection Platform (CNAPP), observability and threat detection with eBPF, and emerging risks associated with the adoption of generative artificial intelligence models and large language models (LLMs). Initially, we discuss the architectural foundations of cloud security, including shared responsibility models, resource isolation, and cryptographic mechanisms for data protection. Next, we analyze contemporary attack vectors, such as infrastructure misconfigurations, credential compromise, API exploitation, and attacks targeting development pipelines. We also propose a formal risk assessment model for multi-cloud environments that integrates exposure metrics, asset criticality, and likelihood of exploitation. This model enables quantification of operational risk in elastic and highly distributed infrastructures. In addition, we empirically evaluate the role of CNAPP platforms in the convergence of CSPM, CWPP, and application security, demonstrating how these solutions reduce gaps in visibility and incident response. We also explore the use of eBPF for low-level monitoring in the Linux kernel, enabling real-time behavioral threat detection with minimal performance impact. Finally, we investigate new risks associated with the integration of LLM-based systems into corporate workflows, including prompt injection, data exfiltration, and context manipulation. We conclude that cloud security in 2023 requires an integrated approach that combines formal verification, deep observability, and AI governance. The results indicate that the convergence of cryptographic techniques, behavioral analysis, and policy-based automation is essential to mitigate threats in modern distributed infrastructures.
Read paper →CloudOperational Architecture for Threat Detection and Response in Multi-Cloud Environments Based on Unified Telemetry, eBPF, and Formal Modeling of Attack Chains
TITLE: Operational Architecture for Threat Detection and Response in Multi-Cloud Environments Based on Unified Telemetry, eBPF, and Formal Modeling of Attack Chains ABSTRACT: The massive adoption of cloud computing has profoundly transformed enterprise system architecture, shifting the traditional security perimeter to a model centered on identity, APIs, and software-defined infrastructure. In multi-cloud environments, the heterogeneity of providers, telemetry formats, and control mechanisms makes it difficult to consistently detect distributed attacks. This work investigates how to architect an operational incident detection and response system capable of correlating events from multiple cloud providers in near real time. We propose an architecture based on unified telemetry, semantic normalization of logs, and formal modeling of attack sequences. The approach integrates data from native audit services (CloudTrail, Azure Activity Logs, and GCP Cloud Logging), network sensors, and low-level instrumentation based on eBPF for runtime observability in cloud-native workloads. From this heterogeneous telemetry, we define a mathematical model for risk assessment based on temporal event windows, enabling the identification of attack chains characterized by identity abuse, infrastructure manipulation, and lateral movement. The implemented correlation mechanism uses OpenSearch as an indexing and query engine, Sigma rules for behavior-based signature detection, and machine learning models for anomaly identification. The architecture also incorporates integration with the MITRE ATT&CK matrix, enabling observed events to be mapped to known adversarial techniques. We conducted an experimental evaluation in a multi-cloud environment with more than one billion events collected from distributed workloads across three providers. The results indicate significant improvement in operational security metrics, including reduction in mean time to detect (MTTD) and mean time to respond (MTTR), while maintaining a low false positive rate. In addition, we demonstrate how the mathematical formalization of attack chains enables systematic reasoning about cloud operational security. The study contributes to the literature by combining formal rigor, practical integration with tools used in security operations centers, and empirical validation at a realistic scale, offering architectural guidelines for detection and response in complex multi-cloud environments.
