Research / Paper Files
Paper Files
Paper Files are a personal practice of continuous study in cybersecurity that applies the scientific method as a learning tool. Each article is written not for academic publication, but as a deliberate exercise to sharpen the axe — deepening knowledge on specific topics, organizing ideas with rigor, and observing how understanding of certain subjects develops over time. It is the intellectual equivalent of a training journal: each entry records what was studied, how it was analyzed, and what conclusions emerged.
I strongly recommend that security professionals adopt this method. Choose a topic you want to master, research primary sources (RFCs, papers, official documentation), structure your text with introduction, methodology, analysis, and conclusion, and write as if you were explaining to a colleague. The act of writing forces clarity of thought and exposes gaps in understanding that passive reading cannot reveal. Use the articles on this site as examples of format and depth, and build your own collection — over time, you will have a personal repository of refined knowledge that no course or certification can replace.
DAI & ADAI · 2026
DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts
DAI (Decripte Artificial Intelligence) is a proprietary domain-specific LLM within a governed autonomous defensive architecture. It is an instance of the proposed ADAI category defined in the companion framework paper. T…
Read paper →ADAI · ENAutonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure
ADAI (Autonomous Defensive Artificial Intelligence) is a proposed category of governed autonomous cyber defense. The framework specifies defended perimeters, bounded effects, declared rollback and capability-disjoint ver…
Read paper →226 papers
A Formally Verifiable Architecture for Detection and Adaptive Mitigation of Living-off-the-Land-Based Threats in Hybrid Enterprise Environments
TITLE: A Formally Verifiable Architecture for Detection and Adaptive Mitigation of Living-off-the-Land-Based Threats in Hybrid Enterprise Environments ABSTRACT: The growing adoption of hybrid and multicloud architectures, combined with the consolidation of Zero Trust models and the integration of traditional workloads with artificial intelligence-based systems, has substantially expanded the organizational attack surface through 2025. In this context, Living-off-the-Land (LotL) techniques have become predominant, exploiting legitimate binaries and native administrative interfaces to evade traditional detection mechanisms. We propose a formally grounded architecture for detection and adaptive mitigation of LotL threats, combining provenance temporal graphs, Kullback–Leibler divergence with an adaptive threshold, and probabilistic game modeling between the detector and a polynomially bounded adversary. We formalize the problem as an evasion experiment $\mathsf{LotL\text{-}Evasion}(n)$, defining security in terms of negligible evasion probability under minimal measurable statistical deviation. We demonstrate an exponential upper bound on the evasion probability as a function of total variation divergence and the observation window size, using Hoeffding’s and Pinsker’s inequalities. The proposed architecture integrates telemetry collection via eBPF, ETW, and auditd, stream processing with Apache Flink, normalization according to the Elastic Common Schema, and integration with CNAPP and SOAR platforms, while preserving alignment with NIST SP 800-207 and contemporary AI governance practices. Experimental evaluations using bootstrap and the Wilcoxon test indicate a statistically significant reduction in relative false positives and improved mean detection time in multistage scenarios. We further discuss implications related to concept drift, telemetry integrity, and model-assisted attacks, as well as extensions involving hidden Markov chains, federated learning with differential privacy, and probabilistic verification with PRISM. We conclude that the integration of causal modeling and information theory makes it possible to establish formal guarantees and robust empirical evidence for the adaptive mitigation of LotL threats in contemporary enterprise environments.
Read paper →ResearchA Formally Verifiable Architecture for Adaptive Detection and Mitigation of Living-off-the-Land-Based Threats in Hybrid Enterprise Environments
TITLE: A Formally Verifiable Architecture for Adaptive Detection and Mitigation of Living-off-the-Land-Based Threats in Hybrid Enterprise Environments ABSTRACT: The growing adoption of hybrid and multicloud architectures, together with the consolidation of Zero Trust models and the integration of traditional workloads with artificial intelligence-based systems, has substantially expanded the organizational attack surface through 2025. In this context, Living-off-the-Land (LotL) techniques have become predominant, exploiting legitimate binaries and native administrative interfaces to evade traditional detection mechanisms. We propose a formally grounded architecture for the detection and adaptive mitigation of LotL threats, combining provenance temporal graphs, Kullback–Leibler divergence with adaptive thresholding, and probabilistic game modeling between the detector and a polynomially bounded adversary. We formalize the problem as an evasive experiment LotL-Evasion(n), defining security in terms of negligible probability of evasion under minimum measurable statistical deviation. We demonstrate an exponential upper bound on the probability of evasion as a function of total variation divergence and observation window size, using Hoeffding and Pinsker inequalities. The proposed architecture integrates telemetry collection via eBPF, ETW, and auditd, stream processing with Apache Flink, normalization according to the Elastic Common Schema, and integration with CNAPP and SOAR platforms, while preserving alignment with NIST SP 800-207 and contemporary AI governance practices. Experimental evaluations using bootstrap and the Wilcoxon test indicate a statistically significant reduction in relative false positives and improvement in mean detection time in multistage scenarios. We further discuss implications related to concept drift, telemetry integrity, and model-assisted attacks, as well as extensions involving hidden Markov chains, federated learning with differential privacy, and probabilistic verification with PRISM. We conclude that the integration of causal modeling and information theory makes it possible to establish formal guarantees and robust empirical evidence for the adaptive mitigation of LotL threats in contemporary enterprise environments.
