Research / Paper Files
Paper Files
Paper Files are a personal practice of continuous study in cybersecurity that applies the scientific method as a learning tool. Each article is written not for academic publication, but as a deliberate exercise to sharpen the axe — deepening knowledge on specific topics, organizing ideas with rigor, and observing how understanding of certain subjects develops over time. It is the intellectual equivalent of a training journal: each entry records what was studied, how it was analyzed, and what conclusions emerged.
I strongly recommend that security professionals adopt this method. Choose a topic you want to master, research primary sources (RFCs, papers, official documentation), structure your text with introduction, methodology, analysis, and conclusion, and write as if you were explaining to a colleague. The act of writing forces clarity of thought and exposes gaps in understanding that passive reading cannot reveal. Use the articles on this site as examples of format and depth, and build your own collection — over time, you will have a personal repository of refined knowledge that no course or certification can replace.
DAI & ADAI · 2026
DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts
DAI (Decripte Artificial Intelligence) is a proprietary domain-specific LLM within a governed autonomous defensive architecture. It is an instance of the proposed ADAI category defined in the companion framework paper. T…
Read paper →ADAI · ENAutonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure
ADAI (Autonomous Defensive Artificial Intelligence) is a proposed category of governed autonomous cyber defense. The framework specifies defended perimeters, bounded effects, declared rollback and capability-disjoint ver…
Read paper →226 papers
A Temporal-Graph-Oriented Formal DFIR Infrastructure with Cryptographic Integrity Assurance and Probabilistic Attack-Chain Reconstruction Capability
TITLE: A Temporal-Graph-Oriented Formal DFIR Infrastructure with Cryptographic Integrity Assurance and Probabilistic Attack-Chain Reconstruction Capability ABSTRACT: A Temporal-Graph-Oriented Formal DFIR Infrastructure with Cryptographic Integrity Assurance and Probabilistic Attack-Chain Reconstruction Capability Abstract: Modern cyberattack activities are becoming increasingly complex, posing significant challenges to Digital Forensics and Incident Response (DFIR) practice. Contemporary enterprise environments generate massive telemetry data from multiple layers—endpoints, networks, applications, and cloud infrastructure—making manual incident reconstruction practically infeasible. Although monitoring systems and SIEM platforms provide event correlation mechanisms, such approaches often lack a formal foundation and struggle to preserve causal relationships and temporal consistency among digital evidence. This paper proposes a temporal-graph-based DFIR formal architecture, combined with probabilistic reasoning and cryptographic mechanisms for evidence integrity. We present a mathematical model that represents forensic events as typed vertices forming a temporally consistent directed graph, thereby capturing causal dependencies among processes, files, network connections, and identities. On top of this graph, we introduce a Probabilistic Attack Reconstruction (RPA) algorithm, which uses Bayesian inference conditioned on tactical and technical patterns described in the MITRE ATT&CK framework to estimate the adversary’s most likely sequence of actions. In addition, we implement a cryptographic hash-chain mechanism to ensure the integrity and verifiability of evidence throughout the investigation workflow. We experimentally evaluate the proposed architecture using three representative datasets: the DARPA Transparent Computing dataset, large-scale real-world enterprise logs, and a synthetic scenario targeting Log4Shell exploitation. The results show significant improvements over methods based solely on heuristic correlation or isolated statistical detection in metrics such as accuracy, recall, and attack-chain reconstruction time. We observed an average 37.4% reduction in investigation reconstruction time, while attack-chain inference precision improved substantially. We also discuss its practical implications for integration with modern SIEM platforms, as well as limitations related to log quality and storage costs. We conclude that the combination of temporal-graph formal modeling, probabilistic reasoning, and cryptographic assurance provides a promising foundation for scalable and verifiable DFIR systems in modern enterprise environments.
Read paper →DFIRA Formally Grounded Architecture for Graph-Based DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction
TITLE: A Formally Grounded Architecture for Graph-Based DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction ABSTRACT: A Formally Grounded Architecture for Graph-Based DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction ABSTRACT: The increasing sophistication of modern cyber campaigns imposes significant challenges on Digital Forensics and Incident Response (DFIR) practices. Contemporary enterprise environments generate massive volumes of telemetry across multiple layers—endpoints, networks, applications, and cloud infrastructures—making manual incident reconstruction practically infeasible. Although monitoring systems and SIEM platforms provide event correlation mechanisms, such approaches often lack a formal basis for preserving causal relationships and temporal consistency among digital evidence. In this work, we present a formal architecture for DFIR based on temporal graphs enriched with probabilistic inference and cryptographic evidence integrity mechanisms. We propose a mathematical model that represents forensic events as typed vertices in a temporally consistent directed graph, enabling the capture of causal dependencies among processes, files, network connections, and identities. On top of this graph, we introduce the Attack Probabilistic Reconstruction (APR) algorithm, which uses Bayesian inference conditioned on tactical and technical patterns described in the MITRE ATT&CK framework to estimate the most likely sequence of adversary actions. Additionally, we implement a cryptographic hash-chaining mechanism that ensures the integrity and verifiability of evidence throughout the investigative pipeline. We experimentally evaluate the proposed architecture using three representative datasets: the DARPA Transparent Computing dataset, large-scale real enterprise logs, and synthetic Log4Shell exploitation scenarios. The results demonstrate substantial improvements in precision, recall, and attack chain reconstruction time compared with approaches based exclusively on heuristic correlation or isolated statistical detection. We observed an average reduction of 37.4% in investigative reconstruction time and a significant increase in the accuracy of attack chain inferences. We also discuss practical implications for integration with modern SIEM platforms, as well as limitations related to log quality and storage costs. We conclude that the combination of formal temporal graph-based modeling, probabilistic inference, and cryptographic guarantees constitutes a promising foundation for scalable and verifiable DFIR systems in contemporary enterprise environments.
Read paper →DFIRA formally grounded architecture for graph-based DFIR with temporal graphs, cryptographic integrity guarantees, and probabilistic reconstruction of the attack chain
TITLE: A formally grounded architecture for graph-based DFIR with temporal graphs, cryptographic integrity guarantees, and probabilistic reconstruction of the attack chain ABSTRACT: A formally grounded architecture for graph-based DFIR with temporal graphs, cryptographic integrity guarantees, and probabilistic reconstruction of the attack chain ABSTRACT: A formally grounded architecture for graph-based DFIR with temporal graphs, cryptographic integrity guarantees, and probabilistic reconstruction of the attack chain SUMMARY: The increasing sophistication of modern cyber campaigns poses significant challenges for Digital Forensics and Incident Response (DFIR) practices. Contemporary enterprise environments generate massive volumes of telemetry across multiple layers—endpoints, networks, applications, and cloud infrastructures—making manual reconstruction of incidents practically impossible. Although monitoring systems and SIEM platforms provide mechanisms for event correlation, such approaches often lack a formal foundation for preserving causal relationships and temporal consistency across digital evidence. In this paper, we present a formal architecture for DFIR based on temporal graphs, enriched with probabilistic inference and cryptographic mechanisms for evidence integrity assurance. We propose a mathematical model that represents forensic events as typed nodes in a temporally consistent directed graph, thereby enabling the capture of causal dependencies among processes, files, network connections, and identities. On this graph, we introduce the Attack Probabilistic Reconstruction (APR) algorithm, which uses Bayesian inference in consideration of tactical and technical patterns as described in the MITRE ATT&CK framework to estimate the most likely sequence of attacker actions. In addition, we implement a cryptographic hash-chaining mechanism that ensures the integrity and verifiability of evidence throughout the entire investigative pipeline. We experimentally evaluate the proposed architecture using three representative datasets: the DARPA Transparent Computing dataset, extensive real-world enterprise logs, and synthetic Log4Shell exploitation scenarios. The results show clear improvements in precision, recall, and attack-chain reconstruction time compared with approaches relying solely on heuristic correlation or isolated statistical detection. We observe an average reduction in investigative reconstruction time of 37.4% as well as a significant increase in the accuracy of attack-chain inference. We also discuss practical implications for integration into modern SIEM platforms and limitations related to log quality and storage overhead. We conclude that the combination of formal modeling based on temporal graphs, probabilistic inference, and cryptographic guarantees provides a promising foundation for scalable and verifiable DFIR systems in contemporary enterprise environments.
