Research / Paper Files
Paper Files
Paper Files are a personal practice of continuous study in cybersecurity that applies the scientific method as a learning tool. Each article is written not for academic publication, but as a deliberate exercise to sharpen the axe — deepening knowledge on specific topics, organizing ideas with rigor, and observing how understanding of certain subjects develops over time. It is the intellectual equivalent of a training journal: each entry records what was studied, how it was analyzed, and what conclusions emerged.
I strongly recommend that security professionals adopt this method. Choose a topic you want to master, research primary sources (RFCs, papers, official documentation), structure your text with introduction, methodology, analysis, and conclusion, and write as if you were explaining to a colleague. The act of writing forces clarity of thought and exposes gaps in understanding that passive reading cannot reveal. Use the articles on this site as examples of format and depth, and build your own collection — over time, you will have a personal repository of refined knowledge that no course or certification can replace.
DAI & ADAI · 2026
DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts
DAI (Decripte Artificial Intelligence) is a proprietary domain-specific LLM within a governed autonomous defensive architecture. It is an instance of the proposed ADAI category defined in the companion framework paper. T…
Read paper →ADAI · ENAutonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure
ADAI (Autonomous Defensive Artificial Intelligence) is a proposed category of governed autonomous cyber defense. The framework specifies defended perimeters, bounded effects, declared rollback and capability-disjoint ver…
Read paper →28 papers
DFIR in 2026: A Unified, Evidence-Centric Methodology for Cloud-Native, Endpoint, Identity, and AI-Assisted Incident Response
Digital Forensics and Incident Response (DFIR) has evolved from a predominantly endpoint-centered discipline into a multi-domain operational capability spanning cloud control planes, identity providers, SaaS platforms, containerized workloads, mobile devices, and AI-assisted collaboration environments. By 2026, defenders face adversaries who routinely exploit signed malware, identity abuse, living-off-the-land binaries, cloud API token theft, and generative AI-enabled social engineering. This paper presents an evidence-centric DFIR methodology designed for contemporary enterprise environments in which telemetry is distributed, ephemeral, partially encrypted, and often retained under policy constraints rather than technical limitations. The proposed approach unifies triage, acquisition, normalization, correlation, reconstruction, and reporting into a single chain-of-custody-aware workflow that preserves evidentiary integrity while supporting rapid operational decision-making. We formalize the DFIR problem as a constrained inference task over heterogeneous event streams and define measurable objectives for latency, completeness, fidelity, and attribution confidence. The paper also introduces an implementation blueprint that combines modern forensic tooling, eBPF-based runtime visibility, cloud audit-log ingestion, Sigma/YARA analytics, and graph-based correlation. An experimental evaluation using representative enterprise datasets demonstrates improved time-to-scoping, higher artifact recovery rates, and stronger timeline reconstruction than traditional siloed workflows. A detailed case study on a hybrid intrusion involving OAuth token theft, endpoint persistence, and cloud data staging illustrates how the methodology performs in practice. Finally, we discuss emerging challenges including AI-generated phishing, post-quantum transition evidence, and legal/ethical constraints around privacy-preserving collection. The result is a practical, publication-ready DFIR framework for 2026 and beyond.
Read paper →DFIRFormal and Operational Architecture for Digital Incident Response with Cryptographic Guarantees and Verifiable Validation in Modern Infrastructures
TITLE: Formal and Operational Architecture for Digital Incident Response with Cryptographic Guarantees and Verifiable Validation in Modern Infrastructures ABSTRACT: Formal and Operational Architecture for Digital Incident Response with Cryptographic Guarantees and Verifiable Validation in Modern Infrastructures Abstract: Formal and Operational Architecture for Digital Incident Response with Cryptographic Guarantees and Verifiable Validation in Modern Infrastructures Abstract: The growing complexity of contemporary digital ecosystems, intensified by the widespread adoption of cloud computing, microservice architectures, artificial intelligence, and distributed infrastructures, demands more rigorous approaches to Digital Forensics and Incident Response (DFIR). Traditional incident response frameworks focus predominantly on operational procedures and organizational governance, leaving important gaps in the mathematical formalization of evidence integrity and in the verifiability of the chain of custody. In this work, we propose an integrated architecture that combines the foundations of applied cryptography, formal verification methods, and operational mechanisms for telemetry collection and correlation for incident response in enterprise environments, critical infrastructures, and cloud platforms. We formalize a DFIR-specific threat model based on adversarial capability classes and define security games that capture properties of integrity, authenticity, and immutability of the evidence chain. We introduce a cryptographic chaining mechanism based on collision-resistant hash functions and Merkle trees, combined with modern digital signatures and immutable storage. In addition, we present a forensic correlation algorithm modeled as a directed acyclic graph, with complexity analysis and demonstrable correctness properties. The architecture is designed for integration with widely used tools in contemporary security operations, including YARA, Sigma, Suricata, SIEM/SOAR telemetry pipelines, and observability mechanisms based on eBPF in Linux environments. We conducted a qualitative experimental evaluation comparing the proposed approach with traditional incident response workflows, examining ingestion latency, computational overhead, and resistance to adversarial tampering. Two case studies—one in a digitized hospital environment and another in an industrial ICS/SCADA network—demonstrate the applicability of the model in domains with stringent regulatory and operational constraints. We conclude that the systematic incorporation of cryptographic guarantees and formal specifications into DFIR practice significantly increases evidentiary reliability and the auditability of investigations, at the cost of moderate computational overhead and greater operational complexity. The work contributes to the convergence of applied cryptography, formal verification, and operational security engineering, aligning with the needs of contemporary cybersecurity in 2024.
