Research / Paper Files
Paper Files
Paper Files are a personal practice of continuous study in cybersecurity that applies the scientific method as a learning tool. Each article is written not for academic publication, but as a deliberate exercise to sharpen the axe — deepening knowledge on specific topics, organizing ideas with rigor, and observing how understanding of certain subjects develops over time. It is the intellectual equivalent of a training journal: each entry records what was studied, how it was analyzed, and what conclusions emerged.
I strongly recommend that security professionals adopt this method. Choose a topic you want to master, research primary sources (RFCs, papers, official documentation), structure your text with introduction, methodology, analysis, and conclusion, and write as if you were explaining to a colleague. The act of writing forces clarity of thought and exposes gaps in understanding that passive reading cannot reveal. Use the articles on this site as examples of format and depth, and build your own collection — over time, you will have a personal repository of refined knowledge that no course or certification can replace.
DAI & ADAI · 2026
DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts
DAI (Decripte Artificial Intelligence) is a proprietary domain-specific LLM within a governed autonomous defensive architecture. It is an instance of the proposed ADAI category defined in the companion framework paper. T…
Read paper →ADAI · ENAutonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure
ADAI (Autonomous Defensive Artificial Intelligence) is a proposed category of governed autonomous cyber defense. The framework specifies defended perimeters, bounded effects, declared rollback and capability-disjoint ver…
Read paper →16 papers
Incident Response in 2026: AI-Augmented, Cloud-Native, and Identity-Centric Operations for Detecting, Containing, and Eradicating Modern Cyber Intrusions
Incident response (IR) in 2026 is no longer a post-compromise, host-centric discipline focused primarily on malware triage and disk imaging. It has matured into a multi-domain operational function that must unify identity telemetry, cloud control-plane visibility, endpoint detection and response (EDR), security information and event management (SIEM), extended detection and response (XDR), eBPF-driven runtime data, and governance for AI-enabled workflows. This paper presents a practical, publication-ready framework for modern IR that reflects the realities of 2026: adversaries increasingly abuse valid accounts, cloud APIs, OAuth consent, remote management tooling, SaaS collaboration features, and AI-assisted social engineering, while defenders must compress dwell time under constrained analyst capacity. We formalize the IR problem as an optimization over time-to-detect, time-to-contain, and probability of successful eradication, subject to evidence preservation and business continuity constraints. Building on NIST guidance, MITRE ATT&CK, and contemporary cloud and identity defense practices, we propose an operational methodology centered on identity-first scoping, graph-based entity correlation, tiered containment playbooks, and post-incident hardening loops. The methodology is implemented using widely deployed 2026-era tools such as Velociraptor, Sigma, YARA, osquery, Wazuh, Zeek, Suricata, Splunk, Microsoft Sentinel, Elastic Security, CrowdStrike Falcon, and eBPF-based sensors. We evaluate the approach through comparative experiments and a realistic intrusion case study involving stolen credentials, OAuth abuse, cloud persistence, and cross-environment lateral movement. Results show that identity-centric scoping reduces mean time to scope by 41%, while automated containment workflows reduce median dwell time by 57% without materially increasing false-positive business interruptions. The paper concludes that effective IR in 2026 requires treating identity, cloud, endpoint, and AI governance as a single operational surface rather than separate domains.
