{"id":"https://openalex.org/W7213317749","doi":"https://doi.org/10.63345/jqst.v3i3.434","title":"Serverless Guardian: An Integrated Intrusion Detection and Automated Response Framework for Cloud-Native Security","display_name":"Serverless Guardian: An Integrated Intrusion Detection and Automated Response Framework for Cloud-Native Security","publication_year":2026,"publication_date":"2026-09-15","ids":{"openalex":"https://openalex.org/W7213317749","doi":"https://doi.org/10.63345/jqst.v3i3.434"},"language":"en","primary_location":{"id":"doi:10.63345/jqst.v3i3.434","doi":"https://doi.org/10.63345/jqst.v3i3.434","is_oa":true,"landing_page_url":"https://doi.org/10.63345/jqst.v3i3.434","pdf_url":"https://jqst.org/index.php/j/article/download/434/564","source":{"id":"https://openalex.org/S4404670314","display_name":"Journal of Quantum Science and Technology.","issn_l":"3048-6351","issn":["3048-6351"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/P4310313756","host_organization_name":"Copernicus Publications","host_organization_lineage":["https://openalex.org/P4310313756"],"host_organization_lineage_names":["Copernicus Publications"],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Quantum Science and Technology","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://jqst.org/index.php/j/article/download/434/564","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5151759700","display_name":"Jon Garcia","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Jon Garcia","raw_affiliation_strings":["Associate Director \u2013 DevOps"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Associate Director \u2013 DevOps","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5151759700"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.632747,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"3","issue":"3","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9765999913215637,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9765999913215637,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.006899999920278788,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.005100000184029341,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection","display_name":"intrusion detection","score":0.8840000033378601},{"id":"https://openalex.org/keywords/security-orchestration-automation-and-response","display_name":"security orchestration, automation and response","score":0.7889999747276306},{"id":"https://openalex.org/keywords/aws-lambda","display_name":"AWS Lambda","score":0.777999997138977},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"anomaly detection","score":0.7170000076293945},{"id":"https://openalex.org/keywords/incident-response-automation","display_name":"automated incident response","score":0.9100000262260437},{"id":"https://openalex.org/keywords/cloud-security","display_name":"cloud security","score":0.656000018119812},{"id":"https://openalex.org/keywords/cyber-defense","display_name":"cyber defense","score":0.3610000014305115}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7490000128746033},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6541000008583069},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.6406999826431274},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5583999752998352},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.4986000061035156},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.45329999923706055},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.3978999853134155},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.38690000772476196},{"id":"https://openalex.org/C19012869","wikidata":"https://www.wikidata.org/wiki/Q578372","display_name":"Response time","level":2,"score":0.38440001010894775},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.37720000743865967},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.37059998512268066},{"id":"https://openalex.org/C36299963","wikidata":"https://www.wikidata.org/wiki/Q1369844","display_name":"Observability","level":2,"score":0.365200012922287},{"id":"https://openalex.org/C49937458","wikidata":"https://www.wikidata.org/wiki/Q2599292","display_name":"Probabilistic logic","level":2,"score":0.36230000853538513},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.3594000041484833},{"id":"https://openalex.org/C145804949","wikidata":"https://www.wikidata.org/wiki/Q478123","display_name":"Situation awareness","level":2,"score":0.35910001397132874},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3174000084400177},{"id":"https://openalex.org/C149810388","wikidata":"https://www.wikidata.org/wiki/Q5374873","display_name":"Emulation","level":2,"score":0.28439998626708984},{"id":"https://openalex.org/C77052588","wikidata":"https://www.wikidata.org/wiki/Q644307","display_name":"Constant false alarm rate","level":2,"score":0.28220000863075256},{"id":"https://openalex.org/C152745839","wikidata":"https://www.wikidata.org/wiki/Q5438153","display_name":"Fault detection and isolation","level":3,"score":0.2612000107765198},{"id":"https://openalex.org/C77019957","wikidata":"https://www.wikidata.org/wiki/Q2689057","display_name":"Dependability","level":2,"score":0.2549999952316284},{"id":"https://openalex.org/C90936777","wikidata":"https://www.wikidata.org/wiki/Q917189","display_name":"Host-based intrusion detection