Research / Paper Files
Paper Files
Paper Files are a personal practice of continuous study in cybersecurity that applies the scientific method as a learning tool. Each article is written not for academic publication, but as a deliberate exercise to sharpen the axe — deepening knowledge on specific topics, organizing ideas with rigor, and observing how understanding of certain subjects develops over time. It is the intellectual equivalent of a training journal: each entry records what was studied, how it was analyzed, and what conclusions emerged.
I strongly recommend that security professionals adopt this method. Choose a topic you want to master, research primary sources (RFCs, papers, official documentation), structure your text with introduction, methodology, analysis, and conclusion, and write as if you were explaining to a colleague. The act of writing forces clarity of thought and exposes gaps in understanding that passive reading cannot reveal. Use the articles on this site as examples of format and depth, and build your own collection — over time, you will have a personal repository of refined knowledge that no course or certification can replace.
DAI & ADAI · 2026
DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts
DAI (Decripte Artificial Intelligence) is a proprietary domain-specific LLM within a governed autonomous defensive architecture. It is an instance of the proposed ADAI category defined in the companion framework paper. T…
Read paper →ADAI · ENAutonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure
ADAI (Autonomous Defensive Artificial Intelligence) is a proposed category of governed autonomous cyber defense. The framework specifies defended perimeters, bounded effects, declared rollback and capability-disjoint ver…
Read paper →226 papers
Risk-Driven DevSecOps Architecture with Multi-Stage Correlation Based on MITRE ATT&CK and Empirical Evidence in Cloud-Native CI/CD Pipelines
TITLE: Risk-Driven DevSecOps Architecture with Multi-Stage Correlation Based on MITRE ATT&CK and Empirical Evidence in Cloud-Native CI/CD Pipelines ABSTRACT: The growing adoption of cloud-native architectures and highly automated CI/CD pipelines has significantly expanded the attack surface associated with the software development lifecycle. Widely documented incidents, including supply chain compromises and the exploitation of widely distributed vulnerabilities, demonstrate that isolated security controls are insufficient when they are not integrated with contextual prioritization and behavioral correlation mechanisms. In this work, we present a risk-driven DevSecOps architecture that integrates static code analysis, dependency analysis, SBOM generation and verification, infrastructure-as-code validation, runtime behavioral detection, and a formal contextual risk calculation engine. The architecture uses the MITRE ATT&CK framework as an ontology for multi-stage correlation of events across the entire development and execution pipeline. We conducted a critical analysis of the limitations of approaches based exclusively on CVSS, showing that the absence of operational context often leads to inappropriate prioritization of vulnerabilities and alert fatigue. We propose a mathematical formulation of risk as a composite function of the exploitation probability estimated by EPSS, normalized technical impact, and dynamic operational exposure factors. We introduce formal definitions of the adversary, correctness properties of the build-blocking mechanism, and a probabilistic model for correlation between adversary techniques. The architecture was implemented in a Kubernetes environment using GitLab CI, SonarQube, Semgrep, Trivy, Syft, Grype, OWASP ZAP, Falco, Suricata, and Open Policy Agent. We empirically evaluated the system over six months in a set of enterprise microservices distributed across two distinct organizational domains. The results indicate a consistent reduction in mean time to remediation, a relative decrease in false positives, and limited operational impact on total build time. The empirical results suggest that the integration of formal risk modeling, threat intelligence, and policy automation can significantly improve the operational effectiveness of DevSecOps programs in cloud-native environments.
Read paper →DevSecOpsRisk-Oriented DevSecOps Architecture with Multi-Stage Correlation Based on MITRE ATT&CK and Empirical Evidence in Cloud-Native CI/CD Pipelines
TITLE: Risk-Oriented DevSecOps Architecture with Multi-Stage Correlation Based on MITRE ATT&CK and Empirical Evidence in Cloud-Native CI/CD Pipelines ABSTRACT: The growing adoption of cloud-native architectures and highly automated CI/CD pipelines has significantly expanded the attack surface associated with the software development lifecycle. Widely documented incidents, including supply chain compromises and exploitation of broadly distributed vulnerabilities, demonstrate that isolated security controls are insufficient when not integrated with contextual prioritization and behavioral correlation mechanisms. In this work, we present a risk-oriented DevSecOps architecture that integrates static code analysis, dependency analysis, SBOM generation and verification, infrastructure as code validation, runtime behavioral detection, and a formal contextual risk computation engine. The architecture uses the MITRE ATT&CK framework as an ontology for multi-stage correlation of events throughout the development and execution pipeline. We conduct a critical analysis of the limitations of approaches based exclusively on CVSS, showing that the absence of operational contextualization often leads to inadequate vulnerability prioritization and alert fatigue. We propose a mathematical formulation of risk as a composite function of the exploitation probability estimated by EPSS, normalized technical impact, and dynamic operational exposure factors. We introduce formal definitions of the adversary, correctness properties of the build-blocking mechanism, and a probabilistic model of correlation between adversarial techniques. The architecture was implemented in a Kubernetes environment using GitLab CI, SonarQube, Semgrep, Trivy, Syft, Grype, OWASP ZAP, Falco, Suricata, and Open Policy Agent. We empirically evaluated the system over six months in a set of corporate microservices distributed across two distinct organizational domains. The results indicate a consistent reduction in mean time to remediation, a relative decrease in false positives, and limited operational impact on total build time. The empirical findings suggest that integrating formal risk modeling, threat intelligence, and policy automation can significantly improve the operational effectiveness of DevSecOps programs in cloud-native environments.
Read paper →DevSecOpsThreat-Oriented DevSecOps: A Formal Architecture for Integrating MITRE ATT&CK–Based SAST, DAST, SCA, and Behavioral Telemetry in CI/CD Pipelines
TITLE: Threat-Oriented DevSecOps: A Formal Architecture for Integrating MITRE ATT&CK–Based SAST, DAST, SCA, and Behavioral Telemetry in CI/CD Pipelines ABSTRACT: Threat-Oriented DevSecOps: A Formal Architecture for Integrating MITRE ATT&CK–Based SAST, DAST, SCA, and Behavioral Telemetry in CI/CD Pipelines Abstract: The large-scale adoption of cloud-native architectures and continuous integration/continuous delivery (CI/CD) pipelines has fundamentally transformed software development processes. However, when security mechanisms are not systematically incorporated into the development lifecycle, this automation can significantly expand the attack surface. Widely documented incidents such as the compromise of the SolarWinds supply chain and the exploitation of CVE-2021-44228 (Log4Shell) demonstrate that a lack of integration among code security, dependency security, and runtime monitoring can lead to large-scale intrusions. Although static analysis (SAST), dynamic analysis (DAST), and software composition analysis (SCA) tools are widely deployed in DevSecOps pipelines, their isolated operation often generates large numbers of alerts and makes risk-based prioritization difficult. This paper proposes a threat-oriented DevSecOps architecture that combines security scan results with behavioral telemetry and systematic mapping to the MITRE ATT&CK framework. We mathematically formalize residual risk computation in CI/CD pipelines by combining severity metrics (CVSS), runtime evidence of exploitation, and the contextual criticality of the application. We introduce an adaptive prioritization algorithm that correlates vulnerabilities detected in static stages with behavioral indicators from detection and observability systems such as Falco and Suricata. We implement the proposed architecture in an enterprise environment based on GitLab CI/CD, Kubernetes, and widely used application security tools, including Semgrep, SonarQube, Trivy, Checkov, and OWASP ZAP. We empirically evaluate the approach across 120 pipelines, 48 microservices, and approximately 3.2 million lines of code over six months. The results show significant reductions in mean time to detect (MTTD), mean time to remediate (MTTR), and the incidence of critical vulnerabilities in production. We also observe a substantial decrease in false positive rates when prioritization is driven by behavioral telemetry and threat intelligence. These results indicate that systematically correlating code analysis, supply chain security, and MITRE ATT&CK–based behavioral detection can measurably reduce operational risk in modern CI/CD pipelines.
