Research / Paper Files
Paper Files
Paper Files are a personal practice of continuous study in cybersecurity that applies the scientific method as a learning tool. Each article is written not for academic publication, but as a deliberate exercise to sharpen the axe — deepening knowledge on specific topics, organizing ideas with rigor, and observing how understanding of certain subjects develops over time. It is the intellectual equivalent of a training journal: each entry records what was studied, how it was analyzed, and what conclusions emerged.
I strongly recommend that security professionals adopt this method. Choose a topic you want to master, research primary sources (RFCs, papers, official documentation), structure your text with introduction, methodology, analysis, and conclusion, and write as if you were explaining to a colleague. The act of writing forces clarity of thought and exposes gaps in understanding that passive reading cannot reveal. Use the articles on this site as examples of format and depth, and build your own collection — over time, you will have a personal repository of refined knowledge that no course or certification can replace.
DAI & ADAI · 2026
DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts
DAI (Decripte Artificial Intelligence) is a proprietary domain-specific LLM within a governed autonomous defensive architecture. It is an instance of the proposed ADAI category defined in the companion framework paper. T…
Read paper →ADAI · ENAutonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure
ADAI (Autonomous Defensive Artificial Intelligence) is a proposed category of governed autonomous cyber defense. The framework specifies defended perimeters, bounded effects, declared rollback and capability-disjoint ver…
Read paper →226 papers
A Formal and Scalable Architecture for Graph-Oriented DFIR with Probabilistic Temporal Correlation and Cryptographic Integrity Guarantees
TITLE: A Formal and Scalable Architecture for Graph-Oriented DFIR with Probabilistic Temporal Correlation and Cryptographic Integrity Guarantees ABSTRACT: The growing complexity of computing environments in 2025 — characterized by cloud-native architectures, microservices, ephemeral workloads, DevSecOps pipelines, hybrid environments, and integrations with artificial intelligence systems — imposes substantial challenges on the discipline of Digital Forensics and Incident Response (DFIR). The causal reconstruction of incidents involving multiple heterogeneous sources, under conditions of temporal uncertainty, statistical noise, and possible log tampering, remains an open problem from a formal perspective. In this work, we propose a mathematically grounded architecture for graph-oriented DFIR, based on a probabilistic acyclic causal graph model with explicit temporal uncertainty, Bayesian inference, and cryptographic integrity guarantees through Merkle trees and immutable storage (WORM). We formalize the attack sequence reconstruction problem as a conditional probability maximization problem over admissible paths in a DAG, demonstrating equivalence with the minimization of the sum of log-probabilities. We introduce two algorithms: (i) Causal Temporal Reconstruction (CTR), with complexity O(|E_c| log |V|), and (ii) Incremental Integrity Verification (IIV), with inclusion proof in O(log n). The architecture was implemented on Elastic Stack 8.x, Apache Kafka 3.5, S3 Object Lock in compliance mode, and PostgreSQL, and evaluated on 12 TB of real and synthetic data, including DARPA Transparent Computing and the Los Alamos Cybersecurity Dataset. The results demonstrate a statistically significant increase in accuracy (91.4% vs. 64.2%), a 37.8% reduction in average triage time, and controlled computational overhead (8.6%). We argue that the integration of probabilistic formalism, cryptographic guarantees, and causal modeling provides a rigorous, auditable, and scalable foundation for modern DFIR, aligned with NIST and ISO/IEC 27037 guidelines and the MITRE ATT&CK taxonomy, as well as compatible with contemporary scenarios involving eBPF, CNAPP, and AI-oriented environments.
Read paper →DFIRA Formal and Scalable Architecture for Graph-Based DFIR with Probabilistic Temporal Correlation and Cryptographic Integrity Guarantees
TITLE: A Formal and Scalable Architecture for Graph-Based DFIR with Probabilistic Temporal Correlation and Cryptographic Integrity Guarantees ABSTRACT: The growing complexity of computational environments in 2025—characterized by cloud-native architectures, microservices, ephemeral workloads, DevSecOps pipelines, hybrid environments, and integrations with artificial intelligence systems—poses substantial challenges to the discipline of Digital Forensics and Incident Response (DFIR). The causal reconstruction of incidents involving multiple heterogeneous sources, under conditions of temporal uncertainty, statistical noise, and possible log tampering, remains an open problem from a formal perspective. In this work, we propose a mathematically grounded architecture for graph-based DFIR, based on a probabilistic acyclic causal graph model with explicit temporal uncertainty, Bayesian inference, and cryptographic integrity guarantees through Merkle trees and write-once-read-many (WORM) immutable storage. We formalize the problem of reconstructing attack sequences as a conditional probability maximization problem over admissible paths in a DAG, demonstrating equivalence to minimizing the sum of log-probabilities. We introduce two algorithms: (i) Temporal Causal Reconstruction (TCR), with complexity O(|E_c|log|V|), and (ii) Incremental Integrity Verification (IIV), with inclusion proof in O(log n). The architecture was implemented on Elastic Stack 8.x, Apache Kafka 3.5, S3 Object Lock in compliance mode, and PostgreSQL, and was evaluated on 12 TB of real and synthetic data, including DARPA Transparent Computing and the Los Alamos Cybersecurity Dataset. The results demonstrate a statistically significant increase in precision (91.4% vs. 64.2%), a 37.8% reduction in mean triage time, and controlled computational overhead (8.6%). We argue that the integration of probabilistic formalism, cryptographic guarantees, and causal modeling provides a rigorous, auditable, and scalable foundation for modern DFIR, aligned with NIST guidelines, ISO/IEC 27037, and the MITRE ATT&CK taxonomy, as well as compatible with contemporary scenarios involving eBPF, CNAPP, and AI-driven environments.