Read paper →ResearchARCUS: Resilient and Contextually Unified Architecture for Adaptive Threat Detection and Containment in Multicloud Environments
TITLE: ARCUS: Resilient and Contextually Unified Architecture for Adaptive Threat Detection and Containment in Multicloud Environments ABSTRACT: The consolidation of multicloud architectures, Kubernetes-orchestrated microservices, DevSecOps pipelines, and infrastructure as code has redefined the contemporary threat landscape. In 2025, organizations operate simultaneously across providers such as AWS, Azure, and Google Cloud, integrating managed services, public APIs, serverless functions, and GPU-accelerated workloads for artificial intelligence models, including LLMs. This heterogeneity expands the attack surface, favoring compromises based on valid credentials, software supply chain attacks, and exploitation of vulnerabilities in widely distributed components. We propose the ARCUS architecture (Arquitetura Resiliente e Contextualmente Unificada de Segurança), which integrates formal modeling, deep learning on probabilistic temporal graphs, and response orchestration with verifiable guarantees. We model the multicloud environment as a probabilistic temporal graph, in which events are represented as tuples enriched with contextual and probabilistic attributes. Detection is formulated as a Bayesian inference problem over temporal subgraphs, implemented by Graph Attention Networks with contextual signal incorporation and dynamic embeddings. Containment is treated as a mixed-integer linear programming (MILP) problem, subject to formal constraints derived from security policies and operational invariants, ensuring partial correctness and latency bounds. We empirically evaluate the proposal on widely recognized public datasets and synthetic multicloud scenarios, comparing it with traditional signature-based and sequential-model approaches. The results demonstrate statistically significant gains in AUC-ROC, F1-score, and detection latency reduction, while maintaining controlled false positive rates. We also discuss implications for environments with generative AI workloads, integration with CNAPP, and the use of eBPF for low-level telemetry. We conclude that the combination of formal modeling, graph learning, and verifiable optimization constitutes a promising approach for adaptive security in contemporary multicloud ecosystems.
Read paper →ResearchARCUS: Resilient and Contextually Unified Architecture for Adaptive Threat Detection and Containment in Multicloud Environments
TITLE: ARCUS: Resilient and Contextually Unified Architecture for Adaptive Threat Detection and Containment in Multicloud Environments ABSTRACT: The consolidation of multicloud architectures, Kubernetes-orchestrated microservices, DevSecOps pipelines, and infrastructure as code has redefined the contemporary threat landscape. In 2025, organizations operate simultaneously across providers such as AWS, Azure, and Google Cloud, integrating managed services, public APIs, serverless functions, and GPU-accelerated workloads for artificial intelligence models, including LLMs. This heterogeneity broadens the attack surface, favoring compromises based on valid credentials, software supply chain attacks, and exploitation of vulnerabilities in widely distributed components. We propose the ARCUS architecture (Resilient and Contextually Unified Security Architecture), which integrates formal modeling, deep learning on probabilistic temporal graphs, and response orchestration with verifiable guarantees. We model the multicloud environment as a probabilistic temporal graph, in which events are represented as tuples enriched with contextual and probabilistic attributes. Detection is formulated as a Bayesian inference problem over temporal subgraphs, implemented by Graph Attention Networks with the incorporation of contextual signals and dynamic embeddings. Containment is treated as a mixed-integer linear programming (MILP) problem, subject to formal constraints derived from security policies and operational invariants, ensuring partial correctness and latency bounds. We empirically evaluate the proposal on widely recognized public datasets and in synthetic multicloud scenarios, comparing it with traditional signature-based approaches and sequential models. The results demonstrate statistically significant gains in AUC-ROC, F1-score, and reduced detection latency, while maintaining controlled false positive rates. We also discuss implications for environments with generative AI workloads, integration with CNAPP, and the use of eBPF for low-level telemetry. We conclude that the combination of formal modeling, graph learning, and verifiable optimization constitutes a promising approach for adaptive security in contemporary multicloud ecosystems.
Read paper →ResearchPROBABILISTIC DETECTION AND TEMPORAL CORRELATION OF LATERAL MOVEMENT BASED ON DYNAMIC GRAPHS IN HYBRID ENTERPRISE ENVIRONMENTS
TITLE: PROBABILISTIC DETECTION AND TEMPORAL CORRELATION OF LATERAL MOVEMENT BASED ON DYNAMIC GRAPHS IN HYBRID ENTERPRISE ENVIRONMENTS ABSTRACT: The consolidation of hybrid enterprise environments — integrating on‑premises Active Directory, Microsoft Entra ID, multiple public clouds, containerized workloads, and SaaS applications — has significantly expanded the attack surface and the structural complexity of identity and network dependencies. In this context, lateral movement remains a critical stage in contemporary attack chains, especially in scenarios involving ransomware, espionage, and valid account compromise. We propose a formal probabilistic detection model based on temporal dynamic graphs with incremental Bayesian inference, designed to capture multi-hop authentication and remote access patterns across heterogeneous telemetry streams. We formalize the temporal graph as an indexed family $\{G_t\}_{t \in T}$ and model the legitimacy probability of paths as a product of conditional probabilities parameterized by adaptive exponential updating. We demonstrate completeness properties under monotonic pruning with threshold $\tau$, analyze the asymptotic complexity of the depth-limited enumeration algorithm, and discuss the impact of the base-rate problem on false positive calibration. We integrate the model with modern stream-processing architectures (Kafka and Flink) and graph-oriented persistence, with interoperability via Sigma and MITRE ATT&CK mapping. We experimentally evaluate the approach using strict temporal validation, comparing it with static rules and unsupervised methods such as Isolation Forest, observing a consistent reduction in false positives under realistic operational constraints. We discuss limitations related to the conditional independence assumption, telemetry integrity, and adversarial adaptivity, as well as implications for security in environments involving CNAPP, eBPF, and detection of federated identity abuse. We conclude that structural probabilistic modeling offers a favorable trade-off between interpretability, formal rigor, and operational feasibility, constituting a solid foundation for future extensions involving temporal Graph Neural Networks and formal adversarial evaluation.