Read paper →DFIRA Formally Grounded Architecture for Graph-Based Temporal DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction
TITLE: A Formally Grounded Architecture for Graph-Based Temporal DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction ABSTRACT: A Formally Grounded Architecture for Graph-Based Temporal DFIR with Cryptographic Integrity Guarantees and Probabilistic Attack Chain Reconstruction ABSTRACT: The increasing sophistication of modern cyber campaigns poses significant challenges to Digital Forensics and Incident Response (DFIR) practices. Contemporary enterprise environments generate massive volumes of telemetry across multiple layers—endpoints, networks, applications, and cloud infrastructures—making manual incident reconstruction practically unfeasible. Although monitoring systems and SIEM platforms provide event correlation mechanisms, such approaches often lack a formal basis to preserve causal relationships and temporal consistency among digital evidence. In this work, we present a formal architecture for DFIR based on temporal graphs enriched with probabilistic inference and cryptographic evidence integrity mechanisms. We propose a mathematical model that represents forensic events as typed vertices in a temporally consistent directed graph, enabling the capture of causal dependencies among processes, files, network connections, and identities. On top of this graph, we introduce the Attack Probabilistic Reconstruction (APR) algorithm, which uses Bayesian inference conditioned on tactical and technical patterns described in the MITRE ATT&CK framework to estimate the most likely sequence of adversary actions. Additionally, we implement a cryptographic hash-chaining mechanism that ensures the integrity and verifiability of evidence throughout the investigative pipeline. We experimentally evaluate the proposed architecture using three representative datasets: the DARPA Transparent Computing dataset, large-scale real-world enterprise logs, and synthetic Log4Shell exploitation scenarios. The results demonstrate substantial improvements in precision, recall, and attack chain reconstruction time compared to approaches based exclusively on heuristic correlation or isolated statistical detection. We observed an average reduction of 37.4% in investigative reconstruction time and a significant increase in the accuracy of attack chain inferences. We also discuss practical implications for integration with modern SIEM platforms, as well as limitations related to log quality and storage costs. We conclude that the combination of formal graph-based temporal modeling, probabilistic inference, and cryptographic guarantees constitutes a promising foundation for scalable and verifiable DFIR systems in contemporary enterprise environments.
Read paper →DFIRA formally grounded architecture for graph-based DFIR with temporal graphs, cryptographic integrity guarantees, and probabilistic attack-chain reconstruction
TITLE: A formally grounded architecture for graph-based DFIR with temporal graphs, cryptographic integrity guarantees, and probabilistic attack-chain reconstruction ABSTRACT: A formally grounded architecture for graph-based DFIR with temporal graphs, cryptographic integrity guarantees, and probabilistic attack-chain reconstruction ABSTRACT: A formally grounded architecture for graph-based DFIR with temporal graphs, cryptographic integrity guarantees, and probabilistic attack-chain reconstruction SUMMARY: The increasing sophistication of modern cyber campaigns poses significant challenges to Digital Forensics and Incident Response (DFIR) practices. Contemporary enterprise environments generate massive amounts of telemetry across multiple layers—endpoints, networks, applications, and cloud infrastructures—making manual reconstruction of incidents practically impossible. Although monitoring systems and SIEM platforms provide mechanisms for event correlation, such approaches often lack a formal foundation to preserve causal relationships and temporal consistency among digital evidence. In this work, we present a formal architecture for DFIR based on temporal graphs, augmented by probabilistic inference and cryptographic mechanisms for evidence integrity assurance. We propose a mathematical model that represents forensic events as typed nodes in a temporally consistent directed graph, enabling the capture of causal dependencies between processes, files, network connections, and identities. On this graph, we introduce the Attack Probabilistic Reconstruction (APR) algorithm, which uses Bayesian inference in consideration of tactical and technical patterns as described in the MITRE ATT&CK framework to estimate the most likely sequence of attacker actions. In addition, we implement a cryptographic hash-chaining mechanism that ensures the integrity and verifiability of evidence throughout the entire investigative pipeline. We experimentally evaluate the proposed architecture using three representative datasets: the DARPA Transparent Computing dataset, large-scale real-world enterprise logs, and synthetic Log4Shell exploitation scenarios. The results show clear improvements in precision, recall, and attack-chain reconstruction time compared with approaches based solely on heuristic correlation or isolated statistical detection. We observe an average reduction of 37.4% in investigative reconstruction time as well as a significant increase in the accuracy of attack-chain inference. We also discuss practical implications for integration into modern SIEM platforms and limitations related to log quality and storage overhead. We conclude that the combination of formal temporal-graph-based modeling, probabilistic inference, and cryptographic guarantees provides a promising foundation for scalable and verifiable DFIR systems in contemporary enterprise environments.
Read paper →DFIREvidence-Oriented Architecture for Modern DFIR: Multi-Layer Correlation, Mathematical Formalization of Timelines, and Automated Orchestration in Hybrid Environments
TITLE: Evidence-Oriented Architecture for Modern DFIR: Multi-Layer Correlation, Mathematical Formalization of Timelines, and Automated Orchestration in Hybrid Environments ABSTRACT: The increasing complexity of contemporary computing environments—characterized by hybrid infrastructures, cloud workloads, containers, and distributed systems—poses new challenges for the discipline of Digital Forensics and Incident Response (DFIR). Traditional investigative procedures, which rely predominantly on the manual collection of artifacts and ad hoc correlation of logs, exhibit clear limitations in light of the volume, volatility, and heterogeneity of data generated by modern systems. Moreover, Advanced Persistent Threat (APT) campaigns, Ransomware-as-a-Service (RaaS) operations, and the automated exploitation of critical vulnerabilities drastically shorten the interval between initial compromise and lateral movement. In this context, it becomes essential to develop formalized and scalable approaches that integrate multiple telemetry sources and can reconstruct attack chains with temporal precision. In this paper, we propose an evidence-oriented architecture for modern DFIR based on three main pillars: (i) mathematical formalization of the reconstruction of forensic timelines using directed acyclic graphs, (ii) an automated pipeline approach for the ingestion, normalization, and correlation of events from network, endpoint, identity, and cloud layers, and (iii) operational integration with platforms for orchestration and automation of incident response. The proposed model represents security events as structured entities and establishes probabilistic causal relationships between correlated events. The experimental implementation uses a technology stack consisting of Elastic Stack, Suricata, Zeek, Sysmon, Volatility 3, and a SOAR platform based on TheHive and Cortex. We evaluate the architecture using a dataset of 37 scenarios aligned with the MITRE ATT&CK framework, totaling 1.2 TB of data and approximately 86 million events. The results show a significant reduction in mean time to investigation (MTTI), a decrease in false positives, and higher accuracy in reconstructing attack chains compared with traditional SIEM-only approaches. In addition, we discuss practical implications for Security Operations Centers (SOC), limitations of the model, and possible extensions, including dynamic graph-based analysis and the integration of machine learning techniques for prioritized investigation.