Read paper →DFIRFormal Orchestration of DFIR Guided by Temporal Graphs and Bayesian Inference for Automated Incident Response in Distributed Enterprise Environments
TITLE: Formal Orchestration of DFIR Guided by Temporal Graphs and Bayesian Inference for Automated Incident Response in Distributed Enterprise Environments ABSTRACT: The growing complexity of distributed enterprise environments, characterized by multicloud architectures, containerized workloads, edge devices, API-based integrations, and artificial intelligence–driven systems, imposes substantial challenges on the discipline of Digital Forensics and Incident Response (DFIR). Contemporary attack chains are typically multistage, exploiting vulnerabilities in heterogeneous components and combining techniques such as remote execution, lateral movement, persistence, and data exfiltration. In this context, traditional rule-based SIEM approaches prove insufficient for reconstructing complex causal sequences under uncertainty and adversarial noise. In this work, we propose a mathematical formalization of incident reconstruction as a MAP (Maximum a Posteriori) inference problem on directed temporal graphs with explicit causal constraints. We model forensic events as structured tuples and introduce a probabilistic framework grounded in conditional local factorization, enabling formal quantification of uncertainty. We demonstrate robustness properties under limited adversarial insertion of spurious events, establishing analytical conditions for MAP path invariance. We implement the TGI-DFIR architecture on scalable infrastructure based on Apache Kafka, Elasticsearch, Neo4j, and Kubernetes, integrated with modern CNAPP pipelines and eBPF telemetry. We empirically evaluate the approach using the DARPA Transparent Computing dataset, real corporate logs (12 TB), and scenarios inspired by widely exploited vulnerabilities up to 2025. Results indicate a statistically significant increase in precision (F1 = 0.91 ± 0.02) and a 47.3% reduction in mean triage time compared with rule-based approaches and sequential deep learning models. We conclude that the integration of temporal graphs and Bayesian inference provides a rigorous formal foundation and an operationally viable approach for automated incident response orchestration in contemporary distributed enterprise environments.
Read paper →DFIRFormal Orchestration of Graph-Based Temporal DFIR and Bayesian Inference for Automated Incident Response in Distributed Enterprise Environments
TITLE: Formal Orchestration of Graph-Based Temporal DFIR and Bayesian Inference for Automated Incident Response in Distributed Enterprise Environments ABSTRACT: The growing complexity of distributed enterprise environments, characterized by multicloud architectures, containerized workloads, edge devices, API-based integrations, and AI-based systems, poses substantial challenges to the discipline of Digital Forensics and Incident Response (DFIR). Contemporary attack chains are typically multi-stage, exploiting vulnerabilities in heterogeneous components and combining techniques for remote execution, lateral movement, persistence, and exfiltration. In this context, traditional rule-based SIEM approaches prove insufficient for reconstructing complex causal sequences under uncertainty and adversarial noise. In this work, we propose a mathematical formalization of incident reconstruction as a Maximum a Posteriori (MAP) inference problem in directed temporal graphs with explicit causal constraints. We model forensic events as structured tuples and introduce a probabilistic framework grounded in conditional local factorization, enabling formal quantification of uncertainty. We demonstrate robustness properties under limited adversarial insertion of spurious events, establishing analytical conditions for MAP path invariance. We implement the TGI-DFIR architecture on scalable infrastructure based on Apache Kafka, Elasticsearch, Neo4j, and Kubernetes, with integration into modern CNAPP pipelines and eBPF telemetry. We empirically evaluate the proposal using the DARPA Transparent Computing dataset, real enterprise logs (12 TB), and scenarios inspired by widely exploited vulnerabilities up to 2025. The results indicate a statistically significant increase in precision (F1 = 0.91 ± 0.02) and a 47.3% reduction in mean triage time compared with rule-based approaches and deep sequential learning models. We conclude that the integration of temporal graphs and Bayesian inference provides a rigorous formal foundation and an operationally viable basis for automated incident response orchestration in contemporary distributed enterprise environments.
Read paper →DFIRFormal and Correlated Orchestration of Evidence in DFIR: A Scalable Framework for Probabilistic Temporal Reconstruction and Incident Attribution in Hybrid Environments
TITLE: Formal and Correlated Orchestration of Evidence in DFIR: A Scalable Framework for Probabilistic Temporal Reconstruction and Incident Attribution in Hybrid Environments ABSTRACT: The increasing complexity of hybrid infrastructures, the massive adoption of cloud computing, microservices-oriented architectures, observability based on eBPF, and the integration of artificial intelligence systems have substantially expanded the challenges faced by the discipline of Digital Forensics and Incident Response (DFIR). In 2025, incidents exploiting critical vulnerabilities, supply chains, and living-off-the-land techniques highlight the limitations of linear log correlation approaches and static SIEM rule sets. In this work, we propose a formal framework for probabilistic temporal reconstruction of attack chains, grounded in directed graphs with conditional weights and semantic constraints derived from the MITRE ATT&CK matrix. We model the problem as Bayesian inference over acyclic subgraphs that maximize posterior probability under heterogeneous and potentially inconsistent evidence. We introduce a Bayesian temporal alignment mechanism to compensate for clock drift among distributed sources and a reconstruction algorithm guided by adversarial knowledge with threshold-controlled probabilistic pruning. We demonstrate formal properties of epsilon-approximate correctness under observational completeness assumptions and analyze the asymptotic complexity of the proposed algorithms. The distributed implementation, based on Apache Kafka, Apache Spark, Elasticsearch, and Neo4j, was evaluated on datasets totaling 1.2 TB of events, including simulations with Atomic Red Team and anonymized corporate logs. We obtained F1 = 0.895 ± 0.02, outperforming a traditional SIEM baseline by 29.7% and reducing average investigative time by 37.4% (p < 0.01). We discuss extensions for environments with AI/ML workloads, integration with CNAPP, and evidentiary implications under digital chain-of-custody requirements. The results indicate that the explicit incorporation of semantic constraints and rigorous probabilistic modeling constitutes a substantial advancement for scalable and formally grounded DFIR.