Read paper →DevSecOpsThreat-Oriented DevSecOps: Formal Architecture for Integrating SAST, DAST, SCA, and MITRE ATT&CK-Based Behavioral Telemetry in CI/CD Pipelines
TITLE: Threat-Oriented DevSecOps: Formal Architecture for Integrating SAST, DAST, SCA, and MITRE ATT&CK-Based Behavioral Telemetry in CI/CD Pipelines ABSTRACT: The massive adoption of cloud-native architectures and continuous integration and continuous delivery (CI/CD) pipelines has profoundly transformed software development processes. However, this automation significantly expands the attack surface when security mechanisms are not systematically incorporated into the development lifecycle. Widely documented incidents, such as the SolarWinds supply chain compromise and the exploitation of vulnerability CVE-2021-44228 (Log4Shell), demonstrate that failures in the integration of code security, dependencies, and runtime monitoring can enable large-scale compromises. Although static analysis (SAST), dynamic analysis (DAST), and software composition analysis (SCA) tools are widely used in DevSecOps pipelines, their isolated operation often generates high volumes of alerts and makes prioritization based on real risk difficult. In this work, we propose a threat-oriented DevSecOps architecture that integrates security scanner results with behavioral telemetry and systematic mapping to the MITRE ATT&CK framework. We mathematically formalize the calculation of residual risk in CI/CD pipelines by combining severity metrics (CVSS), observed runtime exploitation evidence, and contextual application criticality. We introduce an adaptive prioritization algorithm that correlates vulnerabilities detected in static stages with behavioral indicators from detection and observability systems, such as Falco and Suricata. We implemented the proposed architecture in an enterprise environment based on GitLab CI/CD, Kubernetes, and widely used application security tools, including Semgrep, SonarQube, Trivy, Checkov, and OWASP ZAP. We empirically evaluated the approach in 120 pipelines involving 48 microservices and approximately 3.2 million lines of code over six months. The results indicate a significant reduction in mean time to detect (MTTD), mean time to remediate (MTTR), and the incidence of critical vulnerabilities in production. We also observed a substantial decrease in the false positive rate when prioritization is driven by behavioral telemetry and threat intelligence. These results demonstrate that systematic correlation between code analysis, supply chain security, and MITRE ATT&CK-based behavioral detection can measurably reduce operational risk in modern CI/CD pipelines.
Read paper →DevSecOpsThreat-Oriented DevSecOps: A Formal Architecture for Integrating MITRE ATT&CK-Based SAST, DAST, SCA, and Behavioral Telemetry in CI/CD Pipelines
Threat-Oriented DevSecOps: A Formal Architecture for Integrating MITRE ATT&CK-Based SAST, DAST, SCA, and Behavioral Telemetry in CI/CD Pipelines Abstract: The large-scale adoption of cloud-native architectures and continuous integration/continuous delivery (CI/CD) pipelines has profoundly transformed software development processes. However, when security mechanisms are not systematically incorporated into the development lifecycle, such automation can significantly expand the attack surface. Widely documented incidents such as the SolarWinds supply chain compromise and the exploitation of CVE‑2021‑44228 (Log4Shell) demonstrate that a lack of integration among code security, dependency security, and runtime monitoring can lead to large-scale intrusions. Although static analysis (SAST), dynamic analysis (DAST), and software composition analysis (SCA) tools have been widely adopted in DevSecOps pipelines, their isolated operation often generates large volumes of alerts and makes prioritization based on actual risk difficult. This paper proposes a threat-oriented DevSecOps architecture that combines security scanning results with behavioral telemetry and systematic mapping to the MITRE ATT&CK framework. We mathematically formalize residual risk computation in CI/CD pipelines by combining severity metrics (CVSS), runtime evidence of observed exploitation, and the contextual criticality of the application. We introduce an adaptive prioritization algorithm that correlates vulnerabilities detected in the static phase with behavioral indicators from detection and observability systems such as Falco and Suricata. We implemented the proposed architecture in an enterprise environment based on GitLab CI/CD, Kubernetes, and widely used application security tools including Semgrep, SonarQube, Trivy, Checkov, and OWASP ZAP. We empirically evaluated the approach across 120 pipelines, 48 microservices, and approximately 3.2 million lines of code over a six-month period. The results show significant reductions in mean time to detect (MTTD), mean time to remediate (MTTR), and the incidence of critical vulnerabilities in production environments. We also observed a substantial decrease in false positive rates when prioritization was driven by behavioral telemetry and threat intelligence. These results indicate that systematically correlating code analysis, supply chain security, and MITRE ATT&CK-based behavioral detection can measurably reduce operational risk in modern CI/CD pipelines.
Read paper →DevSecOpsCryptographically Verifiable Orchestration of DevSecOps Pipelines: Formal Model, Automated Architecture, and Experimental Evaluation in Cloud-Native Kubernetes Environments
TITLE: Cryptographically Verifiable Orchestration of DevSecOps Pipelines: Formal Model, Automated Architecture, and Experimental Evaluation in Cloud-Native Kubernetes Environments ABSTRACT: The growing adoption of microservices-based architectures and Kubernetes orchestration has established CI/CD pipelines as a central component of modern software engineering. However, this automation has significantly expanded the attack surface of software supply chains. Widely documented incidents have shown that tampering with dependencies, build artifacts, or pipeline infrastructure can compromise thousands of systems simultaneously. This work proposes a formal model for cryptographically verifiable orchestration of DevSecOps pipelines in cloud-native environments. The model represents pipelines as directed acyclic graphs in which each artifact transformation is accompanied by verifiable properties of integrity, authenticity, and traceability. We formalize quantitative metrics of operational risk based on cryptographic hash functions, digital signatures, and scoring derived from CVSS vulnerabilities. Building on this theoretical foundation, we developed an automated architecture called OCV-DevSecOps, which integrates artifact verification with Sigstore/Cosign, declarative policies with Open Policy Agent, runtime behavioral detection with Falco, and vulnerability analysis with SAST, SCA, and DAST tools. The architecture also incorporates a Software Bill of Materials (SBOM) in CycloneDX format for dependency traceability and supply chain governance support. We experimentally evaluated the proposal in a Kubernetes cluster with 42 microservices and 180 pipeline executions. The results indicate a significant reduction in the mean time to detect critical vulnerabilities, substantial improvement in artifact traceability, and a reduction in the number of deployments containing critical failures. We also observed a moderate impact on total pipeline execution time, while maintaining operational viability. The results suggest that the combination of mandatory cryptographic verification, automated policies, and continuous behavioral monitoring provides an effective mechanism to strengthen the security of modern DevSecOps pipelines. This work contributes by providing a mathematical formalization of the problem, a reproducible architecture, and an empirical evaluation based on real cloud-native infrastructure.