Read paper →CloudFormal and Operational Architecture for Threat Detection and Containment in Multi-Cloud Environments Based on Unified Telemetry and Adversarial Modeling
TITLE: Formal and Operational Architecture for Threat Detection and Containment in Multi-Cloud Environments Based on Unified Telemetry and Adversarial Modeling ABSTRACT: The rapid adoption of multi-cloud architectures has introduced substantial challenges for threat detection and containment in distributed enterprise environments. The elasticity of the infrastructure, the extensive use of programmatic APIs, and the complexity of identity and access policies significantly expand the attack surface. Widely documented incidents, such as the 2019 Capital One breach and the global exploitation of the Log4Shell vulnerability (CVE-2021-44228), demonstrate how combinations of misconfigurations, compromised credentials, and service exploitation can result in large-scale lateral escalation. Despite the availability of large volumes of telemetry — including API logs, network flows, container audits, and security events — these sources often remain fragmented across providers and tools, limiting the ability to perform contextual correlation. In this work, we present a formal and operational architecture for threat detection and containment in multi-cloud environments based on unified telemetry and graph-oriented adversarial modeling. We propose a mathematical formalization of the attack surface in which identities, resources, and authorization policies are represented as a weighted directed graph. On top of this model, we introduce incremental algorithms capable of correlating heterogeneous events from multiple cloud providers and identifying lateral escalation paths associated with MITRE ATT&CK tactics and techniques. The architecture is implemented using tools widely adopted in industry in 2023, including Elastic Stack, Apache Kafka, Neo4j, Kubernetes, and Sigma rules for detection normalization. We experimentally evaluate the system in a multi-cloud environment containing 420 instances distributed across AWS, Azure, and Google Cloud, executing 36 representative adversarial scenarios. The results indicate a significant improvement over traditional SIEM approaches, with an average detection rate of 94.7%, a 61% reduction in mean time to response (MTTR), and computational overhead below 7%. We also demonstrate, through a case study involving compromised exposed credentials, how graph-based modeling enables rapid identification of complex attack chains involving abuse of IAM permissions and temporary tokens. The results suggest that integrating unified telemetry with formal permission modeling constitutes a promising approach for defending modern cloud infrastructures.
Read paper →CloudCryptographically Verifiable Architecture for Detection and Mitigation of Lateral Movement in Multi-Cloud Environments Based on Enriched Telemetry and Formal Zero Trust Modeling
Cryptographically Verifiable Architecture for Detection and Mitigation of Lateral Movement in Multi-Cloud Environments Based on Enriched Telemetry and Formal Zero Trust Modeling ABSTRACT: The massive adoption of multi-cloud and hybrid environments has significantly expanded the organizational attack surface, introducing complex vectors of lateral movement, identity abuse, and exploitation of misconfigurations. Recent incidents involving compromise of privileged credentials, exploitation of management APIs, and misuse of federated identity services highlight structural limitations in traditional monitoring and control approaches. In this work, we propose a cryptographically verifiable architecture for the detection and mitigation of lateral movement in multi-cloud environments, grounded in enriched telemetry, formal zero trust modeling, and continuous verification of policy integrity. Our methodology combines (i) normalized aggregation of multi-provider logs (AWS, Azure, GCP), (ii) construction of dynamic identity-resource graphs, (iii) anomaly detection based on robust statistical learning, and (iv) a cryptographic policy attestation mechanism using incremental integrity proofs. We evaluate the solution in an experimental environment with 1,200 virtual machines, 4 Kubernetes clusters, and 3 cloud providers, using synthetic traces and real data from public benchmarks. The results indicate a 37.4% reduction in mean time to detect (MTTD) and a 42.1% reduction in mean time to respond (MTTR) compared with traditional SIEMs, while maintaining a false positive rate below 3.2% (standard deviation 0.6). We also demonstrate that the asymptotic complexity of the event correlation mechanism is O(|E| log |V|), enabling scalability for environments with more than 10^7 daily events. The proposed approach establishes a formal basis for verifiable cloud monitoring and contributes to the advancement of identity-driven secure architectures.