Read paper →DFIRFormal and Correlated Evidence Orchestration in DFIR: A Scalable Framework for Probabilistic Temporal Reconstruction and Incident Attribution in Hybrid Environments
TITLE: Formal and Correlated Evidence Orchestration in DFIR: A Scalable Framework for Probabilistic Temporal Reconstruction and Incident Attribution in Hybrid Environments ABSTRACT: The increasing complexity of hybrid infrastructures, the widespread adoption of cloud computing, microservices-oriented architectures, eBPF-based observability, and the integration of artificial intelligence systems have substantially amplified the challenges of the discipline of Digital Forensics and Incident Response (DFIR). In 2025, incidents exploiting critical vulnerabilities, supply chains, and living-off-the-land techniques highlight the limitations of linear log-correlation approaches and static SIEM rules. In this work, we propose a formal framework for probabilistic temporal reconstruction of attack chains, based on directed graphs with conditional weights and semantic constraints derived from the MITRE ATT&CK matrix. We model the problem as Bayesian inference over acyclic subgraphs that maximize posterior probability under heterogeneous and potentially inconsistent evidence. We introduce a Bayesian temporal alignment mechanism to compensate for clock drift among distributed sources and an adversary-aware reconstruction algorithm with threshold-controlled probabilistic pruning. We demonstrate formal properties of ε-approximate correctness under observational completeness assumptions and analyze the asymptotic complexity of the proposed algorithms. The distributed implementation, based on Apache Kafka, Apache Spark, Elasticsearch, and Neo4j, was evaluated on datasets totaling 1.2 TB of events, including simulations with Atomic Red Team and anonymized enterprise logs. We obtained F1 = 0.895 ± 0.02, outperforming the traditional SIEM baseline by 29.7% and reducing average investigation time by 37.4% (p < 0.01). We discuss extensions to environments with AI/ML workloads, integration with CNAPP, and evidentiary implications under digital chains of custody. The results indicate that the explicit incorporation of semantic constraints and rigorous probabilistic modeling constitutes a substantial advance for scalable and formally grounded DFIR.
Read paper →DetectionMULTILAYER ADAPTIVE DETECTION OF ADVANCED THREATS BASED ON BAYESIAN FUSION OF HETEROGENEOUS TELEMETRY AND TEMPORAL GRAPHS
TITLE: MULTILAYER ADAPTIVE DETECTION OF ADVANCED THREATS BASED ON BAYESIAN FUSION OF HETEROGENEOUS TELEMETRY AND TEMPORAL GRAPHS ABSTRACT: The increasing sophistication of cyber threats in 2025, including multi-stage attacks, exploitation of zero-day vulnerabilities, supply chain compromises, identity abuse, and exploitation of generative artificial intelligence models, imposes substantial challenges for traditional detection mechanisms. In this work, we propose a multilayer adaptive detection architecture grounded in recursive Bayesian fusion of heterogeneous telemetry and structural modeling through dynamic temporal graphs. We formalize the problem as inference over a latent binary process representing the presence of malicious activity over time, estimated from observable events originating from network, endpoint, identity, applications, and cloud workloads. The methodology integrates (i) semantic normalization of events, (ii) extraction of statistical and structural features, (iii) incremental construction of temporal graphs, and (iv) Bayesian inference with log-likelihood updates for numerical stability. We further introduce a structural detector based on Kullback–Leibler divergence between distributions of observed topological metrics and historical baselines. We empirically evaluate the model on widely used public datasets (CIC-IDS2017 and UNSW-NB15) and on a corporate dataset containing 2.3 billion anonymized events, comparing it with Random Forest, XGBoost, and LSTM. The results indicate a statistically significant improvement in F1-score and a consistent reduction in false positive rate and mean time to detect lateral movement. We discuss implications in Zero Trust and CNAPP environments, robustness to concept drift, and risks of data poisoning. We demonstrate that coherent probabilistic fusion of multiple weak signals, combined with structural analysis of temporal graphs, provides substantial gains in precision and latency while maintaining operational scalability in modern distributed architectures.
Read paper →DetectionAdaptive Detection of Advanced Persistent Threats by Multimodal Temporal Modeling and Large-Scale Probabilistic Inference
TITLE: Adaptive Detection of Advanced Persistent Threats by Multimodal Temporal Modeling and Large-Scale Probabilistic Inference ABSTRACT: The increasing sophistication of Advanced Persistent Threats (APTs) in hybrid and cloud-native environments imposes substantial challenges for the early detection of compromises. In 2025, the operational landscape incorporates multi-cloud architectures, CNAPP (Cloud-Native Application Protection Platforms), ephemeral workloads, telemetry via eBPF, and emerging risks associated with large language models (LLMs). In this work, we propose a formal model for adaptive APT detection based on the integration of multimodal dynamic graphs and multivariate Hawkes processes, structured under an explicit Bayesian perspective. We formalize the event flow as a heterogeneous temporal sequence and model the propagation of malicious activity as a self-exciting process with spectral stability constraints. The optimal decision is derived under 0–1 loss with an explicit false-positive rate constraint, addressing the fundamental base rate problem. We implemented the architecture in a distributed environment with Apache Kafka, Apache Flink, and distributed storage, incorporating eBPF-based telemetry extraction and contextual enrichment aligned with MITRE ATT&CK. We evaluated the model on the CIC-IDS2017 and DARPA Transparent Computing datasets, as well as on an anonymized enterprise dataset with 2.3 billion events. The results demonstrate a statistically significant gain (p < 0.01) in F1-score, a 38% reduction in false-positive rate, and an AUC of 0.97 compared with baselines such as Isolation Forest, LSTM, and Sigma rules. We also discuss implications for the security of AI-based systems, model governance, and integration with emerging post-quantum controls. We conclude that relational probabilistic modeling provides a robust theoretical basis and operationally viable foundation for large-scale adaptive detection, compatible with contemporary requirements for observability, compliance, and cyber resilience.