Read paper →DFIRAn Evidence-Oriented Architecture for Modern DFIR: Multilayer Correlation, Mathematical Formalization of Timeline Reconstruction, and Automated Orchestration in Hybrid Environments
TITLE: An Evidence-Oriented Architecture for Modern DFIR: Multilayer Correlation, Mathematical Formalization of Timeline Reconstruction, and Automated Orchestration in Hybrid Environments ABSTRACT: The growing complexity of contemporary computing environments—characterized by hybrid infrastructures, cloud workloads, containers, and distributed systems—poses new challenges for Digital Forensics and Incident Response (DFIR). Traditional investigative methods, based predominantly on manual artifact collection and ad hoc log correlation, exhibit limitations in the face of the scale, volatility, and heterogeneity of the data generated by modern systems. In addition, advanced persistent threat (APT) campaigns, ransomware-as-a-service (RaaS) operations, and automated exploitation of critical vulnerabilities drastically reduce the interval between initial compromise and lateral movement. In this context, it becomes essential to develop formalized and scalable approaches capable of integrating multiple telemetry sources and reconstructing attack chains with temporal precision. In this work, we propose an evidence-oriented architecture for modern DFIR based on three main pillars: (i) mathematical formalization of forensic timeline reconstruction using directed acyclic graphs, (ii) an automated pipeline for ingestion, normalization, and correlation of events from network, endpoint, identity, and cloud layers, and (iii) operational integration with orchestration platforms and incident response automation. The proposed model represents security events as structured entities and establishes probabilistic causal relationships among correlated events. The experimental implementation uses a technology stack composed of Elastic Stack, Suricata, Zeek, Sysmon, Volatility 3, and a SOAR platform based on TheHive and Cortex. We evaluated the architecture using a set of 37 scenarios aligned with the MITRE ATT&CK framework, totaling 1.2 TB of data and approximately 86 million events. The results demonstrate a significant reduction in mean time to investigation (MTTI), a decrease in false positives, and greater accuracy in reconstructing attack chains when compared to traditional approaches based solely on SIEM. Additionally, we discuss practical implications for Security Operations Centers (SOC), limitations of the model, and possible extensions involving dynamic graph-based analysis and integration with machine learning techniques for investigative prioritization.
Read paper →DFIRAn Evidence-Driven Architecture for Modern DFIR: Multilayer Correlation, Mathematical Formalization of Timelines, and Automated Orchestration in Hybrid Environments
TITLE: An Evidence-Driven Architecture for Modern DFIR: Multilayer Correlation, Mathematical Formalization of Timelines, and Automated Orchestration in Hybrid Environments ABSTRACT: An Evidence-Driven Architecture for Modern DFIR: Multilayer Correlation, Mathematical Formalization of Timelines, and Automated Orchestration in Hybrid Environments Abstract: The increasing complexity of contemporary computing environments—characterized by hybrid infrastructures, cloud workloads, containers, and distributed systems—poses new challenges in the field of Digital Forensics and Incident Response (DFIR). Traditional investigative methods, based mainly on manual collection of artifacts and ad hoc correlation of logs, exhibit limitations in light of the scale, volatility, and heterogeneity of data generated by modern systems. In addition, advanced persistent threat (APT) campaigns, ransomware-as-a-service (RaaS) operations, and automated exploitation of critical vulnerabilities drastically reduce the time window between initial compromise and lateral movement. In this context, it is essential to develop formal and scalable approaches capable of integrating multiple telemetry sources and reconstructing attack chains with temporal precision. In this work, we propose an evidence-driven architecture for modern DFIR based on three main pillars: (i) mathematical formalization of forensic timeline reconstruction using directed acyclic graphs, (ii) an automated pipeline for ingestion, normalization, and correlation of events originating from the network, endpoint, identity, and cloud layers, and (iii) operational integration with orchestration platforms and incident response automation. The proposed model represents security events as structured entities and establishes probabilistic causal relationships between correlated events. The experimental implementation uses a technology stack including Elastic Stack, Suricata, Zeek, Sysmon, Volatility 3, and a SOAR platform based on TheHive and Cortex. We evaluated the architecture using a set of 37 scenarios aligned with the MITRE ATT&CK framework, totaling 1.2 TB of data and approximately 86 million events. The results demonstrate a significant reduction in MTTI, a decrease in false positives, and higher accuracy in reconstructing attack chains compared to traditional SIEM-only approaches. In addition, we discuss practical implications for security operations centers (SOC), the limitations of the model, and extension possibilities including dynamic graph-based analysis and integration with machine learning techniques for investigative prioritization.
Read paper →DFIREvidence-Oriented Architecture for Modern DFIR: Multilayer Correlation, Mathematical Formalization of Timeline Reconstruction, and Automated Orchestration in Hybrid Environments
TITLE: Evidence-Oriented Architecture for Modern DFIR: Multilayer Correlation, Mathematical Formalization of Timeline Reconstruction, and Automated Orchestration in Hybrid Environments ABSTRACT: The growing complexity of contemporary computing environments—characterized by hybrid infrastructures, cloud workloads, containers, and distributed systems—poses new challenges for the field of Digital Forensics and Incident Response (DFIR). Traditional investigative methods, based predominantly on manual artifact collection and ad hoc log correlation, exhibit limitations in the face of the scale, volatility, and heterogeneity of data generated by modern systems. In addition, advanced persistent threat (APT) campaigns, ransomware-as-a-service (RaaS) operations, and automated exploitation of critical vulnerabilities drastically reduce the interval between initial compromise and lateral movement. In this context, it becomes essential to develop formalized and scalable approaches capable of integrating multiple telemetry sources and reconstructing attack chains with temporal precision. In this work, we propose an evidence-oriented architecture for modern DFIR based on three main pillars: (i) mathematical formalization of forensic timeline reconstruction using directed acyclic graphs, (ii) an automated pipeline for ingestion, normalization, and correlation of events from network, endpoint, identity, and cloud layers, and (iii) operational integration with orchestration platforms and incident response automation. The proposed model represents security events as structured entities and establishes probabilistic causal relationships between correlated events. The experimental implementation uses a technology stack composed of Elastic Stack, Suricata, Zeek, Sysmon, Volatility 3, and a SOAR platform based on TheHive and Cortex. We evaluated the architecture using a set of 37 scenarios aligned with the MITRE ATT&CK framework, totaling 1.2 TB of data and approximately 86 million events. The results demonstrate a significant reduction in mean time to investigate (MTTI), a decrease in false positives, and greater accuracy in reconstructing attack chains when compared to traditional SIEM-only approaches. Additionally, we discuss practical implications for security operations centers (SOC), limitations of the model, and possible extensions involving graph-based analysis and integration with machine learning techniques for investigative prioritization.
