SECUREVENT: Hybrid AI/ML Security Monitoring for Distributed Event-Based Systems
2026-06-01 • Cryptography and Security
Cryptography and SecurityArtificial Intelligence
AI summaryⓘ
The authors explain that systems sending and receiving messages asynchronously across the internet offer many benefits but also create security challenges because no single part sees everything happening. They propose SECUREVENT, which combines usual security steps like verifying senders with smart AI tools that watch for unusual behavior over time and across different parts of the system. Their tests show that using both traditional and AI methods together catches more problems without raising too many false alarms. They emphasize that AI doesn't replace basic security but helps handle complex and changing message patterns that rules alone can't manage.
distributed event-based systemspublish/subscribeIoT telemetryauthenticated transportanomaly detectionfederated learningcomplex event processingaccess controladversarial machine learningsecurity monitoring
Authors
Eric Liang
Abstract
Distributed event-based systems have become a common substrate for Internet-scale publish/subscribe services, IoT telemetry, cloud-native microservices, and security operations pipelines. Their loose coupling and asynchronous delivery improve scalability, but they also expand the attack surface: publishers, brokers, subscribers, topics, schemas, and temporal ordering can each be abused without a single component observing the whole behavior. This paper proposes SECUREVENT, a hybrid AI/ML security-monitoring architecture for distributed event-based systems. The architecture combines traditional protections such as authenticated transport, topic-level authorization, and signed events with online anomaly detection, graph-aware behavioral features, complex-event policy rules, federated learning, and adversarial-ML governance. A deterministic prototype study over synthetic event-stream attacks illustrates how a hybrid AI/CEP monitor can improve recall over static rules while retaining a low false-positive rate. The central claim is not that machine learning replaces cryptographic and access-control mechanisms, but that model-based security monitoring is necessary when event flows, identities, schemas, and timing relationships are too dynamic for static controls alone.