Read paper →DFIREvidence-Driven Architecture for High-Fidelity DFIR: Multilayer Correlation, Mathematical Formalization, and Empirical Evaluation in Enterprise Environments
TITLE: Evidence-Driven Architecture for High-Fidelity DFIR: Multilayer Correlation, Mathematical Formalization, and Empirical Evaluation in Enterprise Environments ABSTRACT: Evidence-Driven Architecture for High-Fidelity DFIR: Multilayer Correlation, Mathematical Formalization, and Empirical Evaluation in Enterprise Environments ABSTRACT: Evidence-Driven Architecture for High-Fidelity DFIR: Multilayer Correlation, Mathematical Formalization, and Empirical Evaluation in Enterprise Environments ABSTRACT: The growing sophistication of corporate cyberattacks requires Digital Forensics and Incident Response (DFIR) methodologies capable of reconstructing complex attack chains from multiple heterogeneous sources of evidence. Modern enterprise environments generate large volumes of telemetry from endpoints, networks, cloud services, and security platforms, including EDR, SIEM, and observability tools. However, operational integration and rigorous temporal correlation of these evidences remain significant challenges. This paper proposes an evidence-driven architecture for high-fidelity digital forensic investigation, based on formal modeling using verifiable temporal graphs. The model introduces a mathematical structure that represents digital artifacts, causal relationships, and adversary technique labels according to the MITRE ATT&CK framework, while preserving cryptographic integrity and temporal consistency properties. The operational architecture integrates widely adopted industry tools, including Sysmon, Suricata, Auditd, Elastic Stack, Volatility 3, and YARA, as well as incident response orchestration mechanisms. We propose two main algorithms: EviGraph-Builder, responsible for building the forensic graph from normalized events, and CausalPath-Reconstruct, intended for probabilistic reconstruction of multistage attack chains. The experimental evaluation was conducted across 49 scenarios containing real incidents and controlled environments based on Atomic Red Team. The results demonstrate an average reduction of more than 50% in investigation time and a significant increase in the rate of correct correlation of adversary techniques when compared to traditional manual processes. In addition, we discuss operational implications for Security Operations Centers (SOC), temporal synchronization requirements, preservation of the chain of custody, and integration with modern cloud security platforms and hybrid environments. The results indicate that mathematical formalization combined with automated evidence correlation constitutes a significant advance for enterprise DFIR, contributing to faster, reproducible, and verifiable investigations.
Read paper →DFIREvidence-Oriented Architecture for High-Fidelity DFIR: Multilayer Correlation, Mathematical Formalization, and Empirical Evaluation in Corporate Environments
TITLE: Evidence-Oriented Architecture for High-Fidelity DFIR: Multilayer Correlation, Mathematical Formalization, and Empirical Evaluation in Corporate Environments ABSTRACT: The growing sophistication of corporate cyberattacks demands Digital Forensics and Incident Response (DFIR) methodologies capable of reconstructing complex attack chains from multiple heterogeneous sources of evidence. Modern corporate environments generate large volumes of telemetry from endpoints, networks, cloud services, and security platforms, including EDR, SIEM, and observability tools. However, operational integration and rigorous temporal correlation of this evidence remain significant challenges. This work proposes an evidence-oriented architecture for high-fidelity digital forensic investigation based on formal modeling using verifiable temporal graphs. The model introduces a mathematical structure that represents digital artifacts, causal relationships, and adversary technique labels according to the MITRE ATT&CK framework, while simultaneously preserving cryptographic integrity and temporal consistency properties. The operational architecture integrates widely adopted industry tools, including Sysmon, Suricata, Auditd, Elastic Stack, Volatility 3, and YARA, as well as incident response orchestration mechanisms. We propose two main algorithms: EviGraph-Builder, responsible for constructing the forensic graph from normalized events, and CausalPath-Reconstruct, intended for probabilistic reconstruction of multi-stage attack chains. The experimental evaluation was conducted across 49 scenarios containing real incidents and controlled environments based on Atomic Red Team. The results demonstrate an average reduction of more than 50% in investigation time and a significant increase in the correct correlation rate of adversary techniques when compared to traditional manual processes. Additionally, we discuss operational implications for Security Operations Centers (SOC), temporal synchronization requirements, chain-of-custody preservation, and integration with modern cloud security platforms and hybrid environments. The results indicate that mathematical formalization combined with automated evidence correlation constitutes a significant advance for corporate DFIR, contributing to faster, reproducible, and verifiable investigations.
Read paper →DFIRA Formally Grounded Architecture for Graph-Based DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction
TITLE: A Formally Grounded Architecture for Graph-Based DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction ABSTRACT: A Formally Grounded Architecture for Graph-Based DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction ABSTRACT: The increasing sophistication of modern cyber campaigns poses significant challenges to Digital Forensics and Incident Response (DFIR) practices. Contemporary enterprise environments generate massive volumes of telemetry across multiple layers—endpoints, networks, applications, and cloud infrastructures—making manual incident reconstruction practically unfeasible. Although monitoring systems and SIEM platforms provide event correlation mechanisms, such approaches often lack a formal basis for preserving causal relationships and temporal consistency among digital evidence. In this work, we present a formal architecture for DFIR based on temporal graphs enriched with probabilistic inference and cryptographic evidence integrity mechanisms. We propose a mathematical model that represents forensic events as typed vertices in a temporally consistent directed graph, enabling the capture of causal dependencies among processes, files, network connections, and identities. On top of this graph, we introduce the Attack Probabilistic Reconstruction (APR) algorithm, which uses Bayesian inference conditioned on tactical and technical patterns described in the MITRE ATT&CK framework to estimate the most likely sequence of adversary actions. In addition, we implement a cryptographic hash chaining mechanism that ensures the integrity and verifiability of evidence throughout the investigative pipeline. We experimentally evaluate the proposed architecture using three representative datasets: the DARPA Transparent Computing dataset, large-scale real enterprise logs, and synthetic Log4Shell exploitation scenarios. The results demonstrate substantial improvements in precision, recall, and attack chain reconstruction time compared with approaches based exclusively on heuristic correlation or isolated statistical detection. We observed an average reduction of 37.4% in investigative reconstruction time and a significant increase in the accuracy of attack chain inferences. We also discuss practical implications for integration with modern SIEM platforms, as well as limitations related to log quality and storage costs. We conclude that the combination of formal temporal-graph-based modeling, probabilistic inference, and cryptographic guarantees constitutes a promising foundation for scalable and verifiable DFIR systems in contemporary enterprise environments.
Read paper →DFIRA Formally Grounded Architecture for Graph-Oriented Temporal DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction
TITLE: A Formally Grounded Architecture for Graph-Oriented Temporal DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction ABSTRACT: A Formally Grounded Architecture for Graph-Oriented Temporal DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction ABSTRACT: The increasing sophistication of modern cyber campaigns imposes significant challenges on Digital Forensics and Incident Response (DFIR) practices. Contemporary enterprise environments generate massive volumes of telemetry from multiple layers—endpoints, networks, applications, and cloud infrastructures—making manual incident reconstruction practically unfeasible. Although monitoring systems and SIEM platforms provide event correlation mechanisms, such approaches often lack a formal foundation to preserve causal relationships and temporal consistency among digital evidence. In this work, we present a formal architecture for DFIR based on temporal graphs enriched with probabilistic inference and cryptographic evidence-integrity mechanisms. We propose a mathematical model that represents forensic events as typed vertices in a temporally consistent directed graph, enabling the capture of causal dependencies among processes, files, network connections, and identities. On this graph, we introduce the Attack Probabilistic Reconstruction (APR) algorithm, which uses Bayesian inference conditioned on tactical and technical patterns described in the MITRE ATT&CK framework to estimate the most likely sequence of adversary actions. Additionally, we implement a cryptographic hash-chaining mechanism that ensures the integrity and verifiability of evidence throughout the investigative pipeline. We experimentally evaluate the proposed architecture using three representative datasets: the DARPA Transparent Computing dataset, large-scale real-world corporate logs, and synthetic exploitation scenarios of the Log4Shell vulnerability. The results demonstrate substantial improvements in precision, recall, and attack-chain reconstruction time compared with approaches based exclusively on heuristic correlation or isolated statistical detection. We observed an average reduction of 37.4% in investigative reconstruction time and a significant increase in the accuracy of attack-chain inferences. We also discuss practical implications for integration with modern SIEM platforms, as well as limitations related to log quality and storage costs. We conclude that the combination of formal temporal-graph-based modeling, probabilistic inference, and cryptographic guarantees constitutes a promising foundation for scalable and verifiable DFIR systems in contemporary enterprise environments.