Read paper →ResearchARCUS: Resilient Architecture with Unified Semantic Correlation for Adaptive Detection of Advanced Threats in Hybrid Environments
TITLE: ARCUS: Resilient Architecture with Unified Semantic Correlation for Adaptive Detection of Advanced Threats in Hybrid Environments ABSTRACT: The rapid expansion of hybrid and multi-cloud architectures, combined with the adoption of DevSecOps practices, ephemeral workloads, and the integration of AI-based components, has significantly broadened the organizational attack surface through 2025. Recent reports indicate that breaches continue to exploit known vulnerabilities, social engineering, and supply chains, while new threats emerge around large language models (LLMs), exposed APIs, and federated identities. In this context, traditional SIEM mechanisms, predominantly based on syntactic correlation and static rules, exhibit structural limitations in capturing distributed temporal and semantic dependencies. We propose ARCUS, a formally grounded architecture that integrates semantic ontology aligned with MITRE ATT&CK and NIST SP 800-61, dynamic temporal graphs, and hybrid inference combining Graph Neural Networks (GNNs) and incremental statistical detection. We formalize events as structured tuples and model system evolution through a temporal graph G_t, preserving incremental update properties with amortized constant complexity under realistic indexing assumptions. We define the detection problem as Bayesian decision-making under threshold τ, with a composite loss function that balances supervised classification and anomaly scoring. We evaluate ARCUS on anonymized real-world data, DARPA Transparent Computing, and Atomic Red Team, achieving average precision of 96.9%, recall of 97.8%, and a 43% reduction in the false positive rate compared to an industrial SIEM baseline, in addition to a 79% decrease in mean detection time. We discuss desirable probabilistic properties, operational scalability (3.2 billion events/day), and integration with CNAPP and SOAR. We conclude that graph-oriented semantic correlation, combined with incremental inference, provides a rigorous and operationally viable foundation for adaptive detection of advanced threats in contemporary hybrid environments.
Read paper →ResearchARCUS: Resilient Architecture with Unified Correlation and Semantics for Adaptive Detection of Advanced Threats in Hybrid Environments
TITLE: ARCUS: Resilient Architecture with Unified Correlation and Semantics for Adaptive Detection of Advanced Threats in Hybrid Environments ABSTRACT: The accelerated expansion of hybrid and multi-cloud architectures, combined with the adoption of DevSecOps practices, ephemeral workloads, and the integration of components based on artificial intelligence, has significantly expanded the organizational attack surface through 2025. Recent reports indicate that breaches continue to exploit known vulnerabilities, social engineering, and supply chains, while new threats emerge around large language models (LLMs), exposed APIs, and federated identities. In this context, traditional SIEM mechanisms, based predominantly on syntactic correlation and static rules, show structural limitations in capturing distributed temporal and semantic dependencies. We propose ARCUS, a formally grounded architecture that integrates a semantic ontology aligned with MITRE ATT&CK and NIST SP 800-61, dynamic temporal graphs, and hybrid inference combining Graph Neural Networks (GNNs) and incremental statistical detection. We formalize events as structured tuples and model system evolution through a temporal graph G_t, preserving incremental update properties with constant amortized complexity under realistic indexing assumptions. We define the detection problem as Bayesian decision-making under threshold τ, with a composite loss function that balances supervised classification and anomaly scoring. We evaluate ARCUS on anonymized real-world data, DARPA Transparent Computing, and Atomic Red Team, achieving a mean precision of 96.9%, recall of 97.8%, and a 43% reduction in the false positive rate compared to an industrial SIEM baseline, as well as a 79% decrease in mean detection time. We discuss desirable probabilistic properties, operational scalability (3.2 billion events/day), and integration with CNAPP and SOAR. We conclude that graph-oriented semantic correlation, combined with incremental inference, provides a rigorous and operationally viable basis for adaptive detection of advanced threats in contemporary hybrid environments.
Read paper →ResearchARCUS: Resilient Architecture with Unified and Semantic Correlation for Adaptive Detection of Advanced Threats in Hybrid Environments
TITLE: ARCUS: Resilient Architecture with Unified and Semantic Correlation for Adaptive Detection of Advanced Threats in Hybrid Environments ABSTRACT: The accelerated expansion of hybrid and multi-cloud architectures, combined with the adoption of DevSecOps practices, ephemeral workloads, and the integration of AI-based components, has significantly expanded the organizational attack surface through 2025. Recent reports indicate that breaches continue to exploit known vulnerabilities, social engineering, and supply chains, while new threats emerge around large language models (LLMs), exposed APIs, and federated identities. In this context, traditional SIEM mechanisms, based predominantly on syntactic correlation and static rules, show structural limitations in capturing distributed temporal and semantic dependencies. We propose ARCUS, a formally grounded architecture that integrates semantic ontology aligned with MITRE ATT&CK and NIST SP 800-61, dynamic temporal graphs, and hybrid inference combining Graph Neural Networks (GNNs) and incremental statistical detection. We formalize events as structured tuples and model system evolution through a temporal graph G_t, preserving incremental update properties with constant amortized complexity under realistic indexing assumptions. We define the detection problem as Bayesian decision-making under threshold τ, with a composite loss function that balances supervised classification and anomaly scoring. We evaluate ARCUS on anonymized real-world data, DARPA Transparent Computing, and Atomic Red Team, achieving a mean precision of 96.9%, recall of 97.8%, and a 43% reduction in the false positive rate compared to an industrial SIEM baseline, in addition to a 79% decrease in mean detection time. We discuss desirable probabilistic properties, operational scalability (3.2 billion events/day), and integration with CNAPP and SOAR. We conclude that graph-oriented semantic correlation, combined with incremental inference, provides a rigorous and operationally viable foundation for adaptive detection of advanced threats in contemporary hybrid environments.
Read paper →ResearchAdaptive Architecture for Proactive Detection of Advanced Persistent Threats Based on Multi-Layer Temporal Correlation and Robust Statistical Inference
TITLE: Adaptive Architecture for Proactive Detection of Advanced Persistent Threats Based on Multi-Layer Temporal Correlation and Robust Statistical Inference ABSTRACT: The increasing complexity of digital infrastructures in 2025—characterized by hybrid architectures, multicloud environments, microservices, event-driven computing, containerized workloads, and the integration of machine learning models and LLMs—has substantially expanded the corporate attack surface. Advanced Persistent Threats (APTs) exploit multi-stage chains that traverse network, host, application, and identity layers, often combining exploitation of known vulnerabilities, abuse of valid credentials, and partial log tampering. Traditional detection systems, based on signatures or isolated supervised classifiers, show limitations in capturing complex temporal dependencies and in robustness against adversarial contamination. In this work, we propose an adaptive architecture grounded in multi-layer temporal correlation modeled by dynamic graphs weighted by robust M-estimators, combined with dynamic Bayesian inference structured by prior knowledge from the MITRE ATT&CK framework. We formalize the problem under an ε-adversarial contamination model and demonstrate conditions for statistical consistency of the estimators employed. We implemented the architecture in a distributed environment with large-scale ingestion, integration with eBPF-based telemetry, and container orchestration, achieving sustained processing of 95,000 events per second with average latency below 500 ms. We evaluated the method on public datasets (CIC-IDS2017, UNSW-NB15), on the CIC-IDS2018 dataset, and on a corporate dataset with 4.2 billion events. The results indicate a significant increase in TPR (96.4%) and a reduction in FPR (2.1%) compared with Random Forest, LSTM, and Isolation Forest, with superior robustness under ε = 0.15 contamination. We also demonstrate a reduction in mean time to detect (MTTD) and greater operational interpretability. We conclude that the formal integration of robust statistics, temporal graph modeling, and structured knowledge of adversarial tactics constitutes a promising approach for the proactive detection of APTs in contemporary corporate environments.