Read paper →DetectionAdaptive Detection of Advanced Persistent Threats through Multimodal Temporal Modeling and Large-Scale Probabilistic Inference
TITLE: Adaptive Detection of Advanced Persistent Threats through Multimodal Temporal Modeling and Large-Scale Probabilistic Inference ABSTRACT: The increasing sophistication of Advanced Persistent Threats (APTs) in hybrid and cloud-native environments poses substantial challenges to the early detection of compromises. By 2025, the operational landscape incorporates multi-cloud architectures, CNAPP (Cloud-Native Application Protection Platforms), ephemeral workloads, telemetry via eBPF, and emerging risks associated with large language models (LLMs). In this work, we propose a formal model for adaptive APT detection based on the integration of multimodal dynamic graphs and multivariate Hawkes processes, structured under an explicit Bayesian perspective. We formalize the event flow as a heterogeneous temporal sequence and model the propagation of malicious activity as a self-exciting process with spectral stability constraints. The optimal decision rule is derived under 0–1 loss with an explicit false-positive rate constraint, addressing the fundamental base rate problem. We implement the architecture in a distributed environment using Apache Kafka, Apache Flink, and distributed storage, incorporating eBPF-based telemetry extraction and contextual enrichment aligned with MITRE ATT&CK. We evaluate the model on the CIC-IDS2017 and DARPA Transparent Computing datasets, as well as on an anonymized corporate dataset containing 2.3 billion events. The results demonstrate a statistically significant gain (p < 0.01) in F1-score, a 38% reduction in the false-positive rate, and an AUC of 0.97 compared with baselines such as Isolation Forest, LSTM, and Sigma rules. We further discuss implications for the security of AI-based systems, model governance, and integration with emerging post-quantum controls. We conclude that relational probabilistic modeling provides a robust theoretical and operationally viable foundation for large-scale adaptive detection, compatible with contemporary requirements for observability, compliance, and cyber resilience.
Read paper →DetectionADAPTIVE MULTI-LAYER DETECTION OF ADVANCED THREATS BASED ON PROBABILISTIC FUSION AND CONTINUOUS LEARNING IN HETEROGENEOUS ENTERPRISE ENVIRONMENTS
TITLE: ADAPTIVE MULTI-LAYER DETECTION OF ADVANCED THREATS BASED ON PROBABILISTIC FUSION AND CONTINUOUS LEARNING IN HETEROGENEOUS ENTERPRISE ENVIRONMENTS ABSTRACT: Threat detection in contemporary enterprise environments has become a structurally complex problem due to the convergence of hybrid infrastructures, multicloud architectures, mobile devices, containerized workloads, surfaces exposed through APIs, and the growing integration of systems based on artificial intelligence. Recent reports indicate that compromised credentials, exploitation of known vulnerabilities, and abuse of legitimate tools continue to rank among the primary intrusion vectors, while the average attacker dwell time remains significant, highlighting limitations in traditional detection mechanisms (VERIZON, 2024; MANDIANT, 2023). In this work, we formalize the near-real-time detection problem as probabilistic inference over a latent state of systemic compromise, modeled by a Markov process and estimated through the fusion of heterogeneous evidence originating from multiple telemetry layers. We propose the AMuLeT framework (Adaptive Multi-Layer Threat detection), which combines supervised classifiers and layer-specific autoencoders, integrated through a logarithmic likelihood ratio rule under an approximate conditional independence assumption. We further introduce a continuous learning mechanism with elastic regularization to mitigate concept drift and adversarial evolution while preserving historically relevant parameters. We empirically evaluate the approach using widely adopted public datasets and a large-scale enterprise dataset totaling billions of events. The results demonstrate statistically significant gains in AUC, F1-score, false positive rate, and reduction of mean detection time when compared with isolated models. We discuss practical implications in light of NIST recommendations and contemporary trends such as CNAPP, eBPF, and security for large language models, outlining future extensions involving dynamic graphs and federated learning with formal differential privacy guarantees.
Read paper →DetectionAdaptive Multilayer Detection of Advanced Threats Based on Probabilistic Fusion and Continual Learning in Heterogeneous Enterprise Environments
TITLE: Adaptive Multilayer Detection of Advanced Threats Based on Probabilistic Fusion and Continual Learning in Heterogeneous Enterprise Environments ABSTRACT: Threat detection in contemporary enterprise environments has become a structurally complex problem due to the convergence of hybrid infrastructures, multicloud architectures, mobile devices, containerized workloads, surfaces exposed by APIs, and the growing integration of AI-based systems. Recent reports indicate that compromised credentials, exploitation of known vulnerabilities, and abuse of legitimate tools continue to rank among the main intrusion vectors, while the attacker dwell time remains significant, highlighting limitations in traditional detection mechanisms (VERIZON, 2024; MANDIANT, 2023). In this work, we formalize the problem of near real-time detection as probabilistic inference over a latent state of systemic compromise, modeled by a Markov process and estimated via fusion of heterogeneous evidence from multiple telemetry layers. We propose the AMuLeT (Adaptive Multi-Layer Threat detection) framework, which combines supervised classifiers and autoencoders by layer, integrated through a log-likelihood ratio rule under the assumption of approximate conditional independence. We further introduce a continual learning mechanism with elastic regularization to mitigate concept drift and adversarial evolution, preserving historically relevant parameters. We empirically evaluate the approach on widely used public datasets and on a large-scale enterprise dataset, totaling billions of events. The results demonstrate statistically significant gains in AUC, F1-score, false positive rate, and reduction in mean detection time, when compared to isolated models. We discuss practical implications in light of NIST recommendations and contemporary trends such as CNAPP, eBPF, and the security of large language models, outlining future extensions involving dynamic graphs and federated learning with formal differential privacy guarantees.
Read paper →DetectionHybrid and Adaptive Detection of Cyber Threats in Enterprise Environments Using Multilevel Temporal Correlation and Self-Supervised Representation Learning
TITLE: Hybrid and Adaptive Detection of Cyber Threats in Enterprise Environments Using Multilevel Temporal Correlation and Self-Supervised Representation Learning ABSTRACT: The detection of cyber threats in contemporary enterprise environments requires mechanisms capable of correlating heterogeneous events, modeling complex temporal dependencies, and adapting to adversaries who exploit valid credentials, fileless techniques, and multistage chains aligned with MITRE ATT&CK. In this work, we propose a hybrid architecture that integrates self-supervised representation learning, hierarchical temporal modeling, and probabilistic correlation in dynamic graphs, aiming to reduce false positives without compromising sensitivity under concept drift. We formalize the problem as the estimation of $P(Y=1 \mid G_{t-k:t})$, where $G_{t-k:t}$ represents a sliding window of temporal graphs extracted from multiple telemetry sources (authentication logs, endpoint events, network flows, and cloud telemetry). The self-supervised component is based on temporal contextual prediction with lightweight Transformers, enabling the learning of robust semantic embeddings in the absence of abundant labels. The multilevel correlation stage employs log-linear potentials defined over subgraphs coherent with ATT&CK techniques, ensuring operational interpretability. We implemented the solution on distributed infrastructure with Apache Kafka, Apache Flink, PyTorch, and Neo4j, achieving sustained throughput of 120 thousand events per second on a 24-node cluster. We evaluated the model on the CIC-IDS2017 dataset, the LANL Cybersecurity Dataset, and on a corporate dataset containing 4.2 billion events. We observed an average AUC of 0.982, F1 of 0.941, TPR of 96.4%, and FPR of 3.1%, representing a relative reduction of 38% in false positives compared to baselines such as Isolation Forest, DeepLog, and LSTM Autoencoders ($p < 0{,}01$). We discuss implications for integration with SIEM and CNAPP platforms, as well as extensions involving federated learning with differential privacy and adversarial robustness. The results demonstrate that the combination of self-supervised representation and probabilistic structural correlation constitutes a promising approach for large-scale adaptive detection up to the state of the art of 2025.