Read paper →DFIRA Temporal-Graph-Oriented Formal DFIR Infrastructure with Cryptographic Integrity Assurance and Probabilistic Attack-Chain Reconstruction Capability
TITLE: A Temporal-Graph-Oriented Formal DFIR Infrastructure with Cryptographic Integrity Assurance and Probabilistic Attack-Chain Reconstruction Capability ABSTRACT: A Temporal-Graph-Oriented Formal DFIR Infrastructure with Cryptographic Integrity Assurance and Probabilistic Attack-Chain Reconstruction Capability Abstract: Modern cyberattack activities are becoming increasingly complex, posing significant challenges to Digital Forensics and Incident Response (DFIR) practice. Contemporary enterprise environments generate massive telemetry data from multiple layers—endpoints, networks, applications, and cloud infrastructure—making manual incident reconstruction practically infeasible. Although monitoring systems and SIEM platforms provide event correlation mechanisms, such approaches often lack a formal foundation and struggle to preserve causal relationships and temporal consistency among digital evidence. This paper proposes a temporal-graph-based DFIR formal architecture, combined with probabilistic reasoning and cryptographic mechanisms for evidence integrity. We present a mathematical model that represents forensic events as typed vertices forming a temporally consistent directed graph, thereby capturing causal dependencies among processes, files, network connections, and identities. On top of this graph, we introduce a Probabilistic Attack Reconstruction (RPA) algorithm, which uses Bayesian inference conditioned on tactical and technical patterns described in the MITRE ATT&CK framework to estimate the adversary’s most likely sequence of actions. In addition, we implement a cryptographic hash-chain mechanism to ensure the integrity and verifiability of evidence throughout the investigation workflow. We experimentally evaluate the proposed architecture using three representative datasets: the DARPA Transparent Computing dataset, large-scale real-world enterprise logs, and a synthetic scenario targeting Log4Shell exploitation. The results show significant improvements over methods based solely on heuristic correlation or isolated statistical detection in metrics such as accuracy, recall, and attack-chain reconstruction time. We observed an average 37.4% reduction in investigation reconstruction time, while attack-chain inference precision improved substantially. We also discuss its practical implications for integration with modern SIEM platforms, as well as limitations related to log quality and storage costs. We conclude that the combination of temporal-graph formal modeling, probabilistic reasoning, and cryptographic assurance provides a promising foundation for scalable and verifiable DFIR systems in modern enterprise environments.
Read paper →DFIRA Formally Grounded Architecture for Graph-Based DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction
TITLE: A Formally Grounded Architecture for Graph-Based DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction ABSTRACT: A Formally Grounded Architecture for Graph-Based DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction ABSTRACT: The increasing sophistication of modern cyber campaigns imposes significant challenges on Digital Forensics and Incident Response (DFIR) practices. Contemporary enterprise environments generate massive volumes of telemetry across multiple layers—endpoints, networks, applications, and cloud infrastructures—making manual incident reconstruction practically infeasible. Although monitoring systems and SIEM platforms provide event correlation mechanisms, such approaches often lack a formal basis for preserving causal relationships and temporal consistency among digital evidence. In this work, we present a formal architecture for DFIR based on temporal graphs enriched with probabilistic inference and cryptographic evidence integrity mechanisms. We propose a mathematical model that represents forensic events as typed vertices in a temporally consistent directed graph, enabling the capture of causal dependencies among processes, files, network connections, and identities. On top of this graph, we introduce the Attack Probabilistic Reconstruction (APR) algorithm, which uses Bayesian inference conditioned on tactical and technical patterns described in the MITRE ATT&CK framework to estimate the most likely sequence of adversary actions. Additionally, we implement a cryptographic hash-chaining mechanism that ensures the integrity and verifiability of evidence throughout the investigative pipeline. We experimentally evaluate the proposed architecture using three representative datasets: the DARPA Transparent Computing dataset, large-scale real enterprise logs, and synthetic Log4Shell exploitation scenarios. The results demonstrate substantial improvements in precision, recall, and attack chain reconstruction time compared with approaches based exclusively on heuristic correlation or isolated statistical detection. We observed an average reduction of 37.4% in investigative reconstruction time and a significant increase in the accuracy of attack chain inferences. We also discuss practical implications for integration with modern SIEM platforms, as well as limitations related to log quality and storage costs. We conclude that the combination of formal temporal graph-based modeling, probabilistic inference, and cryptographic guarantees constitutes a promising foundation for scalable and verifiable DFIR systems in contemporary enterprise environments.
