Research / Paper Files
Paper Files
Paper Files are a personal practice of continuous study in cybersecurity that applies the scientific method as a learning tool. Each article is written not for academic publication, but as a deliberate exercise to sharpen the axe — deepening knowledge on specific topics, organizing ideas with rigor, and observing how understanding of certain subjects develops over time. It is the intellectual equivalent of a training journal: each entry records what was studied, how it was analyzed, and what conclusions emerged.
I strongly recommend that security professionals adopt this method. Choose a topic you want to master, research primary sources (RFCs, papers, official documentation), structure your text with introduction, methodology, analysis, and conclusion, and write as if you were explaining to a colleague. The act of writing forces clarity of thought and exposes gaps in understanding that passive reading cannot reveal. Use the articles on this site as examples of format and depth, and build your own collection — over time, you will have a personal repository of refined knowledge that no course or certification can replace.
DAI & ADAI · 2026
DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts
DAI (Decripte Artificial Intelligence) is a proprietary domain-specific LLM within a governed autonomous defensive architecture. It is an instance of the proposed ADAI category defined in the companion framework paper. T…
Read paper →ADAI · ENAutonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure
ADAI (Autonomous Defensive Artificial Intelligence) is a proposed category of governed autonomous cyber defense. The framework specifies defended perimeters, bounded effects, declared rollback and capability-disjoint ver…
Read paper →16 papers
DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts
DAI (Decripte Artificial Intelligence) is a proprietary domain-specific LLM within a governed autonomous defensive architecture. It is an instance of the proposed ADAI category defined in the companion framework paper. The paper describes incident-response sessions spanning signal curation, structured target extraction, reviewed playbook selection, declared action contracts, deterministic admissibility, bounded network-edge execution, capability-disjoint verification, hash-linked evidence sealing, scheduled review, reconciliation and undo. The learned model is trained on the system’s own outcome-verified transcripts and narrates the result; admissibility and execution authority remain structurally outside the model. The paper addresses per-principal containment within shared enforcement domains, rule-budget aggregation, element-identified reconciliation, independent receipt recomputation and exact localization of controlled tampering. Reported measurements refer to the version and period described in the manuscript and are not a claim of universal performance.
Read paper →ResearchAutonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure
ADAI (Autonomous Defensive Artificial Intelligence) is a proposed category of governed autonomous cyber defense. The framework specifies defended perimeters, bounded effects, declared rollback and capability-disjoint verification for systems acting on production infrastructure. Admissibility is adjudicated outside the learned model, while hash-linked, seal-terminated receipts provide a self-describing recomputation contract. The paper develops exact tamper localization, per-principal containment at shared enforcement points, element-wise reconciliation under aggregation, atomization conditions, blinded correlation and conditions for composite reversibility. It separates policy quality, envelope integrity and evidence integrity in its evaluation methodology. Formal results depend on their stated assumptions. This preprint does not assert that every theoretical construction is implemented or independently validated.
Read paper →ResearchA Formal and Scalable Architecture for Proactive Threat Detection Based on Multi-Layer Temporal Correlation and Robust Statistical Learning
TITLE: A Formal and Scalable Architecture for Proactive Threat Detection Based on Multi-Layer Temporal Correlation and Robust Statistical Learning ABSTRACT: The increasing sophistication of multi-stage attack campaigns, characterized by stealthy lateral movement and the exploitation of zero-day vulnerabilities, poses substantial challenges to traditional detection mechanisms based on signatures or static rules. In this work, we propose a formal architecture for proactive threat detection that integrates multi-layer temporal correlation with event-driven robust statistical modeling. Our approach combines causal dependency graphs, behavioral embeddings, and Bayesian inference to identify attack chains associated with MITRE ATT&CK techniques, even under noise and adversarial evasion. We formalize the problem as an inference task over dynamic graphs G_t = (V_t, E_t) and demonstrate that detection can be modeled as likelihood maximization under structural constraints. We implemented a distributed prototype capable of processing 1.8 million events per second in a 12-node cluster. We evaluated the system using the DARPA TC and UNSW-NB15 datasets and real corporate environment traces with 4.2 billion events. Compared with traditional SIEMs and pure LSTM models, our solution reduced the false positive rate by 37.4%, increased the average F1-score from 0.81 to 0.92, and detected lateral movement with an average latency of 4.3 seconds. We further demonstrate robustness against obfuscation techniques associated with tactics T1027 and T1070. The results indicate that the combination of rigorous mathematical formalization and distributed systems engineering is essential to address advanced persistent threats in large-scale environments.