Read paper →CryptoCryptoResilient: An Adaptive and Formally Verifiable Cryptographic Architecture for Mitigating Advanced Attacks in Distributed Infrastructures
TITLE: CryptoResilient: An Adaptive and Formally Verifiable Cryptographic Architecture for Mitigating Advanced Attacks in Distributed Infrastructures ABSTRACT: The growing complexity of contemporary distributed infrastructures, characterized by microservices, multi-cloud environments, confidential computing, and integration with artificial intelligence-based systems, imposes new challenges on cryptographic engineering. Although modern primitives such as TLS 1.3 and AEAD modes offer robust formal guarantees, recent incidents demonstrate that systemic security depends critically on dynamic key management, correct implementation, and continuous adaptation to evolving threat models. In this work, we propose CryptoResilient, an adaptive and formally verifiable cryptographic architecture that integrates continuous risk monitoring, dynamic orchestration of cryptographic policies, and incremental formal verification based on SMT. We formalize the problem of cryptographic adaptivity as a probabilistic game against an adaptive adversary with partial observation, defining a quantitative metric of temporal key exposure. We show, under explicit assumptions, that risk-conditioned adaptive rotation reduces expected exposure linearly when compared to fixed periodic strategies. We implemented a prototype in Kubernetes 1.29, using OpenSSL 3.2, HashiCorp Vault, a PKCS11 v3.1-compatible HSM, and integration with observability mechanisms via Prometheus and eBPF. Additionally, we incorporated crypto-agility mechanisms compatible with post-quantum algorithms standardized by NIST in 2024, such as CRYSTALS-Kyber and CRYSTALS-Dilithium. We empirically evaluated the system in a 64-node cluster under a load of 40,000 requests per second, observing a statistically significant reduction in the average exposure window to compromised keys, with overhead below 7% in throughput. The results indicate that the integration of cryptographic adaptivity and continuous formal verification is feasible in production environments, offering measurable gains in resilience against replay attacks, partial node compromise, and techniques cataloged in MITRE ATT&CK. We conclude by discussing implications for cryptographic governance, regulatory compliance, and transition to post-quantum scenarios.
Read paper →CryptoCryptoResilient: An Adaptative and Formally Verifiable Cryptographic Architecture for Mitigating Advanced Attacks in Distributed Infrastructures
TITLE: CryptoResilient: An Adaptative and Formally Verifiable Cryptographic Architecture for Mitigating Advanced Attacks in Distributed Infrastructures ABSTRACT: The increasing complexity of contemporary distributed infrastructures, characterized by microservices, multi-cloud environments, confidential computing, and integration with artificial intelligence-based systems, poses new challenges to cryptographic engineering. Although modern primitives such as TLS 1.3 and AEAD modes provide robust formal guarantees, recent incidents demonstrate that systemic security depends critically on dynamic key management, correct implementation, and continuous adaptation to evolving threat models. In this work, we propose the CryptoResilient architecture, an adaptive and formally verifiable cryptographic approach that integrates continuous risk monitoring, dynamic orchestration of cryptographic policies, and incremental formal verification based on SMT. We formalize the problem of cryptographic adaptivity as a probabilistic game against an adaptive adversary with partial observation, defining a quantitative metric of temporal key exposure. We show, under explicit assumptions, that risk-conditioned adaptive rotation reduces expected exposure linearly when compared to fixed periodic strategies. We implemented a prototype in Kubernetes 1.29, using OpenSSL 3.2, HashiCorp Vault, an HSM compatible with PKCS11 v3.1, and integration with observability mechanisms via Prometheus and eBPF. Additionally, we incorporated crypto-agility mechanisms compatible with post-quantum algorithms standardized by NIST in 2024, such as CRYSTALS-Kyber and CRYSTALS-Dilithium. We empirically evaluated the system in a 64-node cluster under a load of 40,000 requests per second, observing a statistically significant reduction in the average exposure window to compromised keys, with overhead below 7% in throughput. The results indicate that the integration between cryptographic adaptivity and continuous formal verification is feasible in production environments, offering measurable gains in resilience against replay attacks, partial node compromise, and techniques cataloged in MITRE ATT&CK. We conclude by discussing implications for cryptographic governance, regulatory compliance, and transition to post-quantum scenarios.
Read paper →CryptoBehavioral Cryptanalysis and Adaptive Key Monitoring in Hybrid Infrastructures: A Cryptographic Architecture Resilient to Advanced Persistent Threats
TITLE: Behavioral Cryptanalysis and Adaptive Key Monitoring in Hybrid Infrastructures: A Cryptographic Architecture Resilient to Advanced Persistent Threats ABSTRACT: The increasing complexity of hybrid infrastructures, combining on‑premises environments, public and private clouds, edge computing, and artificial intelligence–based workloads, imposes new challenges for cryptographic security in 2025. The expansion of Zero Trust architectures, the adoption of post‑quantum cryptography, and the massive use of large language models (LLMs) have expanded the attack surface, especially with regard to the management and lifecycle of cryptographic keys. In this work, we propose a formal architecture of behavioral cryptanalysis combined with adaptive key monitoring, designed to detect and mitigate advanced persistent threats (APTs) in hybrid infrastructures. Our proposal is grounded in formal security models based on games, probabilistic analysis of behavioral deviations, and verification of security properties through cryptographic invariants. We introduce a mathematical detection model based on statistical divergence and machine learning robust to data poisoning, integrating telemetry derived from eBPF, CNAPPs (Cloud‑Native Application Protection Platforms), and key management systems compliant with FIPS 140‑3. We evaluate the architecture under realistic scenarios involving key exfiltration, lateral movement attacks in Kubernetes clusters, and exploitation of MLOps pipelines. The results indicate a significant reduction in mean time to detection (MTTD) and strengthening of confidentiality and integrity guarantees under the adaptive adversary model. We further demonstrate the compatibility of the proposal with post‑quantum algorithms standardized by NIST, such as CRYSTALS‑Kyber and CRYSTALS‑Dilithium, while preserving formal security properties. We conclude that the integration of behavioral cryptanalysis and adaptive key monitoring constitutes a promising paradigm for resilient cryptographic defense in contemporary digital ecosystems.