Read paper →DFIRA formally grounded architecture for graph-based DFIR with temporal graphs, cryptographic integrity guarantees, and probabilistic reconstruction of the attack chain
TITLE: A formally grounded architecture for graph-based DFIR with temporal graphs, cryptographic integrity guarantees, and probabilistic reconstruction of the attack chain ABSTRACT: A formally grounded architecture for graph-based DFIR with temporal graphs, cryptographic integrity guarantees, and probabilistic reconstruction of the attack chain ABSTRACT: A formally grounded architecture for graph-based DFIR with temporal graphs, cryptographic integrity guarantees, and probabilistic reconstruction of the attack chain SUMMARY: The increasing sophistication of modern cyber campaigns poses significant challenges for Digital Forensics and Incident Response (DFIR) practices. Contemporary enterprise environments generate massive volumes of telemetry across multiple layers—endpoints, networks, applications, and cloud infrastructures—making manual reconstruction of incidents practically impossible. Although monitoring systems and SIEM platforms provide mechanisms for event correlation, such approaches often lack a formal foundation for preserving causal relationships and temporal consistency across digital evidence. In this paper, we present a formal architecture for DFIR based on temporal graphs, enriched with probabilistic inference and cryptographic mechanisms for evidence integrity assurance. We propose a mathematical model that represents forensic events as typed nodes in a temporally consistent directed graph, thereby enabling the capture of causal dependencies among processes, files, network connections, and identities. On this graph, we introduce the Attack Probabilistic Reconstruction (APR) algorithm, which uses Bayesian inference in consideration of tactical and technical patterns as described in the MITRE ATT&CK framework to estimate the most likely sequence of attacker actions. In addition, we implement a cryptographic hash-chaining mechanism that ensures the integrity and verifiability of evidence throughout the entire investigative pipeline. We experimentally evaluate the proposed architecture using three representative datasets: the DARPA Transparent Computing dataset, extensive real-world enterprise logs, and synthetic Log4Shell exploitation scenarios. The results show clear improvements in precision, recall, and attack-chain reconstruction time compared with approaches relying solely on heuristic correlation or isolated statistical detection. We observe an average reduction in investigative reconstruction time of 37.4% as well as a significant increase in the accuracy of attack-chain inference. We also discuss practical implications for integration into modern SIEM platforms and limitations related to log quality and storage overhead. We conclude that the combination of formal modeling based on temporal graphs, probabilistic inference, and cryptographic guarantees provides a promising foundation for scalable and verifiable DFIR systems in contemporary enterprise environments.
Read paper →DFIRA Formally Grounded Architecture for Graph-Based Temporal DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction
TITLE: A Formally Grounded Architecture for Graph-Based Temporal DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction ABSTRACT: A Formally Grounded Architecture for Graph-Based Temporal DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction ABSTRACT: The increasing sophistication of modern cyber campaigns poses significant challenges to Digital Forensics and Incident Response (DFIR) practices. Contemporary enterprise environments generate massive volumes of telemetry across multiple layers—endpoints, networks, applications, and cloud infrastructures—making manual incident reconstruction practically unfeasible. Although monitoring systems and SIEM platforms provide event correlation mechanisms, such approaches often lack a formal basis to preserve causal relationships and temporal consistency among digital evidence. In this work, we present a formal architecture for DFIR based on temporal graphs enriched with probabilistic inference and cryptographic evidence integrity mechanisms. We propose a mathematical model that represents forensic events as typed vertices in a temporally consistent directed graph, enabling the capture of causal dependencies among processes, files, network connections, and identities. On top of this graph, we introduce the Attack Probabilistic Reconstruction (APR) algorithm, which uses Bayesian inference conditioned on tactical and technical patterns described in the MITRE ATT&CK framework to estimate the most likely sequence of adversary actions. Additionally, we implement a cryptographic hash-chaining mechanism that ensures the integrity and verifiability of evidence throughout the investigative pipeline. We experimentally evaluate the proposed architecture using three representative datasets: the DARPA Transparent Computing dataset, large-scale real-world enterprise logs, and synthetic Log4Shell exploitation scenarios. The results demonstrate substantial improvements in precision, recall, and attack chain reconstruction time compared to approaches based exclusively on heuristic correlation or isolated statistical detection. We observed an average reduction of 37.4% in investigative reconstruction time and a significant increase in the accuracy of attack chain inferences. We also discuss practical implications for integration with modern SIEM platforms, as well as limitations related to log quality and storage costs. We conclude that the combination of formal graph-based temporal modeling, probabilistic inference, and cryptographic guarantees constitutes a promising foundation for scalable and verifiable DFIR systems in contemporary enterprise environments.
Read paper →DFIRA formally grounded architecture for graph-based DFIR with temporal graphs, cryptographic integrity guarantees, and probabilistic attack-chain reconstruction
TITLE: A formally grounded architecture for graph-based DFIR with temporal graphs, cryptographic integrity guarantees, and probabilistic attack-chain reconstruction ABSTRACT: A formally grounded architecture for graph-based DFIR with temporal graphs, cryptographic integrity guarantees, and probabilistic attack-chain reconstruction ABSTRACT: A formally grounded architecture for graph-based DFIR with temporal graphs, cryptographic integrity guarantees, and probabilistic attack-chain reconstruction SUMMARY: The increasing sophistication of modern cyber campaigns poses significant challenges to Digital Forensics and Incident Response (DFIR) practices. Contemporary enterprise environments generate massive amounts of telemetry across multiple layers—endpoints, networks, applications, and cloud infrastructures—making manual reconstruction of incidents practically impossible. Although monitoring systems and SIEM platforms provide mechanisms for event correlation, such approaches often lack a formal foundation to preserve causal relationships and temporal consistency among digital evidence. In this work, we present a formal architecture for DFIR based on temporal graphs, augmented by probabilistic inference and cryptographic mechanisms for evidence integrity assurance. We propose a mathematical model that represents forensic events as typed nodes in a temporally consistent directed graph, enabling the capture of causal dependencies between processes, files, network connections, and identities. On this graph, we introduce the Attack Probabilistic Reconstruction (APR) algorithm, which uses Bayesian inference in consideration of tactical and technical patterns as described in the MITRE ATT&CK framework to estimate the most likely sequence of attacker actions. In addition, we implement a cryptographic hash-chaining mechanism that ensures the integrity and verifiability of evidence throughout the entire investigative pipeline. We experimentally evaluate the proposed architecture using three representative datasets: the DARPA Transparent Computing dataset, large-scale real-world enterprise logs, and synthetic Log4Shell exploitation scenarios. The results show clear improvements in precision, recall, and attack-chain reconstruction time compared with approaches based solely on heuristic correlation or isolated statistical detection. We observe an average reduction of 37.4% in investigative reconstruction time as well as a significant increase in the accuracy of attack-chain inference. We also discuss practical implications for integration into modern SIEM platforms and limitations related to log quality and storage overhead. We conclude that the combination of formal temporal-graph-based modeling, probabilistic inference, and cryptographic guarantees provides a promising foundation for scalable and verifiable DFIR systems in contemporary enterprise environments.