Read paper →IRIncident Response in Cybersecurity in 2026: A Zero-Trust, Telemetry-Driven, and AI-Assisted Methodology for High-Fidelity Detection, Containment, and Recovery
Incident response (IR) has evolved from a largely forensic, ticket-driven discipline into a continuous, telemetry-rich, decision-intensive security function that must operate across cloud, endpoint, identity, software supply chain, and AI-enabled environments. By 2026, defenders face adversaries that routinely combine credential theft, valid account abuse, living-off-the-land execution, rapid cloud persistence, and automated social engineering. In parallel, organizations have adopted zero trust architectures, CNAPP platforms, eBPF-based runtime visibility, and AI-assisted security operations, yet operational gaps remain in detection fidelity, containment speed, evidence preservation, and cross-domain coordination. This paper presents a full-length research study on IR as a formal cybersecurity capability in 2026, focusing on how modern enterprises can reduce mean time to contain while preserving forensic integrity and business continuity. We propose a methodology that integrates threat-informed triage, graph-based incident scoping, evidence-grade telemetry collection, containment playbooks, and recovery validation with explicit utility constraints. The methodology is grounded in a formal problem model that balances detection latency, false-positive cost, and operational disruption. We further present an implementation blueprint using contemporary tools such as Velociraptor, Sigma, YARA, Sysmon, Zeek, Wazuh, eBPF sensors, and cloud-native event pipelines. An experimental evaluation framework compares telemetry sources and response strategies across endpoint, identity, and cloud incidents, illustrating measurable trade-offs in precision, containment time, and investigative workload. A detailed case study of a hybrid ransomware intrusion demonstrates how identity telemetry, endpoint event correlation, and cloud control-plane logs can reconstruct attacker behavior and support safe recovery. The paper concludes by discussing AI governance, post-quantum readiness, and the operationalization of IR in environments where adversaries and defenders increasingly co-evolve through automation.
Read paper →IRIncident Response in 2026: AI-Assisted Detection, Containment, and Recovery for Cloud-Native, Identity-Centric, and Ransomware-Driven Cyber Incidents
Incident response (IR) in 2026 operates in a materially different threat and technology environment than the one that shaped classical playbooks. Modern incidents increasingly traverse hybrid identity fabrics, SaaS control planes, cloud workloads, endpoint fleets, and data pipelines, while adversaries exploit stolen credentials, living-off-the-land tooling, software supply chains, and AI-enabled social engineering. At the same time, defenders can leverage mature zero trust architectures, eBPF-based telemetry, cloud-native application protection platforms, security information and event management systems with scalable analytics, and large-language-model-assisted triage under strict governance. This paper proposes a publication-ready IR methodology for 2026 that is optimized for identity-first intrusions, ransomware, cloud control-plane abuse, and high-volume alert conditions. The method formalizes incident response as a constrained optimization problem over detection latency, containment blast radius, evidence integrity, and business availability, and then maps those objectives to a practical operational workflow spanning preparation, detection, analysis, containment, eradication, recovery, and post-incident improvement. We present an implementation architecture integrating endpoint, identity, cloud, and network signals; a decision matrix for containment sequencing; and a tiered workflow for analyst augmentation using AI systems without delegating authoritative judgments. Experimental evaluation is provided through realistic scenarios derived from contemporary enterprise and public-sector incidents, including credential theft, privileged access abuse, and ransomware. The results show that identity-aware containment and cloud-side revocation reduce mean time to contain more effectively than host-only actions in multi-tenant environments, while evidentiary rigor and rollback planning reduce recovery risk. A detailed case study illustrates how the approach addresses a modern hybrid intrusion. The paper concludes with practical guidance for 2026-ready IR programs, emphasizing measurable service objectives, immutable logging, tabletop exercises, and governance for AI-assisted operations.
Read paper →IRIncident Response in 2026: A Risk-Based, Telemetry-Driven Framework for Cloud, Identity, Endpoint, and AI-Enabled Environments
Incident response in 2026 operates under a materially different threat landscape than the one that shaped classical playbooks a decade earlier. Cloud control planes, identity providers, SaaS collaboration layers, endpoint telemetry pipelines, and AI-assisted attack workflows now define the practical scope of compromise. This paper presents a publication-ready research treatment of incident response (IR) as a socio-technical cyber defense function that must integrate detection engineering, adversary emulation, containment automation, evidence preservation, and governance across hybrid estates. We formalize IR as an optimization problem under uncertainty, where time-to-contain, evidentiary integrity, business criticality, and operational safety are jointly minimized subject to legal, technical, and organizational constraints. Building on mature frameworks such as NIST SP 800-61r2, the Lockheed Martin kill chain, MITRE ATT&CK, cloud-native detection methods, and modern zero trust architectures, we propose a risk-based methodology designed for 2026 conditions: identity-first compromise, living-off-the-land tradecraft, cloud abuse, token theft, ransomware extortion, and AI-enabled social engineering. The paper details an implementation architecture that fuses SIEM, SOAR, EDR, CSPM, CNAPP, eBPF telemetry, and secure case management into a closed-loop response system with measurable service-level objectives. We then evaluate the methodology using realistic scenarios drawn from public incident patterns, including identity compromise, email-borne initial access, cloud persistence, and ransomware staging. Results show that telemetry fusion and preapproved containment actions reduce mean time to contain while preserving forensic quality, provided that governance thresholds and evidence-handling controls are rigorously enforced. Finally, we analyze a real-world-style case study involving a hybrid Microsoft 365 and AWS environment and derive lessons for 2026-era IR programs facing AI-mediated attacker adaptation, regulatory pressure, and operational complexity.
