{"id":"https://openalex.org/W7163142234","doi":"https://doi.org/10.48550/arxiv.2606.01741","title":"SECUREVENT: Hybrid AI/ML Security Monitoring for Distributed Event-Based Systems","display_name":"SECUREVENT: Hybrid AI/ML Security Monitoring for Distributed Event-Based Systems","publication_year":2026,"publication_date":"2026-06-01","ids":{"openalex":"https://openalex.org/W7163142234","doi":"https://doi.org/10.48550/arxiv.2606.01741"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.01741","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.01741","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.01741","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5137692830","display_name":"Eric Liang","orcid":null},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Liang, Eric","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5137692830"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.506600022315979,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.506600022315979,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.061500001698732376,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10270","display_name":"Blockchain Technology Applications and Security","score":0.04560000076889992,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/asynchronous-communication","display_name":"Asynchronous communication","score":0.6604999899864197},{"id":"https://openalex.org/keywords/component","display_name":"Component (thermodynamics)","score":0.5202999711036682},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.5077000260353088},{"id":"https://openalex.org/keywords/cryptography","display_name":"Cryptography","score":0.4325000047683716},{"id":"https://openalex.org/keywords/architecture","display_name":"Architecture","score":0.4320000112056732},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.37619999051094055},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.3700000047683716},{"id":"https://openalex.org/keywords/security-policy","display_name":"Security policy","score":0.36079999804496765}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7063000202178955},{"id":"https://openalex.org/C151319957","wikidata":"https://www.wikidata.org/wiki/Q752739","display_name":"Asynchronous communication","level":2,"score":0.6604999899864197},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.5546000003814697},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.5202999711036682},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.5077000260353088},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4375},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.4325000047683716},{"id":"https://openalex.org/C123657996","wikidata":"https://www.wikidata.org/wiki/Q12271","display_name":"Architecture","level":2,"score":0.4320000112056732},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.38600000739097595},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.37619999051094055},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.3700000047683716},{"id":"https://openalex.org/C154908896","wikidata":"https://www.wikidata.org/wiki/Q2167404","display_name":"Security policy","level":2,"score":0.36079999804496765},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.32679998874664307},{"id":"https://openalex.org/C33884865","wikidata":"https://www.wikidata.org/wiki/Q1254335","display_name":"Cryptographic protocol","level":3,"score":0.3203999996185303},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.314300000667572},{"id":"https://openalex.org/C200749887","wikidata":"https://www.wikidata.org/wiki/Q1165574","display_name":"System monitoring","level":2,"score":0.3124000132083893},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.29589998722076416},{"id":"https://openalex.org/C40842320","wikidata":"https://www.wikidata.org/wiki/Q19423","display_name":"Buffer overflow","level":2,"score":0.2874999940395355},{"id":"https://openalex.org/C2778562939","wikidata":"https://www.wikidata.org/wiki/Q1298791","display_name":"Synchronization (alternating current)","level":3,"score":0.28220000863075256},{"id":"https://openalex.org/C31139447","wikidata":"https://www.wikidata.org/wiki/Q5380386","display_name":"Enterprise information security architecture","level":2,"score":0.28040000796318054},{"id":"https://openalex.org/C80445892","wikidata":"https://www.wikidata.org/wiki/Q1052721","display_name":"Multitier architecture","level":3,"score":0.2685000002384186},{"id":"https://openalex.org/C98025372","wikidata":"https://www.wikidata.org/wiki/Q477538","display_name":"Systems architecture","level":3,"score":0.26750001311302185},{"id":"https://openalex.org/C2775941552","wikidata":"https://www.wikidata.org/wiki/Q25212305","display_name":"Isolation (microbiology)","level":2,"score":0.2639000117778778},{"id":"https://openalex.org/C123606473","wikidata":"https://www.wikidata.org/wiki/Q907918","display_name":"Complex event processing","level":3,"score":0.2606000006198883},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.2522999942302704}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.01741","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.01741","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.01741","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.01741","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.6642563939094543,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Distributed":[0],"event-based":[1,66],"systems":[2],"have":[3],"become":[4],"a":[5,48,59,107,119],"common":[6],"substrate":[7],"for":[8,64,154],"Internet-scale":[9],"publish/subscribe":[10],"services,":[11],"IoT":[12],"telemetry,":[13],"cloud-native":[14],"microservices,":[15],"and":[16,23,40,79,94,133,148],"security":[17,139],"operations":[18],"pipelines.":[19],"Their":[20],"loose":[21],"coupling":[22],"asynchronous":[24],"delivery":[25],"improve":[26,112],"scalability,":[27],"but":[28,136],"they":[29],"also":[30],"expand":[31],"the":[32,52],"attack":[33],"surface:":[34],"publishers,":[35],"brokers,":[36],"subscribers,":[37],"topics,":[38],"schemas,":[39,147],"temporal":[41],"ordering":[42],"can":[43,111],"each":[44],"be":[45],"abused":[46],"without":[47],"single":[49],"component":[50],"observing":[51],"whole":[53],"behavior.":[54],"This":[55],"paper":[56],"proposes":[57],"SECUREVENT,":[58],"hybrid":[60,108],"AI/ML":[61],"security-monitoring":[62],"architecture":[63,69],"distributed":[65],"systems.":[67],"The":[68,123],"combines":[70],"traditional":[71],"protections":[72],"such":[73],"as":[74],"authenticated":[75],"transport,":[76],"topic-level":[77],"authorization,":[78],"signed":[80],"events":[81],"with":[82],"online":[83],"anomaly":[84],"detection,":[85],"graph-aware":[86],"behavioral":[87],"features,":[88],"complex-event":[89],"policy":[90],"rules,":[91],"federated":[92],"learning,":[93],"adversarial-ML":[95],"governance.":[96],"A":[97],"deterministic":[98],"prototype":[99],"study":[100],"over":[101,114],"synthetic":[102],"event-stream":[103],"attacks":[104],"illustrates":[105],"how":[106],"AI/CEP":[109],"monitor":[110],"recall":[113],"static":[115,155],"rules":[116],"while":[117],"retaining":[118],"low":[120],"false-positive":[121],"rate.":[122],"central":[124],"claim":[125],"is":[126,141],"not":[127],"that":[128,137],"machine":[129],"learning":[130],"replaces":[131],"cryptographic":[132],"access-control":[134],"mechanisms,":[135],"model-based":[138],"monitoring":[140],"necessary":[142],"when":[143],"event":[144],"flows,":[145],"identities,":[146],"timing":[149],"relationships":[150],"are":[151],"too":[152],"dynamic":[153],"controls":[156],"alone.":[157]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-06-03T00:00:00"}