SECUREVENT: Hybrid AI/ML Security Monitoring for Distributed Event-Based Systems
For operators of distributed event-based systems, this work addresses the need for dynamic security monitoring beyond static controls, though the results are preliminary and based on synthetic data.
SECUREVENT proposes a hybrid AI/ML security monitoring architecture for distributed event-based systems, combining traditional protections with online anomaly detection and federated learning. A prototype study shows improved recall over static rules while maintaining a low false-positive rate.
Distributed event-based systems have become a common substrate for Internet-scale publish/subscribe services, IoT telemetry, cloud-native microservices, and security operations pipelines. Their loose coupling and asynchronous delivery improve scalability, but they also expand the attack surface: publishers, brokers, subscribers, topics, schemas, and temporal ordering can each be abused without a single component observing the whole behavior. This paper proposes SECUREVENT, a hybrid AI/ML security-monitoring architecture for distributed event-based systems. The architecture combines traditional protections such as authenticated transport, topic-level authorization, and signed events with online anomaly detection, graph-aware behavioral features, complex-event policy rules, federated learning, and adversarial-ML governance. A deterministic prototype study over synthetic event-stream attacks illustrates how a hybrid AI/CEP monitor can improve recall over static rules while retaining a low false-positive rate. The central claim is not that machine learning replaces cryptographic and access-control mechanisms, but that model-based security monitoring is necessary when event flows, identities, schemas, and timing relationships are too dynamic for static controls alone.