Read paper →ResearchHybrid Architecture Based on Multilayer Telemetry and Temporal Correlation for Proactive Detection of Advanced Persistent Threats in Enterprise Environments
TITLE: Hybrid Architecture Based on Multilayer Telemetry and Temporal Correlation for Proactive Detection of Advanced Persistent Threats in Enterprise Environments ABSTRACT: The detection of Advanced Persistent Threats (APTs) remains one of the major operational challenges in cybersecurity, especially in hybrid enterprise environments that combine on-premises infrastructure, cloud workloads, and distributed endpoints. Recent reports from Mandiant and Verizon indicate that the average dwell time of sophisticated attackers still exceeds 16 days in mature environments and can surpass 200 days in organizations with low visibility. This paper proposes a hybrid architecture based on multilayer telemetry and probabilistic temporal correlation for proactive APT detection, integrating network logs (Suricata), endpoint telemetry (Sysmon), volatile memory (Volatility), behavioral rules (Sigma), and custom signatures (YARA), combined through a formal model of a weighted directed temporal graph. Our methodology introduces a risk scoring mechanism based on temporal centrality and chaining of TTPs aligned with the MITRE ATT&CK framework, modeled as a critical path detection problem in dynamic graphs. We evaluate the proposal in an experimental environment containing 12 real attack scenarios (including emulations of APT29, FIN7, and exploitation of CVE-2021-44228 – Log4Shell), totaling 4.3 TB of telemetry collected over 60 days. The results demonstrate a detection rate (TPR) of 94.7% with a false positive rate (FPR) of 3.2%, outperforming approaches based exclusively on rules (TPR 71.4%) and isolated machine learning models (TPR 88.1%). The mean time to detection was reduced from 11.2 days to 36 hours. The main contribution lies in the mathematical formalization of TTP-oriented temporal correlation and in practical validation in a realistic operational environment. We demonstrate that the structured integration of heterogeneous telemetry and temporal modeling significantly enhances defensive capability, offering direct practical implications for SOCs (Security Operations Centers) and threat hunting teams.
Read paper →ResearchScalable Hybrid Architecture for Threat Detection and Hunting Based on Multilayer Telemetry and MITRE ATT&CK-Oriented Correlation
TITLE: Scalable Hybrid Architecture for Threat Detection and Hunting Based on Multilayer Telemetry and MITRE ATT&CK-Oriented Correlation ABSTRACT: The accelerated expansion of corporate digital environments, driven by the adoption of cloud computing, hybrid architectures, microservices, and API-based integrations, has profoundly transformed the information security landscape. The contemporary attack surface has become highly distributed and dynamic, which makes early intrusion detection difficult for traditional mechanisms based exclusively on signatures. Modern attacks often follow complex chains of tactics, techniques, and procedures (TTPs), often distributed across multiple layers of infrastructure, including endpoints, networks, identities, and cloud services. In this context, isolated detection approaches — such as rule-based SIEMs or EDR solutions without contextual correlation — aprese
Read paper →ResearchHybrid Detection and Response Architecture Based on Multi-Layer Correlation and Statistical Learning for Mitigating Advanced Threats in Corporate Environments