Read paper →DevSecOpsCryptographically Verifiable Orchestration of DevSecOps Pipelines: Formal Models, Automation Architecture, and Experimental Evaluation in a Cloud-Native Kubernetes Environment
TITLE: Cryptographically Verifiable Orchestration of DevSecOps Pipelines: Formal Models, Automation Architecture, and Experimental Evaluation in a Cloud-Native Kubernetes Environment ABSTRACT: TITLE: Cryptographically Verifiable Orchestration of DevSecOps Pipelines: Formal Models, Automation Architecture, and Experimental Evaluation in a Cloud-Native Kubernetes Environment ABSTRACT: The growing adoption of microservice-based architectures and Kubernetes orchestration has established CI/CD pipelines as a core element of modern software engineering. However, this automation has significantly expanded the attack surface of the software supply chain. Well-documented incidents have shown that tampering with dependencies, build artifacts, or pipeline infrastructure can simultaneously compromise thousands of systems. This study proposes a formal model for cryptographically verifiable orchestration of DevSecOps pipelines in cloud-native environments. The model represents a pipeline as a directed acyclic graph in which each artifact transformation is accompanied by verifiable properties regarding integrity, authenticity, and traceability. In addition, it formalizes quantitative operational risk indicators derived from cryptographic hash functions, digital signatures, and scoring based on CVSS vulnerabilities. Building on this theoretical foundation, we developed an automation architecture called OCV-DevSecOps that integrates artifact verification with Sigstore/Cosign, declarative policy enforcement with Open Policy Agent, runtime behavior detection with Falco, and vulnerability analysis with SAST, SCA, and DAST tools. The architecture also incorporates a Software Bill of Materials (SBOM) in CycloneDX format to support dependency traceability and supply chain governance. We experimentally evaluated the proposed approach on a Kubernetes cluster consisting of 42 microservices and 180 pipeline executions. The results demonstrated a significant reduction in the average detection time for critical vulnerabilities, a substantial improvement in artifact traceability, and a decrease in the number of deployments containing critical defects. Furthermore, the impact on total pipeline execution time was moderate, preserving operational feasibility. These results suggest that the combination of enforced cryptographic verification, policy automation, and continuous behavioral monitoring provides an effective mechanism for strengthening the security of modern DevSecOps pipelines. This study contributes by providing a mathematical formalization of the problem, a reproducible architecture, and an empirical evaluation based on real cloud-native infrastructure.
Read paper →DevSecOpsFormal Security Orchestration in CI/CD Pipelines: A Quantitative Risk Model for DevSecOps with MITRE ATT&CK Correlation and Operational Metrics
TITLE: Formal Security Orchestration in CI/CD Pipelines: A Quantitative Risk Model for DevSecOps with MITRE ATT&CK Correlation and Operational Metrics ABSTRACT: The adoption of DevOps practices has profoundly transformed the software development lifecycle by prioritizing automation, continuous integration, and continuous delivery. However, the acceleration of CI/CD pipelines has significantly expanded organizations’ attack surface, especially in the context of software supply chain attacks and exploitation of vulnerable dependencies. Widely documented incidents, such as the compromise of the SolarWinds Orion distribution chain (SUNBURST) and the large-scale exploitation of the Log4Shell vulnerability (CVE-2021-44228), demonstrate that flaws introduced during the build process or through external dependencies can propagate impact on a global scale. Although the DevSecOps paradigm proposes integrating security controls into the development pipeline, operational practice is still characterized by superficial tool integration, the absence of quantitative risk metrics, and a lack of alignment between automated scanner outputs and formal threat models. In this work, we propose a quantitative model for security orchestration in CI/CD pipelines based on incremental risk analysis. The model formalizes the pipeline as a directed acyclic graph and defines an accumulated risk function that combines CVSS scoring, exploitation probability estimated via EPSS, asset criticality, and a temporal factor associated with vulnerability age. Based on this formulation, we introduce an adaptive blocking mechanism that uses dynamic thresholds to automatically decide the promotion or rejection of artifacts during the build process. We implemented the model in a Kubernetes environment using widely adopted tools in the DevSecOps ecosystem, including Semgrep, SonarQube, Trivy, Syft/Grype, OWASP ZAP, and Checkov, as well as runtime monitoring with Falco and event correlation with the MITRE ATT&CK matrix. The experimental evaluation was conducted over 1,200 pipeline executions involving 37 microservices. The results indicate a significant reduction in exposure to critical vulnerabilities in production and a decrease in mean time to remediation without a substantial impact on pipeline execution time. The study demonstrates that the mathematical formalization of risk in CI/CD pipelines enables more consistent automated decisions and provides an operational basis for metrics-driven security governance in DevSecOps environments.