Read paper →SecretsA Formal Architecture for Governance, Detection, and Automated Rotation of Secrets in Cloud-Native Infrastructures
TITLE: A Formal Architecture for Governance, Detection, and Automated Rotation of Secrets in Cloud-Native Infrastructures ABSTRACT: Inadequate management of computational secrets remains one of the primary causes of breaches in cloud-native infrastructures. Access tokens, cryptographic keys, database credentials, and digital signing artifacts are frequently exposed in public repositories, continuous integration pipelines, and application logs. In 2025, with the consolidation of Kubernetes-based architectures, DevSecOps practices, CNAPP (Cloud-Native Application Protection Platform) platforms, and the widespread use of large language models (LLMs) integrated into development workflows, the attack surface associated with secrets has expanded substantially. In this work, we propose a formal architecture for governance, detection, and automated rotation of secrets, grounded in mathematical modeling and temporal property verification. We formalize the lifecycle of a secret as a dynamical system modeled by timed automata and express confidentiality and consistency guarantees through linear temporal logic. We introduce a hybrid detection mechanism that combines Shannon entropy with Miller–Madow correction, structural patterns, and supervised learning based on gradient boosting. We formally define the exposure window and model the accumulated risk as the integral of the instantaneous exploitation rate. We further propose an adaptive rotation protocol with guarantees of atomicity and auditability, integrated with Kubernetes environments and secret managers compatible with post-quantum cryptography practices in accordance with NIST guidelines. We empirically evaluate the solution on 12,457 public repositories and in a cluster with 10,000 pods, obtaining precision of 0.978, recall of 0.95, and an average reduction of 89% in the exposure window. We demonstrate the statistical significance of the results and discuss implications for security governance in multi-cloud environments and for mitigating MITRE ATT&CK techniques associated with exposed credentials. We conclude that the integration of mathematical formalization, automated detection, and adaptive rotation constitutes an effective and verifiable approach to reducing the systemic risk associated with secrets in cloud-native infrastructures.
Read paper →SecretsA Formal Architecture for Governance, Detection, and Automated Rotation of Secrets in Cloud-Native Infrastructures
TITLE: A Formal Architecture for Governance, Detection, and Automated Rotation of Secrets in Cloud-Native Infrastructures ABSTRACT: Inadequate management of computational secrets remains one of the main causes of compromises in cloud-native infrastructures. Access tokens, cryptographic keys, database credentials, and digital signing artifacts are frequently exposed in public repositories, continuous integration pipelines, and application logs. In 2025, with the consolidation of Kubernetes-based architectures, DevSecOps practices, CNAPP (Cloud-Native Application Protection Platform) platforms, and the widespread use of large language models (LLMs) integrated into development workflows, the attack surface associated with secrets has expanded substantially. In this work, we propose a formal architecture for governance, detection, and automated rotation of secrets, grounded in mathematical modeling and verification of temporal properties. We formalize the lifecycle of a secret as a dynamic system modeled by timed automata and express confidentiality and consistency guarantees through linear temporal logic. We introduce a hybrid detection mechanism that combines Shannon entropy with Miller–Madow correction, structural patterns, and supervised learning based on gradient boosting. We formally define the exposure window and model the accumulated risk as the integral of the instantaneous exploitation rate. We also propose an adaptive rotation protocol with atomicity and auditability guarantees, integrated into Kubernetes environments and secret managers compatible with post-quantum cryptography practices according to NIST guidelines. We empirically evaluate the solution on 12,457 public repositories and on a cluster with 10,000 pods, obtaining precision of 0.978, recall of 0.95, and an average reduction of 89% in the exposure window. We demonstrate the statistical significance of the results and discuss implications for security governance in multi-cloud environments and for mitigating MITRE ATT&CK techniques associated with exposed credentials. We conclude that the integration of mathematical formalization, automated detection, and adaptive rotation constitutes an effective and verifiable approach to reducing the systemic risk associated with secrets in cloud-native infrastructures.