Read paper →DFIREvidence-Driven Architectures for Modern DFIR: Multi-Level Correlation, Mathematical Formalization of Timelines, and Automated Orchestration in Hybrid Environments
TITLE: Evidence-Driven Architectures for Modern DFIR: Multi-Level Correlation, Mathematical Formalization of Timelines, and Automated Orchestration in Hybrid Environments ABSTRACT: Evidence-Driven Architectures for Modern DFIR: Multi-Level Correlation, Mathematical Formalization of Timelines, and Automated Orchestration in Hybrid Environments Abstract: Contemporary computing environments are becoming increasingly complex, characterized by hybrid infrastructures, cloud workloads, containers, and distributed systems, which pose new challenges to the field of Digital Forensics and Incident Response (DFIR). Traditional investigative methods, which mainly rely on manual collection of forensic artifacts and ad hoc correlation of logs, exhibit clear limitations when confronted with the scale, volatility, and heterogeneity of data generated by modern systems. In addition, advanced persistent threat (APT), ransomware-as-a-service (RaaS) attack campaigns, and the automated exploitation of critical vulnerabilities have significantly shortened the time interval between initial compromise and lateral movement. In this context, it has become crucial to develop formal and scalable methods for integrating multiple telemetry sources and accurately reconstructing attack chains. This paper proposes an evidence-driven architecture for modern DFIR based on three main pillars: (i) mathematical formalization of forensic timeline reconstruction using directed acyclic graphs; (ii) the construction of automated ingestion, normalization, and correlation pipelines for events from the network, endpoint, identity, and cloud layers; and (iii) operational integration with incident response orchestration and automation platforms. The proposed model represents security events as structured entities and establishes probabilistic causal relationships among related events. The experimental implementation adopts a technology stack consisting of Elastic Stack, Suricata, Zeek, Sysmon, Volatility 3, and a SOAR platform based on TheHive and Cortex. We evaluated the architecture using 37 scenarios aligned with the MITRE ATT&CK framework, totaling 1.2 TB of data and approximately 86 million events. The results show that, compared with traditional SIEM-only approaches, the architecture significantly reduces mean time to investigate (MTTI), decreases false positives, and improves the accuracy of attack chain reconstruction. In addition, we discuss the practical implications of the model for security operations centers (SOC), the limitations of the model, and potential extensions incorporating dynamic graph analysis and machine learning techniques to support investigative prioritization.
Read paper →DetectionMITRE ATT&CK-Oriented Hybrid Multi-Layer Detection Architecture Using Probabilistic Temporal Correlation Based on Endpoint, Network, and Memory Telemetry
TITLE: MITRE ATT&CK-Oriented Hybrid Multi-Layer Detection Architecture Using Probabilistic Temporal Correlation Based on Endpoint, Network, and Memory Telemetry ABSTRACT: The increasing complexity of intrusion campaigns observed in modern enterprise environments poses significant challenges to conventional detection architectures based on isolated sensors. Today’s attacks often exploit living-off-the-land (LOLBins) techniques, widely available post-exploitation frameworks, and obfuscated command-and-control channels, resulting in chains of events distributed across networks, endpoints, and volatile memory. Although tools such as IDS/IPS, EDR, and SIEM platforms are widely adopted, their analytical integration is still largely constrained by syntactic correlation models and cannot capture the temporal and semantic dependencies that exist among heterogeneous events. The MITRE ATT&CK framework has been established as an operational ontology for describing Tactics, Techniques, and Procedures (TTPs), but its use in detection systems is often limited to static mapping and descriptive visualization. In this study, we propose a hybrid multi-layer detection architecture that integrates network, endpoint, and memory telemetry and incorporates a formally defined probabilistic temporal correlation mechanism semantically aligned with the ATT&CK model. This architecture combines widely used sensors, including Suricata, Sysmon, Volatility 3, and Sigma/YARA rules, with a Kafka-based ingestion layer and indexing structured according to the Elastic Common Schema. We formulate the detection process as an inference problem under uncertainty and model it as a weighted temporal graph, where events represent vertices annotated with ATT&CK techniques and edges represent semantically compatible transitions within a defined time window. Furthermore, we introduce a conditional risk function that integrates the contextual probability of each technique and the transition weights between TTPs, enabling estimation of the likelihood of the entire attack chain. Using a time-indexed structure, we analytically show that incremental construction of these graphs can be performed with O(n log n) computational complexity per time window. Experimental evaluation was conducted using widely referenced datasets in the literature (CIC-IDS2017 and UNSW-NB15) and controlled scenarios of malware execution in an isolated laboratory environment. The results showed consistent improvement in relative F1-score and a qualitative reduction in operational noise compared with isolated sensors. In addition, additional case studies in simulated enterprise and healthcare infrastructures demonstrated reduced detection time for attack chains involving credential dumping and lateral movement. This study provides a mathematical formulation of ATT&CK-oriented temporal correlation, a reproducible architecture based on widely adopted tools, and a critical analysis of the statistical limitations associated with intrusion detection in environments where attacks occur infrequently.
Read paper →DetectionHybrid Multilayer Detection Architecture Based on Endpoint, Network, and Memory Telemetry with MITRE ATT&CK-Oriented Probabilistic Temporal Correlation
TITLE: Hybrid Multilayer Detection Architecture Based on Endpoint, Network, and Memory Telemetry with MITRE ATT&CK-Oriented Probabilistic Temporal Correlation ABSTRACT: The growing complexity of intrusion campaigns observed in modern enterprise environments challenges traditional detection architectures based on isolated sensors. Contemporary attacks frequently exploit living-off-the-land (LOLBins) techniques, widely available post-exploitation frameworks, and obfuscated command-and-control channels, resulting in event chains distributed across network, endpoint, and volatile memory. Although tools such as IDS/IPS, EDR, and SIEM platforms are widely adopted, their analytical integration remains limited by predominantly syntactic correlation models, unable to capture temporal and semantic dependencies among heterogeneous events. The MITRE ATT&CK framework has become established as an operational ontology for describing Tactics, Techniques, and Procedures (TTPs), yet its use in detection systems is often restricted to static mappings or descriptive visualizations. In this work, we propose a hybrid multilayer detection architecture that integrates network, endpoint, and memory telemetry with a formal mechanism for probabilistic temporal correlation semantically aligned with the ATT&CK model. The architecture combines widely used sensors — including Suricata, Sysmon, Volatility 3, and Sigma/YARA rules — with an ingestion layer based on Kafka and structured indexing according to the Elastic Common Schema. We formalize the detection process as an inference-under-uncertainty problem, modeled by weighted temporal graphs in which events represent vertices annotated with ATT&CK techniques and edges represent semantically compatible transitions within a defined temporal window. We introduce a conditional risk function that integrates contextual probabilities of individual techniques and transition weights between TTPs, enabling estimation of the plausibility of complete attack chains. We analytically demonstrate that the incremental construction of these graphs can be performed with complexity O(n log n) per temporal window using time-indexed structures. The experimental evaluation was conducted using widely referenced datasets in the literature (CIC-IDS2017 and UNSW-NB15) and controlled malware execution scenarios in an isolated laboratory. The results indicate consistent improvements in relative F1-score metrics and qualitative reduction of operational noise when compared to isolated sensors. Additional case studies in simulated enterprise environments and in hospital infrastructure demonstrate reduced detection time for attack chains involving credential dumping and lateral movement. The work contributes a mathematical formalization of ATT&CK-oriented temporal correlation, a reproducible architecture based on widely adopted tools, and a critical analysis of the statistical limitations associated with intrusion detection in low-prevalence attack environments.
