Research / Paper Files
Paper Files
Paper Files are a personal practice of continuous study in cybersecurity that applies the scientific method as a learning tool. Each article is written not for academic publication, but as a deliberate exercise to sharpen the axe — deepening knowledge on specific topics, organizing ideas with rigor, and observing how understanding of certain subjects develops over time. It is the intellectual equivalent of a training journal: each entry records what was studied, how it was analyzed, and what conclusions emerged.
I strongly recommend that security professionals adopt this method. Choose a topic you want to master, research primary sources (RFCs, papers, official documentation), structure your text with introduction, methodology, analysis, and conclusion, and write as if you were explaining to a colleague. The act of writing forces clarity of thought and exposes gaps in understanding that passive reading cannot reveal. Use the articles on this site as examples of format and depth, and build your own collection — over time, you will have a personal repository of refined knowledge that no course or certification can replace.
DAI & ADAI · 2026
DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts
DAI (Decripte Artificial Intelligence) is a proprietary domain-specific LLM within a governed autonomous defensive architecture. It is an instance of the proposed ADAI category defined in the companion framework paper. T…
Read paper →ADAI · ENAutonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure
ADAI (Autonomous Defensive Artificial Intelligence) is a proposed category of governed autonomous cyber defense. The framework specifies defended perimeters, bounded effects, declared rollback and capability-disjoint ver…
Read paper →28 papers
DFIR-GraphX: A Formal Architecture Based on Probabilistic Temporal Graphs for Incident Response and Digital Forensics in Hybrid and Multicloud Environments
ProbabilisticInference ProbabilisticInference --> HypothesisGeneration HypothesisGeneration --> Verification Verification --> IncidentAttribution IncidentAttribution --> [] Verification --> GraphConstruction ``` This state machine allows formal reasoning about termination and correctness of the inference process. Theorem 1: Convergence of Incremental Graph Construction Let $G_t = (V_t, E_t)$ denote the reconstructed investigation graph at time $t$. Assume event streams are finite and each event produces at most $k$ new edges. We show that the incremental construction algorithm converges.
Read paper →DFIRScalable Digital Forensics and Incident Response in Cloud-Native and AI-Augmented Environments: Operational Methodologies for 2026 Threat Landscapes
IntegrityVerification IntegrityVerification --> ArtifactExtraction ArtifactExtraction --> CorrelationEngine CorrelationEngine --> HypothesisGeneration HypothesisGeneration --> AnalystReview AnalystReview --> EvidenceArchival EvidenceArchival --> [] IntegrityVerification --> AlertTamperingDetected AlertTamperingDetected --> AnalystReview ``` Each transition enforces constraints over evidence metadata and cryptographic integrity properties. Evidence Integrity Property Let $E_i$ represent a forensic artifact and $H(E_i)$ a cryptographic hash function such as S
Read paper →DFIRARC-DFIR: A Formal, Probabilistic, and Scalable Architecture for Automated Detection, Reconstruction, and Correlation of Incidents in Heterogeneous Corporate Environments
1. Introduction
Read paper →DFIRA Unified Graph-Theoretic and Causality-Driven Framework for Scalable Digital Forensics and Incident Response in Heterogeneous Enterprise Environments
Generic_PHP_Webshell { strings: $eval = /eval\s\(/ $base64 = /base64_decode\s\(/ condition: uint16(0) == 0x3c3f and 2 of ($eval,$base64) } ``` Suricata Signature (Suspicious Outbound Exfiltration) ``` alert http $HOME_NET any -> $EXTERNAL_NET any \ (msg:"Possible Data Exfiltration via Large POST"; \ flow:established,to_server; content:"POST"; http_method; \ dsize:>1048576; sid:900001;) ``` These artifacts integrate into the suspicious set $S$ that seeds graph extraction. 5. Implementation The ingestion layer uses Apache Kafka with partitioning by host and
Read paper →