Read paper →SecretsOperational Security of Secrets in Modern Cloud-Native Systems: Threat Modeling, Detection, and Lifecycle Management in the 2025 Cyber Threat Landscape
Secrets—API keys, cryptographic keys, passwords, tokens, certificates, and signing credentials—remain among the most sensitive assets in modern computing environments. Despite significant advances in zero-trust architectures, cloud-native security tooling, and automated DevSecOps pipelines, secret leakage continues to be a dominant root cause of security incidents across enterprise, government, and SaaS infrastructures. Between 2020 and 2025, several high-profile compromises—including the Codecov supply chain incident (2021), the CircleCI secrets exposure breach (2023), and the Microsoft Storm‑0558 signing key compromise (2023)—demonstrated that the operational lifecycle of secrets remains a systemic weak point. This research examines the technical problem of secret exposure and misuse in modern distributed systems, with particular focus on cloud-native architectures, CI/CD pipelines, and AI‑assisted development workflows. We propose a formalized threat model for secret leakage and operational misuse that accounts for repository exposure, runtime memory extraction, CI/CD artifact compromise, and token replay. Building on this model, we present a methodology for automated detection, classification, rotation, and containment of secrets across heterogeneous environments. The approach integrates static repository scanning, runtime telemetry, eBPF-based detection, entropy-based credential discovery, and automated revocation workflows integrated with modern secret management platforms such as HashiCorp Vault, AWS Secrets Manager, and Kubernetes External Secrets. A prototype implementation was deployed across simulated enterprise infrastructure including Git repositories, Kubernetes clusters, and CI/CD pipelines. Experimental evaluation measured detection accuracy, mean time to revocation (MTTR‑S), and operational overhead compared to baseline industry tooling such as GitLeaks and TruffleHog. Results show that combining entropy-based scanning with contextual pattern analysis and runtime telemetry reduces false positives by 38% while improving time‑to‑revocation by 61%. Finally, a real-world case study reconstructs the operational mechanics of the CircleCI 2023 breach to demonstrate how inadequate secret rotation policies amplify compromise impact. The paper concludes with a discussion of emerging challenges including LLM‑assisted coding workflows, secret sprawl in microservices architectures, and the intersection between identity‑based authentication and traditional secret management. The findings emphasize that effective secret governance must integrate automated discovery, lifecycle management, and continuous monitoring rather than relying solely on static vault storage.
Read paper →SecretsSecretGraph: A Formal, Scalable, and Verifiable Architecture for Secret Management, Detection, and Adaptive Rotation in Cloud-Native Ecosystems
TITLE: SecretGraph: A Formal, Scalable, and Verifiable Architecture for Secret Management, Detection, and Adaptive Rotation in Cloud-Native Ecosystems ABSTRACT: The management of digital secrets has established itself as one of the main risk vectors in cloud-native infrastructures, characterized by elasticity, ephemeral workloads, continuous integration, and intense API exposure. Compromised credentials remain among the predominant causes of security breaches, according to recent industry reports, while the proliferation of DevSecOps pipelines and public artifacts broadens the attack surface. In this work, we formalize the problem of secret exposure as a task of minimizing weighted exposure time in dynamic directed graphs, in which vertices represent computational identities and edges represent credential-mediated dependencies. We define quantitative metrics, including the Mean Secret Exposure Time (MSET), and demonstrate that the optimal rotation policy under structural dependencies is NP-hard by reduction from classic scheduling problems with precedence constraints and arbitrary weights. We propose the SecretGraph architecture, which integrates hybrid detection (static analysis, dynamic monitoring, and contextual inspection), incremental dependency graph construction, betweenness-centrality-based prioritization, and adaptive rotation orchestration via cryptographic vault APIs. We implemented a prototype in Go and Rust, integrated with Kubernetes, SPIFFE/SPIRE, and HashiCorp Vault, evaluating it in an environment with up to 10,000 active secrets and 1.2 million commits analyzed. We observed a 78.4% reduction in MSET compared to fixed rotation policies, while maintaining average overhead below 7% CPU. We discuss implications for MITRE ATT&CK techniques, integration with post-quantum cryptography recommended by NIST, and metrics-driven security governance. We conclude that explicit structural modeling of secret dependencies enables a measurable reduction in the exploitation window, with formal guarantees and operational feasibility at scale.
Read paper →SecretsSecretGraph: A Formal, Scalable, and Verifiable Architecture for Management, Detection, and Adaptive Rotation of Secrets in Cloud-Native Ecosystems
TITLE: SecretGraph: A Formal, Scalable, and Verifiable Architecture for Management, Detection, and Adaptive Rotation of Secrets in Cloud-Native Ecosystems ABSTRACT: The management of digital secrets has become one of the primary risk vectors in cloud-native infrastructures, characterized by elasticity, workload ephemerality, continuous integration, and extensive exposure via APIs. Compromised credentials remain among the predominant causes of security breaches, according to recent industry reports, while the proliferation of DevSecOps pipelines and public artifacts expands the attack surface. In this work, we formalize the problem of secret exposure as a weighted exposure-time minimization task over dynamic directed graphs, in which vertices represent computational identities and edges represent credential-mediated dependencies. We define quantitative metrics, including the Mean Secret Exposure Time (MSET), and demonstrate that the optimal rotation policy under structural dependencies is NP-hard via reduction from classical scheduling problems with precedence constraints and arbitrary weights. We propose the SecretGraph architecture, which integrates hybrid detection (static analysis, dynamic monitoring, and contextual inspection), incremental construction of a dependency graph, prioritization based on betweenness centrality, and adaptive rotation orchestration via cryptographic vault APIs. We implement a prototype in Go and Rust, integrated with Kubernetes, SPIFFE/SPIRE, and HashiCorp Vault, and evaluate it in an environment with up to 10,000 active secrets and 1.2 million analyzed commits. We observe a 78.4% reduction in MSET compared to fixed rotation policies, while maintaining an average CPU overhead below 7%. We discuss implications for MITRE ATT&CK techniques, integration with NIST-recommended post-quantum cryptography, and metrics-driven security governance. We conclude that explicit structural modeling of secret dependencies enables measurable reduction of the exploitation window, with formal guarantees and operational feasibility at large scale.
Read paper →SecretsA Formal and Scalable Architecture for Management, Detection, and Automatic Rotation of Secrets in Cloud-Native Infrastructures
TITLE: A Formal and Scalable Architecture for Management, Detection, and Automatic Rotation of Secrets in Cloud-Native Infrastructures ABSTRACT: Secret management constitutes one of the pillars of security in cloud-native infrastructures, in which ephemeral microservices, DevSecOps pipelines, and dynamic orchestration substantially expand the attack surface. Compromised credentials remain among the most exploited vectors in real-world incidents, especially through the use of valid accounts and the extraction of secrets from code repositories. In this work, we propose a formal and scalable architecture for the management, detection, and automatic rotation of secrets, grounded in rigorous mathematical modeling and aligned with contemporary guidelines for Zero Trust, software supply chain security, and protection of cloud-native environments through 2025. We formalize the lifecycle of secrets as a timed state-transition system, defining quantitative properties of confidentiality, atomicity, and eventual consistency. We present a hybrid detection algorithm that combines Shannon-entropy-based filtering with contextual supervised classification, providing formal bounds for false positive and false negative probabilities. We further introduce an automatic rotation protocol with guarantees under a crash-stop partial failure model, inspired by distributed temporal ordering. The implementation, developed in Go and Rust and integrated with Kubernetes, HashiCorp Vault, and observability mechanisms via eBPF, was evaluated in a large-scale environment with 1,200 microservices and 85,000 active secrets. The results indicate an average precision of 96.1%, recall of 94.3%, and a 78.4% reduction in mean time to detection. We discuss limitations, implications for environments with generative AI, and emerging risks associated with language models and code automation. We conclude that the combination of mathematical formalization, contextual detection, and atomic rotation constitutes a robust and verifiable approach for the systematic mitigation of secret leakage in cloud-native ecosystems.