Read paper →DetectionA Multi-Layer Detection Hybrid Architecture Using MITRE ATT&CK-Oriented Probabilistic Temporal Correlation Based on Endpoint, Network, and Memory Telemetry
TITLE: A Multi-Layer Detection Hybrid Architecture Using MITRE ATT&CK-Oriented Probabilistic Temporal Correlation Based on Endpoint, Network, and Memory Telemetry ABSTRACT: The increasing complexity of intrusion campaigns observed in modern enterprise environments poses challenges for conventional detection architectures based on isolated sensors. Today’s attacks often exploit living-off-the-land (LOLBins) techniques, widely available post-exploitation frameworks, and obfuscated command-and-control channels, resulting in chains of events distributed across network, endpoint, and volatile memory. Although tools such as IDS/IPS, EDR, and SIEM platforms are widely adopted, their analytical integration remains constrained mainly to syntactic correlation models and cannot capture the temporal and semantic dependencies that exist among diverse events. The MITRE ATT&CK framework has been established as an operational ontology for describing Tactics, Techniques and Procedures (TTPs), but its use in detection systems is often limited to static mapping and descriptive visualization. In this study, we propose a multi-layer detection hybrid architecture that integrates network, endpoint, and memory telemetry and provides a formal probabilistic temporal correlation mechanism semantically aligned with the ATT&CK model. This architecture combines a widely used sensor set including Suricata, Sysmon, Volatility 3, and Sigma/YARA rules with a Kafka-based ingestion layer and indexing structured according to the Elastic Common Schema. We formulate the detection process as an inference problem under uncertainty and model it as a weighted temporal graph, where events represent vertices annotated with ATT&CK techniques and edges represent semantically compatible transitions within a defined time window. Furthermore, we introduce a conditional risk function that integrates the contextual probability of individual techniques and transition weights between TTPs, enabling estimation of the likelihood of the entire attack chain. Using a time-indexed structure, we analytically show that incremental construction of these graphs can be performed with O(n log n) computational complexity per time window. Experimental evaluation was conducted using widely referenced datasets in the literature (CIC-IDS2017 and UNSW-NB15) and controlled scenarios of malware execution in an isolated laboratory environment. The results showed consistent improvements in relative F1-score and a qualitative reduction in operational noise compared with isolated sensors. In addition, additional case studies in simulated enterprise and healthcare infrastructure demonstrated shorter detection times for attack chains involving credential dumping and lateral movement. This study provides a mathematical formulation of ATT&CK-oriented temporal correlation, a reproducible architecture based on widely adopted tools, and a critical analysis of the statistical limitations associated with intrusion detection in low-incident environments.
Read paper →DetectionHybrid Architecture Based on Multilayer Telemetry and Semantic Correlation for Advanced Threat Detection in Enterprise Environments
TITLE: Hybrid Architecture Based on Multilayer Telemetry and Semantic Correlation for Advanced Threat Detection in Enterprise Environments ABSTRACT: TITLE: Hybrid Architecture Based on Multilayer Telemetry and Semantic Correlation for Advanced Threat Detection in Enterprise Environments ABSTRACT: TITLE: Hybrid Architecture Based on Multilayer Telemetry and Semantic Correlation for Advanced Threat Detection in Enterprise Environments ABSTRACT: The growing sophistication of cyberattacks, combined with the expansion of hybrid and multicloud infrastructures, imposes substantial challenges on modern security operations (Security Operations Centers – SOCs). Contemporary attack techniques exploit zero-day vulnerabilities, abuse legitimate identities, use living-off-the-land binaries (LOLBins), and complex lateral movement chains, often distributed across endpoints, enterprise networks, and cloud services. In this context, traditional mechanisms based exclusively on signatures or isolated anomaly detection present significant limitations, especially with regard to operational scalability and the reduction of false positives. This article presents a hybrid detection architecture based on multilayer telemetry and semantic event correlation guided by graphs of Tactics, Techniques, and Procedures (TTPs) derived from the MITRE ATT&CK framework. The proposal integrates network sensors, endpoint telemetry, identity events, and cloud-native environment logs, incorporating contemporary components such as eBPF-based instrumentation and integration with CNAPP (Cloud-Native Application Protection Platform) platforms. We formalize the detection process as a problem of inference over dynamic event graphs, in which sequences of observable activities are mapped to ATT&CK techniques and semantically correlated to identify attack chains. The model combines three complementary paradigms: signature-based detection (YARA and Suricata), structured behavioral rules (Sigma), and statistical analysis of behavioral patterns. We experimentally evaluated the architecture using a dataset composed of widely used academic benchmarks (UNSW-NB15 and CIC-IDS2017) and controlled red teaming campaigns conducted in a simulated enterprise environment. The results indicate a significant improvement in performance metrics: precision of 0.89, recall of 0.83, and F1-score of 0.86, in addition to a 38.2% reduction in the false positive rate compared with isolated approaches. A reduction in mean time to detect (MTTD) from 6.1 to 4.2 minutes was also observed. The results demonstrate that semantic correlation based on TTP graphs, combined with multilayer telemetry, represents a promising approach to improving the operational effectiveness of contemporary SOCs in complex enterprise scenarios.