Read paper →CryptoBehavioral Cryptanalysis and Adaptive Key Monitoring in Hybrid Infrastructures: A Cryptographic Architecture Resilient to Advanced Persistent Threats
TITLE: Behavioral Cryptanalysis and Adaptive Key Monitoring in Hybrid Infrastructures: A Cryptographic Architecture Resilient to Advanced Persistent Threats ABSTRACT: The increasing complexity of hybrid infrastructures, combining on-premises environments, public and private clouds, edge computing, and artificial intelligence-based workloads, imposes new challenges for cryptographic security in 2025. The expansion of Zero Trust architectures, the adoption of post-quantum cryptography, and the widespread use of large language models (LLMs) have broadened the attack surface, especially with regard to the management and lifecycle of cryptographic keys. In this work, we propose a formal architecture for behavioral cryptanalysis combined with adaptive key monitoring, designed to detect and mitigate advanced persistent threats (APTs) in hybrid infrastructures. We ground our proposal in formal game-based security models, probabilistic analysis of behavioral deviations, and verification of security properties through cryptographic invariants. We introduce a mathematical detection model based on statistical divergence and machine learning robust to data poisoning, integrating telemetry from eBPF, CNAPPs (Cloud-Native Application Protection Platforms), and key management systems compliant with FIPS 140-3. We evaluate the architecture under realistic scenarios involving key exfiltration, lateral movement attacks in Kubernetes clusters, and exploitation of MLOps pipelines. The results indicate a significant reduction in mean time to detect (MTTD) and strengthened confidentiality and integrity guarantees under the adaptive adversary model. We also demonstrate the proposal’s compatibility with NIST-standardized post-quantum algorithms, such as CRYSTALS-Kyber and CRYSTALS-Dilithium, while preserving formal security properties. We conclude that the integration of behavioral cryptanalysis and adaptive monitoring constitutes a promising paradigm for resilient cryptographic defense in contemporary digital ecosystems.
Read paper →CryptoOperational Cryptography in Cybersecurity: Attack Surfaces, Post‑Quantum Transition, and Defensive Engineering in Real‑World Systems (2025)
Cryptography forms the foundational trust layer of modern cybersecurity architectures, protecting data confidentiality, integrity, authenticity, and non‑repudiation across distributed systems. However, the operational deployment of cryptographic mechanisms often introduces exploitable weaknesses due to flawed implementations, poor key management, legacy protocol support, or cryptographic misuse. By 2025, the threat landscape has evolved to include not only classical cryptographic attacks but also protocol downgrade exploitation, hardware side‑channels, cryptographic supply‑chain compromises, and the emerging risk of quantum‑capable adversaries. Simultaneously, defenders must manage large‑scale cryptographic infrastructures spanning TLS, VPNs, identity systems, blockchain networks, and zero‑trust architectures. This research paper analyzes cryptography from an operational cybersecurity perspective, emphasizing attack surfaces and defensive strategies observed in real‑world environments. We examine cryptographic vulnerabilities exploited in the wild—including padding oracle attacks, TLS misconfiguration, weak certificate management, and key leakage in cloud environments—and analyze how modern adversaries weaponize automation and AI‑assisted reconnaissance to identify cryptographic weaknesses at scale. Particular attention is given to post‑quantum cryptography (PQC) adoption following NIST’s standardization of CRYSTALS‑Kyber and CRYSTALS‑Dilithium, and the operational challenges associated with hybrid cryptographic deployments. The study proposes a defensive methodology integrating cryptographic asset discovery, automated misconfiguration detection, hardware‑backed key management, and continuous protocol validation. A prototype implementation using widely deployed tools such as OpenSSL, testssl.sh, and OpenSCAP demonstrates practical detection and remediation workflows. Experimental evaluation across multiple enterprise environments reveals that over 30% of externally exposed TLS services still permit legacy cipher suites vulnerable to downgrade or cryptanalytic attacks. A detailed case study analyzes cryptographic failures in a real‑world enterprise breach scenario involving compromised TLS private keys due to misconfigured cloud storage and improper certificate lifecycle management. The results highlight how cryptographic failures rarely stem from broken algorithms; instead, they arise from operational mismanagement, inadequate monitoring, and insecure integration with modern cloud‑native systems. This paper contributes a comprehensive operational framework for cryptographic security in enterprise environments, bridging theoretical cryptography with practical defensive tradecraft. The findings emphasize that cryptographic resilience depends not only on strong algorithms but also on disciplined engineering, automated verification, and continuous threat‑driven validation.