TITLE: Hybrid Detection and Response Architecture Based on Multi-Layer Correlation and Statistical Learning for Mitigating Advanced Threats in Corporate Environments ABSTRACT: The increasing sophistication of targeted intrusion campaigns, including human-operated ransomware attacks, zero-day vulnerability exploitation, and stealthy lateral movement, poses significant challenges to traditional detection architectures based exclusively on signatures or static rules. Recent incidents exploiting vulnerabilities such as CVE-2021-44228 (Log4Shell), CVE-2023-34362 (MOVEit Transfer), and MITRE ATT&CK techniques such as T1059 (Command and Scripting Interpreter) and T1021 (Remote Services) demonstrate the need for adaptive, multi-layer mechanisms. In this work, we propose a hybrid architecture that integrates deterministic rule-based correlation (Sigma, Suricata, YARA), statistical behavioral analysis, and formal modeling of attack chains, with operational focus on corporate SOCs. Our methodology combines a weighted directed graph mathematical model to represent security events with an incremental Bayesian scoring mechanism to estimate the posterior probability of compromise P(C|E1..n). We implemented a prototype using Elastic Stack, Suricata, Wazuh, Volatility, and custom Python modules, evaluating it in a controlled environment with 12 TB of real logs and public datasets (CIC-IDS2017, UNSW-NB15). The results indicate a 38.7% reduction in the false positive rate compared to a traditional SIEM based solely on rules, a 24.3% increase in the detection rate of lateral movement, and a reduction in mean time to detect (MTTD) from 47 minutes to 18 minutes. We further demonstrate, through a case study involving simulation of a ransomware attack with Cobalt Strike and Mimikatz, that multi-layer correlation enables the identification of pre-encryption patterns with an average advance of 11 minutes. The contributions include: (i) mathematical formalization of adaptive correlation, (ii) an incremental alert prioritization algorithm with complexity analysis, and (iii) empirical validation with operational metrics. The work offers direct practical implications for Blue Team teams and next-generation SOC architectures.
Read paper →ResearchA Formally Verifiable Architecture for Detection and Adaptive Mitigation of Living-off-the-Land-Based Threats in Hybrid Enterprise Environments
TITLE: A Formally Verifiable Architecture for Detection and Adaptive Mitigation of Living-off-the-Land-Based Threats in Hybrid Enterprise Environments ABSTRACT: The growing adoption of hybrid and multicloud architectures, combined with the consolidation of Zero Trust models and the integration of traditional workloads with artificial intelligence-based systems, has substantially expanded the organizational attack surface through 2025. In this context, Living-off-the-Land (LotL) techniques have become predominant, exploiting legitimate binaries and native administrative interfaces to evade traditional detection mechanisms. We propose a formally grounded architecture for detection and adaptive mitigation of LotL threats, combining provenance temporal graphs, Kullback–Leibler divergence with an adaptive threshold, and probabilistic game modeling between the detector and a polynomially bounded adversary. We formalize the problem as an evasion experiment $\mathsf{LotL\text{-}Evasion}(n)$, defining security in terms of negligible evasion probability under minimal measurable statistical deviation. We demonstrate an exponential upper bound on the evasion probability as a function of total variation divergence and the observation window size, using Hoeffding’s and Pinsker’s inequalities. The proposed architecture integrates telemetry collection via eBPF, ETW, and auditd, stream processing with Apache Flink, normalization according to the Elastic Common Schema, and integration with CNAPP and SOAR platforms, while preserving alignment with NIST SP 800-207 and contemporary AI governance practices. Experimental evaluations using bootstrap and the Wilcoxon test indicate a statistically significant reduction in relative false positives and improved mean detection time in multistage scenarios. We further discuss implications related to concept drift, telemetry integrity, and model-assisted attacks, as well as extensions involving hidden Markov chains, federated learning with differential privacy, and probabilistic verification with PRISM. We conclude that the integration of causal modeling and information theory makes it possible to establish formal guarantees and robust empirical evidence for the adaptive mitigation of LotL threats in contemporary enterprise environments.