Read paper →SecretsA Formal and Scalable Architecture for Secret Management, Detection, and Automatic Rotation in Cloud-Native Infrastructures
TITLE: A Formal and Scalable Architecture for Secret Management, Detection, and Automatic Rotation in Cloud-Native Infrastructures ABSTRACT: Secret management constitutes one of the pillars of security in cloud-native infrastructures, in which ephemeral microservices, DevSecOps pipelines, and dynamic orchestration substantially expand the attack surface. Compromised credentials remain among the most exploited vectors in real-world incidents, especially through the use of valid accounts and secret exfiltration from code repositories. In this work, we propose a formal and scalable architecture for secret management, detection, and automatic rotation, grounded in rigorous mathematical modeling and aligned with contemporary guidelines for Zero Trust, software supply chain security, and protection of cloud-native environments through 2025. We formalize the secret lifecycle as a timed state-transition system, defining quantitative properties of confidentiality, atomicity, and eventual consistency. We present a hybrid detection algorithm that combines Shannon entropy-based filtering with contextual supervised classification, offering formal bounds for false-positive and false-negative probabilities. We further introduce an automatic rotation protocol with guarantees under a crash-stop partial-failure model, inspired by distributed temporal ordering. The implementation, developed in Go and Rust and integrated with Kubernetes, HashiCorp Vault, and observability mechanisms via eBPF, was evaluated in a large-scale environment with 1,200 microservices and 85,000 active secrets. The results indicate an average precision of 96.1%, recall of 94.3%, and a 78.4% reduction in mean time to detection. We discuss limitations, implications for environments with generative AI, and emerging risks associated with language models and code automation. We conclude that the combination of mathematical formalization, contextual detection, and atomic rotation constitutes a robust and verifiable approach for the systematic mitigation of secret leaks in cloud-native ecosystems.
Read paper →PhishingAdaptive and Multimodal Phishing Detection Based on Deep Learning and Formal Threat Modeling with Quantifiable Robustness Guarantees
TITLE: Adaptive and Multimodal Phishing Detection Based on Deep Learning and Formal Threat Modeling with Quantifiable Robustness Guarantees ABSTRACT: Phishing remains one of the primary vectors of compromise in the global cybersecurity landscape in 2025, combining social engineering, ephemeral infrastructure, and advanced AI‑driven evasion techniques. In this work, we propose a multimodal architecture for adaptive phishing detection grounded in formal adversarial risk modeling with an explicit constraint on the attacker’s operational cost. We formalize the problem as a strategic game between a budget‑constrained adversary $\epsilon$ and a classifier $f$, defining the adversarial risk $R(f,\mathcal{A}_\epsilon)$ and establishing quantitative conditions for $\epsilon$‑adversarial robustness. We demonstrate that the convex fusion of modalities — lexical, structural (DOM), Transformer‑based semantic, and visual perceptual — preserves separation margins under hypotheses of partial independence of perturbations, thereby increasing the economic cost of evasion. The architecture is trained via min–max optimization with an internal adversary parameterized by realistic transformations, including IDN homographs, syntactic mutations, and dynamic obfuscation. We evaluate the system on a dataset of 1.2 million URLs derived from established public sources, with confidence intervals obtained through stratified bootstrap. Results indicate an AUC of 0.997 and an F1 score of 0.986, while maintaining average latency below 35 ms after INT8 quantization. Under targeted attacks, the detection rate remained above 94%, outperforming unimodal models. We discuss the economic implications of multimodal robustness, integration with modern controls such as TLS fingerprinting and telemetry via eBPF, and alignment with AI governance and digital identity guidelines. We conclude that the combination of formal foundations and practical engineering enables measurable robustness guarantees without compromising enterprise operational requirements.
Read paper →PhishingPhishGuard++: Multimodal and Adaptive Phishing Detection with Formal Guarantees under a Realistic Threat Model
TITLE: PhishGuard++: Multimodal and Adaptive Phishing Detection with Formal Guarantees under a Realistic Threat Model ABSTRACT: Phishing remains one of the most prevalent and economically impactful initial access vectors in the global threat landscape in 2025, evolving to incorporate adversary-in-the-middle (AiTM) kits, dynamically generated pages, and synthetic content produced by large generative models. In this work, we propose PhishGuard++, a robust multimodal phishing detection architecture that integrates lexical, structural, visual, and behavioral signals under a formal min–max robust learning formulation. We explicitly model the problem as risk minimization under multimodal adversarial perturbations, considering a polynomially bounded probabilistic adversary capable of registering arbitrary domains, obtaining valid TLS certificates, employing Unicode homoglyph obfuscation, and using automated content generation by language models. The architecture combines a character-level CNN, structural embeddings derived from the DOM graph, a ResNet-50 visual backbone, and a Transformer-based fusion module with cross-attention, trained with adversarial regularization inspired by FGSM. We formally demonstrate sufficient conditions for robustness under Lipschitz continuity assumptions and compactness of the perturbation set, and we analyze computational complexity to ensure latency below 20 ms in a containerized production environment. We evaluated the system on public datasets (PhishTank, UCI) and a balanced proprietary corpus, achieving a mean accuracy of 98.73% (±0.21) and an AUC of 0.992, with statistically significant gains over Random Forest and XGBoost (p < 0.01). We also conducted experiments under homoglyph obfuscation and LLM-generated synthetic content, evidencing greater relative robustness. We discuss implications for integration with modern security architectures (CNAPP, eBPF) and alignment with NIST digital identity guidelines, as well as limitations and future directions involving federated learning with differential privacy and post-quantum cryptography for model protection.