Read paper →AppSecA Formal and Operational Architecture for Attacker-Oriented AppSec: Risk-Exploitability-Based Prioritization through the Integration of SAST, DAST, SCA, Runtime Telemetry, and ATT&CK Intelligence
TITLE: A Formal and Operational Architecture for Attacker-Oriented AppSec: Risk-Exploitability-Based Prioritization through the Integration of SAST, DAST, SCA, Runtime Telemetry, and ATT&CK Intelligence ABSTRACT: A Formal and Operational Architecture for Attacker-Oriented AppSec: Risk-Exploitability-Based Prioritization through the Integration of SAST, DAST, SCA, Runtime Telemetry, and ATT&CK Intelligence Abstract: The attack surface of modern applications has expanded significantly with the adoption of microservices, APIs, containers, and continuous integration/continuous delivery pipelines. Although application security tools such as Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) are widely used, these mechanisms often operate in isolation and generate large volumes of alerts lacking operational context. As a result, security teams find it difficult to prioritize vulnerabilities based on their likelihood of being actually exploited. In this study, we present a formal and operational architecture for threat-oriented application security that integrates SAST, DAST, and SCA results with runtime telemetry collected in production through network sensors and eBPF-based monitoring. The proposed architecture uses Bayesian model-inspired probabilistic correlation to estimate the risk-exploitability of identified vulnerabilities, incorporating empirical evidence derived from events observed at runtime and aligning that evidence with the MITRE ATT&CK framework. We mathematically formalize the concept of risk-exploitability and show how multiple sources of evidence can be combined to reduce false positives and improve remediation prioritization. Implementation experiments were conducted in a Kubernetes environment integrated into a CI/CD pipeline, using widely adopted industry tools including Semgrep, OWASP ZAP, OWASP Dependency-Check, Falco, and Suricata. Evaluation on a set of vulnerable applications confirmed a significant improvement in the identification accuracy of exploitable vulnerabilities. The experimental results show that while the F1-score for individual approaches ranged from 0.67 to 0.63, the integrated model improved it to 0.85, while also reducing false positives by 37.4% and shortening the mean time for vulnerability triage. We discuss the limitations of the probabilistic model, the operational implications for DevSecOps practices, and extensibility opportunities including integration with exploitability indicators such as EPSS and machine-learning-assisted analysis for adaptive prioritization. The proposed architecture demonstrates that correlating static analysis, dynamic testing, dependency analysis, and operational telemetry is a promising path toward narrowing the gap between vulnerability detection and real-world exploit detection.
Read paper →AppSecA Formal and Operational Architecture for Threat-Driven AppSec: Integration of SAST, DAST, SCA, Runtime Telemetry, and ATT&CK Intelligence for Risk-Based Prioritization Based on Exploitable Risk
TITLE: A Formal and Operational Architecture for Threat-Driven AppSec: Integration of SAST, DAST, SCA, Runtime Telemetry, and ATT&CK Intelligence for Risk-Based Prioritization Based on Exploitable Risk ABSTRACT: The attack surface of modern applications has expanded substantially with the adoption of microservices-based architectures, APIs, containers, and continuous integration and delivery pipelines. Although application security tools such as Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) are widely used, these mechanisms often operate in isolation, producing large volumes of alerts that lack operational context. Consequently, security teams face difficulties in prioritizing vulnerabilities based on the actual probability of exploitation. In this work, we present a formal and operational architecture for threat-driven application security that integrates SAST, DAST, and SCA results with runtime execution telemetry collected through network sensors and eBPF-based monitoring. The proposed architecture uses probabilistic correlation inspired by Bayesian models to estimate the exploitable risk of identified vulnerabilities, incorporating empirical evidence from events observed at runtime and aligning such evidence with the MITRE ATT&CK framework. We mathematically formalize the concept of exploitable risk and demonstrate how multiple sources of evidence can be combined to reduce false positives and improve remediation prioritization. The experimental implementation was carried out in a Kubernetes environment with CI/CD pipeline integration, using widely adopted industry tools, including Semgrep, OWASP ZAP, OWASP Dependency-Check, Falco, and Suricata. We evaluated the approach on a set of vulnerable applications and observed significant improvements in the accuracy of identifying exploitable vulnerabilities. The experimental results indicate an increase in the F1-score from 0.67–0.63 in isolated approaches to 0.85 in the integrated model, along with a 37.4% reduction in false positives and a decrease in mean vulnerability triage time. We discuss limitations of the probabilistic model, operational implications for DevSecOps practices, and possible extensions, including integration with exploitation metrics such as EPSS and machine-learning-assisted analysis for adaptive prioritization. The proposed architecture demonstrates that correlating static analysis, dynamic testing, dependency analysis, and operational telemetry is a promising path to narrowing the gap between vulnerability detection and real exploitation detection.
Read paper →AppSecA Formal and Operational Architecture for Threat-Driven AppSec: Integrating SAST, DAST, SCA, Runtime Telemetry, and ATT&CK Intelligence for Exploitable Risk-Based Prioritization
TITLE: A Formal and Operational Architecture for Threat-Driven AppSec: Integrating SAST, DAST, SCA, Runtime Telemetry, and ATT&CK Intelligence for Exploitable Risk-Based Prioritization ABSTRACT: The attack surface of modern applications has expanded substantially with the adoption of microservice-based architectures, APIs, containers, and continuous integration and delivery pipelines. Although application security tools such as Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) are widely used, these mechanisms often operate in isolation, producing large volumes of alerts that lack operational context. Consequently, security teams face difficulties in prioritizing vulnerabilities based on the actual likelihood of exploitation. In this work, we present a formal and operational architecture for threat-driven application security that integrates SAST, DAST, and SCA results with runtime execution telemetry collected through network sensors and eBPF-based monitoring. The proposed architecture uses probabilistic correlation inspired by Bayesian models to estimate the exploitable risk of identified vulnerabilities, incorporating empirical evidence from observed runtime events and aligning such evidence with the MITRE ATT&CK framework. We mathematically formalize the concept of exploitable risk and demonstrate how multiple sources of evidence can be combined to reduce false positives and improve remediation prioritization. The experimental implementation was carried out in a Kubernetes environment with integration into a CI/CD pipeline, using widely adopted industry tools including Semgrep, OWASP ZAP, OWASP Dependency-Check, Falco, and Suricata. We evaluated the approach on a set of vulnerable applications and observed significant improvements in the accuracy of identifying exploitable vulnerabilities. The experimental results indicate an increase in the F1-score from 0.67–0.63 in isolated approaches to 0.85 in the integrated model, as well as a 37.4% reduction in false positives and a decrease in the average time required for vulnerability triage. We discuss limitations of the probabilistic model, operational implications for DevSecOps practices, and possible extensions, including integration with exploitation metrics such as EPSS and machine learning-assisted analysis for adaptive prioritization. The proposed architecture demonstrates that correlating static analysis, dynamic testing, dependency analysis, and operational telemetry constitutes a promising path to reducing the gap between vulnerability detection and actual exploitation detection.
