Research / Paper Files

Paper Files

Paper Files are a personal practice of continuous study in cybersecurity that applies the scientific method as a learning tool. Each article is written not for academic publication, but as a deliberate exercise to sharpen the axe — deepening knowledge on specific topics, organizing ideas with rigor, and observing how understanding of certain subjects develops over time. It is the intellectual equivalent of a training journal: each entry records what was studied, how it was analyzed, and what conclusions emerged.

I strongly recommend that security professionals adopt this method. Choose a topic you want to master, research primary sources (RFCs, papers, official documentation), structure your text with introduction, methodology, analysis, and conclusion, and write as if you were explaining to a colleague. The act of writing forces clarity of thought and exposes gaps in understanding that passive reading cannot reveal. Use the articles on this site as examples of format and depth, and build your own collection — over time, you will have a personal repository of refined knowledge that no course or certification can replace.

DAI & ADAI · 2026

DAI · EN

DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts

DAI (Decripte Artificial Intelligence) is a proprietary domain-specific LLM within a governed autonomous defensive architecture. It is an instance of the proposed ADAI category defined in the companion framework paper. T…

Read paper →ADAI · EN

Autonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure

ADAI (Autonomous Defensive Artificial Intelligence) is a proposed category of governed autonomous cyber defense. The framework specifies defended perimeters, bounded effects, declared rollback and capability-disjoint ver…

Read paper →

All Detection DFIR AppSec DevSecOps AI Security IAM Cloud Containers IR Crypto Research Phishing Secrets

25 papers

Detection

Detection Engineering for Modern Cybersecurity in 2026: A Multi-Layer, Behavior-Centric Framework for High-Fidelity Threat Detection Across Endpoint, Identity, Cloud, and AI Workloads

Detection remains the decisive control plane in modern cybersecurity because prevention is no longer sufficient against adaptive adversaries, living-off-the-land intrusion chains, identity abuse, supply-chain compromise, and prompt-injection-enabled abuse of generative AI systems. In 2026, effective detection must operate across heterogeneous telemetry domains: endpoint process and kernel events, identity provider logs, cloud control-plane activity, container and Kubernetes signals, network flow and packet metadata, and emergent AI application traces. This paper presents a behavior-centric detection framework designed to reduce false positives while improving coverage against post-compromise activity. The framework unifies rules, statistical baselines, graph correlation, and detection-as-code practices into a single operational pipeline. It formalizes the detection problem as an optimization over expected utility, balancing detection probability, alert cost, and analyst workload under constrained telemetry fidelity. The paper also provides an implementation blueprint using widely deployed 2026-era tools and standards, including Sigma, YARA, Zeek, Suricata, Sysmon, eBPF telemetry, OpenTelemetry, and cloud-native audit sources. Experimental evaluation is conducted through representative adversary behaviors mapped to ATT&CK, demonstrating measurable gains in precision and triage efficiency when detections are layered and context-enriched rather than deployed as isolated signatures. A case study on identity-driven cloud intrusion illustrates how token abuse, OAuth consent manipulation, and abnormal control-plane sequencing can be detected before lateral expansion. The discussion addresses operational pitfalls such as alert fatigue, sensor blind spots, encrypted traffic, and the special challenges of detecting misuse in AI-assisted workflows. The paper concludes that detection in 2026 must be engineered as a continuously tested socio-technical system, not as a static collection of rules, and argues for standardized validation, adversary emulation, and detection quality metrics as foundational security practices.

2026-05-08Read paper →Detection

Detection in Cybersecurity at Scale in 2026: A Risk-Calibrated, Multi-Layer Methodology for Telemetry Fusion, Adversary Behavior Modeling, and Operational Response

Detection remains the decisive control plane of modern cybersecurity because prevention is incomplete, identity has become the new perimeter, and adversaries now routinely combine living-off-the-land tradecraft, cloud control-plane abuse, supply-chain compromise, and AI-assisted social engineering. This paper presents a 2026-oriented, publication-ready treatment of detection as an operational discipline rather than a narrow alerting function. We formalize detection as a probabilistic inference problem over heterogeneous telemetry streams, including endpoint, network, identity, cloud, SaaS, application, and model-usage signals. Building on established frameworks such as MITRE ATT&CK, D3FEND, NIST CSF 2.0, and Elastic’s detection engineering practices, we propose a risk-calibrated methodology that fuses signatures, behavioral analytics, anomaly detection, and graph-based correlation into a layered detection pipeline. The paper introduces a threat-model-driven design that explicitly accounts for false-positive economics, adversary dwell-time reduction, telemetry loss, and analytic drift. We describe an implementation pattern using eBPF-based host telemetry, OpenTelemetry for application observability, Sigma-to-backend rule translation, and SOAR-enforced response gating. An experimental evaluation is presented using representative attack scenarios spanning credential theft, token abuse, lateral movement, exfiltration, and AI-assisted phishing, with comparative tables for precision, recall, and time-to-detect. A case study demonstrates how a cloud-tenant compromise can be detected through weak signals that individually appear benign but become highly actionable when correlated across identity, endpoint, and control-plane events. We argue that high-fidelity detection in 2026 requires continuous validation, adversary emulation, and governance around AI-generated content and model endpoints. The paper concludes with a practical roadmap for organizations seeking measurable detection maturity without overfitting to any single platform, vendor, or data source.

2026-05-04Read paper →Detection

Detection-Centric Cybersecurity in 2026: A Multi-Layer, Telemetry-Fused Framework for High-Fidelity Intrusion Detection, Threat Hunting, and Adversarially Robust Response

Detection remains the decisive control plane of cybersecurity in 2026 because perimeter defenses have become porous, identity is the new boundary, and adversaries increasingly blend commodity exploitation with AI-assisted social engineering, living-off-the-land tradecraft, and cloud-native abuse. This paper examines detection as an end-to-end cyber capability rather than a single alerting technology, and proposes a telemetry-fused methodology that unifies endpoint, network, identity, cloud, and application signals into a probabilistic detection pipeline. The framework is designed for contemporary environments characterized by hybrid work, SaaS dependency, containerized workloads, ephemeral infrastructure, and automated attacker adaptation. We formalize detection as a sequential inference problem under partial observability, adversarial manipulation, and severe class imbalance, and we derive operational metrics that extend beyond precision and recall to cost-weighted expected loss, time-to-detect, and adversarial robustness. The paper synthesizes mature 2026-era practices including Sigma normalization, MITRE ATT&CK mapping, eBPF-driven telemetry, cloud posture and workload visibility, behavioral baselining, and security orchestration with analyst-in-the-loop feedback. We further provide an implementation blueprint using open-source tools and widely deployed commercial paradigms, then evaluate the approach through realistic attack scenarios including credential theft, cloud token abuse, lateral movement, and defense evasion. Results show that high-fidelity detection in 2026 depends less on any single sensor and more on correlation quality, identity context, and disciplined rule lifecycle management. A case study based on a hybrid enterprise compromise illustrates how multi-layer detection compresses attacker dwell time, exposes cross-domain pivots, and reduces false positives compared with siloed alerting. The paper concludes that future progress lies in robust analytics, privacy-preserving sharing, model governance, and adversarially aware detection engineering that can withstand AI-enabled attackers and rapidly evolving operational environments.