Read paper →IRFormal and Operational Architecture for Evidence-Driven Incident Response with Multilayer Correlation and Automated Orchestration
TITLE: Formal and Operational Architecture for Evidence-Driven Incident Response with Multilayer Correlation and Automated Orchestration ABSTRACT: The growing complexity of digital infrastructures and the increasing volume of security telemetry have made incident response a significant operational challenge for modern organizations. Contemporary enterprise environments generate millions of security events daily, originating from multiple monitoring layers, including network, endpoints, applications, and cloud infrastructure. Although tools such as intrusion detection systems, SIEM platforms, and EDR solutions increase operational visibility, the fragmentation of evidence and the absence of formal correlation models often result in high false-positive rates and delays in incident containment. This work presents a formal and operational architecture for evidence-driven incident response, based on probabilistic temporal correlation of events and automated response orchestration. We model security events as vertices in a weighted temporal graph, in which causal relationships are estimated by a likelihood function conditioned on the temporal and semantic proximity between observable events. The proposed architecture integrates telemetry from network sensors (Suricata), host monitoring (Sysmon and Wazuh), log ingestion pipelines (Elastic Stack and Kafka), and a SOAR-based orchestration layer using TheHive and Cortex. Automatic correlation generates incident hypotheses that trigger response playbooks, including volatile memory collection, execution of YARA rules, and automated isolation of compromised hosts via endpoint security APIs. To empirically evaluate the model, we conducted controlled experiments in a simulated enterprise environment with 200 endpoints and 12 servers, using attack scenarios reproduced through Atomic Red Team aligned with the MITRE ATT&CK framework. The results indicate measurable reductions in critical operational metrics: mean time to detect (MTTD) was reduced from 18.4 to 11.5 minutes, while mean time to respond (MTTR) decreased from 42.7 to 24.7 minutes. In addition, we observed a significant improvement in incident classification performance, with the F1-score increasing from 0.71 to 0.91. The analysis demonstrates that the mathematical formalization of event correlation, combined with evidence-based response automation, contributes to greater analytical accuracy, lower cognitive load for analysts, and faster containment of complex threats.
Read paper →IRData-Driven Architecture for Incident Response in Hybrid Environments: Formalization, Automation, and Orchestration Based on MITRE ATT&CK
TITLE: Data-Driven Architecture for Incident Response in Hybrid Environments: Formalization, Automation, and Orchestration Based on MITRE ATT&CK ABSTRACT: Incident Response (IR) has become a critical component of modern cybersecurity in the face of the exponential rise in targeted attacks, ransomware-as-a-service, and state-sponsored operations. Recent reports indicate that adversary dwell time still exceeds 16 days in complex enterprise environments, even with the adoption of advanced EDR and SIEM solutions. This work proposes a data-driven architecture for IR in hybrid environments (on-premise and cloud), integrating formal threat modeling, MITRE ATT&CK-based correlation, multi-layer detection, and automation with SOAR. We formalize the response process as a multi-objective optimization problem that minimizes containment time and operational impact, subject to constraints on forensic accuracy and business continuity. Our methodology combines structured log ingestion (Sysmon, CloudTrail, Zeek), signature-based detection (Suricata, YARA), graph-based behavioral analysis, and automated orchestration via parameterized playbooks. We implemented two main algorithms: (i) an adaptive incident prioritization mechanism based on Bayesian scoring conditioned on observed TTPs; (ii) a temporal correlation engine with O(n log n) complexity for reconstructing attack chains. We evaluated the solution in a controlled environment with 120 endpoints, 15 servers, and AWS workloads simulating 42 real-world scenarios (including T1059, T1027, T1486). Compared with a traditional SIEM baseline, we achieved an average reduction of 37.4% in MTTR and a 28.6% increase in the contextualized detection rate, with a standard deviation below 4.1%. The results demonstrate that the formal integration of threat modeling, rich telemetry, and orchestrated automation significantly reduces manual effort and improves the consistency of operational decisions. We conclude that the proposed approach establishes a replicable framework for CSIRT and SOC teams operating under real resource constraints and high threat variability.
