{"id":"https://openalex.org/W7161171148","doi":"https://doi.org/10.48550/arxiv.2605.12976","title":"CLOUDBURST: Cloud-Layer Observations Using Beacons for Unified Real-time Surveillance and Threat Attribution","display_name":"CLOUDBURST: Cloud-Layer Observations Using Beacons for Unified Real-time Surveillance and Threat Attribution","publication_year":2026,"publication_date":"2026-05-13","ids":{"openalex":"https://openalex.org/W7161171148","doi":"https://doi.org/10.48550/arxiv.2605.12976"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.12976","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.12976","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.12976","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5037956466","display_name":"Abraham Itzhak Weinberg","orcid":"https://orcid.org/0000-0002-2505-9653"},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Weinberg, Abraham Itzhak","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5037956466"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.391400009393692,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.391400009393692,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11614","display_name":"Cloud Data Security Solutions","score":0.22550000250339508,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.10159999877214432,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ephemeral-key","display_name":"Ephemeral key","score":0.5674999952316284},{"id":"https://openalex.org/keywords/threat-model","display_name":"Threat model","score":0.41990000009536743},{"id":"https://openalex.org/keywords/naturalness","display_name":"Naturalness","score":0.4002000093460083},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.39640000462532043},{"id":"https://openalex.org/keywords/covert","display_name":"Covert","score":0.3917999863624573},{"id":"https://openalex.org/keywords/channel","display_name":"Channel (broadcasting)","score":0.36890000104904175},{"id":"https://openalex.org/keywords/metric","display_name":"Metric (unit)","score":0.33959999680519104}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6420999765396118},{"id":"https://openalex.org/C76947770","wikidata":"https://www.wikidata.org/wiki/Q4533181","display_name":"Ephemeral key","level":2,"score":0.5674999952316284},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.46970000863075256},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.41990000009536743},{"id":"https://openalex.org/C134537474","wikidata":"https://www.wikidata.org/wiki/Q17144832","display_name":"Naturalness","level":2,"score":0.4002000093460083},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.39640000462532043},{"id":"https://openalex.org/C2779338814","wikidata":"https://www.wikidata.org/wiki/Q5179285","display_name":"Covert","level":2,"score":0.3917999863624573},{"id":"https://openalex.org/C127162648","wikidata":"https://www.wikidata.org/wiki/Q16858953","display_name":"Channel (broadcasting)","level":2,"score":0.36890000104904175},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.35830000042915344},{"id":"https://openalex.org/C176217482","wikidata":"https://www.wikidata.org/wiki/Q860554","display_name":"Metric (unit)","level":2,"score":0.33959999680519104},{"id":"https://openalex.org/C143299363","wikidata":"https://www.wikidata.org/wiki/Q900584","display_name":"Attribution","level":2,"score":0.325300008058548},{"id":"https://openalex.org/C97931131","wikidata":"https://www.wikidata.org/wiki/Q5282087","display_name":"Discriminative model","level":2,"score":0.31150001287460327},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.29679998755455017},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2874000072479248},{"id":"https://openalex.org/C102168758","wikidata":"https://www.wikidata.org/wiki/Q7321258","display_name":"Beacon","level":2,"score":0.2745000123977661},{"id":"https://openalex.org/C2780992000","wikidata":"https://www.wikidata.org/wiki/Q17016113","display_name":"Generator (circuit