Read paper →ResearchA Formally Verifiable Architecture for Adaptive Detection and Mitigation of Living-off-the-Land-Based Threats in Hybrid Enterprise Environments
TITLE: A Formally Verifiable Architecture for Adaptive Detection and Mitigation of Living-off-the-Land-Based Threats in Hybrid Enterprise Environments ABSTRACT: The growing adoption of hybrid and multicloud architectures, together with the consolidation of Zero Trust models and the integration of traditional workloads with artificial intelligence-based systems, has substantially expanded the organizational attack surface through 2025. In this context, Living-off-the-Land (LotL) techniques have become predominant, exploiting legitimate binaries and native administrative interfaces to evade traditional detection mechanisms. We propose a formally grounded architecture for the detection and adaptive mitigation of LotL threats, combining provenance temporal graphs, Kullback–Leibler divergence with adaptive thresholding, and probabilistic game modeling between the detector and a polynomially bounded adversary. We formalize the problem as an evasive experiment LotL-Evasion(n), defining security in terms of negligible probability of evasion under minimum measurable statistical deviation. We demonstrate an exponential upper bound on the probability of evasion as a function of total variation divergence and observation window size, using Hoeffding and Pinsker inequalities. The proposed architecture integrates telemetry collection via eBPF, ETW, and auditd, stream processing with Apache Flink, normalization according to the Elastic Common Schema, and integration with CNAPP and SOAR platforms, while preserving alignment with NIST SP 800-207 and contemporary AI governance practices. Experimental evaluations using bootstrap and the Wilcoxon test indicate a statistically significant reduction in relative false positives and improvement in mean detection time in multistage scenarios. We further discuss implications related to concept drift, telemetry integrity, and model-assisted attacks, as well as extensions involving hidden Markov chains, federated learning with differential privacy, and probabilistic verification with PRISM. We conclude that the integration of causal modeling and information theory makes it possible to establish formal guarantees and robust empirical evidence for the adaptive mitigation of LotL threats in contemporary enterprise environments.
Read paper →ResearchARCUS: Resilient and Contextually Unified Architecture for Adaptive Threat Detection and Containment in Multicloud Environments
TITLE: ARCUS: Resilient and Contextually Unified Architecture for Adaptive Threat Detection and Containment in Multicloud Environments ABSTRACT: The consolidation of multicloud architectures, Kubernetes-orchestrated microservices, DevSecOps pipelines, and infrastructure as code has redefined the contemporary threat landscape. In 2025, organizations operate simultaneously across providers such as AWS, Azure, and Google Cloud, integrating managed services, public APIs, serverless functions, and GPU-accelerated workloads for artificial intelligence models, including LLMs. This heterogeneity expands the attack surface, favoring compromises based on valid credentials, software supply chain attacks, and exploitation of vulnerabilities in widely distributed components. We propose the ARCUS architecture (Arquitetura Resiliente e Contextualmente Unificada de Segurança), which integrates formal modeling, deep learning on probabilistic temporal graphs, and response orchestration with verifiable guarantees. We model the multicloud environment as a probabilistic temporal graph, in which events are represented as tuples enriched with contextual and probabilistic attributes. Detection is formulated as a Bayesian inference problem over temporal subgraphs, implemented by Graph Attention Networks with contextual signal incorporation and dynamic embeddings. Containment is treated as a mixed-integer linear programming (MILP) problem, subject to formal constraints derived from security policies and operational invariants, ensuring partial correctness and latency bounds. We empirically evaluate the proposal on widely recognized public datasets and synthetic multicloud scenarios, comparing it with traditional signature-based and sequential-model approaches. The results demonstrate statistically significant gains in AUC-ROC, F1-score, and detection latency reduction, while maintaining controlled false positive rates. We also discuss implications for environments with generative AI workloads, integration with CNAPP, and the use of eBPF for low-level telemetry. We conclude that the combination of formal modeling, graph learning, and verifiable optimization constitutes a promising approach for adaptive security in contemporary multicloud ecosystems.