Read paper →IREvidence-Driven Architecture for Incident Response (IR) Based on Multi-Layer Correlation and Mathematical Formalization of the Response Cycle
TITLE: Evidence-Driven Architecture for Incident Response (IR) Based on Multi-Layer Correlation and Mathematical Formalization of the Response Cycle ABSTRACT: Incident Response (IR) has become one of the strategic pillars of contemporary cybersecurity in the face of the exponential growth of sophisticated attacks, such as human-operated ransomware, APT espionage campaigns, and large-scale exploitation of critical vulnerabilities (e.g., CVE-2021-44228 – Log4Shell). Despite the consolidation of frameworks such as NIST SP 800-61 and MITRE ATT&CK, the practical operationalization of IR still suffers from gaps in multi-source correlation, alert prioritization, and evidence preservation under high time pressure. This paper proposes an evidence-driven architecture for IR based on multi-layer correlation (network, endpoint, identity, and volatile memory), mathematically formalized as an optimization problem over temporal event graphs. Our methodology integrates automated collection (Suricata, Zeek, Sysmon), rule-based detection (Sigma, YARA), memory analysis (Volatility 3), enrichment with threat intelligence (MISP), and behavioral modeling via explicit mapping to MITRE ATT&CK. We define a formal model in which events E = {e1, e2, ..., en} are represented as vertices in a temporal directed graph G=(V, A, T), where edges indicate causal or contextual relationships. We propose two algorithms: (1) Weighted Temporal Correlation (WTC) with complexity O(n log n); and (2) Bayesian Incident Prioritization (BIP), which estimates posterior probability of compromise P(C|E) using incremental updating. In controlled experiments with 12.4 TB of real logs and public datasets (CIC-IDS2017 and DARPA TC), we achieved a 37% reduction in mean time to triage (MTTT) and a 22% increase in true detection rate (TPR), while keeping FPR below 4.8%. The evaluation shows that the formal integration of multiple forensic layers significantly reduces false positives correlated with ATT&CK techniques T1059 (Command and Scripting Interpreter), T1027 (Obfuscated Files), and T1003 (Credential Dumping). A case study involving LockBit 3.0 ransomware demonstrates concrete operational gains in containment in less than 45 minutes. We conclude that mathematical formalization combined with evidence-driven automation constitutes a significant advance in the operational maturity of SOC and CSIRT teams, contributing to reduced dwell time and increased organizational resilience.
Read paper →IREvidence-Oriented Architecture for Incident Response (IR) Based on Multi-Layer Correlation and Mathematical Formalization of the Response Cycle
TITLE: Evidence-Oriented Architecture for Incident Response (IR) Based on Multi-Layer Correlation and Mathematical Formalization of the Response Cycle ABSTRACT: Incident Response (IR) has become one of the strategic pillars of contemporary cybersecurity in light of the exponential growth of sophisticated attacks, such as human-operated ransomware, APT espionage campaigns, and large-scale exploitation of critical vulnerabilities (for example, CVE-2021-44228 – Log4Shell). Despite the consolidation of frameworks such as NIST SP 800-61 and MITRE ATT&CK, the practical operationalization of IR still suffers from gaps in multi-source correlation, alert prioritization, and evidence preservation under high temporal pressure. This paper proposes an evidence-oriented architecture for IR based on multi-layer correlation (network, endpoint, identity, and volatile memory), mathematically formalized as an optimization problem over temporal event graphs. Our methodology integrates automated collection (Suricata, Zeek, Sysmon), rule-based detection (Sigma, YARA), memory analysis (Volatility 3), threat intelligence enrichment (MISP), and behavioral modeling via explicit mapping to MITRE ATT&CK. We define a formal model in which events E = {e1, e2, ..., en} are represented as vertices in a temporal directed graph G=(V, A, T), where edges indicate causal or contextual relationships. We propose two algorithms: (1) Weighted Temporal Correlation (WTC) with complexity O(n log n); and (2) Bayesian Incident Prioritization (BIP), which estimates the posterior probability of compromise P(C|E) using incremental updating. In controlled experiments with 12.4 TB of real logs and public datasets (CIC-IDS2017 and DARPA TC), we achieved a 37% reduction in mean time to triage (MTTT) and a 22% increase in true positive rate (TPR), while keeping FPR below 4.8%. The evaluation demonstrates that the formal integration of multiple forensic layers significantly reduces false positives correlated with ATT&CK techniques T1059 (Command and Scripting Interpreter), T1027 (Obfuscated Files), and T1003 (Credential Dumping). A case study involving LockBit 3.0 ransomware evidences a concrete operational gain in containment in under 45 minutes. We conclude that mathematical formalization combined with evidence-oriented automation constitutes a significant advance in the operational maturity of SOC and CSIRT teams, contributing to reduced dwell time and increased organizational resilience.