Read paper →DetectionHybrid Architecture Based on Multi-Layer Telemetry and Semantic Correlation for Advanced Threat Detection in Enterprise Environments
TITLE: Hybrid Architecture Based on Multi-Layer Telemetry and Semantic Correlation for Advanced Threat Detection in Enterprise Environments ABSTRACT: Hybrid Architecture Based on Multi-Layer Telemetry and Semantic Correlation for Advanced Threat Detection in Enterprise Environments ABSTRACT: TITLE: Hybrid Architecture Based on Multi-Layer Telemetry and Semantic Correlation for Advanced Threat Detection in Enterprise Environments ABSTRACT: The increasing sophistication of cyberattacks, together with the expansion of hybrid and multicloud infrastructures, poses substantial challenges to modern security operations (Security Operations Centers – SOCs). Contemporary attack techniques exploit zero-day vulnerabilities, abuse legitimate identities, use living-off-the-land binaries (LOLBins), and rely on complex lateral movement chains, often distributed across endpoints, corporate networks, and cloud services. In this context, traditional mechanisms based exclusively on signatures or isolated anomaly detection present significant limitations, especially with regard to operational scalability and the reduction of false positives. This paper presents a hybrid detection architecture based on multi-layer telemetry and graph-oriented semantic correlation of events driven by Tactics, Techniques, and Procedures (TTPs) derived from the MITRE ATT&CK framework. The proposal integrates network sensors, endpoint telemetry, identity events, and logs from cloud-native environments, incorporating contemporary components such as eBPF-based instrumentation and integration with CNAPP (Cloud-Native Application Protection Platform) platforms. We formalize the detection process as a problem of inference over dynamic event graphs, in which sequences of observable activities are mapped to ATT&CK techniques and semantically correlated to identify attack chains. The model combines three complementary paradigms: signature-based detection (YARA and Suricata), structured behavioral rules (Sigma), and statistical analysis of behavioral patterns. We experimentally evaluated the architecture using a dataset composed of widely used academic benchmarks (UNSW-NB15 and CIC-IDS2017) and controlled red teaming campaigns conducted in a simulated enterprise environment. The results indicate a significant improvement in performance metrics: precision of 0.89, recall of 0.83, and F1-score of 0.86, in addition to a 38.2% reduction in the false positive rate compared with isolated approaches. A reduction in mean time to detect (MTTD) from 6.1 to 4.2 minutes was also observed. The results demonstrate that TTP graph-based semantic correlation, combined with multi-layer telemetry, represents a promising approach to enhancing the operational effectiveness of contemporary SOCs in complex enterprise scenarios.
Read paper →DetectionMultilevel Adaptive Detection of Cyber Threats Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs
TITLE: Multilevel Adaptive Detection of Cyber Threats Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs ABSTRACT: TITLE: Multilevel Adaptive Detection of Cyber Threats Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs ABSTRACT: The growing complexity of contemporary digital infrastructures, characterized by hybrid cloud environments, distributed architectures, and massive operational telemetry streams, poses substantial challenges to the early detection of cyber threats. Traditional Security Information and Event Management (SIEM) systems, based on deterministic rules, exhibit structural limitations in identifying multi-stage campaigns, particularly when adversaries use legitimate credentials, stealthy lateral movement, and evasion techniques. In parallel, purely machine learning-based approaches often suffer from degradation under distribution shifts and lack operational interpretability. In this work, we present a multilevel adaptive detection architecture that integrates incremental Bayesian fusion of evidence with structural modeling based on temporal attack graphs. The proposed approach enables correlation of heterogeneous telemetry from endpoints, networks, identities, and cloud environments, while preserving explicit temporal dependencies among events and semantic alignment with the MITRE ATT&CK taxonomy. We formalize the problem as probabilistic inference over attack chains in a dynamic graph G_t=(V_t,E_t,w_t), in which the weights represent conditional probabilities of malicious behavior. We developed an incremental Bayesian updating mechanism capable of processing streams exceeding 10^6 events per minute, while maintaining probabilistic convergence and low operational latency. The implementation was built on a stream processing architecture based on Apache Kafka and Apache Flink, with graph persistence in Neo4j and state management in RocksDB. Experimental evaluations were conducted using the UNSW-NB15 and CIC-IDS2017 datasets, as well as an anonymized enterprise corpus containing approximately 400 million events. Compared with rule-based approaches, Random Forest, and LSTM networks, the proposed method achieved an average precision of 0.91, a recall of 0.88, and an F1-score of 0.89, while reducing the false positive rate by 42% relative to conventional SIEM systems. The results show that probabilistic fusion of telemetry, combined with the structural representation of attack chains, provides substantial gains in robustness, interpretability, and scalability. We also discuss the implications for modern cloud security architectures, integration with CNAPP platforms, and the limitations associated with a priori modeling of adversarial assumptions.
Read paper →DetectionAdaptive Multilevel Detection of Cyber Threats Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs
TITLE: Adaptive Multilevel Detection of Cyber Threats Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs ABSTRACT: TITLE: Adaptive Multilevel Detection of Cyber Threats Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs ABSTRACT: The increasing complexity of contemporary digital infrastructures, characterized by hybrid cloud environments, distributed architectures, and massive operational telemetry streams, poses substantial challenges to the early detection of cyber threats. Traditional security information and event management (SIEM) systems, based on deterministic rules, exhibit structural limitations in identifying multi-stage campaigns, especially when adversaries use legitimate credentials, discreet lateral movement, and evasion techniques. In parallel, purely machine-learning-based approaches often suffer from degradation under distribution shifts and lack operational interpretability. In this work, we present a multilevel adaptive detection architecture that integrates incremental Bayesian evidence fusion with structural modeling based on temporal attack graphs. The proposed approach makes it possible to correlate heterogeneous telemetry from endpoints, networks, identities, and cloud environments, while preserving explicit temporal dependencies between events and semantic alignment with the MITRE ATT&CK taxonomy. We formalize the problem as probabilistic inference over attack chains in a dynamic graph G_t=(V_t,E_t,w_t), in which the weights represent conditional probabilities of malicious behavior. We developed an incremental Bayesian update mechanism capable of processing streams exceeding 10^6 events per minute, while maintaining probabilistic convergence and low operational latency. The implementation was carried out on a stream-processing architecture based on Apache Kafka and Apache Flink, with graph persistence in Neo4j and state management in RocksDB. Experimental evaluations were conducted using the UNSW-NB15 and CIC-IDS2017 datasets and an anonymized enterprise corpus containing approximately 400 million events. In comparison with rule-based approaches, Random Forest, and LSTM networks, the proposed method achieved an average precision of 0.91, a recall of 0.88, and an F1-score of 0.89, while reducing the false positive rate by 42% relative to conventional SIEM systems. The results show that probabilistic fusion of telemetry, combined with the structural representation of attack chains, offers substantial gains in robustness, interpretability, and scalability. We also discuss the implications for modern cloud security architectures, integration with CNAPP platforms, and the limitations associated with a priori modeling of adversarial assumptions.