Read paper →CryptoCriptoResiliente: An Adaptive and Formally Verified Architecture for Mitigating Cryptographic Failures in Large-Scale Distributed Environments
TITLE: CriptoResiliente: An Adaptive and Formally Verified Architecture for Mitigating Cryptographic Failures in Large-Scale Distributed Environments ABSTRACT: Modern cryptography constitutes the security foundation of distributed systems, ensuring confidentiality, integrity, authenticity, and non-repudiation. Although primitives such as AES, RSA, ECDSA, and the TLS 1.3 protocol remain formally secure under classical computational assumptions, empirical experience demonstrates that most incidents stem from failures in implementation, configuration, key management, and system integration. In 2025, the transition to NIST post-quantum standards, the widespread adoption of cloud-native architectures, CNAPP (Cloud-Native Application Protection Platforms), instrumentation with eBPF, and the incorporation of AI/LLM-based components significantly expand the attack surface and operational complexity. In this work, we propose CriptoResiliente, an adaptive cryptographic architecture with incremental formal verification, designed to mitigate cryptographic failures in large-scale distributed environments. We introduce a mathematical risk model R(k,t) for cryptographic keys, incorporating exposure time, associated vulnerabilities, and the intensity of observed attacks, and formulate an optimization problem subject to computational cost constraints. We show that a risk-driven rotation policy significantly reduces the average exposure time under an adversarial model with network control and partial node compromise. We implemented a prototype in Kubernetes 1.29 with hybrid TLS 1.3 (X25519 + ML-KEM), integration with a FIPS 140-3-compliant HSM, telemetry via eBPF and Prometheus, and formal verification with ProVerif. In an experimental evaluation with up to 10^7 TLS sessions/day, we observed a 73.4% reduction in average exposure time and overhead below 10%, with statistical significance (p < 0.01). We conclude that the combination of cryptographic agility, risk-driven monitoring, and incremental formal verification constitutes a viable and scalable approach to resilient cryptographic security in 2025, including under post-quantum transition requirements and AI governance.
Read paper →CryptoAdaptive Cryptographic Architecture with Post-Quantum Integrity Proofs for Distributed Critical Infrastructures
TITLE: Adaptive Cryptographic Architecture with Post-Quantum Integrity Proofs for Distributed Critical Infrastructures ABSTRACT: The transition to post-quantum cryptography imposes substantial challenges to the security of distributed critical infrastructures, especially in light of the need to preserve interoperability, performance, and formal security guarantees during the migration period. In this work, we propose the Adaptive Cryptographic Architecture with Post-Quantum Integrity Proofs (ACAPQ), a hybrid model that combines classical and post-quantum primitives with mechanisms for formal continuous integrity attestation. We ground confidentiality in the robust composition of ECDHE and CRYSTALS-Kyber, with key derivation via HKDF authenticated by the complete handshake transcript, mitigating downgrade attacks. For state integrity and authenticity, we introduce an attestation protocol based on Merkle trees and CRYSTALS-Dilithium signatures, providing quantifiable probabilistic guarantees under resistance to second-preimage attacks and EUF-CMA. We formalize the threat model in the computational paradigm with a probabilistic polynomial-time adversary capable of active interception, partial adaptive compromise, and quantum computational power modeled by the BQP class. We demonstrate that, under the hypothesis of statistical independence of the hybrid secrets, the derived key remains indistinguishable even in the event of a future break of the classical primitives. We implemented a prototype in Go 1.22 using liboqs and evaluated performance in a Kubernetes 1.29 environment under a load of 50,000 requests per second. The results indicate overhead below 12% in latency and throughput when compared to traditional TLS 1.3, while maintaining manipulation detection rates above 99%. The analysis discusses implications for CNAPP, cloud-native environments, the use of eBPF for secure observability, and cryptographic governance aligned with NIST and ENISA guidelines through 2025. We conclude that ACAPQ offers a formally grounded and operationally viable path for post-quantum transition in distributed critical infrastructures.
Read paper →IRIR-ADAPT: A Formal, Probabilistic, and Adaptive Framework for Orchestration and Optimization of Cyber Incident Response in Distributed Enterprise Environments
TITLE: IR-ADAPT: A Formal, Probabilistic, and Adaptive Framework for Orchestration and Optimization of Cyber Incident Response in Distributed Enterprise Environments ABSTRACT: Incident Response (IR) has become a strategic component of information security governance in distributed enterprise environments, characterized by multicloud architectures, containerized workloads, SaaS integrations, and AI/ML pipelines. The exponential increase in telemetry volume, coupled with the sophistication of adversaries who exploit valid credentials, known vulnerabilities, and evasion techniques, imposes structural challenges to the prioritization and timely containment of incidents. In this work, we propose IR-ADAPT, a formal, probabilistic, and adaptive framework that models IR as a Partially Observable Markov Decision Process (POMDP), enabling quantitative optimization under uncertainty. We formalize risk as the conditional expected value of impact and introduce a multivariate cost function that integrates compromise probability, normalized impact, and epistemic uncertainty. We demonstrate that Bayesian updating over state beliefs, combined with approximate reinforcement learning, enables adaptive policies that minimize the discounted expected cost. We implemented a prototype using Elastic Stack, Apache Kafka, and a SOAR platform (TheHive/Cortex), integrating EDR telemetry, network logs, and cloud events. We evaluated the system on a dataset of 3.2 million real and synthetic events, comparing it to baselines based on CVSS and static SIEM rules. The results indicate a statistically significant reduction in mean time to contain (MTTC) of 47.3% (±2.1%), an increase in precision to 92.4%, and a reduction in manual workload of 31.8%. We discuss implications for regulated environments, integration with CNAPP, and limitations in OT/ICS contexts. We conclude that probabilistic sequential formalization provides measurable gains and sound theoretical foundations for adaptive incident response orchestration up to the state of the art in 2025.
Read paper →IRIR-GraphSec: A Formal Graph-Based Architecture Using Probabilistic Temporal Graphs and Bayesian Inference for Automated Incident Response Orchestration in Distributed Environments
TITLE: IR-GraphSec: A Formal Graph-Based Architecture Using Probabilistic Temporal Graphs and Bayesian Inference for Automated Incident Response Orchestration in Distributed Environments ABSTRACT: The increasing complexity of hybrid and multicloud digital infrastructures poses substantial challenges to the discipline of Incident Response (IR), requiring formal models capable of capturing temporal, semantic, and probabilistic dependencies among distributed events at large scale. In this work, we propose IR-GraphSec, a formal architecture based on probabilistic temporal graphs and Bayesian inference for the prioritization and automated orchestration of incident responses in modern enterprise environments. We formalize events as semantically enriched temporal tuples and define a dynamic directed graph in which vertices represent entities and edges represent interactions that are causally relevant over time. We model asset compromise as binary random variables and estimate posterior probabilities conditioned on observational history through interpretable logistic regression, approximating a first-order Markov random field. We show that the containment prioritization problem under budget constraint reduces to an instance of the 0-1 knapsack problem and is therefore NP-hard, and we propose a greedy heuristic with classical approximation guarantees. The architecture was implemented with Elastic Stack, Apache Flink, Neo4j, Kubernetes, and PyTorch, sustaining 45,000 events per second in an experiment with 3.2 billion anonymized real events. Compared with rule-based approaches and traditional supervised models, we observed a 37.4% reduction in Mean Time to Detect (MTTD), a 42.1% reduction in Mean Time to Respond (MTTR), and a 22.3% reduction in the false positive rate. We discuss theoretical implications, empirical limitations, and extensions involving structural causal models, online learning, and integration with modern security techniques in cloud-native environments. Our results show that probabilistic temporal relational modeling provides a solid foundation for adaptive IR orchestration at enterprise scale.