2026-04-28Read paper →Detection

Detection at Scale in 2026: A Unified Multi-Layer Framework for Cloud, Endpoint, Identity, and AI-Driven Cyber Threat Detection

Detection remains the decisive control in modern cybersecurity because prevention fails under adversarial adaptation, software complexity, and identity-centric attack paths. By 2026, defenders operate across hybrid cloud estates, containerized workloads, SaaS identities, endpoint fleets, and AI-assisted user and machine interactions, while attackers increasingly combine living-off-the-land tradecraft, credential theft, supply-chain intrusion, and automation-enhanced social engineering. This paper presents a full-stack detection framework for 2026 that unifies telemetry normalization, behavior-centric analytics, attack-graph correlation, and risk-adaptive scoring across endpoint, network, identity, cloud control plane, and AI interaction layers. The core contribution is a practical methodology that treats detection as an evidence fusion problem under uncertainty rather than as isolated alert rules. We formalize detection quality using precision, recall, timeliness, and expected cost, and we map those metrics to operational playbooks and response thresholds. The proposed architecture combines high-fidelity data sources such as endpoint security telemetry, DNS and proxy logs, cloud audit events, Kubernetes control-plane signals, eBPF-derived process visibility, identity risk events, and LLM safety and abuse telemetry. We evaluate the framework against representative intrusion sequences including phishing-led account takeover, cloud API abuse, lateral movement, and low-and-slow exfiltration patterns. Results show that correlation across layers materially improves true-positive rate while reducing alert volume compared with siloed detection. The paper also examines practical deployment constraints: schema drift, telemetry gaps, adversarial evasion, privacy, and analyst workload. A 2026 case study demonstrates how the framework would have shortened dwell time in a hybrid identity-cloud intrusion by combining impossible travel, token abuse, anomalous OAuth consent, and container execution analytics. The contribution is not a new detector in isolation, but a defensible operational model for modern detection engineering that remains robust under the threat landscape of 2026.

2026-04-27Read paper →Detection

Detection in Cybersecurity at Scale in 2026: A Hybrid Telemetry, eBPF, and ML-Driven Framework for High-Fidelity Intrusion Detection

Detection remains the decisive control plane in modern cybersecurity because prevention is no longer sufficient against supply-chain compromise, cloud-native abuse, identity theft, living-off-the-land tradecraft, and rapidly adapting adversaries. By 2026, defensive programs must operate across endpoints, identities, containers, cloud control planes, SaaS platforms, and AI-enabled workflows while preserving low latency, low false-positive rates, and operational explainability. This paper presents a technically grounded framework for detection that combines deterministic analytics, behavioral correlation, graph-based investigation, and supervised and unsupervised machine learning over heterogeneous telemetry. The proposed architecture integrates endpoint visibility through eBPF and ETW, cloud audit streams, IAM signals, DNS and proxy telemetry, and security orchestration outputs into a unified detection pipeline. We formalize detection as an optimization problem that balances detection probability, expected analyst cost, and adversary adaptation risk under constrained latency and observability. We further describe a production-oriented implementation pattern using Sigma-to-backend translation, rule versioning, feature extraction, entity-centric correlation, and model governance. To ground the design, we evaluate representative detection scenarios including credential theft, PowerShell abuse, container escape precursors, suspicious OAuth consent, and beaconing behavior. The evaluation uses realistic metrics such as precision, recall, mean time to detect, and alert volume per day, showing that hybrid detection consistently outperforms single-source signature or ML-only approaches. A detailed case study on a cloud identity compromise demonstrates how multi-layer telemetry can reveal attacker progression before lateral movement and exfiltration. The paper concludes that the future of detection lies in composable analytics, cryptographically trustworthy telemetry, and human-centered triage pipelines that retain rigor under AI-accelerated adversarial pressure.

2026-04-23Read paper →Detection

Detection at Scale in Cybersecurity: A Multi-Layer, Behavior-Centric Architecture for Adversary Detection Across Endpoint, Identity, Cloud, and Network Telemetry

Detection is the decisive control-plane problem in modern cybersecurity: if malicious activity cannot be observed, normalized, correlated, and prioritized quickly enough, prevention becomes a probabilistic aspiration rather than an operational guarantee. By 2026, the detection problem has been reshaped by cloud-native infrastructure, SaaS sprawl, encrypted traffic, identity-centric attacks, living-off-the-land tradecraft, and the operationalization of generative AI for both defenders and adversaries. This paper presents a full-length research treatment of detection as a cyber-defense discipline, formalizing the problem across endpoint, identity, network, application, and cloud telemetry, and proposing a multi-layer, behavior-centric detection architecture designed for high-volume enterprise environments. The methodology combines deterministic rules, statistical baselines, graph correlation, ATT&CK-aligned behavior modeling, and supervised anomaly triage to reduce false positives while preserving sensitivity to low-and-slow intrusions. We define detection quality in terms of precision, recall, time-to-detect, analyst workload, and cost-adjusted utility, and we evaluate the architecture under realistic adversary emulation scenarios including credential theft, lateral movement, cloud token abuse, and data staging. The paper also examines implementation trade-offs in SIEM, SOAR, EDR, NDR, XDR, CNAPP, and eBPF-based monitoring stacks, with practical deployment guidance for log normalization, rule lifecycle management, and detection engineering workflows. A case study demonstrates how a mature organization can detect a hybrid intrusion chain spanning phishing, identity compromise, cloud persistence, and exfiltration by fusing multiple weak signals into a high-confidence incident. The central argument is that detection in 2026 must be treated as an adaptive distributed inference problem, not a static ruleset: resilient detection systems require telemetry breadth, semantic normalization, adversary-centric design, and continuous validation against evolving tradecraft.