Read paper →DFIREvidence-Oriented Architecture for Modern DFIR: Multi-Layer Correlation, Mathematical Formalization of Timelines, and Automated Orchestration in Hybrid Environments
TITLE: Evidence-Oriented Architecture for Modern DFIR: Multi-Layer Correlation, Mathematical Formalization of Timelines, and Automated Orchestration in Hybrid Environments ABSTRACT: The increasing complexity of contemporary computing environments—characterized by hybrid infrastructures, cloud workloads, containers, and distributed systems—poses new challenges for the discipline of Digital Forensics and Incident Response (DFIR). Traditional investigative procedures, which rely predominantly on the manual collection of artifacts and ad hoc correlation of logs, exhibit clear limitations in light of the volume, volatility, and heterogeneity of data generated by modern systems. Moreover, Advanced Persistent Threat (APT) campaigns, Ransomware-as-a-Service (RaaS) operations, and the automated exploitation of critical vulnerabilities drastically shorten the interval between initial compromise and lateral movement. In this context, it becomes essential to develop formalized and scalable approaches that integrate multiple telemetry sources and can reconstruct attack chains with temporal precision. In this paper, we propose an evidence-oriented architecture for modern DFIR based on three main pillars: (i) mathematical formalization of the reconstruction of forensic timelines using directed acyclic graphs, (ii) an automated pipeline approach for the ingestion, normalization, and correlation of events from network, endpoint, identity, and cloud layers, and (iii) operational integration with platforms for orchestration and automation of incident response. The proposed model represents security events as structured entities and establishes probabilistic causal relationships between correlated events. The experimental implementation uses a technology stack consisting of Elastic Stack, Suricata, Zeek, Sysmon, Volatility 3, and a SOAR platform based on TheHive and Cortex. We evaluate the architecture using a dataset of 37 scenarios aligned with the MITRE ATT&CK framework, totaling 1.2 TB of data and approximately 86 million events. The results show a significant reduction in mean time to investigation (MTTI), a decrease in false positives, and higher accuracy in reconstructing attack chains compared with traditional SIEM-only approaches. In addition, we discuss practical implications for Security Operations Centers (SOC), limitations of the model, and possible extensions, including dynamic graph-based analysis and the integration of machine learning techniques for prioritized investigation.
Read paper →DFIRAn Evidence-Oriented Architecture for Modern DFIR: Multilayer Correlation, Mathematical Formalization of Timeline Reconstruction, and Automated Orchestration in Hybrid Environments
TITLE: An Evidence-Oriented Architecture for Modern DFIR: Multilayer Correlation, Mathematical Formalization of Timeline Reconstruction, and Automated Orchestration in Hybrid Environments ABSTRACT: The growing complexity of contemporary computing environments—characterized by hybrid infrastructures, cloud workloads, containers, and distributed systems—poses new challenges for Digital Forensics and Incident Response (DFIR). Traditional investigative methods, based predominantly on manual artifact collection and ad hoc log correlation, exhibit limitations in the face of the scale, volatility, and heterogeneity of the data generated by modern systems. In addition, advanced persistent threat (APT) campaigns, ransomware-as-a-service (RaaS) operations, and automated exploitation of critical vulnerabilities drastically reduce the interval between initial compromise and lateral movement. In this context, it becomes essential to develop formalized and scalable approaches capable of integrating multiple telemetry sources and reconstructing attack chains with temporal precision. In this work, we propose an evidence-oriented architecture for modern DFIR based on three main pillars: (i) mathematical formalization of forensic timeline reconstruction using directed acyclic graphs, (ii) an automated pipeline for ingestion, normalization, and correlation of events from network, endpoint, identity, and cloud layers, and (iii) operational integration with orchestration platforms and incident response automation. The proposed model represents security events as structured entities and establishes probabilistic causal relationships among correlated events. The experimental implementation uses a technology stack composed of Elastic Stack, Suricata, Zeek, Sysmon, Volatility 3, and a SOAR platform based on TheHive and Cortex. We evaluated the architecture using a set of 37 scenarios aligned with the MITRE ATT&CK framework, totaling 1.2 TB of data and approximately 86 million events. The results demonstrate a significant reduction in mean time to investigation (MTTI), a decrease in false positives, and greater accuracy in reconstructing attack chains when compared to traditional approaches based solely on SIEM. Additionally, we discuss practical implications for Security Operations Centers (SOC), limitations of the model, and possible extensions involving dynamic graph-based analysis and integration with machine learning techniques for investigative prioritization.
Read paper →DFIRAn Evidence-Driven Architecture for Modern DFIR: Multilayer Correlation, Mathematical Formalization of Timelines, and Automated Orchestration in Hybrid Environments
TITLE: An Evidence-Driven Architecture for Modern DFIR: Multilayer Correlation, Mathematical Formalization of Timelines, and Automated Orchestration in Hybrid Environments ABSTRACT: An Evidence-Driven Architecture for Modern DFIR: Multilayer Correlation, Mathematical Formalization of Timelines, and Automated Orchestration in Hybrid Environments Abstract: The increasing complexity of contemporary computing environments—characterized by hybrid infrastructures, cloud workloads, containers, and distributed systems—poses new challenges in the field of Digital Forensics and Incident Response (DFIR). Traditional investigative methods, based mainly on manual collection of artifacts and ad hoc correlation of logs, exhibit limitations in light of the scale, volatility, and heterogeneity of data generated by modern systems. In addition, advanced persistent threat (APT) campaigns, ransomware-as-a-service (RaaS) operations, and automated exploitation of critical vulnerabilities drastically reduce the time window between initial compromise and lateral movement. In this context, it is essential to develop formal and scalable approaches capable of integrating multiple telemetry sources and reconstructing attack chains with temporal precision. In this work, we propose an evidence-driven architecture for modern DFIR based on three main pillars: (i) mathematical formalization of forensic timeline reconstruction using directed acyclic graphs, (ii) an automated pipeline for ingestion, normalization, and correlation of events originating from the network, endpoint, identity, and cloud layers, and (iii) operational integration with orchestration platforms and incident response automation. The proposed model represents security events as structured entities and establishes probabilistic causal relationships between correlated events. The experimental implementation uses a technology stack including Elastic Stack, Suricata, Zeek, Sysmon, Volatility 3, and a SOAR platform based on TheHive and Cortex. We evaluated the architecture using a set of 37 scenarios aligned with the MITRE ATT&CK framework, totaling 1.2 TB of data and approximately 86 million events. The results demonstrate a significant reduction in MTTI, a decrease in false positives, and higher accuracy in reconstructing attack chains compared to traditional SIEM-only approaches. In addition, we discuss practical implications for security operations centers (SOC), the limitations of the model, and extension possibilities including dynamic graph-based analysis and integration with machine learning techniques for investigative prioritization.
