Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces SECUREVENT, a hybrid AI/ML architecture designed to enhance security monitoring in distributed event-based systems, which are increasingly prevalent in modern Internet-scale applications. By integrating traditional security measures with advanced techniques like online anomaly detection and federated learning, the system effectively addresses the vulnerabilities introduced by the dynamic nature of event flows. The results from a deterministic prototype study demonstrate that SECUREVENT significantly improves recall compared to static rules while maintaining a low false-positive rate, underscoring the necessity of model-based monitoring in complex environments.
Hybrid AI/ML security monitoring can drastically improve detection capabilities in dynamic event-based systems, outperforming traditional static methods.
Distributed event-based systems have become a common substrate for Internet-scale publish/subscribe services, IoT telemetry, cloud-native microservices, and security operations pipelines. Their loose coupling and asynchronous delivery improve scalability, but they also expand the attack surface: publishers, brokers, subscribers, topics, schemas, and temporal ordering can each be abused without a single component observing the whole behavior. This paper proposes SECUREVENT, a hybrid AI/ML security-monitoring architecture for distributed event-based systems. The architecture combines traditional protections such as authenticated transport, topic-level authorization, and signed events with online anomaly detection, graph-aware behavioral features, complex-event policy rules, federated learning, and adversarial-ML governance. A deterministic prototype study over synthetic event-stream attacks illustrates how a hybrid AI/CEP monitor can improve recall over static rules while retaining a low false-positive rate. The central claim is not that machine learning replaces cryptographic and access-control mechanisms, but that model-based security monitoring is necessary when event flows, identities, schemas, and timing relationships are too dynamic for static controls alone.