2026-04-19Read paper →Detection

MITRE ATT&CK-Oriented Hybrid Multi-Layer Detection Architecture Using Probabilistic Temporal Correlation Based on Endpoint, Network, and Memory Telemetry

TITLE: MITRE ATT&CK-Oriented Hybrid Multi-Layer Detection Architecture Using Probabilistic Temporal Correlation Based on Endpoint, Network, and Memory Telemetry ABSTRACT: The increasing complexity of intrusion campaigns observed in modern enterprise environments poses significant challenges to conventional detection architectures based on isolated sensors. Today’s attacks often exploit living-off-the-land (LOLBins) techniques, widely available post-exploitation frameworks, and obfuscated command-and-control channels, resulting in chains of events distributed across networks, endpoints, and volatile memory. Although tools such as IDS/IPS, EDR, and SIEM platforms are widely adopted, their analytical integration is still largely constrained by syntactic correlation models and cannot capture the temporal and semantic dependencies that exist among heterogeneous events. The MITRE ATT&CK framework has been established as an operational ontology for describing Tactics, Techniques, and Procedures (TTPs), but its use in detection systems is often limited to static mapping and descriptive visualization. In this study, we propose a hybrid multi-layer detection architecture that integrates network, endpoint, and memory telemetry and incorporates a formally defined probabilistic temporal correlation mechanism semantically aligned with the ATT&CK model. This architecture combines widely used sensors, including Suricata, Sysmon, Volatility 3, and Sigma/YARA rules, with a Kafka-based ingestion layer and indexing structured according to the Elastic Common Schema. We formulate the detection process as an inference problem under uncertainty and model it as a weighted temporal graph, where events represent vertices annotated with ATT&CK techniques and edges represent semantically compatible transitions within a defined time window. Furthermore, we introduce a conditional risk function that integrates the contextual probability of each technique and the transition weights between TTPs, enabling estimation of the likelihood of the entire attack chain. Using a time-indexed structure, we analytically show that incremental construction of these graphs can be performed with O(n log n) computational complexity per time window. Experimental evaluation was conducted using widely referenced datasets in the literature (CIC-IDS2017 and UNSW-NB15) and controlled scenarios of malware execution in an isolated laboratory environment. The results showed consistent improvement in relative F1-score and a qualitative reduction in operational noise compared with isolated sensors. In addition, additional case studies in simulated enterprise and healthcare infrastructures demonstrated reduced detection time for attack chains involving credential dumping and lateral movement. This study provides a mathematical formulation of ATT&CK-oriented temporal correlation, a reproducible architecture based on widely adopted tools, and a critical analysis of the statistical limitations associated with intrusion detection in environments where attacks occur infrequently.

2008-04-04Read paper →Detection

Hybrid Multilayer Detection Architecture Based on Endpoint, Network, and Memory Telemetry with MITRE ATT&CK-Oriented Probabilistic Temporal Correlation

TITLE: Hybrid Multilayer Detection Architecture Based on Endpoint, Network, and Memory Telemetry with MITRE ATT&CK-Oriented Probabilistic Temporal Correlation ABSTRACT: The growing complexity of intrusion campaigns observed in modern enterprise environments challenges traditional detection architectures based on isolated sensors. Contemporary attacks frequently exploit living-off-the-land (LOLBins) techniques, widely available post-exploitation frameworks, and obfuscated command-and-control channels, resulting in event chains distributed across network, endpoint, and volatile memory. Although tools such as IDS/IPS, EDR, and SIEM platforms are widely adopted, their analytical integration remains limited by predominantly syntactic correlation models, unable to capture temporal and semantic dependencies among heterogeneous events. The MITRE ATT&CK framework has become established as an operational ontology for describing Tactics, Techniques, and Procedures (TTPs), yet its use in detection systems is often restricted to static mappings or descriptive visualizations. In this work, we propose a hybrid multilayer detection architecture that integrates network, endpoint, and memory telemetry with a formal mechanism for probabilistic temporal correlation semantically aligned with the ATT&CK model. The architecture combines widely used sensors — including Suricata, Sysmon, Volatility 3, and Sigma/YARA rules — with an ingestion layer based on Kafka and structured indexing according to the Elastic Common Schema. We formalize the detection process as an inference-under-uncertainty problem, modeled by weighted temporal graphs in which events represent vertices annotated with ATT&CK techniques and edges represent semantically compatible transitions within a defined temporal window. We introduce a conditional risk function that integrates contextual probabilities of individual techniques and transition weights between TTPs, enabling estimation of the plausibility of complete attack chains. We analytically demonstrate that the incremental construction of these graphs can be performed with complexity O(n log n) per temporal window using time-indexed structures. The experimental evaluation was conducted using widely referenced datasets in the literature (CIC-IDS2017 and UNSW-NB15) and controlled malware execution scenarios in an isolated laboratory. The results indicate consistent improvements in relative F1-score metrics and qualitative reduction of operational noise when compared to isolated sensors. Additional case studies in simulated enterprise environments and in hospital infrastructure demonstrate reduced detection time for attack chains involving credential dumping and lateral movement. The work contributes a mathematical formalization of ATT&CK-oriented temporal correlation, a reproducible architecture based on widely adopted tools, and a critical analysis of the statistical limitations associated with intrusion detection in low-prevalence attack environments.

2008-04-04Read paper →Detection

A Multi-Layer Detection Hybrid Architecture Using MITRE ATT&CK-Oriented Probabilistic Temporal Correlation Based on Endpoint, Network, and Memory Telemetry

TITLE: A Multi-Layer Detection Hybrid Architecture Using MITRE ATT&CK-Oriented Probabilistic Temporal Correlation Based on Endpoint, Network, and Memory Telemetry ABSTRACT: The increasing complexity of intrusion campaigns observed in modern enterprise environments poses challenges for conventional detection architectures based on isolated sensors. Today’s attacks often exploit living-off-the-land (LOLBins) techniques, widely available post-exploitation frameworks, and obfuscated command-and-control channels, resulting in chains of events distributed across network, endpoint, and volatile memory. Although tools such as IDS/IPS, EDR, and SIEM platforms are widely adopted, their analytical integration remains constrained mainly to syntactic correlation models and cannot capture the temporal and semantic dependencies that exist among diverse events. The MITRE ATT&CK framework has been established as an operational ontology for describing Tactics, Techniques and Procedures (TTPs), but its use in detection systems is often limited to static mapping and descriptive visualization. In this study, we propose a multi-layer detection hybrid architecture that integrates network, endpoint, and memory telemetry and provides a formal probabilistic temporal correlation mechanism semantically aligned with the ATT&CK model. This architecture combines a widely used sensor set including Suricata, Sysmon, Volatility 3, and Sigma/YARA rules with a Kafka-based ingestion layer and indexing structured according to the Elastic Common Schema. We formulate the detection process as an inference problem under uncertainty and model it as a weighted temporal graph, where events represent vertices annotated with ATT&CK techniques and edges represent semantically compatible transitions within a defined time window. Furthermore, we introduce a conditional risk function that integrates the contextual probability of individual techniques and transition weights between TTPs, enabling estimation of the likelihood of the entire attack chain. Using a time-indexed structure, we analytically show that incremental construction of these graphs can be performed with O(n log n) computational complexity per time window. Experimental evaluation was conducted using widely referenced datasets in the literature (CIC-IDS2017 and UNSW-NB15) and controlled scenarios of malware execution in an isolated laboratory environment. The results showed consistent improvements in relative F1-score and a qualitative reduction in operational noise compared with isolated sensors. In addition, additional case studies in simulated enterprise and healthcare infrastructure demonstrated shorter detection times for attack chains involving credential dumping and lateral movement. This study provides a mathematical formulation of ATT&CK-oriented temporal correlation, a reproducible architecture based on widely adopted tools, and a critical analysis of the statistical limitations associated with intrusion detection in low-incident environments.