Read paper →DFIREvidence-Oriented Architecture for Modern DFIR: Multilayer Correlation, Mathematical Formalization of Timeline Reconstruction, and Automated Orchestration in Hybrid Environments
TITLE: Evidence-Oriented Architecture for Modern DFIR: Multilayer Correlation, Mathematical Formalization of Timeline Reconstruction, and Automated Orchestration in Hybrid Environments ABSTRACT: The growing complexity of contemporary computing environments—characterized by hybrid infrastructures, cloud workloads, containers, and distributed systems—poses new challenges for the field of Digital Forensics and Incident Response (DFIR). Traditional investigative methods, based predominantly on manual artifact collection and ad hoc log correlation, exhibit limitations in the face of the scale, volatility, and heterogeneity of data generated by modern systems. In addition, advanced persistent threat (APT) campaigns, ransomware-as-a-service (RaaS) operations, and automated exploitation of critical vulnerabilities drastically reduce the interval between initial compromise and lateral movement. In this context, it becomes essential to develop formalized and scalable approaches capable of integrating multiple telemetry sources and reconstructing attack chains with temporal precision. In this work, we propose an evidence-oriented architecture for modern DFIR based on three main pillars: (i) mathematical formalization of forensic timeline reconstruction using directed acyclic graphs, (ii) an automated pipeline for ingestion, normalization, and correlation of events from network, endpoint, identity, and cloud layers, and (iii) operational integration with orchestration platforms and incident response automation. The proposed model represents security events as structured entities and establishes probabilistic causal relationships between correlated events. The experimental implementation uses a technology stack composed of Elastic Stack, Suricata, Zeek, Sysmon, Volatility 3, and a SOAR platform based on TheHive and Cortex. We evaluated the architecture using a set of 37 scenarios aligned with the MITRE ATT&CK framework, totaling 1.2 TB of data and approximately 86 million events. The results demonstrate a significant reduction in mean time to investigate (MTTI), a decrease in false positives, and greater accuracy in reconstructing attack chains when compared to traditional SIEM-only approaches. Additionally, we discuss practical implications for security operations centers (SOC), limitations of the model, and possible extensions involving graph-based analysis and integration with machine learning techniques for investigative prioritization.
Read paper →DFIREvidence-Driven Architectures for Modern DFIR: Multi-Level Correlation, Mathematical Formalization of Timelines, and Automated Orchestration in Hybrid Environments
TITLE: Evidence-Driven Architectures for Modern DFIR: Multi-Level Correlation, Mathematical Formalization of Timelines, and Automated Orchestration in Hybrid Environments ABSTRACT: Evidence-Driven Architectures for Modern DFIR: Multi-Level Correlation, Mathematical Formalization of Timelines, and Automated Orchestration in Hybrid Environments Abstract: Contemporary computing environments are becoming increasingly complex, characterized by hybrid infrastructures, cloud workloads, containers, and distributed systems, which pose new challenges to the field of Digital Forensics and Incident Response (DFIR). Traditional investigative methods, which mainly rely on manual collection of forensic artifacts and ad hoc correlation of logs, exhibit clear limitations when confronted with the scale, volatility, and heterogeneity of data generated by modern systems. In addition, advanced persistent threat (APT), ransomware-as-a-service (RaaS) attack campaigns, and the automated exploitation of critical vulnerabilities have significantly shortened the time interval between initial compromise and lateral movement. In this context, it has become crucial to develop formal and scalable methods for integrating multiple telemetry sources and accurately reconstructing attack chains. This paper proposes an evidence-driven architecture for modern DFIR based on three main pillars: (i) mathematical formalization of forensic timeline reconstruction using directed acyclic graphs; (ii) the construction of automated ingestion, normalization, and correlation pipelines for events from the network, endpoint, identity, and cloud layers; and (iii) operational integration with incident response orchestration and automation platforms. The proposed model represents security events as structured entities and establishes probabilistic causal relationships among related events. The experimental implementation adopts a technology stack consisting of Elastic Stack, Suricata, Zeek, Sysmon, Volatility 3, and a SOAR platform based on TheHive and Cortex. We evaluated the architecture using 37 scenarios aligned with the MITRE ATT&CK framework, totaling 1.2 TB of data and approximately 86 million events. The results show that, compared with traditional SIEM-only approaches, the architecture significantly reduces mean time to investigate (MTTI), decreases false positives, and improves the accuracy of attack chain reconstruction. In addition, we discuss the practical implications of the model for security operations centers (SOC), the limitations of the model, and potential extensions incorporating dynamic graph analysis and machine learning techniques to support investigative prioritization.
Read paper →DFIRFormal Orchestration and Probabilistic Analysis of Evidence in DFIR: A Scalable Graph-Based Architecture for Multisource Correlation
TITLE: Formal Orchestration and Probabilistic Analysis of Evidence in DFIR: A Scalable Graph-Based Architecture for Multisource Correlation ABSTRACT: Digital Forensics and Incident Response (DFIR) faces structural challenges arising from the growing heterogeneity of enterprise environments, the volatility of digital evidence, and the sophistication of adversaries employing living-off-the-land and anti-forensic evasion techniques. This work proposes a formal architecture for the orchestration and probabilistic correlation of digital evidence based on multisource temporal graphs, with explicit mathematical modeling of the incident reconstruction problem. Our methodology integrates distributed collection, semantic normalization guided by MITRE ATT&CK, construction of causal graphs, and Bayesian inference for assigning events to attack chains. We formalize the problem as the maximization of the posterior probability of a sequence of compromise states given a heterogeneous set of forensic observations. We implemented a functional prototype on a pipeline based on Elastic Stack, Apache Kafka, and Neo4j, evaluating it on a dataset composed of 12 TB of real logs and synthetic traces representing 18 distinct ATT&CK techniques. The experimental results demonstrate a 27.4% increase in timeline reconstruction accuracy compared to deterministic rule-based approaches, a 34.1% reduction in mean time to investigation (MTTI), and a 22.8% improvement in F1-score for identifying complex attack chains. The architecture maintains an average processing latency below 420 ms per event under a load of 15,000 events/second, with linear scalability observed up to 8 processing nodes. We conclude that probabilistic formalization combined with temporal graphs offers substantial gains in accuracy and operational efficiency in DFIR, establishing rigorous foundations for reliable and auditable automation of large-scale digital investigations.
Read paper →DFIRFormal Orchestration and Probabilistic Analysis of Evidence in DFIR: A Scalable Architecture Based on Temporal Graphs for Multi-Source Correlation
TITLE: Formal Orchestration and Probabilistic Analysis of Evidence in DFIR: A Scalable Architecture Based on Temporal Graphs for Multi-Source Correlation ABSTRACT: Digital Forensics and Incident Response (DFIR) faces structural challenges arising from the growing heterogeneity of enterprise environments, the volatility of digital evidence, and the sophistication of adversaries employing living-off-the-land techniques and anti-forensic evasion. This work proposes a formal architecture for the orchestration and probabilistic correlation of digital evidence based on multi-source temporal graphs, with explicit mathematical modeling of the incident reconstruction problem. Our methodology integrates distributed collection, MITRE ATT&CK-oriented semantic normalization, construction of causal graphs, and Bayesian inference for assigning events to attack chains. We formalize the problem as the maximization of the posterior probability of a sequence of compromise states given a heterogeneous set of forensic observations. We implemented a functional prototype on a pipeline based on Elastic Stack, Apache Kafka, and Neo4j, evaluating it on a dataset composed of 12 TB of real logs and synthetic traces representing 18 distinct ATT&CK techniques. Experimental results demonstrate a 27.4% increase in timeline reconstruction accuracy compared to deterministic rule-based approaches, a 34.1% reduction in mean time to investigation (MTTI), and a 22.8% improvement in F1-score for identifying complex attack chains. The architecture maintains an average processing latency below 420 ms per event under a load of 15,000 events per second, with linear scalability observed up to eight processing nodes. We conclude that probabilistic formalization combined with temporal graphs provides substantial gains in accuracy and operational efficiency in DFIR, establishing rigorous foundations for reliable and auditable automation of large-scale digital investigations.