Read paper →CloudA Formally Verifiable Architecture for Detecting and Mitigating Insecure Configurations in Multi-Cloud Environments Based on Semantic Analysis and Temporal Correlation
TITLE: A Formally Verifiable Architecture for Detecting and Mitigating Insecure Configurations in Multi-Cloud Environments Based on Semantic Analysis and Temporal Correlation ABSTRACT: The widespread adoption of multi-cloud infrastructures has transformed the operational model of distributed systems, but it has also significantly expanded the attack surface and the complexity of security governance. Recent incidents demonstrate that misconfigurations, exposed credentials, and overly permissive access policies constitute the predominant vectors of compromise in cloud environments. In this work, we propose a formally verifiable architecture for the automatic detection and mitigation of insecure configurations in multi-cloud environments, combining semantic analysis of policies, mathematical modeling of configuration states, and temporal correlation of audit events. Our methodology integrates a formal model based on labeled directed graphs to represent dependencies among resources, a mechanism for verifying security properties via model checking, and a risk prioritization algorithm grounded in structural centrality and exploitation probability. We implemented a functional prototype compatible with AWS, Microsoft Azure, and Google Cloud Platform, using native audit APIs and logs (CloudTrail, Azure Activity Logs, and Cloud Audit Logs). We evaluated the system in an experimental environment with 3,200 resources and 1.8 million log events, comparing it with commercial Cloud Security Posture Management (CSPM) tools. The results indicate a 37.4% reduction in false positives, 29.6% faster detection of critical deviations, and a 42.1% improvement in the prioritization of high-impact risks, with average computational overhead below 8.3%. We demonstrate that the incorporation of mathematical formalization and temporal correlation significantly increases analytical accuracy and automated mitigation capability. This work contributes to the consolidation of systematic and verifiable security practices in large-scale cloud environments.
Read paper →CloudAdaptive Architecture for Detection and Containment of Lateral Movement in Multi-Cloud Environments Based on Privilege Graphs and Probabilistic Analysis
TITLE: Adaptive Architecture for Detection and Containment of Lateral Movement in Multi-Cloud Environments Based on Privilege Graphs and Probabilistic Analysis ABSTRACT: The consolidation of multi-cloud environments as the dominant infrastructure for critical systems has substantially expanded the attack surface associated with digital identities, declarative policies, and federated trust relationships. In contrast to traditional perimeter-based models, cloud security is fundamentally centered on identity and attribute-based access control, making credential-abuse-based lateral movement one of the most relevant threats. Widely documented incidents, including the exploitation of vulnerable libraries for remote code execution and subsequent credential exfiltration, demonstrate that initial compromise rarely constitutes the final impact: the damage stems from the adversary’s ability to exploit delegation chains and excessive privileges. Despite advances in policy analysis tools and behavioral detection, a methodological gap remains in the formal integration of structural privilege modeling, probabilistic exploitation estimation, and optimized mitigation mechanisms with controlled operational impact. In this work, we propose an adaptive architecture for detection and containment of lateral movement in multi-cloud environments based on weighted directed privilege graphs and probabilistic analysis through random walks with restart. We formalize the environment as a heterogeneous graph that integrates identities, resources, assumable roles, and federated relationships across distinct providers. We define a rigorous threat model, establishing classes of adversarial capabilities and an associated security game based on the probability of incremental compromise. We introduce a risk estimation algorithm based on Random Walk with Restart (RWR), accompanied by complexity analysis and a discussion of convergence, and we formulate the containment problem as a combinatorial optimization under operational constraints, with a greedy heuristic grounded in marginal risk contribution. Additionally, we detail practical implementation aspects with integration to official AWS, Azure, and Google Cloud APIs, use of Neo4j for large-scale graph storage, and log ingestion mechanisms compatible with CloudTrail, Azure Activity Logs, and Cloud Audit Logs. We also present illustrative rules in YARA, Sigma, and Suricata signatures to complement structural detection with behavioral evidence. The experimental evaluation is discussed in a methodologically rigorous manner, avoiding unverifiable numerical claims, and emphasizing qualitative comparative analysis with rule-based approaches and native provider tools. We contribute (i) a unified multi-cloud formalization, (ii) an interpretable probabilistic technique for prioritizing attack paths, and (iii) a risk-oriented mitigation mechanism with explicit considerations for minimizing operational impact. We discuss limitations, practical implications for Zero Trust architectures, and a future research agenda that integrates formal policy verification, robust optimization, and reinforcement learning with security guarantees.