2008-04-04Read paper →Detection

Hybrid Architecture Based on Multilayer Telemetry and Semantic Correlation for Advanced Threat Detection in Enterprise Environments

TITLE: Hybrid Architecture Based on Multilayer Telemetry and Semantic Correlation for Advanced Threat Detection in Enterprise Environments ABSTRACT: TITLE: Hybrid Architecture Based on Multilayer Telemetry and Semantic Correlation for Advanced Threat Detection in Enterprise Environments ABSTRACT: TITLE: Hybrid Architecture Based on Multilayer Telemetry and Semantic Correlation for Advanced Threat Detection in Enterprise Environments ABSTRACT: The growing sophistication of cyberattacks, combined with the expansion of hybrid and multicloud infrastructures, imposes substantial challenges on modern security operations (Security Operations Centers – SOCs). Contemporary attack techniques exploit zero-day vulnerabilities, abuse legitimate identities, use living-off-the-land binaries (LOLBins), and complex lateral movement chains, often distributed across endpoints, enterprise networks, and cloud services. In this context, traditional mechanisms based exclusively on signatures or isolated anomaly detection present significant limitations, especially with regard to operational scalability and the reduction of false positives. This article presents a hybrid detection architecture based on multilayer telemetry and semantic event correlation guided by graphs of Tactics, Techniques, and Procedures (TTPs) derived from the MITRE ATT&CK framework. The proposal integrates network sensors, endpoint telemetry, identity events, and cloud-native environment logs, incorporating contemporary components such as eBPF-based instrumentation and integration with CNAPP (Cloud-Native Application Protection Platform) platforms. We formalize the detection process as a problem of inference over dynamic event graphs, in which sequences of observable activities are mapped to ATT&CK techniques and semantically correlated to identify attack chains. The model combines three complementary paradigms: signature-based detection (YARA and Suricata), structured behavioral rules (Sigma), and statistical analysis of behavioral patterns. We experimentally evaluated the architecture using a dataset composed of widely used academic benchmarks (UNSW-NB15 and CIC-IDS2017) and controlled red teaming campaigns conducted in a simulated enterprise environment. The results indicate a significant improvement in performance metrics: precision of 0.89, recall of 0.83, and F1-score of 0.86, in addition to a 38.2% reduction in the false positive rate compared with isolated approaches. A reduction in mean time to detect (MTTD) from 6.1 to 4.2 minutes was also observed. The results demonstrate that semantic correlation based on TTP graphs, combined with multilayer telemetry, represents a promising approach to improving the operational effectiveness of contemporary SOCs in complex enterprise scenarios.

2008-03-28Read paper →Detection

Hybrid Architecture Based on Multi-Layer Telemetry and Semantic Correlation for Advanced Threat Detection in Enterprise Environments

TITLE: Hybrid Architecture Based on Multi-Layer Telemetry and Semantic Correlation for Advanced Threat Detection in Enterprise Environments ABSTRACT: Hybrid Architecture Based on Multi-Layer Telemetry and Semantic Correlation for Advanced Threat Detection in Enterprise Environments ABSTRACT: TITLE: Hybrid Architecture Based on Multi-Layer Telemetry and Semantic Correlation for Advanced Threat Detection in Enterprise Environments ABSTRACT: The increasing sophistication of cyberattacks, together with the expansion of hybrid and multicloud infrastructures, poses substantial challenges to modern security operations (Security Operations Centers – SOCs). Contemporary attack techniques exploit zero-day vulnerabilities, abuse legitimate identities, use living-off-the-land binaries (LOLBins), and rely on complex lateral movement chains, often distributed across endpoints, corporate networks, and cloud services. In this context, traditional mechanisms based exclusively on signatures or isolated anomaly detection present significant limitations, especially with regard to operational scalability and the reduction of false positives. This paper presents a hybrid detection architecture based on multi-layer telemetry and graph-oriented semantic correlation of events driven by Tactics, Techniques, and Procedures (TTPs) derived from the MITRE ATT&CK framework. The proposal integrates network sensors, endpoint telemetry, identity events, and logs from cloud-native environments, incorporating contemporary components such as eBPF-based instrumentation and integration with CNAPP (Cloud-Native Application Protection Platform) platforms. We formalize the detection process as a problem of inference over dynamic event graphs, in which sequences of observable activities are mapped to ATT&CK techniques and semantically correlated to identify attack chains. The model combines three complementary paradigms: signature-based detection (YARA and Suricata), structured behavioral rules (Sigma), and statistical analysis of behavioral patterns. We experimentally evaluated the architecture using a dataset composed of widely used academic benchmarks (UNSW-NB15 and CIC-IDS2017) and controlled red teaming campaigns conducted in a simulated enterprise environment. The results indicate a significant improvement in performance metrics: precision of 0.89, recall of 0.83, and F1-score of 0.86, in addition to a 38.2% reduction in the false positive rate compared with isolated approaches. A reduction in mean time to detect (MTTD) from 6.1 to 4.2 minutes was also observed. The results demonstrate that TTP graph-based semantic correlation, combined with multi-layer telemetry, represents a promising approach to enhancing the operational effectiveness of contemporary SOCs in complex enterprise scenarios.