Read paper →AppSecA Formal and Operational Architecture for Threat-Oriented AppSec: Integration of SAST, DAST, SCA, Runtime Telemetry, and ATT&CK Intelligence for Exploitability-Based Risk Prioritization
TITLE: A Formal and Operational Architecture for Threat-Oriented AppSec: Integration of SAST, DAST, SCA, Runtime Telemetry, and ATT&CK Intelligence for Exploitability-Based Risk Prioritization ABSTRACT: The attack surface of modern applications has expanded substantially with the adoption of microservices-based architectures, APIs, containers, and continuous integration and delivery pipelines. Although application security tools such as Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) are widely used, these mechanisms often operate in isolation, generating large volumes of alerts that lack operational context. Consequently, security teams face difficulties in prioritizing vulnerabilities based on the actual likelihood of exploitation. In this work, we present a formal and operational architecture for threat-oriented application security that integrates SAST, DAST, and SCA findings with runtime execution telemetry collected through network sensors and eBPF-based monitoring. The proposed architecture uses probabilistic correlation inspired by Bayesian models to estimate the exploitability risk of identified vulnerabilities, incorporating empirical evidence from events observed at runtime and aligning such evidence with the MITRE ATT&CK framework. We mathematically formalize the concept of exploitability risk and demonstrate how multiple sources of evidence can be combined to reduce false positives and improve remediation prioritization. The experimental implementation was carried out in a Kubernetes environment with integration into a CI/CD pipeline, using widely adopted industry tools, including Semgrep, OWASP ZAP, OWASP Dependency-Check, Falco, and Suricata. We evaluated the approach on a set of vulnerable applications and observed significant improvements in the accuracy of identifying exploitable vulnerabilities. The experimental results indicate an increase in the F1-score from 0.67–0.63 in isolated approaches to 0.85 in the integrated model, as well as a 37.4% reduction in false positives and a decrease in the average vulnerability triage time. We discuss the limitations of the probabilistic model, operational implications for DevSecOps practices, and possible extensions, including integration with exploitation metrics such as EPSS and machine-learning-assisted analysis for adaptive prioritization. The proposed architecture demonstrates that correlation among static analysis, dynamic testing, dependency analysis, and operational telemetry constitutes a promising path to reducing the gap between vulnerability detection and real exploitation detection.
Read paper →AppSecEvidence-Oriented AppSec: A Formal and Scalable Framework for Application Security Orchestration Based on Threat Modeling and Continuous Hybrid Analysis
TITLE: Evidence-Oriented AppSec: A Formal and Scalable Framework for Application Security Orchestration Based on Threat Modeling and Continuous Hybrid Analysis ABSTRACT: Application security has become a central component of modern cybersecurity due to the growing reliance on distributed architectures, microservices, public APIs, and complex open-source dependency chains. The attack surface of contemporary systems grows proportionally to the interconnectivity among components, rendering traditional approaches that analyze vulnerabilities in isolation insufficient. In contemporary DevSecOps environments, tools such as static analysis (SAST), dynamic analysis (DAST), and software composition analysis (SCA) produce large volumes of alerts, often characterized by high false-positive rates and inadequate risk prioritization. This work proposes a formal framework called EO-AppSec (Evidence-Oriented Application Security), which integrates multiple sources of security evidence into a unified probabilistic model for vulnerability prioritization. We formalize the problem using Bayesian inference combined with contextualized CVSS metrics and dependency modeling of components represented by directed graphs. The framework correlates outputs from SAST, DAST, and SCA tools, as well as operational telemetry, to estimate the likelihood of vulnerability exploitation and compute a conditional risk score. The proposed architecture integrates CI/CD pipelines and cloud-native infrastructures, including Kubernetes environments and observability platforms based on eBPF and modern telemetry stacks. We evaluate the system in an industrial environment comprising 47 applications and approximately 3.2 million lines of code, comparing it with traditional approaches based on isolated analysis. The results demonstrate a significant improvement in vulnerability prioritization accuracy (0.89) and a 42.3% reduction in false positives, as well as a reduction in mean remediation time from 14.2 to 8.7 days. We discuss practical implications for software security governance and integration with contemporary security frameworks, including the NIST Secure Software Development Framework and modern security practices in DevSecOps pipelines. We also analyze methodological limitations and implications for environments that incorporate artificial intelligence components and large language models in modern applications. The results indicate that evidence-based orchestration offers a viable path to reducing operational noise and improving the effectiveness of AppSec programs at industrial scale.
Read paper →AppSecEvidence-Driven AppSec: A Formal and Scalable Framework for Application Security Orchestration Based on Threat Modeling and Continuous Hybrid Analysis
TITLE: Evidence-Driven AppSec: A Formal and Scalable Framework for Application Security Orchestration Based on Threat Modeling and Continuous Hybrid Analysis ABSTRACT: Application security has become a central component of modern cybersecurity due to the growing reliance on distributed architectures, microservices, public APIs, and complex open-source dependency chains. The attack surface of contemporary systems grows in proportion to the interconnectivity among components, making traditional approaches that analyze vulnerabilities in isolation insufficient. In contemporary DevSecOps environments, tools such as static analysis (SAST), dynamic analysis (DAST), and software composition analysis (SCA) generate large volumes of alerts, often characterized by high false-positive rates and inadequate risk prioritization. This work proposes a formal framework called EO-AppSec (Evidence-Oriented Application Security), which integrates multiple security evidence sources into a unified probabilistic model for vulnerability prioritization. We formalize the problem using Bayesian inference combined with contextualized CVSS metrics and component dependency modeling represented by directed graphs. The framework correlates results from SAST, DAST, and SCA tools, as well as operational telemetry, to estimate the probability of vulnerability exploitation and compute a conditional risk score. The proposed architecture integrates CI/CD pipelines and cloud-native infrastructures, including Kubernetes environments and observability platforms based on eBPF and modern telemetry stacks. We evaluated the system in an industrial environment containing 47 applications and approximately 3.2 million lines of code, comparing it with traditional approaches based on isolated analysis. The results demonstrate a significant increase in vulnerability prioritization accuracy (0.89) and a 42.3% reduction in false positives, in addition to a reduction in mean remediation time from 14.2 to 8.7 days. We discuss practical implications for software security governance and integration with contemporary security frameworks, including the NIST Secure Software Development Framework and modern security practices in DevSecOps pipelines. We also analyze methodological limitations and implications for environments that incorporate artificial intelligence components and large language models in modern applications. The results indicate that evidence-based orchestration offers a viable path to reduce operational noise and improve the effectiveness of AppSec programs at industrial scale.
Read paper →AppSecA Quantitative and Operational Application Security Architecture Based on the Integration of SAST, DAST, SCA, and Threat Intelligence in the DevSecOps Lifecycle
TITLE: A Quantitative and Operational Application Security Architecture Based on the Integration of SAST, DAST, SCA, and Threat Intelligence in the DevSecOps Lifecycle ABSTRACT: Application security (Application Security – AppSec) has become a central component of risk management in modern digital environments. The growing adoption of architectures based on microservices, exposed APIs, containers, and continuous delivery pipelines has significantly expanded organizations’ attack surface. Although various security analysis tools are widely available, many organizations still face difficulties in prioritizing vulnerabilities based on the actual risk of exploitation. Static analysis (SAST), dynamic analysis (DAST), and software composition analysis (SCA) tools frequently produce large volumes of findings, many of which have low operational impact or a high false positive rate. This paper proposes a quantitative architecture for risk-oriented AppSec programs, integrating SAST, DAST, and SCA results with external threat intelligence sources. We present a formal prioritization model based on a risk function that combines CVSS scores, evidence of public exploits, application exposure context, and mapping to techniques in the MITRE ATT&CK framework. The proposed architecture is integrated into DevSecOps pipelines and uses vulnerability correlation and normalization mechanisms through management platforms such as DefectDojo. We empirically evaluate the approach on a set of 42 real applications developed in Java, Python, and Node.js. The results indicate a significant reduction in duplicate vulnerabilities, a decrease in the false positive rate, and a substantial improvement in mean time to remediation (MTTR). A 63% reduction in MTTR and a 44.7% decrease in the volume of findings after correlation between scanners were observed. We further demonstrate that incorporating threat intelligence — including the presence of public exploits and observation of adversary activity — improves remediation prioritization and directs resources to vulnerabilities that are effectively exploitable. The results suggest that risk-driven AppSec programs, when integrated into the DevSecOps lifecycle, offer measurable gains in reducing attack surface and improving the operational efficiency of security teams.