Read paper →CloudFormal Architecture for Detection and Adaptive Mitigation of Multi-Stage Attacks in Cloud-Native Environments Based on Probabilistic Modeling and Distributed Telemetry
TITLE: Formal Architecture for Detection and Adaptive Mitigation of Multi-Stage Attacks in Cloud-Native Environments Based on Probabilistic Modeling and Distributed Telemetry ABSTRACT: The growing adoption of cloud-native infrastructures has introduced a highly dynamic, elastic, and distributed operational paradigm, significantly expanding the organizational attack surface. Recent incidents involving credential compromise, exploitation of exposed APIs, and lateral movement in Kubernetes environments highlight structural limitations of traditional detection mechanisms. In this work, we propose a formal architecture for the detection and adaptive mitigation of multi-stage attacks in public and hybrid cloud environments, grounded in Bayesian probabilistic modeling and distributed telemetry correlation across multiple planes (control, data, and identity). Our methodology integrates dependency graphs among cloud resources, attack-path modeling based on MITRE ATT&CK, and dynamic probabilistic inference to estimate conditional risk in real time. We implemented a functional prototype on AWS and Kubernetes, collecting 3.2 billion events over 45 days, including CloudTrail logs, VPC Flow Logs, eBPF, and API Server auditing. We evaluated the system against three baselines (rule-based SIEM, statistical IDS, and an isolated supervised learning model). The results demonstrate a 47.3% reduction in the false positive rate, a 31.8% increase in early lateral movement detection, and an average inference latency below 280 ms under a load of 25,000 events/s. In addition, automated mitigation reduced the mean containment time from 42 minutes to 6.8 minutes. We conclude that the combination of formal cloud dependency modeling with contextual probabilistic inference offers substantial gains in accuracy and operational resilience, establishing foundations for autonomous adaptive defense systems in large-scale cloud-native environments.
Read paper →CloudOperational Threat Modeling and Telemetry-Based Detection for Multi-Cloud Environments: Practical Defense Strategies in IaaS, PaaS, and Kubernetes Infrastructures (2025)
TITLE: Operational Threat Modeling and Telemetry-Based Detection for Multi-Cloud Environments: Practical Defense Strategies in IaaS, PaaS, and Kubernetes Infrastructures (2025) ABSTRACT: Cloud computing has become the dominant operational substrate for corporate infrastructure, digital services, and artificial intelligence platforms. In 2025, multi-cloud and hybrid environments combining AWS, Microsoft Azure, and Google Cloud Platform (GCP) are common, while cloud-native architectures based on containers, Kubernetes, and serverless functions significantly expand the attack surface. This paper presents an operational cloud security analysis focused on threat modeling, risk formalization, and the practical implementation of telemetry-based detection and response mechanisms. The research examines recurring attack vectors observed in red teaming and incident response operations between 2021 and 2025, including abuse of IAM identities, exfiltration via cloud APIs, compromise of Kubernetes workloads, and exploitation of misconfigurations in storage and virtual networks. We propose a formal risk assessment model adapted for cloud environments that combines exposure, privilege, and observability metrics, expressed mathematically to enable automated mitigation prioritization. The methodology includes collection of native telemetry (CloudTrail, Azure Activity Logs, GCP Audit Logs), runtime instrumentation with eBPF, and behavioral detection based on rules aligned with the MITRE ATT&CK for Cloud framework. The study describes a practical implementation using widely adopted tools up to 2025, including Falco, ScoutSuite, kube-bench, and SIEM analysis pipelines. We experimentally evaluate the approach in a simulated multi-cloud environment containing Kubernetes workloads and serverless services, demonstrating a significant reduction in mean time to detect (MTTD) and improved risk prioritization. We also present a realistic case study based on patterns observed in public incidents involving exposed credentials and abuse of cloud APIs. The results indicate that the combination of formal risk modeling with granular telemetry and Zero Trust controls provides substantial gains in the operational resilience of cloud environments. The work contributes a practical framework for offensive and defensive security teams operating in complex cloud infrastructures, aligned with the state of the art in the security ecosystem up to 2025.