2008-03-28Read paper →Detection

Multilevel Adaptive Detection of Cyber Threats Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs

TITLE: Multilevel Adaptive Detection of Cyber Threats Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs ABSTRACT: TITLE: Multilevel Adaptive Detection of Cyber Threats Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs ABSTRACT: The growing complexity of contemporary digital infrastructures, characterized by hybrid cloud environments, distributed architectures, and massive operational telemetry streams, poses substantial challenges to the early detection of cyber threats. Traditional Security Information and Event Management (SIEM) systems, based on deterministic rules, exhibit structural limitations in identifying multi-stage campaigns, particularly when adversaries use legitimate credentials, stealthy lateral movement, and evasion techniques. In parallel, purely machine learning-based approaches often suffer from degradation under distribution shifts and lack operational interpretability. In this work, we present a multilevel adaptive detection architecture that integrates incremental Bayesian fusion of evidence with structural modeling based on temporal attack graphs. The proposed approach enables correlation of heterogeneous telemetry from endpoints, networks, identities, and cloud environments, while preserving explicit temporal dependencies among events and semantic alignment with the MITRE ATT&CK taxonomy. We formalize the problem as probabilistic inference over attack chains in a dynamic graph G_t=(V_t,E_t,w_t), in which the weights represent conditional probabilities of malicious behavior. We developed an incremental Bayesian updating mechanism capable of processing streams exceeding 10^6 events per minute, while maintaining probabilistic convergence and low operational latency. The implementation was built on a stream processing architecture based on Apache Kafka and Apache Flink, with graph persistence in Neo4j and state management in RocksDB. Experimental evaluations were conducted using the UNSW-NB15 and CIC-IDS2017 datasets, as well as an anonymized enterprise corpus containing approximately 400 million events. Compared with rule-based approaches, Random Forest, and LSTM networks, the proposed method achieved an average precision of 0.91, a recall of 0.88, and an F1-score of 0.89, while reducing the false positive rate by 42% relative to conventional SIEM systems. The results show that probabilistic fusion of telemetry, combined with the structural representation of attack chains, provides substantial gains in robustness, interpretability, and scalability. We also discuss the implications for modern cloud security architectures, integration with CNAPP platforms, and the limitations associated with a priori modeling of adversarial assumptions.

2008-03-21Read paper →Detection

Adaptive Multilevel Detection of Cyber Threats Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs

TITLE: Adaptive Multilevel Detection of Cyber Threats Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs ABSTRACT: TITLE: Adaptive Multilevel Detection of Cyber Threats Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs ABSTRACT: The increasing complexity of contemporary digital infrastructures, characterized by hybrid cloud environments, distributed architectures, and massive operational telemetry streams, poses substantial challenges to the early detection of cyber threats. Traditional security information and event management (SIEM) systems, based on deterministic rules, exhibit structural limitations in identifying multi-stage campaigns, especially when adversaries use legitimate credentials, discreet lateral movement, and evasion techniques. In parallel, purely machine-learning-based approaches often suffer from degradation under distribution shifts and lack operational interpretability. In this work, we present a multilevel adaptive detection architecture that integrates incremental Bayesian evidence fusion with structural modeling based on temporal attack graphs. The proposed approach makes it possible to correlate heterogeneous telemetry from endpoints, networks, identities, and cloud environments, while preserving explicit temporal dependencies between events and semantic alignment with the MITRE ATT&CK taxonomy. We formalize the problem as probabilistic inference over attack chains in a dynamic graph G_t=(V_t,E_t,w_t), in which the weights represent conditional probabilities of malicious behavior. We developed an incremental Bayesian update mechanism capable of processing streams exceeding 10^6 events per minute, while maintaining probabilistic convergence and low operational latency. The implementation was carried out on a stream-processing architecture based on Apache Kafka and Apache Flink, with graph persistence in Neo4j and state management in RocksDB. Experimental evaluations were conducted using the UNSW-NB15 and CIC-IDS2017 datasets and an anonymized enterprise corpus containing approximately 400 million events. In comparison with rule-based approaches, Random Forest, and LSTM networks, the proposed method achieved an average precision of 0.91, a recall of 0.88, and an F1-score of 0.89, while reducing the false positive rate by 42% relative to conventional SIEM systems. The results show that probabilistic fusion of telemetry, combined with the structural representation of attack chains, offers substantial gains in robustness, interpretability, and scalability. We also discuss the implications for modern cloud security architectures, integration with CNAPP platforms, and the limitations associated with a priori modeling of adversarial assumptions.

2008-03-21Read paper →Detection

Multi-stage Adaptive Cyber Threat Detection Based on Bayesian Fusion of Telemetry and Attack Temporal Graphs

TITLE: Multi-stage Adaptive Cyber Threat Detection Based on Bayesian Fusion of Telemetry and Attack Temporal Graphs ABSTRACT: Modern digital infrastructures are characterized by hybrid cloud environments, distributed architectures, and massive operational telemetry flows, and their increasing complexity poses major challenges for early cyber threat detection. Conventional security information event management (SIEM) systems based on deterministic rules exhibit structural limitations in identifying multi-stage campaigns, especially when attackers exploit legitimate credentials, low-visibility lateral movement, and evasion techniques. At the same time, purely machine learning-based approaches are prone to performance degradation under distribution shift and often lack operational interpretability. In this study, we propose a multi-stage adaptive detection architecture that integrates incremental Bayesian fusion of evidence with structural modeling based on attack temporal graphs. The proposed method correlates heterogeneous telemetry from endpoints, networks, identities, and cloud environments while preserving explicit temporal dependencies among events and semantic alignment with the MITRE ATT&CK taxonomy. The problem is formulated as probabilistic inference over attack chains on a dynamic graph G_t=(V_t,E_t,w_t), where the weights represent conditional probabilities of malicious behavior. Furthermore, we developed an incremental Bayesian update mechanism capable of processing event streams exceeding 10^6 events per minute while maintaining probabilistic convergence and low operational latency. The implementation was carried out on a stream processing architecture based on Apache Kafka and Apache Flink, with Neo4j used for graph persistence and RocksDB for state management. Experimental evaluation was conducted using UNSW-NB15, CIC-IDS2017, and an anonymized enterprise corpus containing approximately 400 million events. Compared with rule-based methods, Random Forest, and LSTM networks, the proposed approach achieved a mean precision of 0.91, recall of 0.88, and F1-score of 0.89, while reducing the false positive rate by 42% relative to conventional SIEM systems. These results indicate that combining probabilistic fusion of telemetry with structural representation of attack chains yields substantial improvements in robustness, interpretability, and scalability. We also discuss limitations related to integration with state-of-the-art cloud security architectures, CNAPP platforms, and prior modeling of adversarial hypotheses.