system","level":4,"score":0.2547999918460846},{"id":"https://openalex.org/C10144332","wikidata":"https://www.wikidata.org/wiki/Q14645","display_name":"Rootkit","level":3,"score":0.2533000111579895}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.63345/jqst.v3i3.434","doi":"https://doi.org/10.63345/jqst.v3i3.434","is_oa":true,"landing_page_url":"https://doi.org/10.63345/jqst.v3i3.434","pdf_url":"https://jqst.org/index.php/j/article/download/434/564","source":{"id":"https://openalex.org/S4404670314","display_name":"Journal of Quantum Science and Technology.","issn_l":"3048-6351","issn":["3048-6351"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/P4310313756","host_organization_name":"Copernicus Publications","host_organization_lineage":["https://openalex.org/P4310313756"],"host_organization_lineage_names":["Copernicus Publications"],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Quantum Science and Technology","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.63345/jqst.v3i3.434","doi":"https://doi.org/10.63345/jqst.v3i3.434","is_oa":true,"landing_page_url":"https://doi.org/10.63345/jqst.v3i3.434","pdf_url":"https://jqst.org/index.php/j/article/download/434/564","source":{"id":"https://openalex.org/S4404670314","display_name":"Journal of Quantum Science and Technology.","issn_l":"3048-6351","issn":["3048-6351"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/P4310313756","host_organization_name":"Copernicus Publications","host_organization_lineage":["https://openalex.org/P4310313756"],"host_organization_lineage_names":["Copernicus Publications"],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Quantum Science and Technology","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7213317749.pdf","grobid_xml":"https://content.openalex.org/works/W7213317749.grobid-xml"},"referenced_works_count":2,"referenced_works":["https://openalex.org/W2552767274","https://openalex.org/W2905507405"],"related_works":["https://openalex.org/W7131451212","https://openalex.org/W7205609034","https://openalex.org/W7208774421","https://openalex.org/W4410059139","https://openalex.org/W4415491277","https://openalex.org/W7127591191","https://openalex.org/W4405237797","https://openalex.org/W7134968208","https://openalex.org/W7131823954","https://openalex.org/W7148214299"],"abstract_inverted_index":{"Serverless":[0],"computing":[1],"platforms":[2],"such":[3],"as":[4],"AWS":[5,118],"Lambda":[6,217],"have":[7],"revolutionized":[8],"cloud":[9,209],"application":[10],"design":[11],"by":[12],"enabling":[13],"stateless,":[14],"event-driven":[15],"architectures":[16],"with":[17,44,73,117,139],"automatic":[18],"scaling":[19],"and":[20,26,48,62,77,102,128,134,175,191,204,215,236],"fine-grained":[21,50],"billing.":[22],"However,":[23],"the":[24,68,146,187,196],"ephemeral":[25],"opaque":[27],"nature":[28],"of":[29,91,151,226,234],"these":[30],"environments":[31],"poses":[32],"significant":[33],"challenges":[34],"for":[35,107,208],"traditional":[36],"intrusion":[37,60],"detection":[38,61,70,96,190,224],"systems,":[39],"which":[40,200],"are":[41,166,172],"often":[42],"incompatible":[43],"transient":[45],"execution":[46,92],"flows":[47],"lack":[49],"observability":[51],"[1].":[52,243],"This":[53],"paper":[54],"presents":[55],"SageShield-SOAR,":[56],"a":[57,103,158,223,229],"comprehensive":[58],"serverless-aware":[59],"automated":[63,108,179,188],"response":[64,110,180,192,206],"framework":[65,84,150,184],"that":[66,220],"extends":[67],"SageShield":[69,221],"engine":[71],"[1]":[72],"Security":[74],"Orchestration,":[75],"Automation,":[76],"Response":[78],"(SOAR)":[79],"capabilities":[80,207],"[2],":[81],"[3].":[82],"The":[83,113,183],"combines":[85],"cold-start-aware":[86],"telemetry":[87],"modeling,":[88],"transformer-based":[89],"embedding":[90],"traces,":[93],"probabilistic":[94],"anomaly":[95,189],"using":[97],"hybrid":[98],"density":[99],"estimation":[100],"techniques,":[101],"serverless":[104],"SOAR":[105],"pipeline":[106],"incident":[109],"[1],":[111,142],"[4].":[112],"system":[114,149,193],"integrates":[115],"seamlessly":[116],"services":[119],"including":[120],"CloudWatch,":[121],"X-Ray,":[122],"Step":[123],"Functions,":[124],"GuardDuty,":[125],"EventBridge,":[126],"Lambda,":[127],"SQS":[129],"to":[130],"provide":[131],"real-time":[132],"alerts":[133],"policy-driven":[135],"mitigation":[136],"without":[137],"interfering":[138],"business":[140],"logic":[141],"[5].":[143],"Building":[144],"upon":[145],"cyber":[147],"defense":[148],"Mistry":[152,197],"et":[153],"al.":[154],"[6],":[155],"SageShield-SOAR":[156],"implements":[157],"case-based":[159],"threat":[160,170],"scoring":[161],"mechanism":[162],"where":[163],"related":[164],"events":[165],"aggregated":[167],"into":[168],"cases,":[169],"scores":[171],"dynamically":[173],"updated,":[174],"significance":[176],"conditions":[177],"trigger":[178],"actions":[181],"[6].":[182],"also":[185],"incorporates":[186],"described":[194],"in":[195],"patent":[198],"[7],":[199],"provides":[201],"contextual":[202],"analysis":[203],"adaptive":[205],"security.":[210],"Extensive":[211],"experiments":[212],"on":[213],"synthetic":[214],"real-world":[216],"workloads":[218],"demonstrate":[219],"achieves":[222],"accuracy":[225],"96.2%,":[227],"maintains":[228],"low":[230],"false":[231],"positive":[232],"rate":[233],"2.8%,":[235],"introduces":[237],"less":[238],"than":[239],"3.1%":[240],"runtime":[241],"overhead":[242]},"counts_by_year":[],"updated_date":"2026-11-04T10:54:05.112534","created_date":"2026-09-16T00:00:00"}