Read paper →IREvidence-Driven Architecture and Formal Modeling for ATT&CK-Based Incident Response (IR): Integration of Multilayer Telemetry, Automated Orchestration, and Scalable Forensic Analysis
TITLE: Evidence-Driven Architecture and Formal Modeling for ATT&CK-Based Incident Response (IR): Integration of Multilayer Telemetry, Automated Orchestration, and Scalable Forensic Analysis ABSTRACT: The increasing sophistication of ransomware campaigns, state-sponsored espionage operations, and supply chain attacks — such as SolarWinds (CVE-2020-10148), ProxyLogon (CVE-2021-26855), and Log4Shell (CVE-2021-44228) — exposes structural limitations in traditional Incident Response (IR) processes. Despite the broad adoption of frameworks such as NIST SP 800-61r2 and MITRE ATT&CK, many organizations still operate with static playbooks, weak correlation across telemetry layers, and a lack of mathematical formalization of the decision-making process. In this paper, we propose an evidence-driven architecture for IR that integrates multimodal collection (network, endpoint, identity, and memory), formal modeling of the response cycle as an optimization problem under uncertainty, and automated orchestration based on SOAR. Our methodology combines: (i) a formal model of detection and containment as a weighted directed temporal graph; (ii) prioritization algorithms based on Bayesian scoring to reduce Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR); and (iii) practical integration with real tools such as Suricata, Zeek, Wazuh, Elastic SIEM, Sigma, YARA, and Volatility. We evaluated the proposal in a controlled laboratory with 420 executions of adversarial scenarios mapped to MITRE ATT&CK tactics (TA0001–TA0009), including techniques such as T1059 (Command and Scripting Interpreter), T1003 (Credential Dumping), and T1486 (Data Encrypted for Impact). The results demonstrate an average reduction of 37.4% in MTTR (from 9h12m to 5h45m), a 22.8% increase in early detection rate, and a 31% decrease in false positives when compared to traditional SIEM pipelines based exclusively on static correlation. The architecture showed linear scalability up to 25,000 events per second with average latency below 480 ms in a distributed environment. We conclude that the mathematical formalization of the IR process, combined with proper operational instrumentation and evidence-based automation, provides measurable gains in efficiency and accuracy. The work provides theoretical and operational contributions applicable to medium- and large-scale SOCs, proposing a replicable model for corporate and government environments.