2008-03-21Read paper →Detection

Adaptive Multilevel Detection of Cyber Threats Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs

TITLE: Adaptive Multilevel Detection of Cyber Threats Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs ABSTRACT: TITLE: Adaptive Multilevel Detection of Cyber Threats Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs ABSTRACT: The increasing complexity of contemporary digital infrastructures, characterized by hybrid cloud environments, distributed architectures, and massive streams of operational telemetry, poses substantial challenges to the early detection of cyber threats. Traditional Security Information and Event Management (SIEM) systems, based on deterministic rules, exhibit structural limitations in identifying multi-stage campaigns, particularly when adversaries use legitimate credentials, stealthy lateral movement, and evasion techniques. At the same time, purely machine learning-based approaches often suffer degradation under distribution shifts and lack operational interpretability. In this work, we present a multilevel adaptive detection architecture that integrates incremental Bayesian fusion of evidence with structural modeling based on temporal attack graphs. The proposed approach enables the correlation of heterogeneous telemetry from endpoints, networks, identities, and cloud environments, while preserving explicit temporal dependencies between events and semantic alignment with the MITRE ATT&CK taxonomy. We formalize the problem as probabilistic inference over attack chains in a dynamic graph G_t=(V_t,E_t,w_t), in which the weights represent conditional probabilities of malicious behavior. We developed an incremental Bayesian updating mechanism capable of processing streams exceeding 10^6 events per minute, while maintaining probabilistic convergence and low operational latency. The implementation was carried out on a stream-processing architecture based on Apache Kafka and Apache Flink, with graph persistence in Neo4j and state management in RocksDB. Experimental evaluations were conducted using the UNSW-NB15, CIC-IDS2017 datasets, and an anonymized enterprise corpus containing approximately 400 million events. Compared with rule-based approaches, Random Forest, and LSTM networks, the proposed method achieved a mean precision of 0.91, a recall of 0.88, and an F1-score of 0.89, while reducing the false positive rate by 42% relative to conventional SIEM systems. The results show that probabilistic fusion of telemetry, combined with the structural representation of attack chains, provides substantial gains in robustness, interpretability, and scalability. We also discuss the implications for modern cloud security architectures, integration with CNAPP platforms, and the limitations associated with a priori modeling of adversarial hypotheses.

2008-03-21Read paper →Detection

Adaptive Multilevel Cyber Threat Detection Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs

TITLE: Adaptive Multilevel Cyber Threat Detection Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs ABSTRACT: TITLE: Adaptive Multilevel Cyber Threat Detection Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs ABSTRACT: The growing complexity of contemporary digital infrastructures, characterized by hybrid cloud environments, distributed architectures, and massive streams of operational telemetry, poses substantial challenges for the early detection of cyber threats. Traditional security information and event management (SIEM) systems, based on deterministic rules, present structural limitations in identifying multi-stage campaigns, particularly when adversaries use legitimate credentials, discrete lateral movement, and evasion techniques. In parallel, purely machine learning-based approaches often suffer degradation under distribution shifts and lack operational interpretability. In this work, we present a multilevel adaptive detection architecture that integrates incremental Bayesian evidence fusion with structural modeling based on temporal attack graphs. The proposed approach makes it possible to correlate heterogeneous telemetry from endpoints, networks, identities, and cloud environments while preserving explicit temporal dependencies between events and semantic alignment with the MITRE ATT&CK taxonomy. We formalize the problem as probabilistic inference over attack chains in a dynamic graph G_t=(V_t,E_t,w_t), in which weights represent conditional probabilities of malicious behavior. We developed an incremental Bayesian update mechanism capable of processing streams exceeding 10^6 events per minute while maintaining probabilistic convergence and low operational latency. The implementation was carried out on a stream processing architecture based on Apache Kafka and Apache Flink, with graph persistence in Neo4j and state management in RocksDB. Experimental evaluations were conducted using the UNSW-NB15 and CIC-IDS2017 datasets and an anonymized enterprise corpus containing approximately 400 million events. Compared with rule-based approaches, Random Forest, and LSTM networks, the proposed method achieved a mean precision of 0.91, a recall of 0.88, and an F1-score of 0.89, while reducing the false positive rate by 42% relative to conventional SIEM systems. The results show that probabilistic telemetry fusion, combined with the structural representation of attack chains, offers substantial gains in robustness, interpretability, and scalability. We also discuss the implications for modern cloud security architectures, integration with CNAPP platforms, and the limitations associated with a priori modeling of adversarial assumptions.

2008-03-21Read paper →Detection

Multilevel Adaptive Cyber Threat Detection Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs

TITLE: Multilevel Adaptive Cyber Threat Detection Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs ABSTRACT: TITLE: Multilevel Adaptive Cyber Threat Detection Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs ABSTRACT: The increasing complexity of contemporary digital infrastructures, characterized by hybrid cloud environments, distributed architectures, and massive streams of operational telemetry, imposes substantial challenges for the early detection of cyber threats. Traditional Security Information and Event Management (SIEM) systems, based on deterministic rules, exhibit structural limitations in identifying multi-stage campaigns, particularly when adversaries use legitimate credentials, discreet lateral movement, and evasion techniques. In parallel, purely machine learning-based approaches often suffer degradation under distribution shifts and lack operational interpretability. In this work, we present a multilevel adaptive detection architecture that integrates incremental Bayesian evidence fusion with structural modeling based on temporal attack graphs. The proposed approach enables correlation of heterogeneous telemetry from endpoints, networks, identities, and cloud environments, while preserving explicit temporal dependencies between events and semantic alignment with the MITRE ATT&CK taxonomy. We formalize the problem as probabilistic inference over attack chains in a dynamic graph G_t=(V_t,E_t,w_t), in which the weights represent conditional probabilities of malicious behavior. We developed an incremental Bayesian update mechanism capable of processing streams exceeding 10^6 events per minute, while maintaining probabilistic convergence and low operational latency. The implementation was realized on a stream-processing architecture based on Apache Kafka and Apache Flink, with graph persistence in Neo4j and state management in RocksDB. Experimental evaluations were conducted using the UNSW-NB15 and CIC-IDS2017 datasets and an anonymized enterprise corpus containing approximately 400 million events. Compared with rule-based approaches, Random Forest, and LSTM networks, the proposed method achieved an average precision of 0.91, a recall of 0.88, and an F1-score of 0.89, while reducing the false positive rate by 42% relative to conventional SIEM systems. The results show that probabilistic fusion of telemetry, combined with the structural representation of attack chains, provides substantial gains in robustness, interpretability, and scalability. We also discuss the implications for modern cloud security architectures, integration with CNAPP platforms, and the limitations associated with a priori modeling of adversarial hypotheses.