Read paper →DetectionMulti-stage Adaptive Cyber Threat Detection Based on Bayesian Fusion of Telemetry and Attack Temporal Graphs
TITLE: Multi-stage Adaptive Cyber Threat Detection Based on Bayesian Fusion of Telemetry and Attack Temporal Graphs ABSTRACT: Modern digital infrastructures are characterized by hybrid cloud environments, distributed architectures, and massive operational telemetry flows, and their increasing complexity poses major challenges for early cyber threat detection. Conventional security information event management (SIEM) systems based on deterministic rules exhibit structural limitations in identifying multi-stage campaigns, especially when attackers exploit legitimate credentials, low-visibility lateral movement, and evasion techniques. At the same time, purely machine learning-based approaches are prone to performance degradation under distribution shift and often lack operational interpretability. In this study, we propose a multi-stage adaptive detection architecture that integrates incremental Bayesian fusion of evidence with structural modeling based on attack temporal graphs. The proposed method correlates heterogeneous telemetry from endpoints, networks, identities, and cloud environments while preserving explicit temporal dependencies among events and semantic alignment with the MITRE ATT&CK taxonomy. The problem is formulated as probabilistic inference over attack chains on a dynamic graph G_t=(V_t,E_t,w_t), where the weights represent conditional probabilities of malicious behavior. Furthermore, we developed an incremental Bayesian update mechanism capable of processing event streams exceeding 10^6 events per minute while maintaining probabilistic convergence and low operational latency. The implementation was carried out on a stream processing architecture based on Apache Kafka and Apache Flink, with Neo4j used for graph persistence and RocksDB for state management. Experimental evaluation was conducted using UNSW-NB15, CIC-IDS2017, and an anonymized enterprise corpus containing approximately 400 million events. Compared with rule-based methods, Random Forest, and LSTM networks, the proposed approach achieved a mean precision of 0.91, recall of 0.88, and F1-score of 0.89, while reducing the false positive rate by 42% relative to conventional SIEM systems. These results indicate that combining probabilistic fusion of telemetry with structural representation of attack chains yields substantial improvements in robustness, interpretability, and scalability. We also discuss limitations related to integration with state-of-the-art cloud security architectures, CNAPP platforms, and prior modeling of adversarial hypotheses.
Read paper →DetectionAdaptive Multilevel Detection of Cyber Threats Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs
TITLE: Adaptive Multilevel Detection of Cyber Threats Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs ABSTRACT: TITLE: Adaptive Multilevel Detection of Cyber Threats Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs ABSTRACT: The increasing complexity of contemporary digital infrastructures, characterized by hybrid cloud environments, distributed architectures, and massive streams of operational telemetry, poses substantial challenges to the early detection of cyber threats. Traditional Security Information and Event Management (SIEM) systems, based on deterministic rules, exhibit structural limitations in identifying multi-stage campaigns, particularly when adversaries use legitimate credentials, stealthy lateral movement, and evasion techniques. At the same time, purely machine learning-based approaches often suffer degradation under distribution shifts and lack operational interpretability. In this work, we present a multilevel adaptive detection architecture that integrates incremental Bayesian fusion of evidence with structural modeling based on temporal attack graphs. The proposed approach enables the correlation of heterogeneous telemetry from endpoints, networks, identities, and cloud environments, while preserving explicit temporal dependencies between events and semantic alignment with the MITRE ATT&CK taxonomy. We formalize the problem as probabilistic inference over attack chains in a dynamic graph G_t=(V_t,E_t,w_t), in which the weights represent conditional probabilities of malicious behavior. We developed an incremental Bayesian updating mechanism capable of processing streams exceeding 10^6 events per minute, while maintaining probabilistic convergence and low operational latency. The implementation was carried out on a stream-processing architecture based on Apache Kafka and Apache Flink, with graph persistence in Neo4j and state management in RocksDB. Experimental evaluations were conducted using the UNSW-NB15, CIC-IDS2017 datasets, and an anonymized enterprise corpus containing approximately 400 million events. Compared with rule-based approaches, Random Forest, and LSTM networks, the proposed method achieved a mean precision of 0.91, a recall of 0.88, and an F1-score of 0.89, while reducing the false positive rate by 42% relative to conventional SIEM systems. The results show that probabilistic fusion of telemetry, combined with the structural representation of attack chains, provides substantial gains in robustness, interpretability, and scalability. We also discuss the implications for modern cloud security architectures, integration with CNAPP platforms, and the limitations associated with a priori modeling of adversarial hypotheses.
Read paper →DetectionAdaptive Multilevel Cyber Threat Detection Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs
TITLE: Adaptive Multilevel Cyber Threat Detection Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs ABSTRACT: TITLE: Adaptive Multilevel Cyber Threat Detection Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs ABSTRACT: The growing complexity of contemporary digital infrastructures, characterized by hybrid cloud environments, distributed architectures, and massive streams of operational telemetry, poses substantial challenges for the early detection of cyber threats. Traditional security information and event management (SIEM) systems, based on deterministic rules, present structural limitations in identifying multi-stage campaigns, particularly when adversaries use legitimate credentials, discrete lateral movement, and evasion techniques. In parallel, purely machine learning-based approaches often suffer degradation under distribution shifts and lack operational interpretability. In this work, we present a multilevel adaptive detection architecture that integrates incremental Bayesian evidence fusion with structural modeling based on temporal attack graphs. The proposed approach makes it possible to correlate heterogeneous telemetry from endpoints, networks, identities, and cloud environments while preserving explicit temporal dependencies between events and semantic alignment with the MITRE ATT&CK taxonomy. We formalize the problem as probabilistic inference over attack chains in a dynamic graph G_t=(V_t,E_t,w_t), in which weights represent conditional probabilities of malicious behavior. We developed an incremental Bayesian update mechanism capable of processing streams exceeding 10^6 events per minute while maintaining probabilistic convergence and low operational latency. The implementation was carried out on a stream processing architecture based on Apache Kafka and Apache Flink, with graph persistence in Neo4j and state management in RocksDB. Experimental evaluations were conducted using the UNSW-NB15 and CIC-IDS2017 datasets and an anonymized enterprise corpus containing approximately 400 million events. Compared with rule-based approaches, Random Forest, and LSTM networks, the proposed method achieved a mean precision of 0.91, a recall of 0.88, and an F1-score of 0.89, while reducing the false positive rate by 42% relative to conventional SIEM systems. The results show that probabilistic telemetry fusion, combined with the structural representation of attack chains, offers substantial gains in robustness, interpretability, and scalability. We also discuss the implications for modern cloud security architectures, integration with CNAPP platforms, and the limitations associated with a priori modeling of adversarial assumptions.
Read paper →DetectionMultilevel Adaptive Cyber Threat Detection Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs
TITLE: Multilevel Adaptive Cyber Threat Detection Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs ABSTRACT: TITLE: Multilevel Adaptive Cyber Threat Detection Based on Bayesian Fusion of Telemetry and Temporal Attack Graphs ABSTRACT: The increasing complexity of contemporary digital infrastructures, characterized by hybrid cloud environments, distributed architectures, and massive streams of operational telemetry, imposes substantial challenges for the early detection of cyber threats. Traditional Security Information and Event Management (SIEM) systems, based on deterministic rules, exhibit structural limitations in identifying multi-stage campaigns, particularly when adversaries use legitimate credentials, discreet lateral movement, and evasion techniques. In parallel, purely machine learning-based approaches often suffer degradation under distribution shifts and lack operational interpretability. In this work, we present a multilevel adaptive detection architecture that integrates incremental Bayesian evidence fusion with structural modeling based on temporal attack graphs. The proposed approach enables correlation of heterogeneous telemetry from endpoints, networks, identities, and cloud environments, while preserving explicit temporal dependencies between events and semantic alignment with the MITRE ATT&CK taxonomy. We formalize the problem as probabilistic inference over attack chains in a dynamic graph G_t=(V_t,E_t,w_t), in which the weights represent conditional probabilities of malicious behavior. We developed an incremental Bayesian update mechanism capable of processing streams exceeding 10^6 events per minute, while maintaining probabilistic convergence and low operational latency. The implementation was realized on a stream-processing architecture based on Apache Kafka and Apache Flink, with graph persistence in Neo4j and state management in RocksDB. Experimental evaluations were conducted using the UNSW-NB15 and CIC-IDS2017 datasets and an anonymized enterprise corpus containing approximately 400 million events. Compared with rule-based approaches, Random Forest, and LSTM networks, the proposed method achieved an average precision of 0.91, a recall of 0.88, and an F1-score of 0.89, while reducing the false positive rate by 42% relative to conventional SIEM systems. The results show that probabilistic fusion of telemetry, combined with the structural representation of attack chains, provides substantial gains in robustness, interpretability, and scalability. We also discuss the implications for modern cloud security architectures, integration with CNAPP platforms, and the limitations associated with a priori modeling of adversarial hypotheses.