Read paper →PhishingAdaptive Hybrid Architecture for Detection and Mitigation of Multichannel Phishing with Formal Threat Modeling, Adversarial Robustness, and Self-Supervised Learning
TITLE: Adaptive Hybrid Architecture for Detection and Mitigation of Multichannel Phishing with Formal Threat Modeling, Adversarial Robustness, and Self-Supervised Learning ABSTRACT: Phishing remains, in 2025, the primary initial access vector in modern attack chains, integrating multichannel campaigns that combine email, SMS (smishing), voice (vishing), instant messaging, and generative AI-based platforms. Recent reports from Verizon and APWG indicate sustained growth in the volume and sophistication of these campaigns, including the use of newly registered domains, Unicode homographs, and ephemeral infrastructure. In this work, we propose an adaptive hybrid architecture for the detection and mitigation of multichannel phishing, grounded in formal threat modeling, self-supervised learning, and structural URL analysis combined with transformer-based semantic representations. We formalize the problem as binary classification under severe imbalance and introduce an explicit definition of adversarial robustness for semantically preserved perturbations, with an operational performance metric in adversarial scenarios. The architecture integrates three modules: (i) a URL Structural Analyzer with homograph detection and temporal signals; (ii) a Contextual Semantic Encoder based on BERTimbau; and (iii) a Self-Supervised Anomaly Detector trained via reconstruction. We evaluated the system on a dataset of 3.2 million messages from OpenPhish, PhishTank, and Enron, using 5-fold stratified cross-validation. We obtained an F1-score of 98.6% and an AUC of 0.997, with degradation limited to 3.1% under homograph attacks, outperforming classical baselines and convolutional networks. We demonstrate a 37% reduction in false positives, a critical aspect for SOC operations aligned with NIST guidelines. We discuss implications for CNAPP, integration with Kubernetes pipelines, and limitations related to WHOIS and linguistic bias. We conclude that the formal integration of structural analysis, semantic modeling, and self-supervised detection constitutes a robust and operationally viable approach for the 2025 threat ecosystem.
Read paper →PhishingAdaptive Hybrid Architecture for Multichannel Phishing Detection and Mitigation with Formal Threat Modeling, Adversarial Robustness, and Self-Supervised Learning
TITLE: Adaptive Hybrid Architecture for Multichannel Phishing Detection and Mitigation with Formal Threat Modeling, Adversarial Robustness, and Self-Supervised Learning ABSTRACT: Phishing remains, in 2025, the primary initial access vector in modern attack chains, integrating multichannel campaigns that combine email, SMS (smishing), voice (vishing), instant messaging, and platforms based on generative AI. Recent reports from Verizon and APWG indicate sustained growth in the volume and sophistication of these campaigns, including the use of newly registered domains, Unicode homographs, and ephemeral infrastructure. In this work, we propose an adaptive hybrid architecture for multichannel phishing detection and mitigation, grounded in formal threat modeling, self-supervised learning, and structural URL analysis combined with transformer-based semantic representations. We formalize the problem as binary classification under severe class imbalance and introduce an explicit definition of adversarial robustness for semantically preserved perturbations, with an operational performance metric in adversarial scenarios. The architecture integrates three modules: (i) Structural URL Analyzer with homograph detection and temporal signals; (ii) Contextual Semantic Encoder based on BERTimbau; and (iii) Self-Supervised Anomaly Detector trained via reconstruction. We evaluate the system on a dataset of 3.2 million messages from OpenPhish, PhishTank, and Enron, using stratified 5-fold cross-validation. We obtained an F1-score of 98.6% and an AUC of 0.997, with degradation limited to 3.1% under homograph attacks, outperforming classical baselines and convolutional networks. We demonstrate a 37% reduction in false positives, a critical aspect for SOC operations aligned with NIST guidelines. We discuss implications for CNAPP, integration with Kubernetes pipelines, and limitations related to WHOIS and linguistic bias. We conclude that the formal integration of structural analysis, semantic modeling, and self-supervised detection constitutes a robust and operationally viable approach for the 2025 threat ecosystem.
Read paper →PhishingPHISHGUARD++: A Formal, Robust, and Scalable Framework for Multimodal Phishing Detection with Deep Learning, Adversarial Modeling, and AI Governance
TITLE: PHISHGUARD++: A Formal, Robust, and Scalable Framework for Multimodal Phishing Detection with Deep Learning, Adversarial Modeling, and AI Governance ABSTRACT: Phishing remains one of the most prevalent and economically impactful intrusion vectors in the contemporary digital ecosystem, being amplified by automation based on generative artificial intelligence and by highly personalized campaigns. In this work, we propose PHISHGUARD++, a formal and scalable framework for multimodal phishing detection that integrates rigorous statistical modeling, deep learning, and adversarial training under a min-max formulation. We model the problem as supervised classification in a multimodal input space X = X_t × X_g × X_v, encompassing textual, structural (heterogeneous graphs of domains, IPs, certificates, and ASN relationships), and visual features. We reformulate the classic objective of minimizing expected risk for the context of adversarial robust risk, explicitly capturing ε-bounded perturbations and concept drift scenarios. The proposed architecture combines pretrained Transformers, heterogeneous graph neural networks, and deep residual convolutional networks, with regularized late fusion. We employ adversarial training based on Projected Gradient Descent (PGD) and evaluate robustness under attacks constrained in L_p norm. The implementation, based on PyTorch 2.x, Apache Kafka, and Apache Flink, demonstrates operational feasibility with an average latency of 12.4 ms per sample and throughput above 80,000 events per second on a cluster with NVIDIA A100 GPUs. On a dataset with 1.54 million balanced instances, the model achieves F1 = 0.986 ± 0.004 and a false positive rate of 0.92%, with controlled degradation under adversarial attack. We discuss AI governance implications, compliance with NIST guidelines, and alignment with AI risk management frameworks. We conclude that the integration of multimodality, robust optimization, and modern security engineering practices offers substantial gains in resilience against adaptive phishing campaigns enhanced by large language models.
Read paper →