2008-03-21Read paper →Detection

Multilayer Hybrid Architecture for Proactive Detection of Advanced Threats Based on Semantic Correlation, Multisource Telemetry, and Adaptive Statistical Models

TITLE: Multilayer Hybrid Architecture for Proactive Detection of Advanced Threats Based on Semantic Correlation, Multisource Telemetry, and Adaptive Statistical Models ABSTRACT: Efficient detection of advanced threats remains one of the main operational challenges in contemporary cybersecurity. Modern enterprise environments are characterized by hybrid infrastructures that combine on-premise resources, public clouds, and containerized workloads, generating massive volumes of heterogeneous telemetry from endpoints, networks, and identity platforms. In this context, traditional detection mechanisms based exclusively on signatures show significant limitations in the face of multistage attacks, fileless malware, and living-off-the-land techniques. This work proposes a multilayer hybrid architecture for proactive detection of advanced threats that integrates semantic correlation based on the MITRE ATT&CK ontology, temporal event analysis, and adaptive statistical models for the identification of anomalous behaviors. We formalize the detection problem as the probabilistic inference of attack chains in heterogeneous event streams, considering operational constraints on latency and acceptable false positive rates. The proposed architecture organizes the detection process into three main layers: (i) collection and normalization of multisource telemetry from network sensors, endpoint agents, and identity logs; (ii) semantic correlation based on ATT&CK technique graphs, capable of identifying plausible sequences of adversary activities; and (iii) adaptive statistical modeling using anomaly detection algorithms, such as Isolation Forest, to identify previously unobserved behavioral deviations. We implemented an operational prototype using Elastic Stack, Suricata, Sysmon, and Wazuh, integrated with threat intelligence sources via MISP. The experimental evaluation was conducted in a controlled environment containing multiple Windows and Linux virtual machines, in which realistic attack scenarios were executed using tools widely documented in the offensive security literature, including Metasploit, Cobalt Strike, and Mimikatz. The results demonstrate a substantial improvement in mean time to detect (MTTD), as well as greater coverage of ATT&CK techniques when compared to approaches based exclusively on network IDS. We observed an approximate 37% reduction in MTTD and a 21% increase in the coverage of detected techniques. The results indicate that hybrid architectures combining semantic correlation, statistical analysis, and distributed telemetry constitute a promising approach for modern Security Operations Center (SOC) operations, particularly in hybrid and cloud-native environments.

2008-03-14Read paper →Detection

MULTILAYER ADAPTIVE DETECTION OF ADVANCED THREATS BASED ON BAYESIAN FUSION OF HETEROGENEOUS TELEMETRY AND TEMPORAL GRAPHS

TITLE: MULTILAYER ADAPTIVE DETECTION OF ADVANCED THREATS BASED ON BAYESIAN FUSION OF HETEROGENEOUS TELEMETRY AND TEMPORAL GRAPHS ABSTRACT: The increasing sophistication of cyber threats in 2025, including multi-stage attacks, exploitation of zero-day vulnerabilities, supply chain compromises, identity abuse, and exploitation of generative artificial intelligence models, imposes substantial challenges for traditional detection mechanisms. In this work, we propose a multilayer adaptive detection architecture grounded in recursive Bayesian fusion of heterogeneous telemetry and structural modeling through dynamic temporal graphs. We formalize the problem as inference over a latent binary process representing the presence of malicious activity over time, estimated from observable events originating from network, endpoint, identity, applications, and cloud workloads. The methodology integrates (i) semantic normalization of events, (ii) extraction of statistical and structural features, (iii) incremental construction of temporal graphs, and (iv) Bayesian inference with log-likelihood updates for numerical stability. We further introduce a structural detector based on Kullback–Leibler divergence between distributions of observed topological metrics and historical baselines. We empirically evaluate the model on widely used public datasets (CIC-IDS2017 and UNSW-NB15) and on a corporate dataset containing 2.3 billion anonymized events, comparing it with Random Forest, XGBoost, and LSTM. The results indicate a statistically significant improvement in F1-score and a consistent reduction in false positive rate and mean time to detect lateral movement. We discuss implications in Zero Trust and CNAPP environments, robustness to concept drift, and risks of data poisoning. We demonstrate that coherent probabilistic fusion of multiple weak signals, combined with structural analysis of temporal graphs, provides substantial gains in precision and latency while maintaining operational scalability in modern distributed architectures.

2007-04-29Read paper →Detection

Adaptive Detection of Advanced Persistent Threats by Multimodal Temporal Modeling and Large-Scale Probabilistic Inference

TITLE: Adaptive Detection of Advanced Persistent Threats by Multimodal Temporal Modeling and Large-Scale Probabilistic Inference ABSTRACT: The increasing sophistication of Advanced Persistent Threats (APTs) in hybrid and cloud-native environments imposes substantial challenges for the early detection of compromises. In 2025, the operational landscape incorporates multi-cloud architectures, CNAPP (Cloud-Native Application Protection Platforms), ephemeral workloads, telemetry via eBPF, and emerging risks associated with large language models (LLMs). In this work, we propose a formal model for adaptive APT detection based on the integration of multimodal dynamic graphs and multivariate Hawkes processes, structured under an explicit Bayesian perspective. We formalize the event flow as a heterogeneous temporal sequence and model the propagation of malicious activity as a self-exciting process with spectral stability constraints. The optimal decision is derived under 0–1 loss with an explicit false-positive rate constraint, addressing the fundamental base rate problem. We implemented the architecture in a distributed environment with Apache Kafka, Apache Flink, and distributed storage, incorporating eBPF-based telemetry extraction and contextual enrichment aligned with MITRE ATT&CK. We evaluated the model on the CIC-IDS2017 and DARPA Transparent Computing datasets, as well as on an anonymized enterprise dataset with 2.3 billion events. The results demonstrate a statistically significant gain (p < 0.01) in F1-score, a 38% reduction in false-positive rate, and an AUC of 0.97 compared with baselines such as Isolation Forest, LSTM, and Sigma rules. We also discuss implications for the security of AI-based systems, model governance, and integration with emerging post-quantum controls. We conclude that relational probabilistic modeling provides a robust theoretical basis and operationally viable foundation for large-scale adaptive detection, compatible with contemporary requirements for observability, compliance, and cyber resilience.

2007-04-22Read paper →Detection

Adaptive Detection of Advanced Persistent Threats through Multimodal Temporal Modeling and Large-Scale Probabilistic Inference

TITLE: Adaptive Detection of Advanced Persistent Threats through Multimodal Temporal Modeling and Large-Scale Probabilistic Inference ABSTRACT: The increasing sophistication of Advanced Persistent Threats (APTs) in hybrid and cloud-native environments poses substantial challenges to the early detection of compromises. By 2025, the operational landscape incorporates multi-cloud architectures, CNAPP (Cloud-Native Application Protection Platforms), ephemeral workloads, telemetry via eBPF, and emerging risks associated with large language models (LLMs). In this work, we propose a formal model for adaptive APT detection based on the integration of multimodal dynamic graphs and multivariate Hawkes processes, structured under an explicit Bayesian perspective. We formalize the event flow as a heterogeneous temporal sequence and model the propagation of malicious activity as a self-exciting process with spectral stability constraints. The optimal decision rule is derived under 0–1 loss with an explicit false-positive rate constraint, addressing the fundamental base rate problem. We implement the architecture in a distributed environment using Apache Kafka, Apache Flink, and distributed storage, incorporating eBPF-based telemetry extraction and contextual enrichment aligned with MITRE ATT&CK. We evaluate the model on the CIC-IDS2017 and DARPA Transparent Computing datasets, as well as on an anonymized corporate dataset containing 2.3 billion events. The results demonstrate a statistically significant gain (p < 0.01) in F1-score, a 38% reduction in the false-positive rate, and an AUC of 0.97 compared with baselines such as Isolation Forest, LSTM, and Sigma rules. We further discuss implications for the security of AI-based systems, model governance, and integration with emerging post-quantum controls. We conclude that relational probabilistic modeling provides a robust theoretical and operationally viable foundation for large-scale adaptive detection, compatible with contemporary requirements for observability, compliance, and cyber resilience.