Read paper →DFIRA Formal and Scalable Architecture for Graph-Oriented DFIR with Probabilistic Temporal Correlation and Cryptographic Integrity Guarantees
TITLE: A Formal and Scalable Architecture for Graph-Oriented DFIR with Probabilistic Temporal Correlation and Cryptographic Integrity Guarantees ABSTRACT: The growing complexity of computing environments in 2025 — characterized by cloud-native architectures, microservices, ephemeral workloads, DevSecOps pipelines, hybrid environments, and integrations with artificial intelligence systems — imposes substantial challenges on the discipline of Digital Forensics and Incident Response (DFIR). The causal reconstruction of incidents involving multiple heterogeneous sources, under conditions of temporal uncertainty, statistical noise, and possible log tampering, remains an open problem from a formal perspective. In this work, we propose a mathematically grounded architecture for graph-oriented DFIR, based on a probabilistic acyclic causal graph model with explicit temporal uncertainty, Bayesian inference, and cryptographic integrity guarantees through Merkle trees and immutable storage (WORM). We formalize the attack sequence reconstruction problem as a conditional probability maximization problem over admissible paths in a DAG, demonstrating equivalence with the minimization of the sum of log-probabilities. We introduce two algorithms: (i) Causal Temporal Reconstruction (CTR), with complexity O(|E_c| log |V|), and (ii) Incremental Integrity Verification (IIV), with inclusion proof in O(log n). The architecture was implemented on Elastic Stack 8.x, Apache Kafka 3.5, S3 Object Lock in compliance mode, and PostgreSQL, and evaluated on 12 TB of real and synthetic data, including DARPA Transparent Computing and the Los Alamos Cybersecurity Dataset. The results demonstrate a statistically significant increase in accuracy (91.4% vs. 64.2%), a 37.8% reduction in average triage time, and controlled computational overhead (8.6%). We argue that the integration of probabilistic formalism, cryptographic guarantees, and causal modeling provides a rigorous, auditable, and scalable foundation for modern DFIR, aligned with NIST and ISO/IEC 27037 guidelines and the MITRE ATT&CK taxonomy, as well as compatible with contemporary scenarios involving eBPF, CNAPP, and AI-oriented environments.
Read paper →DFIRA Formal and Scalable Architecture for Graph-Based DFIR with Probabilistic Temporal Correlation and Cryptographic Integrity Guarantees
TITLE: A Formal and Scalable Architecture for Graph-Based DFIR with Probabilistic Temporal Correlation and Cryptographic Integrity Guarantees ABSTRACT: The growing complexity of computational environments in 2025—characterized by cloud-native architectures, microservices, ephemeral workloads, DevSecOps pipelines, hybrid environments, and integrations with artificial intelligence systems—poses substantial challenges to the discipline of Digital Forensics and Incident Response (DFIR). The causal reconstruction of incidents involving multiple heterogeneous sources, under conditions of temporal uncertainty, statistical noise, and possible log tampering, remains an open problem from a formal perspective. In this work, we propose a mathematically grounded architecture for graph-based DFIR, based on a probabilistic acyclic causal graph model with explicit temporal uncertainty, Bayesian inference, and cryptographic integrity guarantees through Merkle trees and write-once-read-many (WORM) immutable storage. We formalize the problem of reconstructing attack sequences as a conditional probability maximization problem over admissible paths in a DAG, demonstrating equivalence to minimizing the sum of log-probabilities. We introduce two algorithms: (i) Temporal Causal Reconstruction (TCR), with complexity O(|E_c|log|V|), and (ii) Incremental Integrity Verification (IIV), with inclusion proof in O(log n). The architecture was implemented on Elastic Stack 8.x, Apache Kafka 3.5, S3 Object Lock in compliance mode, and PostgreSQL, and was evaluated on 12 TB of real and synthetic data, including DARPA Transparent Computing and the Los Alamos Cybersecurity Dataset. The results demonstrate a statistically significant increase in precision (91.4% vs. 64.2%), a 37.8% reduction in mean triage time, and controlled computational overhead (8.6%). We argue that the integration of probabilistic formalism, cryptographic guarantees, and causal modeling provides a rigorous, auditable, and scalable foundation for modern DFIR, aligned with NIST guidelines, ISO/IEC 27037, and the MITRE ATT&CK taxonomy, as well as compatible with contemporary scenarios involving eBPF, CNAPP, and AI-driven environments.
Read paper →DFIRFormal Orchestration of DFIR Guided by Temporal Graphs and Bayesian Inference for Automated Incident Response in Distributed Enterprise Environments
TITLE: Formal Orchestration of DFIR Guided by Temporal Graphs and Bayesian Inference for Automated Incident Response in Distributed Enterprise Environments ABSTRACT: The growing complexity of distributed enterprise environments, characterized by multicloud architectures, containerized workloads, edge devices, API-based integrations, and artificial intelligence–driven systems, imposes substantial challenges on the discipline of Digital Forensics and Incident Response (DFIR). Contemporary attack chains are typically multistage, exploiting vulnerabilities in heterogeneous components and combining techniques such as remote execution, lateral movement, persistence, and data exfiltration. In this context, traditional rule-based SIEM approaches prove insufficient for reconstructing complex causal sequences under uncertainty and adversarial noise. In this work, we propose a mathematical formalization of incident reconstruction as a MAP (Maximum a Posteriori) inference problem on directed temporal graphs with explicit causal constraints. We model forensic events as structured tuples and introduce a probabilistic framework grounded in conditional local factorization, enabling formal quantification of uncertainty. We demonstrate robustness properties under limited adversarial insertion of spurious events, establishing analytical conditions for MAP path invariance. We implement the TGI-DFIR architecture on scalable infrastructure based on Apache Kafka, Elasticsearch, Neo4j, and Kubernetes, integrated with modern CNAPP pipelines and eBPF telemetry. We empirically evaluate the approach using the DARPA Transparent Computing dataset, real corporate logs (12 TB), and scenarios inspired by widely exploited vulnerabilities up to 2025. Results indicate a statistically significant increase in precision (F1 = 0.91 ± 0.02) and a 47.3% reduction in mean triage time compared with rule-based approaches and sequential deep learning models. We conclude that the integration of temporal graphs and Bayesian inference provides a rigorous formal foundation and an operationally viable approach for automated incident response orchestration in contemporary distributed enterprise environments.
