Scholarlink

<p>While the decentralized nature of microservices fuels unprecedented development agility, it also plants silent production landmines: <i>authorization drift</i>, exposing the limits of traditional, semantically-oblivious analysis. We envision distributed systems that proactively reason about their own security posture in the CI/CD pipeline. This paper presents a neuro-symbolic vision that quantifies a system’s holistic security posture. Our approach performs semantic lifting, transforming static Intermediate Representations into a structured Knowledge Graph–a symbolic model grounded with inductively inferred business context from application logic. We employ <i>Subjective Logic</i> as a novel calculus to resolve conflicts arising from two sources of truth. This moves beyond a single risk score to produce a multi-dimensional opinion for each execution path, explicitly quantifying not just <i>belief</i> and <i>disbelief</i>, but also <i>uncertainty</i> and <i>logical-business conflict</i>. Our vision offers a paradigm shift from vulnerability detection to continuous, automated security introspection for complex, distributed systems, empowering practitioners with intelligent risk assessment capabilities.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

A neuro-symbolic calculus for quantifying security posture in microservice architectures

  • 期刊论文

  • 发表日期：

    2026年7月2日

查看全文
  • Shakthi Weerasinghe,
  • Tomas Cerny

摘要

While the decentralized nature of microservices fuels unprecedented development agility, it also plants silent production landmines: authorization drift, exposing the limits of traditional, semantically-oblivious analysis. We envision distributed systems that proactively reason about their own security posture in the CI/CD pipeline. This paper presents a neuro-symbolic vision that quantifies a system’s holistic security posture. Our approach performs semantic lifting, transforming static Intermediate Representations into a structured Knowledge Graph–a symbolic model grounded with inductively inferred business context from application logic. We employ Subjective Logic as a novel calculus to resolve conflicts arising from two sources of truth. This moves beyond a single risk score to produce a multi-dimensional opinion for each execution path, explicitly quantifying not just belief and disbelief, but also uncertainty and logical-business conflict. Our vision offers a paradigm shift from vulnerability detection to continuous, automated security introspection for complex, distributed systems, empowering practitioners with intelligent risk assessment capabilities.