theory)","level":3,"score":0.2667999863624573},{"id":"https://openalex.org/C2779628075","wikidata":"https://www.wikidata.org/wiki/Q1253258","display_name":"Downgrade","level":2,"score":0.2529999911785126}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.12976","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.12976","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.12976","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.12976","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","score":0.6568557024002075,"display_name":"Industry, innovation and infrastructure"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Modern":[0],"cloud-native":[1,58,159],"environments":[2],"present":[3,48],"a":[4,77],"fundamentally":[5],"different":[6],"exfiltration":[7],"threat":[8],"surface":[9],"than":[10],"traditional":[11],"file-based":[12],"scenarios.":[13],"Attackers":[14],"targeting":[15],"AWS,":[16],"GCP,":[17],"Azure,":[18],"and":[19,32,41,54,91,113,132],"OCI":[20],"steal":[21],"S3":[22,145],"presigned":[23],"URLs,":[24],"container":[25],"images,":[26],"Kubernetes":[27],"secrets,":[28],"Terraform":[29],"state":[30],"modules,":[31],"IAM":[33,87,123],"role":[34],"tokens":[35],"--":[36,96],"artefacts":[37],"that":[38,80,245],"existing":[39],"honeytoken":[40],"beacon":[42],"frameworks":[43],"do":[44],"not":[45],"address.":[46],"We":[47,70],"\\textbf{CLOUDBURST},":[49],"the":[50,72,127,140,149,191,206],"first":[51,192],"formal":[52],"taxonomy":[53],"measurement":[55],"framework":[56],"for":[57,184],"passive":[59],"beacons,":[60,109],"comprising":[61],"six":[62],"vector":[63],"classes":[64],"across":[65,106,235],"four":[66,119],"major":[67],"cloud":[68,236],"providers.":[69],"introduce":[71],"\\textit{Cloud":[73],"Attribution":[74],"Score}":[75],"(CAS),":[76],"four-component":[78],"metric":[79],"explicitly":[81],"models":[82,161],"ephemeral":[83,168],"infrastructure":[84,169],"penalty":[85],"($E_p$),":[86],"coverage":[88],"depth":[89],"($I_c$),":[90],"multi-cloud":[92],"correlation":[93],"bonus":[94],"($M_b$)":[95],"dimensions":[97],"absent":[98],"from":[99,173],"all":[100,157,185],"prior":[101],"attribution":[102,196],"quality":[103],"metrics.":[104],"Experiments":[105],"$21$":[107],"deployed":[108],"$205$":[110],"simulated":[111],"callbacks,":[112],"three":[114,158],"attacker":[115],"sophistication":[116],"levels":[117],"yield":[118],"principal":[120],"findings.":[121],"First,":[122],"Canary":[124],"Roles":[125],"achieve":[126,148],"highest":[128,150],"CAS":[129,172,231],"(mean":[130],"$0.450$)":[131],"Detection":[133],"Resistance":[134],"(DR":[135,153,210],"$=":[136,154,211],"0.873$),":[137],"making":[138],"them":[139],"most":[141],"deployable":[142],"vector.":[143],"Second,":[144],"Presigned":[146],"URLs":[147],"detection":[151,208],"resistance":[152,209],"0.890$),":[155],"surviving":[156],"scanner":[160],"(AWS":[162],"Macie,":[163],"Checkov/tfsec,":[164],"Prisma":[165],"Cloud/Wiz).":[166],"Third,":[167],"churn":[170],"degrades":[171],"$\\approx":[174,179],"0.79$":[175],"at":[176,181],"deployment":[177],"to":[178,214],"0.18$--$0.22$":[180],"$48$":[182],"hours":[183],"vectors":[186],"($p":[187],"<":[188],"0.001$),":[189],"establishing":[190],"quantitative":[193],"model":[194],"of":[195],"decay":[197],"in":[198,249],"containerised":[199],"environments.":[200],"Fourth,":[201],"Serverless":[202],"Function":[203],"Triggers":[204],"exhibit":[205],"worst":[207],"0.611$)":[212],"due":[213],"their":[215],"explicit":[216],"outbound":[217],"HTTP":[218],"callback":[219,223],"pattern,":[220],"motivating":[221],"covert":[222],"channel":[224],"design":[225],"as":[226],"future":[227],"work.":[228],"No":[229],"significant":[230],"difference":[232],"is":[233,247],"observed":[234],"providers":[237],"($H":[238],"=":[239,242],"1.99$,":[240],"$p":[241],"0.57$),":[243],"confirming":[244],"CLOUDBURST":[246],"provider-agnostic":[248],"its":[250],"effectiveness.":[251]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-15T00:00:00"}