Read paper →DFIRFormal Orchestration of Graph-Based Temporal DFIR and Bayesian Inference for Automated Incident Response in Distributed Enterprise Environments
TITLE: Formal Orchestration of Graph-Based Temporal DFIR and Bayesian Inference for Automated Incident Response in Distributed Enterprise Environments ABSTRACT: The growing complexity of distributed enterprise environments, characterized by multicloud architectures, containerized workloads, edge devices, API-based integrations, and AI-based systems, poses substantial challenges to the discipline of Digital Forensics and Incident Response (DFIR). Contemporary attack chains are typically multi-stage, exploiting vulnerabilities in heterogeneous components and combining techniques for remote execution, lateral movement, persistence, and exfiltration. In this context, traditional rule-based SIEM approaches prove insufficient for reconstructing complex causal sequences under uncertainty and adversarial noise. In this work, we propose a mathematical formalization of incident reconstruction as a Maximum a Posteriori (MAP) inference problem in directed temporal graphs with explicit causal constraints. We model forensic events as structured tuples and introduce a probabilistic framework grounded in conditional local factorization, enabling formal quantification of uncertainty. We demonstrate robustness properties under limited adversarial insertion of spurious events, establishing analytical conditions for MAP path invariance. We implement the TGI-DFIR architecture on scalable infrastructure based on Apache Kafka, Elasticsearch, Neo4j, and Kubernetes, with integration into modern CNAPP pipelines and eBPF telemetry. We empirically evaluate the proposal using the DARPA Transparent Computing dataset, real enterprise logs (12 TB), and scenarios inspired by widely exploited vulnerabilities up to 2025. The results indicate a statistically significant increase in precision (F1 = 0.91 ± 0.02) and a 47.3% reduction in mean triage time compared with rule-based approaches and deep sequential learning models. We conclude that the integration of temporal graphs and Bayesian inference provides a rigorous formal foundation and an operationally viable basis for automated incident response orchestration in contemporary distributed enterprise environments.
Read paper →DFIRFormal and Correlated Orchestration of Evidence in DFIR: A Scalable Framework for Probabilistic Temporal Reconstruction and Incident Attribution in Hybrid Environments
TITLE: Formal and Correlated Orchestration of Evidence in DFIR: A Scalable Framework for Probabilistic Temporal Reconstruction and Incident Attribution in Hybrid Environments ABSTRACT: The increasing complexity of hybrid infrastructures, the massive adoption of cloud computing, microservices-oriented architectures, observability based on eBPF, and the integration of artificial intelligence systems have substantially expanded the challenges faced by the discipline of Digital Forensics and Incident Response (DFIR). In 2025, incidents exploiting critical vulnerabilities, supply chains, and living-off-the-land techniques highlight the limitations of linear log correlation approaches and static SIEM rule sets. In this work, we propose a formal framework for probabilistic temporal reconstruction of attack chains, grounded in directed graphs with conditional weights and semantic constraints derived from the MITRE ATT&CK matrix. We model the problem as Bayesian inference over acyclic subgraphs that maximize posterior probability under heterogeneous and potentially inconsistent evidence. We introduce a Bayesian temporal alignment mechanism to compensate for clock drift among distributed sources and a reconstruction algorithm guided by adversarial knowledge with threshold-controlled probabilistic pruning. We demonstrate formal properties of epsilon-approximate correctness under observational completeness assumptions and analyze the asymptotic complexity of the proposed algorithms. The distributed implementation, based on Apache Kafka, Apache Spark, Elasticsearch, and Neo4j, was evaluated on datasets totaling 1.2 TB of events, including simulations with Atomic Red Team and anonymized corporate logs. We obtained F1 = 0.895 ± 0.02, outperforming a traditional SIEM baseline by 29.7% and reducing average investigative time by 37.4% (p < 0.01). We discuss extensions for environments with AI/ML workloads, integration with CNAPP, and evidentiary implications under digital chain-of-custody requirements. The results indicate that the explicit incorporation of semantic constraints and rigorous probabilistic modeling constitutes a substantial advancement for scalable and formally grounded DFIR.
Read paper →DFIRFormal and Correlated Evidence Orchestration in DFIR: A Scalable Framework for Probabilistic Temporal Reconstruction and Incident Attribution in Hybrid Environments
TITLE: Formal and Correlated Evidence Orchestration in DFIR: A Scalable Framework for Probabilistic Temporal Reconstruction and Incident Attribution in Hybrid Environments ABSTRACT: The increasing complexity of hybrid infrastructures, the widespread adoption of cloud computing, microservices-oriented architectures, eBPF-based observability, and the integration of artificial intelligence systems have substantially amplified the challenges of the discipline of Digital Forensics and Incident Response (DFIR). In 2025, incidents exploiting critical vulnerabilities, supply chains, and living-off-the-land techniques highlight the limitations of linear log-correlation approaches and static SIEM rules. In this work, we propose a formal framework for probabilistic temporal reconstruction of attack chains, based on directed graphs with conditional weights and semantic constraints derived from the MITRE ATT&CK matrix. We model the problem as Bayesian inference over acyclic subgraphs that maximize posterior probability under heterogeneous and potentially inconsistent evidence. We introduce a Bayesian temporal alignment mechanism to compensate for clock drift among distributed sources and an adversary-aware reconstruction algorithm with threshold-controlled probabilistic pruning. We demonstrate formal properties of ε-approximate correctness under observational completeness assumptions and analyze the asymptotic complexity of the proposed algorithms. The distributed implementation, based on Apache Kafka, Apache Spark, Elasticsearch, and Neo4j, was evaluated on datasets totaling 1.2 TB of events, including simulations with Atomic Red Team and anonymized enterprise logs. We obtained F1 = 0.895 ± 0.02, outperforming the traditional SIEM baseline by 29.7% and reducing average investigation time by 37.4% (p < 0.01). We discuss extensions to environments with AI/ML workloads, integration with CNAPP, and evidentiary implications under digital chains of custody. The results indicate that the explicit incorporation of semantic constraints and rigorous probabilistic modeling constitutes a substantial advance for scalable and formally grounded DFIR.
Read paper →