2007-04-22Read paper →Detection

ADAPTIVE MULTI-LAYER DETECTION OF ADVANCED THREATS BASED ON PROBABILISTIC FUSION AND CONTINUOUS LEARNING IN HETEROGENEOUS ENTERPRISE ENVIRONMENTS

TITLE: ADAPTIVE MULTI-LAYER DETECTION OF ADVANCED THREATS BASED ON PROBABILISTIC FUSION AND CONTINUOUS LEARNING IN HETEROGENEOUS ENTERPRISE ENVIRONMENTS ABSTRACT: Threat detection in contemporary enterprise environments has become a structurally complex problem due to the convergence of hybrid infrastructures, multicloud architectures, mobile devices, containerized workloads, surfaces exposed through APIs, and the growing integration of systems based on artificial intelligence. Recent reports indicate that compromised credentials, exploitation of known vulnerabilities, and abuse of legitimate tools continue to rank among the primary intrusion vectors, while the average attacker dwell time remains significant, highlighting limitations in traditional detection mechanisms (VERIZON, 2024; MANDIANT, 2023). In this work, we formalize the near-real-time detection problem as probabilistic inference over a latent state of systemic compromise, modeled by a Markov process and estimated through the fusion of heterogeneous evidence originating from multiple telemetry layers. We propose the AMuLeT framework (Adaptive Multi-Layer Threat detection), which combines supervised classifiers and layer-specific autoencoders, integrated through a logarithmic likelihood ratio rule under an approximate conditional independence assumption. We further introduce a continuous learning mechanism with elastic regularization to mitigate concept drift and adversarial evolution while preserving historically relevant parameters. We empirically evaluate the approach using widely adopted public datasets and a large-scale enterprise dataset totaling billions of events. The results demonstrate statistically significant gains in AUC, F1-score, false positive rate, and reduction of mean detection time when compared with isolated models. We discuss practical implications in light of NIST recommendations and contemporary trends such as CNAPP, eBPF, and security for large language models, outlining future extensions involving dynamic graphs and federated learning with formal differential privacy guarantees.

2007-04-15Read paper →Detection

Adaptive Multilayer Detection of Advanced Threats Based on Probabilistic Fusion and Continual Learning in Heterogeneous Enterprise Environments

TITLE: Adaptive Multilayer Detection of Advanced Threats Based on Probabilistic Fusion and Continual Learning in Heterogeneous Enterprise Environments ABSTRACT: Threat detection in contemporary enterprise environments has become a structurally complex problem due to the convergence of hybrid infrastructures, multicloud architectures, mobile devices, containerized workloads, surfaces exposed by APIs, and the growing integration of AI-based systems. Recent reports indicate that compromised credentials, exploitation of known vulnerabilities, and abuse of legitimate tools continue to rank among the main intrusion vectors, while the attacker dwell time remains significant, highlighting limitations in traditional detection mechanisms (VERIZON, 2024; MANDIANT, 2023). In this work, we formalize the problem of near real-time detection as probabilistic inference over a latent state of systemic compromise, modeled by a Markov process and estimated via fusion of heterogeneous evidence from multiple telemetry layers. We propose the AMuLeT (Adaptive Multi-Layer Threat detection) framework, which combines supervised classifiers and autoencoders by layer, integrated through a log-likelihood ratio rule under the assumption of approximate conditional independence. We further introduce a continual learning mechanism with elastic regularization to mitigate concept drift and adversarial evolution, preserving historically relevant parameters. We empirically evaluate the approach on widely used public datasets and on a large-scale enterprise dataset, totaling billions of events. The results demonstrate statistically significant gains in AUC, F1-score, false positive rate, and reduction in mean detection time, when compared to isolated models. We discuss practical implications in light of NIST recommendations and contemporary trends such as CNAPP, eBPF, and the security of large language models, outlining future extensions involving dynamic graphs and federated learning with formal differential privacy guarantees.

2007-04-15Read paper →Detection

Hybrid and Adaptive Detection of Cyber Threats in Enterprise Environments Using Multilevel Temporal Correlation and Self-Supervised Representation Learning

TITLE: Hybrid and Adaptive Detection of Cyber Threats in Enterprise Environments Using Multilevel Temporal Correlation and Self-Supervised Representation Learning ABSTRACT: The detection of cyber threats in contemporary enterprise environments requires mechanisms capable of correlating heterogeneous events, modeling complex temporal dependencies, and adapting to adversaries who exploit valid credentials, fileless techniques, and multistage chains aligned with MITRE ATT&CK. In this work, we propose a hybrid architecture that integrates self-supervised representation learning, hierarchical temporal modeling, and probabilistic correlation in dynamic graphs, aiming to reduce false positives without compromising sensitivity under concept drift. We formalize the problem as the estimation of $P(Y=1 \mid G_{t-k:t})$, where $G_{t-k:t}$ represents a sliding window of temporal graphs extracted from multiple telemetry sources (authentication logs, endpoint events, network flows, and cloud telemetry). The self-supervised component is based on temporal contextual prediction with lightweight Transformers, enabling the learning of robust semantic embeddings in the absence of abundant labels. The multilevel correlation stage employs log-linear potentials defined over subgraphs coherent with ATT&CK techniques, ensuring operational interpretability. We implemented the solution on distributed infrastructure with Apache Kafka, Apache Flink, PyTorch, and Neo4j, achieving sustained throughput of 120 thousand events per second on a 24-node cluster. We evaluated the model on the CIC-IDS2017 dataset, the LANL Cybersecurity Dataset, and on a corporate dataset containing 4.2 billion events. We observed an average AUC of 0.982, F1 of 0.941, TPR of 96.4%, and FPR of 3.1%, representing a relative reduction of 38% in false positives compared to baselines such as Isolation Forest, DeepLog, and LSTM Autoencoders ($p < 0{,}01$). We discuss implications for integration with SIEM and CNAPP platforms, as well as extensions involving federated learning with differential privacy and adversarial robustness. The results demonstrate that the combination of self-supervised representation and probabilistic structural correlation constitutes a promising approach for large-scale adaptive detection up to the state of the art of 2025.

2007-04-08Read paper →