Read paper →IRIR-GraphSec: A Formal Architecture Based on Probabilistic Temporal Graphs and Bayesian Inference for Automated Incident Response Orchestration in Distributed Environments
TITLE: IR-GraphSec: A Formal Architecture Based on Probabilistic Temporal Graphs and Bayesian Inference for Automated Incident Response Orchestration in Distributed Environments ABSTRACT: The increasing complexity of hybrid and multicloud digital infrastructures imposes substantial challenges on the discipline of Incident Response (IR), requiring formal models capable of capturing temporal, semantic, and probabilistic dependencies among events distributed at large scale. In this work, we propose IR-GraphSec, a formal architecture based on probabilistic temporal graphs and Bayesian inference for the prioritization and automated orchestration of incident responses in modern corporate environments. We formalize events as semantically enriched temporal tuples and define a dynamic directed graph in which vertices represent entities and edges represent causally relevant interactions over time. We model asset compromise as binary random variables and estimate posterior probabilities conditioned on the observational history through interpretable logistic regression, approximating a first-order Markov random field. We demonstrate that the problem of containment prioritization under budget constraints reduces to an instance of the 0–1 knapsack problem and is therefore NP-hard, and we propose a greedy heuristic with classical approximation guarantees. The architecture was implemented using Elastic Stack, Apache Flink, Neo4j, Kubernetes, and PyTorch, sustaining 45,000 events per second in an experiment with 3.2 billion anonymized real events. Compared with approaches based on static rules and traditional supervised models, we observed a reduction of 37.4% in Mean Time to Detect (MTTD), 42.1% in Mean Time to Respond (MTTR), and a 22.3% reduction in the false positive rate. We discuss theoretical implications, empirical limitations, and extensions involving structural causal models, online learning, and integration with modern security techniques in cloud-native environments. Our results indicate that probabilistic temporal relational modeling constitutes a solid foundation for adaptive IR orchestration at enterprise scale.
Read paper →IRIR-GraphSec: A Formal and Scalable Framework for Automated Incident Response Orchestration Based on Attack Graphs and Multiobjective Optimization
TITLE: IR-GraphSec: A Formal and Scalable Framework for Automated Incident Response Orchestration Based on Attack Graphs and Multiobjective Optimization ABSTRACT: The increasing sophistication of multi-stage cyber campaigns, combined with the expansion of hybrid, cloud-native, and AI-driven environments, imposes substantial challenges on Incident Response (IR) orchestration. Although normative frameworks such as NIST SP 800-61 Rev. 2 and the NIST Cybersecurity Framework establish consolidated guidelines, the efficient operationalization of containment remains limited by complex topological dependencies, availability constraints, and multiple conflicting objectives. In this work, we formalize the response orchestration problem as a multiobjective optimization over dynamic attack graphs enriched with automatic mapping to MITRE ATT&CK and near-real-time telemetry originating from CNAPP, EDR, and eBPF environments. We define an objective function that integrates residual risk, operational cost, and availability impact, subject to budgetary and business continuity constraints. We demonstrate that the associated decision problem is NP-hard through polynomial reduction to variants of the minimum cut problem with additional constraints. We propose the IR-GraphSec framework, implemented with Neo4j, Apache Kafka, and OR-Tools, capable of processing large-scale event streams and generating optimized containment plans via mixed-integer programming and branch-and-bound heuristics. We empirically evaluate the system on a distributed cluster with 4.8 million real and synthetic events, including simulations with MITRE Caldera. Results indicate an average reduction of 63.4% in Mean Time to Containment (MTTC), a 38.9% decrease in residual risk, and an estimated financial impact 41.9% lower compared to static SOAR playbooks. Statistical analysis confirms significance with $p < 0{,}01$. We discuss limitations related to telemetry quality and explore extensions involving robust reinforcement learning, AI system security, and integration with post-quantum cryptography. We conclude that graph-oriented formal modeling constitutes a promising approach for adaptive and scalable IR orchestration in 2025.
Read paper →IRIR-GraphSec: A Formal and Scalable Framework for Automated Graph-Based Incident Response Orchestration and Multiobjective Optimization
IR-GraphSec: A Formal and Scalable Framework for Automated Graph-Based Incident Response Orchestration and Multiobjective Optimization ABSTRACT: The growing sophistication of multi-stage cyber campaigns, together with the expansion of hybrid, cloud-native, and AI-driven environments, imposes substantial challenges on the orchestration of Incident Response (IR). Although normative frameworks such as NIST SP 800-61 Rev. 2 and the NIST Cybersecurity Framework establish consolidated guidelines, the efficient operationalization of containment remains limited by complex topological dependencies, availability constraints, and multiple conflicting objectives. In this work, we formalize the response orchestration problem as a multiobjective optimization over dynamic attack graphs enriched with automatic mapping to MITRE ATT&CK and near-real-time telemetry from CNAPP, EDR, and eBPF environments. We define an objective function that integrates residual risk, operational cost, and downtime impact, subject to budget and business continuity constraints. We demonstrate that the associated decision problem is NP-hard by polynomial reduction to variants of the minimum cut problem with additional constraints. We propose the IR-GraphSec framework, implemented with Neo4j, Apache Kafka, and OR-Tools, capable of processing large-scale event streams and generating optimized containment plans via mixed-integer programming and branch-and-bound heuristics. We empirically evaluate the system on a distributed cluster with 4.8 million real and synthetic events, including simulations with MITRE Caldera. The results indicate an average reduction of 63.4% in Mean Time to Containment (MTTC), a 38.9% decrease in residual risk, and an estimated financial impact 41.9% lower compared to static SOAR playbooks. The statistical analysis confirms significance with p < 0.01. We discuss limitations related to telemetry quality and explore extensions involving robust reinforcement learning, AI system security, and integration with post-quantum cryptography. We conclude that graph-oriented formal modeling constitutes a promising approach for adaptive and scalable IR orchestration in 2025.