Read paper →AppSecA Quantitative and Operational Architecture for Application Security Based on Integrating SAST, DAST, SCA, and Threat Intelligence in the DevSecOps Lifecycle
TITLE: A Quantitative and Operational Architecture for Application Security Based on Integrating SAST, DAST, SCA, and Threat Intelligence in the DevSecOps Lifecycle ABSTRACT: A Quantitative and Operational Architecture for Application Security Based on Integrating SAST, DAST, SCA, and Threat Intelligence in the DevSecOps Lifecycle Abstract: Application Security (AppSec) has become a central component of risk management in modern digital environments. The growing adoption of microservices-based architectures, exposed APIs, containers, and continuous delivery pipelines has significantly expanded organizations’ attack surface. Although many security analysis tools are widely available, many organizations still face difficulties in prioritizing vulnerabilities based on the actual risk of exploitation. Static analysis tools (SAST), dynamic analysis (DAST), and software composition analysis (SCA) often generate large volumes of findings, many of which have low operational impact or a high rate of false positives. This work proposes a quantitative architecture for risk-driven AppSec programs, integrating SAST, DAST, and SCA results with external Threat Intelligence sources. We present a formal prioritization model based on a risk function that combines CVSS scores, evidence of public exploit availability, the application’s exposure context, and mapping to MITRE ATT&CK techniques. The proposed architecture is integrated into DevSecOps pipelines and uses vulnerability correlation and normalization mechanisms through management platforms such as DefectDojo. We empirically evaluated the approach across a set of 42 real-world applications developed in Java, Python, and Node.js. The results indicate a significant reduction in duplicate vulnerabilities, a decrease in the false positive rate, and a substantial improvement in mean time to remediation (MTTR). A 63% reduction in MTTR and a 44.7% decrease in findings volume were observed after correlating scans. We also demonstrated that integrating Threat Intelligence—including the presence of public exploits and observation of adversary activity—improves remediation prioritization and directs resources toward vulnerabilities that are actually exploitable. The findings indicate that risk-driven AppSec programs, when integrated into the DevSecOps lifecycle, provide measurable benefits in reducing the attack surface and improving the operational efficiency of security teams.
Read paper →AppSecA Quantitative and Operational Architecture for Application Security Based on the Integration of SAST, DAST, SCA, and Threat Intelligence in the DevSecOps Lifecycle
Title: A Quantitative and Operational Architecture for Application Security Based on the Integration of SAST, DAST, SCA, and Threat Intelligence in the DevSecOps Lifecycle Abstract: Application Security (AppSec) has become a central component of risk management in modern digital environments. The growing adoption of microservices-based architectures, exposed APIs, containers, and continuous delivery pipelines has significantly expanded organizations’ attack surface. Although many security analysis tools are widely available, many organizations still struggle to prioritize vulnerabilities based on the actual risk of exploitation. Static Analysis (SAST), Dynamic Analysis (DAST), and Software Composition Analysis (SCA) tools often generate large volumes of findings, many of which have low operational impact or a high rate of false positives. This work proposes a quantitative architecture for risk-oriented AppSec programs, integrating SAST, DAST, and SCA results with external Threat Intelligence sources. We present a formal prioritization model based on a risk function that combines CVSS scores, evidence of public exploit availability, the application’s exposure context, and mapping to MITRE ATT&CK framework techniques. The proposed architecture is integrated into DevSecOps pipelines and uses vulnerability correlation and normalization mechanisms via management platforms such as DefectDojo. We empirically evaluated the approach across a set of 42 real applications developed in Java, Python, and Node.js. The results indicate a significant reduction in duplicate vulnerabilities, a decrease in the false positive rate, and a substantial improvement in mean time to remediation (MTTR). A 63% reduction in MTTR and a 44.7% decrease in the volume of findings were observed after correlation across scanners. We also demonstrated that integrating Threat Intelligence — including the presence of public exploits and observation of adversary activity — improves remediation prioritization and directs resources toward vulnerabilities that are actually exploitable. The findings indicate that risk-oriented AppSec programs, when integrated into the DevSecOps lifecycle, provide measurable benefits in reducing the attack surface and improving the operational efficiency of security teams.
Read paper →AppSecA Quantitative Architecture for Application Security Based on Formal Threat Modeling, Integration of SAST/DAST/SCA, and Runtime Telemetry in DevSecOps Environments
TITLE: A Quantitative Architecture for Application Security Based on Formal Threat Modeling, Integration of SAST/DAST/SCA, and Runtime Telemetry in DevSecOps Environments ABSTRACT: A Quantitative Architecture for Application Security Based on Formal Threat Modeling, Integration of SAST/DAST/SCA, and Runtime Telemetry in DevSecOps Environments ABSTRACT: A Quantitative Architecture for Application Security Based on Formal Threat Modeling, Integration of SAST/DAST/SCA, and Runtime Telemetry in DevSecOps Environments ABSTRACT: The growing reliance on web applications, APIs, and microservice-based architectures has significantly expanded the attack surface of modern systems. Recent incident reports indicate that the exploitation of Internet-facing applications remains among the most frequent intrusion vectors, often leveraging known vulnerabilities in libraries, input validation flaws, or misconfigurations. Although application security tools such as static analysis (SAST), dynamic analysis (DAST), and software composition analysis (SCA) are widely used in DevSecOps pipelines, these mechanisms typically operate in a fragmented manner and without a quantitative framework that enables estimation of the system’s residual risk. This work proposes an integrated Application Security architecture based on formal threat modeling, aggregation of results from multiple analysis sources, and incorporation of real-time execution telemetry. We formalize the problem of vulnerability prioritization as a weighted residual-risk minimization process, in which each vulnerability is evaluated based on metrics of exploitability probability, potential impact, and operational context. The proposed architecture integrates static, dynamic, and dependency analysis tools with security observability mechanisms, including runtime behavioral detection and continuous event collection. We experimentally evaluate the approach in an environment composed of deliberately vulnerable applications and real microservices running on containerized infrastructure. The results indicate a significant improvement in the ability to identify effectively exploitable vulnerabilities, with an average increase in recall to 91.3% and a 63.4% reduction in mean time to detect (MTTD) compared with isolated approaches. The observed computational overhead remained below 20%, compatible with the operational requirements of modern CI/CD pipelines. In addition, we discuss implications for corporate AppSec programs, highlighting the importance of integrating code analysis, operational monitoring, and threat intelligence. The proposed architecture demonstrates that combining formal modeling with runtime telemetry provides a solid foundation for contextual vulnerability prioritization and the effective reduction of residual risk in contemporary software systems.