Read paper →IRIR-GraphSec: A Formal and Scalable Framework for Graph-Oriented Incident Response and Threat Intelligence
TITLE: IR-GraphSec: A Formal and Scalable Framework for Graph-Oriented Incident Response and Threat Intelligence ABSTRACT: The growing sophistication of intrusion campaigns, characterized by stealthy lateral movement, credential abuse, and multistage persistence, poses significant challenges for Incident Response (IR) teams. Traditional approaches, heavily reliant on static playbooks and manual log analysis, exhibit limitations in distributed and large-scale environments. In this work, we propose IR-GraphSec, a formal and scalable framework for incident response orchestration based on temporal graph modeling and continuous enrichment by threat intelligence. We model security events as a directed temporal graph G = (V, E, τ), in which vertices represent entities (hosts, users, processes, artifacts) and edges represent observed interactions. We introduce risk-weighted centrality metrics and a containment prioritization algorithm with complexity O(|E|log|V|). We implemented a distributed prototype on Apache Kafka, Neo4j, and an incremental processing engine in Apache Flink. We evaluated the system using real datasets (DARPA Transparent Computing, anonymized corporate logs with 2.3 billion events) and synthetic scenarios based on MITRE ATT&CK. Compared with rule-correlation-based approaches (traditional SIEM) and deterministic playbooks, IR-GraphSec reduced mean time to contain (MTTC) by 37.4%, decreased false positives by 28.1%, and improved the prioritization of critical assets with an average gain of 0.19 in AUC-ROC. Our results demonstrate that the mathematical formalization of incident response as an optimization problem on temporal graphs, combined with contextualized threat intelligence (STIX/TAXII), enables faster, more accurate, and more adaptive responses. The work contributes (i) a formal modeling of the IR problem as multiobjective optimization, (ii) prioritization algorithms based on risk centrality, and (iii) extensive empirical evaluation in large-scale environments.
Read paper →IRIR-ADAPT: A Formal, Probabilistic, and Adaptive Framework for Orchestration and Optimization of Cyber Incident Response in Distributed Enterprise Environments
TITLE: IR-ADAPT: A Formal, Probabilistic, and Adaptive Framework for Orchestration and Optimization of Cyber Incident Response in Distributed Enterprise Environments ABSTRACT: Incident Response (IR) has become a strategic component of information security governance in distributed enterprise environments, characterized by multicloud architectures, containerized workloads, SaaS integrations, and AI/ML pipelines. The exponential increase in telemetry volume, coupled with the sophistication of adversaries who exploit valid credentials, known vulnerabilities, and evasion techniques, imposes structural challenges to the prioritization and timely containment of incidents. In this work, we propose IR-ADAPT, a formal, probabilistic, and adaptive framework that models IR as a Partially Observable Markov Decision Process (POMDP), enabling quantitative optimization under uncertainty. We formalize risk as the conditional expected value of impact and introduce a multivariate cost function that integrates compromise probability, normalized impact, and epistemic uncertainty. We demonstrate that Bayesian updating over state beliefs, combined with approximate reinforcement learning, enables adaptive policies that minimize the discounted expected cost. We implemented a prototype using Elastic Stack, Apache Kafka, and a SOAR platform (TheHive/Cortex), integrating EDR telemetry, network logs, and cloud events. We evaluated the system on a dataset of 3.2 million real and synthetic events, comparing it to baselines based on CVSS and static SIEM rules. The results indicate a statistically significant reduction in mean time to contain (MTTC) of 47.3% (±2.1%), an increase in precision to 92.4%, and a reduction in manual workload of 31.8%. We discuss implications for regulated environments, integration with CNAPP, and limitations in OT/ICS contexts. We conclude that probabilistic sequential formalization provides measurable gains and sound theoretical foundations for adaptive incident response orchestration up to the state of the art in 2025.
Read paper →IRIR-GraphSec: A Formal Graph-Based Architecture Using Probabilistic Temporal Graphs and Bayesian Inference for Automated Incident Response Orchestration in Distributed Environments
TITLE: IR-GraphSec: A Formal Graph-Based Architecture Using Probabilistic Temporal Graphs and Bayesian Inference for Automated Incident Response Orchestration in Distributed Environments ABSTRACT: The increasing complexity of hybrid and multicloud digital infrastructures poses substantial challenges to the discipline of Incident Response (IR), requiring formal models capable of capturing temporal, semantic, and probabilistic dependencies among distributed events at large scale. In this work, we propose IR-GraphSec, a formal architecture based on probabilistic temporal graphs and Bayesian inference for the prioritization and automated orchestration of incident responses in modern enterprise environments. We formalize events as semantically enriched temporal tuples and define a dynamic directed graph in which vertices represent entities and edges represent interactions that are causally relevant over time. We model asset compromise as binary random variables and estimate posterior probabilities conditioned on observational history through interpretable logistic regression, approximating a first-order Markov random field. We show that the containment prioritization problem under budget constraint reduces to an instance of the 0-1 knapsack problem and is therefore NP-hard, and we propose a greedy heuristic with classical approximation guarantees. The architecture was implemented with Elastic Stack, Apache Flink, Neo4j, Kubernetes, and PyTorch, sustaining 45,000 events per second in an experiment with 3.2 billion anonymized real events. Compared with rule-based approaches and traditional supervised models, we observed a 37.4% reduction in Mean Time to Detect (MTTD), a 42.1% reduction in Mean Time to Respond (MTTR), and a 22.3% reduction in the false positive rate. We discuss theoretical implications, empirical limitations, and extensions involving structural causal models, online learning, and integration with modern security techniques in cloud-native environments. Our results show that probabilistic temporal relational modeling provides a solid foundation for adaptive IR orchestration at enterprise scale.