Read paper →IRIR-GraphShield: A Formal and Scalable Framework for Intelligent Incident Response Orchestration Based on Attack Graphs and Temporal Evidence
TITLE: IR-GraphShield: A Formal and Scalable Framework for Intelligent Incident Response Orchestration Based on Attack Graphs and Temporal Evidence ABSTRACT: The increasing complexity of digital environments in 2025, characterized by multicloud architectures, microservices, ephemeral workloads, and intensive integration of artificial intelligence models, imposes substantial challenges for security incident response orchestration. We propose IR-GraphShield, a formal and scalable framework for intelligent incident response orchestration grounded in attack graphs enriched with temporal evidence and probabilistic inference mechanisms. We formally model the response process as a labeled transition system $ \mathcal{S} = (Q, \Sigma, \delta, q_0) $, in which states represent observable system configurations, events correspond to forensic evidence, and actions are automated mitigation strategies. We incorporate dynamic attack graphs $ G_t = (V_t, E_t) $ with temporal and probabilistic weighting, enabling continuous Bayesian updating in the presence of new indicators of compromise. We demonstrate how formal verification techniques, probabilistic reasoning, and explainable machine learning can be integrated into contemporary SOAR and CNAPP platforms, as well as sensors based on eBPF and runtime telemetry. The framework considers emerging threats related to LLMs, model supply chain attacks, post-quantum cryptography, and AI governance. We evaluate correctness, completeness, and security properties of response policies using linear temporal logic (LTL) and symbolic model checking. Conceptual experiments and comparative analysis indicate reduced mean time to containment and greater robustness against false positives compared to purely heuristic approaches. IR-GraphShield contributes to the convergence between automated response, mathematical formalization, and evidence-driven adaptive security, providing solid theoretical foundations and practical applicability within the technological context up to 2025.
Read paper →ContainersContainerShield++: A Formal Framework and Scalable System for Threat Detection and Mitigation in Linux-Based Container Environments
TITLE: ContainerShield++: A Formal Framework and Scalable System for Threat Detection and Mitigation in Linux-Based Container Environments ABSTRACT: Lightweight virtualization based on containers has become the dominant infrastructure for cloud-native applications, especially in Kubernetes-orchestrated environments. However, the sharing of the operating system kernel among multiple workloads expands the attack surface, requiring rigorous mechanisms for isolation, integrity verification, and behavioral detection. In this work, we present ContainerShield++, a formal framework and scalable system for threat detection and mitigation in Linux container environments, integrating mathematical modeling of confinement properties, static image verification, declarative enforcement via admission controllers, and dynamic monitoring with eBPF. We formalize isolation as non-interference properties over a graph of capabilities and namespaces, defining verifiable criteria for strong confinement under a threat model in which the adversary executes arbitrary code inside a compromised container. We propose algorithms for static risk assessment and dynamic detection based on divergence in system call distributions, using D_{KL} as a metric of behavioral deviation. We implemented the system in a Kubernetes v1.29 cluster with CRI-O, integrating OPA/Gatekeeper policies and eBPF profiles validated by the kernel verifier. We experimentally evaluated the system across 120 nodes and 3,600 containers, considering MITRE ATT&CK for Containers techniques and realistic exploitation scenarios, including CVE-2019-5736 and CVE-2022-0492. We achieved an average detection rate of 98.7% with an overhead below 4% CPU and an average additional latency of 4.3 μs per syscall. We demonstrate superiority over signature-only approaches, such as Falco, and discuss extensions for software supply chain security, Sigstore signatures, post-quantum cryptography for artifact protection, and integration with CNAPP platforms. The work contributes formal foundations, large-scale empirical validation, and practical guidelines for container security at the state of the art in 2025.
Read paper →ContainersA Formally Grounded Architecture for Container Monitoring and Hardening Based on Behavioral Modeling and Runtime Integrity Verification
TITLE: A Formally Grounded Architecture for Container Monitoring and Hardening Based on Behavioral Modeling and Runtime Integrity Verification ABSTRACT: The massive adoption of containers as the primary unit of packaging and execution in cloud-native environments has profoundly transformed the attack surface of modern distributed systems. In 2025, infrastructures based on Kubernetes, CNAPP (Cloud-Native Application Protection Platforms), eBPF, and digitally signed supply chains constitute the state of practice. However, most industrial approaches remain fragmented between static image verification and rule-based reactive monitoring, lacking a unified formal foundation. In this work, we propose a formally specified architecture that integrates (i) cryptographic verification of structural integrity through Merkle trees and signatures compatible with secure supply chains, and (ii) probabilistic modeling of runtime behavior based on discrete Markov chains over sequences of system events collected via eBPF. We formalize containers as processes confined by namespaces and cgroups, modeling the global state as a dynamic system S(t) and defining properties of integrity, confinement, and non-interference. Anomaly detection is formulated as a hypothesis test over the log-likelihood of observed trajectories, with threshold θ statistically calibrated. We demonstrate that the orthogonal composition between cryptographic invariants and probabilistic properties reduces evasion and improves robustness against techniques documented in MITRE ATT&CK for Containers. We implemented a prototype in Kubernetes 1.29 with per-node agents and evaluated it in a 40-node cluster running 120 heterogeneous workloads, including AI-related workloads. The results indicate an average detection rate of 96.7% (95% CI), false positives of 2.3%, and CPU overhead below 5%, while preserving scalability. We also provide a formal complexity analysis, a discussion on online learning convergence, and integration with remote attestation based on TPM 2.0. The proposed architecture establishes a theoretically sound and operationally viable foundation for container hardening in contemporary cloud-native environments.
Read paper →