Read paper →AppSecA Quantitative Application Security Architecture Based on Formal Threat Modeling, SAST/DAST/SCA Integration, and Runtime Telemetry in DevSecOps Environments
TITLE: A Quantitative Application Security Architecture Based on Formal Threat Modeling, SAST/DAST/SCA Integration, and Runtime Telemetry in DevSecOps Environments ABSTRACT: The growing dependence on web applications, APIs, and microservice-based architectures has significantly expanded the attack surface of modern systems. Recent incident reports indicate that exploitation of internet-exposed applications remains among the most frequent intrusion vectors, often leveraging known vulnerabilities in libraries, input validation flaws, or misconfigurations. Although application security tools such as static analysis (SAST), dynamic analysis (DAST), and software composition analysis (SCA) are widely used in DevSecOps pipelines, these mechanisms typically operate in a fragmented manner and without a quantitative framework that enables estimation of the system’s residual risk. This work proposes an integrated Application Security architecture based on formal threat modeling, aggregation of results from multiple analysis sources, and incorporation of real-time execution telemetry. We formalize the problem of vulnerability prioritization as a weighted residual risk minimization process, in which each vulnerability is assessed based on exploit probability metrics, potential impact, and operational context. The proposed architecture integrates static, dynamic, and dependency analysis tools with security observability mechanisms, including behavioral detection at runtime and continuous event collection. We experimentally evaluate the approach in an environment composed of deliberately vulnerable applications and real microservices running on containerized infrastructure. The results indicate a significant improvement in the ability to identify effectively exploitable vulnerabilities, with an average recall increase to 91.3% and a 63.4% reduction in mean time to detection (MTTD) compared with isolated approaches. The observed computational overhead remained below 20%, compatible with the operational requirements of modern CI/CD pipelines. In addition, we discuss implications for enterprise AppSec programs, highlighting the importance of integration between code analysis, operational monitoring, and threat intelligence. The proposed architecture demonstrates that combining formal modeling with runtime telemetry provides a solid basis for contextualized vulnerability prioritization and effective reduction of residual risk in contemporary software systems.
Read paper →DFIRFormal and Operational Architecture for Digital Incident Response with Cryptographic Guarantees and Verifiable Validation in Modern Infrastructures
TITLE: Formal and Operational Architecture for Digital Incident Response with Cryptographic Guarantees and Verifiable Validation in Modern Infrastructures ABSTRACT: Formal and Operational Architecture for Digital Incident Response with Cryptographic Guarantees and Verifiable Validation in Modern Infrastructures Abstract: Formal and Operational Architecture for Digital Incident Response with Cryptographic Guarantees and Verifiable Validation in Modern Infrastructures Abstract: The growing complexity of contemporary digital ecosystems, intensified by the widespread adoption of cloud computing, microservice architectures, artificial intelligence, and distributed infrastructures, demands more rigorous approaches to Digital Forensics and Incident Response (DFIR). Traditional incident response frameworks focus predominantly on operational procedures and organizational governance, leaving important gaps in the mathematical formalization of evidence integrity and in the verifiability of the chain of custody. In this work, we propose an integrated architecture that combines the foundations of applied cryptography, formal verification methods, and operational mechanisms for telemetry collection and correlation for incident response in enterprise environments, critical infrastructures, and cloud platforms. We formalize a DFIR-specific threat model based on adversarial capability classes and define security games that capture properties of integrity, authenticity, and immutability of the evidence chain. We introduce a cryptographic chaining mechanism based on collision-resistant hash functions and Merkle trees, combined with modern digital signatures and immutable storage. In addition, we present a forensic correlation algorithm modeled as a directed acyclic graph, with complexity analysis and demonstrable correctness properties. The architecture is designed for integration with widely used tools in contemporary security operations, including YARA, Sigma, Suricata, SIEM/SOAR telemetry pipelines, and observability mechanisms based on eBPF in Linux environments. We conducted a qualitative experimental evaluation comparing the proposed approach with traditional incident response workflows, examining ingestion latency, computational overhead, and resistance to adversarial tampering. Two case studies—one in a digitized hospital environment and another in an industrial ICS/SCADA network—demonstrate the applicability of the model in domains with stringent regulatory and operational constraints. We conclude that the systematic incorporation of cryptographic guarantees and formal specifications into DFIR practice significantly increases evidentiary reliability and the auditability of investigations, at the cost of moderate computational overhead and greater operational complexity. The work contributes to the convergence of applied cryptography, formal verification, and operational security engineering, aligning with the needs of contemporary cybersecurity in 2024.
Read paper →DFIREvidence-Driven Architecture for High-Fidelity DFIR: Multilayer Correlation, Mathematical Formalization, and Empirical Evaluation in Enterprise Environments
TITLE: Evidence-Driven Architecture for High-Fidelity DFIR: Multilayer Correlation, Mathematical Formalization, and Empirical Evaluation in Enterprise Environments ABSTRACT: Evidence-Driven Architecture for High-Fidelity DFIR: Multilayer Correlation, Mathematical Formalization, and Empirical Evaluation in Enterprise Environments ABSTRACT: Evidence-Driven Architecture for High-Fidelity DFIR: Multilayer Correlation, Mathematical Formalization, and Empirical Evaluation in Enterprise Environments ABSTRACT: The growing sophistication of corporate cyberattacks requires Digital Forensics and Incident Response (DFIR) methodologies capable of reconstructing complex attack chains from multiple heterogeneous sources of evidence. Modern enterprise environments generate large volumes of telemetry from endpoints, networks, cloud services, and security platforms, including EDR, SIEM, and observability tools. However, operational integration and rigorous temporal correlation of these evidences remain significant challenges. This paper proposes an evidence-driven architecture for high-fidelity digital forensic investigation, based on formal modeling using verifiable temporal graphs. The model introduces a mathematical structure that represents digital artifacts, causal relationships, and adversary technique labels according to the MITRE ATT&CK framework, while preserving cryptographic integrity and temporal consistency properties. The operational architecture integrates widely adopted industry tools, including Sysmon, Suricata, Auditd, Elastic Stack, Volatility 3, and YARA, as well as incident response orchestration mechanisms. We propose two main algorithms: EviGraph-Builder, responsible for building the forensic graph from normalized events, and CausalPath-Reconstruct, intended for probabilistic reconstruction of multistage attack chains. The experimental evaluation was conducted across 49 scenarios containing real incidents and controlled environments based on Atomic Red Team. The results demonstrate an average reduction of more than 50% in investigation time and a significant increase in the rate of correct correlation of adversary techniques when compared to traditional manual processes. In addition, we discuss operational implications for Security Operations Centers (SOC), temporal synchronization requirements, preservation of the chain of custody, and integration with modern cloud security platforms and hybrid environments. The results indicate that mathematical formalization combined with automated evidence correlation constitutes a significant advance for enterprise DFIR, contributing to faster, reproducible, and verifiable investigations.