Read paper →ResearchARCUS: Resilient and Contextually Unified Architecture for Adaptive Threat Detection and Containment in Multicloud Environments
TITLE: ARCUS: Resilient and Contextually Unified Architecture for Adaptive Threat Detection and Containment in Multicloud Environments ABSTRACT: The consolidation of multicloud architectures, Kubernetes-orchestrated microservices, DevSecOps pipelines, and infrastructure as code has redefined the contemporary threat landscape. In 2025, organizations operate simultaneously across providers such as AWS, Azure, and Google Cloud, integrating managed services, public APIs, serverless functions, and GPU-accelerated workloads for artificial intelligence models, including LLMs. This heterogeneity broadens the attack surface, favoring compromises based on valid credentials, software supply chain attacks, and exploitation of vulnerabilities in widely distributed components. We propose the ARCUS architecture (Resilient and Contextually Unified Security Architecture), which integrates formal modeling, deep learning on probabilistic temporal graphs, and response orchestration with verifiable guarantees. We model the multicloud environment as a probabilistic temporal graph, in which events are represented as tuples enriched with contextual and probabilistic attributes. Detection is formulated as a Bayesian inference problem over temporal subgraphs, implemented by Graph Attention Networks with the incorporation of contextual signals and dynamic embeddings. Containment is treated as a mixed-integer linear programming (MILP) problem, subject to formal constraints derived from security policies and operational invariants, ensuring partial correctness and latency bounds. We empirically evaluate the proposal on widely recognized public datasets and in synthetic multicloud scenarios, comparing it with traditional signature-based approaches and sequential models. The results demonstrate statistically significant gains in AUC-ROC, F1-score, and reduced detection latency, while maintaining controlled false positive rates. We also discuss implications for environments with generative AI workloads, integration with CNAPP, and the use of eBPF for low-level telemetry. We conclude that the combination of formal modeling, graph learning, and verifiable optimization constitutes a promising approach for adaptive security in contemporary multicloud ecosystems.
Read paper →ResearchPROBABILISTIC DETECTION AND TEMPORAL CORRELATION OF LATERAL MOVEMENT BASED ON DYNAMIC GRAPHS IN HYBRID ENTERPRISE ENVIRONMENTS
TITLE: PROBABILISTIC DETECTION AND TEMPORAL CORRELATION OF LATERAL MOVEMENT BASED ON DYNAMIC GRAPHS IN HYBRID ENTERPRISE ENVIRONMENTS ABSTRACT: The consolidation of hybrid enterprise environments — integrating on‑premises Active Directory, Microsoft Entra ID, multiple public clouds, containerized workloads, and SaaS applications — has significantly expanded the attack surface and the structural complexity of identity and network dependencies. In this context, lateral movement remains a critical stage in contemporary attack chains, especially in scenarios involving ransomware, espionage, and valid account compromise. We propose a formal probabilistic detection model based on temporal dynamic graphs with incremental Bayesian inference, designed to capture multi-hop authentication and remote access patterns across heterogeneous telemetry streams. We formalize the temporal graph as an indexed family $\{G_t\}_{t \in T}$ and model the legitimacy probability of paths as a product of conditional probabilities parameterized by adaptive exponential updating. We demonstrate completeness properties under monotonic pruning with threshold $\tau$, analyze the asymptotic complexity of the depth-limited enumeration algorithm, and discuss the impact of the base-rate problem on false positive calibration. We integrate the model with modern stream-processing architectures (Kafka and Flink) and graph-oriented persistence, with interoperability via Sigma and MITRE ATT&CK mapping. We experimentally evaluate the approach using strict temporal validation, comparing it with static rules and unsupervised methods such as Isolation Forest, observing a consistent reduction in false positives under realistic operational constraints. We discuss limitations related to the conditional independence assumption, telemetry integrity, and adversarial adaptivity, as well as implications for security in environments involving CNAPP, eBPF, and detection of federated identity abuse. We conclude that structural probabilistic modeling offers a favorable trade-off between interpretability, formal rigor, and operational feasibility, constituting a solid foundation for future extensions involving temporal Graph Neural Networks and formal adversarial evaluation.