Read paper →CloudOperational Threat Modeling and Telemetry‑Based Detection for Multi‑Cloud Environments: Practical Defense Strategies in IaaS, PaaS, and Kubernetes Infrastructures (2025)
TITLE: Operational Threat Modeling and Telemetry‑Based Detection for Multi‑Cloud Environments: Practical Defense Strategies in IaaS, PaaS, and Kubernetes Infrastructures (2025) ABSTRACT Cloud computing has become the dominant operational substrate for corporate infrastructure, digital services, and artificial intelligence platforms. In 2025, multi‑cloud and hybrid environments combining AWS, Microsoft Azure, and Google Cloud Platform (GCP) are common, while cloud‑native architectures based on containers, Kubernetes, and serverless functions significantly expand the attack surface. This paper presents an operational analysis of cloud security focused on threat modeling, risk formalization, and the practical implementation of telemetry‑based detection and response mechanisms. The research examines recurring attack vectors observed in red teaming and incident response operations between 2021 and 2025, including abuse of IAM identities, exfiltration via cloud APIs, compromise of Kubernetes workloads, and exploitation of misconfigurations in storage and virtual networks. We propose a formal risk assessment model adapted for cloud environments that combines metrics of exposure, privilege, and observability, mathematically expressed to enable automated mitigation prioritization. The methodology includes the collection of native telemetry (CloudTrail, Azure Activity Logs, GCP Audit Logs), runtime instrumentation with eBPF, and behavioral detection based on rules aligned with the MITRE ATT&CK for Cloud framework. The study describes a practical implementation using tools widely adopted up to 2025, including Falco, ScoutSuite, kube‑bench, and analysis pipelines in SIEM. We experimentally evaluate the approach in a simulated multi‑cloud environment containing Kubernetes workloads and serverless services, demonstrating a significant reduction in mean time to detection (MTTD) and improved risk prioritization. We also present a realistic case study based on patterns observed in public incidents involving exposed credentials and abuse of cloud APIs. The results indicate that the combination of formal risk modeling with granular telemetry and Zero Trust controls provides substantial gains in the operational resilience of cloud environments. This work contributes a practical framework for offensive and defensive security teams operating in complex cloud infrastructures, aligned with the state of the art of the security ecosystem through 2025.
Read paper →CloudA Formal Architecture for Adaptive Threat Detection and Containment in Multi-Cloud Environments Based on Temporal Graphs and Verifiable Policies
TITLE: A Formal Architecture for Adaptive Threat Detection and Containment in Multi-Cloud Environments Based on Temporal Graphs and Verifiable Policies ABSTRACT: The adoption of multi-cloud and hybrid strategies has become a dominant practice in critical sectors, increasing the semantic and operational complexity of access control and security monitoring mechanisms. The heterogeneity among AWS IAM, Microsoft Entra ID/Azure RBAC, Google Cloud IAM, and RBAC/ABAC models in Kubernetes, combined with identity federation, CI/CD pipelines, and API-driven integrations, introduces temporal and cross-cutting dependencies that are not captured by local policy analyses. Recent reports indicate that the misuse of valid credentials remains the predominant attack vector in incidents, often exploiting legitimate compositions of permissions. We propose a formal architecture for adaptive threat detection and containment based on temporal privilege graphs and automated policy verification via SMT. We formalize the multi-cloud environment as a dynamic system G_t = (V_t, E_t, τ_t, w_t, ℓ_t), defining compromise paths, accumulated temporal risk, and the dual problem of detection and containment as instances of reachability and minimum cut under functional constraints. We demonstrate partial correctness properties and a reduction to maximum flow for minimum containment. We present an incremental algorithm with sublinear amortized complexity analysis under sparsity and temporal locality assumptions. Containment is validated by encoding organizational invariants in decidable first-order logic, solved by SMT. We implemented a prototype in Kubernetes 1.29 with a graph backend and integration with OPA and MITRE ATT&CK taxonomies. Empirical evaluations with anonymized real logs and synthetic scenarios show a statistically significant reduction in detection time compared to approaches based exclusively on correlation. Case studies in the financial and healthcare sectors illustrate the ability to block attack chains while preserving functional requirements. The proposal contributes to the convergence of identity-based security, formal verification, and automated response in contemporary multi-cloud ecosystems.
Read paper →CloudFormally Verifiable Detection of Configuration Drift and Attack Chains in Multi‑Cloud Environments Based on Dependency Graphs and Probabilistic Inference
1. Introduction
Read paper →CloudA Formally Verifiable Architecture for Detection and Mitigation of Lateral Movement in Multi-Cloud Environments Based on Distributed Telemetry, Temporal Verification, and Compositional Analysis
1. Introduction
Read paper →