Read paper →DFIREvidence-Oriented Architecture for High-Fidelity DFIR: Multilayer Correlation, Mathematical Formalization, and Empirical Evaluation in Corporate Environments
TITLE: Evidence-Oriented Architecture for High-Fidelity DFIR: Multilayer Correlation, Mathematical Formalization, and Empirical Evaluation in Corporate Environments ABSTRACT: The growing sophistication of corporate cyberattacks demands Digital Forensics and Incident Response (DFIR) methodologies capable of reconstructing complex attack chains from multiple heterogeneous sources of evidence. Modern corporate environments generate large volumes of telemetry from endpoints, networks, cloud services, and security platforms, including EDR, SIEM, and observability tools. However, operational integration and rigorous temporal correlation of this evidence remain significant challenges. This work proposes an evidence-oriented architecture for high-fidelity digital forensic investigation based on formal modeling using verifiable temporal graphs. The model introduces a mathematical structure that represents digital artifacts, causal relationships, and adversary technique labels according to the MITRE ATT&CK framework, while simultaneously preserving cryptographic integrity and temporal consistency properties. The operational architecture integrates widely adopted industry tools, including Sysmon, Suricata, Auditd, Elastic Stack, Volatility 3, and YARA, as well as incident response orchestration mechanisms. We propose two main algorithms: EviGraph-Builder, responsible for constructing the forensic graph from normalized events, and CausalPath-Reconstruct, intended for probabilistic reconstruction of multi-stage attack chains. The experimental evaluation was conducted across 49 scenarios containing real incidents and controlled environments based on Atomic Red Team. The results demonstrate an average reduction of more than 50% in investigation time and a significant increase in the correct correlation rate of adversary techniques when compared to traditional manual processes. Additionally, we discuss operational implications for Security Operations Centers (SOC), temporal synchronization requirements, chain-of-custody preservation, and integration with modern cloud security platforms and hybrid environments. The results indicate that mathematical formalization combined with automated evidence correlation constitutes a significant advance for corporate DFIR, contributing to faster, reproducible, and verifiable investigations.
Read paper →DFIRA Formally Grounded Architecture for Graph-Based DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction
TITLE: A Formally Grounded Architecture for Graph-Based DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction ABSTRACT: A Formally Grounded Architecture for Graph-Based DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction ABSTRACT: The increasing sophistication of modern cyber campaigns poses significant challenges to Digital Forensics and Incident Response (DFIR) practices. Contemporary enterprise environments generate massive volumes of telemetry across multiple layers—endpoints, networks, applications, and cloud infrastructures—making manual incident reconstruction practically unfeasible. Although monitoring systems and SIEM platforms provide event correlation mechanisms, such approaches often lack a formal basis for preserving causal relationships and temporal consistency among digital evidence. In this work, we present a formal architecture for DFIR based on temporal graphs enriched with probabilistic inference and cryptographic evidence integrity mechanisms. We propose a mathematical model that represents forensic events as typed vertices in a temporally consistent directed graph, enabling the capture of causal dependencies among processes, files, network connections, and identities. On top of this graph, we introduce the Attack Probabilistic Reconstruction (APR) algorithm, which uses Bayesian inference conditioned on tactical and technical patterns described in the MITRE ATT&CK framework to estimate the most likely sequence of adversary actions. In addition, we implement a cryptographic hash chaining mechanism that ensures the integrity and verifiability of evidence throughout the investigative pipeline. We experimentally evaluate the proposed architecture using three representative datasets: the DARPA Transparent Computing dataset, large-scale real enterprise logs, and synthetic Log4Shell exploitation scenarios. The results demonstrate substantial improvements in precision, recall, and attack chain reconstruction time compared with approaches based exclusively on heuristic correlation or isolated statistical detection. We observed an average reduction of 37.4% in investigative reconstruction time and a significant increase in the accuracy of attack chain inferences. We also discuss practical implications for integration with modern SIEM platforms, as well as limitations related to log quality and storage costs. We conclude that the combination of formal temporal-graph-based modeling, probabilistic inference, and cryptographic guarantees constitutes a promising foundation for scalable and verifiable DFIR systems in contemporary enterprise environments.
Read paper →DFIRA Formally Grounded Architecture for Graph-Oriented Temporal DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction
TITLE: A Formally Grounded Architecture for Graph-Oriented Temporal DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction ABSTRACT: A Formally Grounded Architecture for Graph-Oriented Temporal DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction ABSTRACT: The increasing sophistication of modern cyber campaigns imposes significant challenges on Digital Forensics and Incident Response (DFIR) practices. Contemporary enterprise environments generate massive volumes of telemetry from multiple layers—endpoints, networks, applications, and cloud infrastructures—making manual incident reconstruction practically unfeasible. Although monitoring systems and SIEM platforms provide event correlation mechanisms, such approaches often lack a formal foundation to preserve causal relationships and temporal consistency among digital evidence. In this work, we present a formal architecture for DFIR based on temporal graphs enriched with probabilistic inference and cryptographic evidence-integrity mechanisms. We propose a mathematical model that represents forensic events as typed vertices in a temporally consistent directed graph, enabling the capture of causal dependencies among processes, files, network connections, and identities. On this graph, we introduce the Attack Probabilistic Reconstruction (APR) algorithm, which uses Bayesian inference conditioned on tactical and technical patterns described in the MITRE ATT&CK framework to estimate the most likely sequence of adversary actions. Additionally, we implement a cryptographic hash-chaining mechanism that ensures the integrity and verifiability of evidence throughout the investigative pipeline. We experimentally evaluate the proposed architecture using three representative datasets: the DARPA Transparent Computing dataset, large-scale real-world corporate logs, and synthetic exploitation scenarios of the Log4Shell vulnerability. The results demonstrate substantial improvements in precision, recall, and attack-chain reconstruction time compared with approaches based exclusively on heuristic correlation or isolated statistical detection. We observed an average reduction of 37.4% in investigative reconstruction time and a significant increase in the accuracy of attack-chain inferences. We also discuss practical implications for integration with modern SIEM platforms, as well as limitations related to log quality and storage costs. We conclude that the combination of formal temporal-graph-based modeling, probabilistic inference, and cryptographic guarantees constitutes a promising foundation for scalable and verifiable DFIR systems in contemporary enterprise environments.
Read paper →