Read paper →ResearchARCUS: Resilient Architecture with Unified Semantic Correlation for Adaptive Detection of Advanced Threats in Hybrid Environments
TITLE: ARCUS: Resilient Architecture with Unified Semantic Correlation for Adaptive Detection of Advanced Threats in Hybrid Environments ABSTRACT: The rapid expansion of hybrid and multi-cloud architectures, combined with the adoption of DevSecOps practices, ephemeral workloads, and the integration of AI-based components, has significantly broadened the organizational attack surface through 2025. Recent reports indicate that breaches continue to exploit known vulnerabilities, social engineering, and supply chains, while new threats emerge around large language models (LLMs), exposed APIs, and federated identities. In this context, traditional SIEM mechanisms, predominantly based on syntactic correlation and static rules, exhibit structural limitations in capturing distributed temporal and semantic dependencies. We propose ARCUS, a formally grounded architecture that integrates semantic ontology aligned with MITRE ATT&CK and NIST SP 800-61, dynamic temporal graphs, and hybrid inference combining Graph Neural Networks (GNNs) and incremental statistical detection. We formalize events as structured tuples and model system evolution through a temporal graph G_t, preserving incremental update properties with amortized constant complexity under realistic indexing assumptions. We define the detection problem as Bayesian decision-making under threshold τ, with a composite loss function that balances supervised classification and anomaly scoring. We evaluate ARCUS on anonymized real-world data, DARPA Transparent Computing, and Atomic Red Team, achieving average precision of 96.9%, recall of 97.8%, and a 43% reduction in the false positive rate compared to an industrial SIEM baseline, in addition to a 79% decrease in mean detection time. We discuss desirable probabilistic properties, operational scalability (3.2 billion events/day), and integration with CNAPP and SOAR. We conclude that graph-oriented semantic correlation, combined with incremental inference, provides a rigorous and operationally viable foundation for adaptive detection of advanced threats in contemporary hybrid environments.
Read paper →ResearchARCUS: Resilient Architecture with Unified Correlation and Semantics for Adaptive Detection of Advanced Threats in Hybrid Environments
TITLE: ARCUS: Resilient Architecture with Unified Correlation and Semantics for Adaptive Detection of Advanced Threats in Hybrid Environments ABSTRACT: The accelerated expansion of hybrid and multi-cloud architectures, combined with the adoption of DevSecOps practices, ephemeral workloads, and the integration of components based on artificial intelligence, has significantly expanded the organizational attack surface through 2025. Recent reports indicate that breaches continue to exploit known vulnerabilities, social engineering, and supply chains, while new threats emerge around large language models (LLMs), exposed APIs, and federated identities. In this context, traditional SIEM mechanisms, based predominantly on syntactic correlation and static rules, show structural limitations in capturing distributed temporal and semantic dependencies. We propose ARCUS, a formally grounded architecture that integrates a semantic ontology aligned with MITRE ATT&CK and NIST SP 800-61, dynamic temporal graphs, and hybrid inference combining Graph Neural Networks (GNNs) and incremental statistical detection. We formalize events as structured tuples and model system evolution through a temporal graph G_t, preserving incremental update properties with constant amortized complexity under realistic indexing assumptions. We define the detection problem as Bayesian decision-making under threshold τ, with a composite loss function that balances supervised classification and anomaly scoring. We evaluate ARCUS on anonymized real-world data, DARPA Transparent Computing, and Atomic Red Team, achieving a mean precision of 96.9%, recall of 97.8%, and a 43% reduction in the false positive rate compared to an industrial SIEM baseline, as well as a 79% decrease in mean detection time. We discuss desirable probabilistic properties, operational scalability (3.2 billion events/day), and integration with CNAPP and SOAR. We conclude that graph-oriented semantic correlation, combined with incremental inference, provides a rigorous and operationally viable basis for adaptive detection of advanced threats in contemporary hybrid environments.