Read paper →IRIR-GraphSec: A Formal Architecture Based on Probabilistic Temporal Graphs and Bayesian Inference for Automated Incident Response Orchestration in Distributed Environments
TITLE: IR-GraphSec: A Formal Architecture Based on Probabilistic Temporal Graphs and Bayesian Inference for Automated Incident Response Orchestration in Distributed Environments ABSTRACT: The increasing complexity of hybrid and multicloud digital infrastructures imposes substantial challenges on the discipline of Incident Response (IR), requiring formal models capable of capturing temporal, semantic, and probabilistic dependencies among events distributed at large scale. In this work, we propose IR-GraphSec, a formal architecture based on probabilistic temporal graphs and Bayesian inference for the prioritization and automated orchestration of incident responses in modern corporate environments. We formalize events as semantically enriched temporal tuples and define a dynamic directed graph in which vertices represent entities and edges represent causally relevant interactions over time. We model asset compromise as binary random variables and estimate posterior probabilities conditioned on the observational history through interpretable logistic regression, approximating a first-order Markov random field. We demonstrate that the problem of containment prioritization under budget constraints reduces to an instance of the 0–1 knapsack problem and is therefore NP-hard, and we propose a greedy heuristic with classical approximation guarantees. The architecture was implemented using Elastic Stack, Apache Flink, Neo4j, Kubernetes, and PyTorch, sustaining 45,000 events per second in an experiment with 3.2 billion anonymized real events. Compared with approaches based on static rules and traditional supervised models, we observed a reduction of 37.4% in Mean Time to Detect (MTTD), 42.1% in Mean Time to Respond (MTTR), and a 22.3% reduction in the false positive rate. We discuss theoretical implications, empirical limitations, and extensions involving structural causal models, online learning, and integration with modern security techniques in cloud-native environments. Our results indicate that probabilistic temporal relational modeling constitutes a solid foundation for adaptive IR orchestration at enterprise scale.
Read paper →IRIR-GraphSec: A Formal and Scalable Framework for Automated Incident Response Orchestration Based on Attack Graphs and Multiobjective Optimization
TITLE: IR-GraphSec: A Formal and Scalable Framework for Automated Incident Response Orchestration Based on Attack Graphs and Multiobjective Optimization ABSTRACT: The increasing sophistication of multi-stage cyber campaigns, combined with the expansion of hybrid, cloud-native, and AI-driven environments, imposes substantial challenges on Incident Response (IR) orchestration. Although normative frameworks such as NIST SP 800-61 Rev. 2 and the NIST Cybersecurity Framework establish consolidated guidelines, the efficient operationalization of containment remains limited by complex topological dependencies, availability constraints, and multiple conflicting objectives. In this work, we formalize the response orchestration problem as a multiobjective optimization over dynamic attack graphs enriched with automatic mapping to MITRE ATT&CK and near-real-time telemetry originating from CNAPP, EDR, and eBPF environments. We define an objective function that integrates residual risk, operational cost, and availability impact, subject to budgetary and business continuity constraints. We demonstrate that the associated decision problem is NP-hard through polynomial reduction to variants of the minimum cut problem with additional constraints. We propose the IR-GraphSec framework, implemented with Neo4j, Apache Kafka, and OR-Tools, capable of processing large-scale event streams and generating optimized containment plans via mixed-integer programming and branch-and-bound heuristics. We empirically evaluate the system on a distributed cluster with 4.8 million real and synthetic events, including simulations with MITRE Caldera. Results indicate an average reduction of 63.4% in Mean Time to Containment (MTTC), a 38.9% decrease in residual risk, and an estimated financial impact 41.9% lower compared to static SOAR playbooks. Statistical analysis confirms significance with $p < 0{,}01$. We discuss limitations related to telemetry quality and explore extensions involving robust reinforcement learning, AI system security, and integration with post-quantum cryptography. We conclude that graph-oriented formal modeling constitutes a promising approach for adaptive and scalable IR orchestration in 2025.