Read paper →DetectionMultilayer Hybrid Architecture for Proactive Detection of Advanced Threats Based on Semantic Correlation, Multisource Telemetry, and Adaptive Statistical Models
TITLE: Multilayer Hybrid Architecture for Proactive Detection of Advanced Threats Based on Semantic Correlation, Multisource Telemetry, and Adaptive Statistical Models ABSTRACT: Efficient detection of advanced threats remains one of the main operational challenges in contemporary cybersecurity. Modern enterprise environments are characterized by hybrid infrastructures that combine on-premise resources, public clouds, and containerized workloads, generating massive volumes of heterogeneous telemetry from endpoints, networks, and identity platforms. In this context, traditional detection mechanisms based exclusively on signatures show significant limitations in the face of multistage attacks, fileless malware, and living-off-the-land techniques. This work proposes a multilayer hybrid architecture for proactive detection of advanced threats that integrates semantic correlation based on the MITRE ATT&CK ontology, temporal event analysis, and adaptive statistical models for the identification of anomalous behaviors. We formalize the detection problem as the probabilistic inference of attack chains in heterogeneous event streams, considering operational constraints on latency and acceptable false positive rates. The proposed architecture organizes the detection process into three main layers: (i) collection and normalization of multisource telemetry from network sensors, endpoint agents, and identity logs; (ii) semantic correlation based on ATT&CK technique graphs, capable of identifying plausible sequences of adversary activities; and (iii) adaptive statistical modeling using anomaly detection algorithms, such as Isolation Forest, to identify previously unobserved behavioral deviations. We implemented an operational prototype using Elastic Stack, Suricata, Sysmon, and Wazuh, integrated with threat intelligence sources via MISP. The experimental evaluation was conducted in a controlled environment containing multiple Windows and Linux virtual machines, in which realistic attack scenarios were executed using tools widely documented in the offensive security literature, including Metasploit, Cobalt Strike, and Mimikatz. The results demonstrate a substantial improvement in mean time to detect (MTTD), as well as greater coverage of ATT&CK techniques when compared to approaches based exclusively on network IDS. We observed an approximate 37% reduction in MTTD and a 21% increase in the coverage of detected techniques. The results indicate that hybrid architectures combining semantic correlation, statistical analysis, and distributed telemetry constitute a promising approach for modern Security Operations Center (SOC) operations, particularly in hybrid and cloud-native environments.
Read paper →SecretsFormal and Operational Architecture for Secret Leak Management and Detection in Cloud-Native Environments: An Integrated Approach Based on Telemetry, Static Analysis, and Threat Hunting
TITLE: Formal and Operational Architecture for Secret Leak Management and Detection in Cloud-Native Environments: An Integrated Approach Based on Telemetry, Static Analysis, and Threat Hunting ABSTRACT: Improper exposure of secrets—including API keys, credentials, OAuth tokens, private certificates, and cryptographic secrets—represents one of the main causes of compromise in cloud-native and DevSecOps environments. Recent incidents involving leakage of AWS keys, GitHub tokens, and hardcoded credentials demonstrate that the attack surface associated with inadequate secret management grows proportionally with the adoption of microservices, CI/CD, and infrastructure as code. This work proposes an integrated architecture for the prevention, detection, and response to secret leaks, combining static code analysis, runtime monitoring, traffic inspection, correlation with MITRE ATT&CK, and a formal risk model based on entropy and temporal exposure. Our methodology includes (i) a mathematical model for quantifying the risk of exposed secrets, (ii) detection algorithms based on heuristics and lightweight supervised learning, and (iii) operational integration with tools such as GitLeaks, TruffleHog, HashiCorp Vault, Suricata, Sigma, and SIEM. We implemented a functional prototype tested on 12 open source repositories with a known history of leaks and in a Kubernetes environment with 48 microservices. The results show an 87% reduction in mean time to detect (MTTD), a 72% decrease in the average temporal exposure of credentials, and a false positive rate below 4.8%. We also demonstrate a direct correlation between secret leakage and MITRE ATT&CK techniques T1552 (Unsecured Credentials) and T1078 (Valid Accounts). The study provides practical contributions for offensive and defensive security teams, including operational procedures, objective metrics, and technical recommendations for systematic risk mitigation. The research establishes a replicable framework for organizations seeking to mature their Secret Management program from a technical and operational perspective.
Read paper →SecretsFormal and Operational Architecture for Managing, Detecting, and Responding to Secret Leakage in Multi-Cloud and DevSecOps Environments
TITLE: Formal and Operational Architecture for Managing, Detecting, and Responding to Secret Leakage in Multi-Cloud and DevSecOps Environments ABSTRACT: The improper exposure of “secrets” — cryptographic keys, API tokens, credentials, certificates, Kubernetes secrets, and sensitive material embedded in code — is now one of the main causes of initial compromise in security incidents. Recent reports indicate that more than 80% of breaches involve misuse of credentials (VERIZON, 2023), while empirical studies show millions of secrets publicly exposed in Git repositories (MELARA et al., 2019). In this work, we propose a formal and operational architecture for managing, detecting, and responding to secret leakage in multi-cloud environments and DevSecOps pipelines. Our approach combines formal modeling of the problem as a dynamic system of exposure of secret assets, hybrid detection algorithms (structural regexes, entropy analysis, supervised machine learning, and contextual heuristics), integration with tools such as GitGuardian, TruffleHog, Gitleaks, HashiCorp Vault, AWS Secrets Manager, Suricata, and Sigma, as well as automated rotation and revocation mechanisms. We experimentally evaluated the solution on a set of 1.2 million public and private commits, with 87,341 real secrets and 120,000 synthetic samples, achieving 97.3% precision, 94.8% recall, and a 63% reduction in mean time to contain (MTTC) compared to manual processes. We also demonstrate that integration with OPA-based policies and Just-in-Time controls reduces the attack surface associated with MITRE ATT&CK TTPs such as T1552 (Unsecured Credentials) and T1078 (Valid Accounts). The study includes a real incident response case involving exfiltration of an AWS IAM key, detailing the attack chain, forensic indicators, and the eradication process. We conclude that effective secret management requires a systemic approach that combines mathematical formalization, secure engineering, continuous monitoring, and response automation, offering practical guidelines for offensive and defensive security teams.
Read paper →