Read paper →ResearchARCUS: Resilient Architecture with Unified and Semantic Correlation for Adaptive Detection of Advanced Threats in Hybrid Environments
TITLE: ARCUS: Resilient Architecture with Unified and Semantic Correlation for Adaptive Detection of Advanced Threats in Hybrid Environments ABSTRACT: The accelerated expansion of hybrid and multi-cloud architectures, combined with the adoption of DevSecOps practices, ephemeral workloads, and the integration of AI-based components, has significantly expanded the organizational attack surface through 2025. Recent reports indicate that breaches continue to exploit known vulnerabilities, social engineering, and supply chains, while new threats emerge around large language models (LLMs), exposed APIs, and federated identities. In this context, traditional SIEM mechanisms, based predominantly on syntactic correlation and static rules, show structural limitations in capturing distributed temporal and semantic dependencies. We propose ARCUS, a formally grounded architecture that integrates semantic ontology aligned with MITRE ATT&CK and NIST SP 800-61, dynamic temporal graphs, and hybrid inference combining Graph Neural Networks (GNNs) and incremental statistical detection. We formalize events as structured tuples and model system evolution through a temporal graph G_t, preserving incremental update properties with constant amortized complexity under realistic indexing assumptions. We define the detection problem as Bayesian decision-making under threshold τ, with a composite loss function that balances supervised classification and anomaly scoring. We evaluate ARCUS on anonymized real-world data, DARPA Transparent Computing, and Atomic Red Team, achieving a mean precision of 96.9%, recall of 97.8%, and a 43% reduction in the false positive rate compared to an industrial SIEM baseline, in addition to a 79% decrease in mean detection time. We discuss desirable probabilistic properties, operational scalability (3.2 billion events/day), and integration with CNAPP and SOAR. We conclude that graph-oriented semantic correlation, combined with incremental inference, provides a rigorous and operationally viable foundation for adaptive detection of advanced threats in contemporary hybrid environments.
Read paper →ResearchAdaptive Architecture for Proactive Detection of Advanced Persistent Threats Based on Multi-Layer Temporal Correlation and Robust Statistical Inference
TITLE: Adaptive Architecture for Proactive Detection of Advanced Persistent Threats Based on Multi-Layer Temporal Correlation and Robust Statistical Inference ABSTRACT: The increasing complexity of digital infrastructures in 2025—characterized by hybrid architectures, multicloud environments, microservices, event-driven computing, containerized workloads, and the integration of machine learning models and LLMs—has substantially expanded the corporate attack surface. Advanced Persistent Threats (APTs) exploit multi-stage chains that traverse network, host, application, and identity layers, often combining exploitation of known vulnerabilities, abuse of valid credentials, and partial log tampering. Traditional detection systems, based on signatures or isolated supervised classifiers, show limitations in capturing complex temporal dependencies and in robustness against adversarial contamination. In this work, we propose an adaptive architecture grounded in multi-layer temporal correlation modeled by dynamic graphs weighted by robust M-estimators, combined with dynamic Bayesian inference structured by prior knowledge from the MITRE ATT&CK framework. We formalize the problem under an ε-adversarial contamination model and demonstrate conditions for statistical consistency of the estimators employed. We implemented the architecture in a distributed environment with large-scale ingestion, integration with eBPF-based telemetry, and container orchestration, achieving sustained processing of 95,000 events per second with average latency below 500 ms. We evaluated the method on public datasets (CIC-IDS2017, UNSW-NB15), on the CIC-IDS2018 dataset, and on a corporate dataset with 4.2 billion events. The results indicate a significant increase in TPR (96.4%) and a reduction in FPR (2.1%) compared with Random Forest, LSTM, and Isolation Forest, with superior robustness under ε = 0.15 contamination. We also demonstrate a reduction in mean time to detect (MTTD) and greater operational interpretability. We conclude that the formal integration of robust statistics, temporal graph modeling, and structured knowledge of adversarial tactics constitutes a promising approach for the proactive detection of APTs in contemporary corporate environments.
Read paper →ResearchOperational Cybersecurity Research in the Era of AI-Augmented Threats: A Practical Framework for Empirical Threat Hunting, Detection Engineering, and Adversarial Simulation (2026)
1. Introduction Cybersecurity research has evolved dramatically over the past two decades, transitioning from a discipline primarily focused on cryptography and protocol analysis into a complex operational science encompassing adversarial modeling, telemetry analytics, large-scale distributed systems, and cyber-physical risk management. The emergence of cloud-native architectures, containerized workloads, software supply-chain dependencies, and identity-centric infrastructures has significantly expanded the attack surface available to adversaries. Simultaneously, attackers have adopted increa
Read paper →