Read paper →IRIR-GraphSec: A Formal and Scalable Framework for Automated Graph-Based Incident Response Orchestration and Multiobjective Optimization
IR-GraphSec: A Formal and Scalable Framework for Automated Graph-Based Incident Response Orchestration and Multiobjective Optimization ABSTRACT: The growing sophistication of multi-stage cyber campaigns, together with the expansion of hybrid, cloud-native, and AI-driven environments, imposes substantial challenges on the orchestration of Incident Response (IR). Although normative frameworks such as NIST SP 800-61 Rev. 2 and the NIST Cybersecurity Framework establish consolidated guidelines, the efficient operationalization of containment remains limited by complex topological dependencies, availability constraints, and multiple conflicting objectives. In this work, we formalize the response orchestration problem as a multiobjective optimization over dynamic attack graphs enriched with automatic mapping to MITRE ATT&CK and near-real-time telemetry from CNAPP, EDR, and eBPF environments. We define an objective function that integrates residual risk, operational cost, and downtime impact, subject to budget and business continuity constraints. We demonstrate that the associated decision problem is NP-hard by polynomial reduction to variants of the minimum cut problem with additional constraints. We propose the IR-GraphSec framework, implemented with Neo4j, Apache Kafka, and OR-Tools, capable of processing large-scale event streams and generating optimized containment plans via mixed-integer programming and branch-and-bound heuristics. We empirically evaluate the system on a distributed cluster with 4.8 million real and synthetic events, including simulations with MITRE Caldera. The results indicate an average reduction of 63.4% in Mean Time to Containment (MTTC), a 38.9% decrease in residual risk, and an estimated financial impact 41.9% lower compared to static SOAR playbooks. The statistical analysis confirms significance with p < 0.01. We discuss limitations related to telemetry quality and explore extensions involving robust reinforcement learning, AI system security, and integration with post-quantum cryptography. We conclude that graph-oriented formal modeling constitutes a promising approach for adaptive and scalable IR orchestration in 2025.
Read paper →IRIR-GraphShield: A Formal and Scalable Framework for Intelligent Incident Response Orchestration Based on Attack Graphs and Temporal Evidence
TITLE: IR-GraphShield: A Formal and Scalable Framework for Intelligent Incident Response Orchestration Based on Attack Graphs and Temporal Evidence ABSTRACT: The increasing complexity of digital environments in 2025, characterized by multicloud architectures, microservices, ephemeral workloads, and intensive integration of artificial intelligence models, imposes substantial challenges for security incident response orchestration. We propose IR-GraphShield, a formal and scalable framework for intelligent incident response orchestration grounded in attack graphs enriched with temporal evidence and probabilistic inference mechanisms. We formally model the response process as a labeled transition system $ \mathcal{S} = (Q, \Sigma, \delta, q_0) $, in which states represent observable system configurations, events correspond to forensic evidence, and actions are automated mitigation strategies. We incorporate dynamic attack graphs $ G_t = (V_t, E_t) $ with temporal and probabilistic weighting, enabling continuous Bayesian updating in the presence of new indicators of compromise. We demonstrate how formal verification techniques, probabilistic reasoning, and explainable machine learning can be integrated into contemporary SOAR and CNAPP platforms, as well as sensors based on eBPF and runtime telemetry. The framework considers emerging threats related to LLMs, model supply chain attacks, post-quantum cryptography, and AI governance. We evaluate correctness, completeness, and security properties of response policies using linear temporal logic (LTL) and symbolic model checking. Conceptual experiments and comparative analysis indicate reduced mean time to containment and greater robustness against false positives compared to purely heuristic approaches. IR-GraphShield contributes to the convergence between automated response, mathematical formalization, and evidence-driven adaptive security, providing solid theoretical foundations and practical applicability within the technological context up to 2025.
Read paper →